@diegoaltoworks/chatter 0.11.0 → 0.13.0

package/dist/bin/create-apikey.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/auth/apikeys.ts
+var import_node_crypto = require("node:crypto");
+var import_jose = require("jose");
+var ApiKeyManager = class {
+  constructor(secret) {
+    this.secret = secret;
+    if (!secret) {
+      throw new Error("API key secret is required");
+    }
+    this.secretBytes = new TextEncoder().encode(secret);
+  }
+  secretBytes;
+  /**
+   * Create a new API key
+   *
+   * @param options - API key options
+   * @returns JWT token string
+   */
+  async create(options = {}) {
+    const keyId = (0, import_node_crypto.randomUUID)();
+    const keyName = options.name || "api-key";
+    const expiresIn = options.expiresIn || "365d";
+    const expirationMs = this.parseExpiration(expiresIn);
+    const expiresAt = new Date(Date.now() + expirationMs);
+    const jwt = await new import_jose.SignJWT({
+      name: keyName,
+      type: "api_key",
+      ...options.claims
+    }).setProtectedHeader({ alg: "HS256" }).setSubject(keyId).setIssuedAt().setExpirationTime(expiresAt).sign(this.secretBytes);
+    return jwt;
+  }
+  /**
+   * Verify an API key
+   *
+   * @param token - JWT token to verify
+   * @returns Verification result with payload if valid
+   */
+  async verify(token) {
+    try {
+      const { payload } = await (0, import_jose.jwtVerify)(token, this.secretBytes);
+      if (payload.type !== "api_key") {
+        return {
+          valid: false,
+          error: "Token is not an API key"
+        };
+      }
+      return {
+        valid: true,
+        payload
+      };
+    } catch (error) {
+      return {
+        valid: false,
+        error: error instanceof Error ? error.message : "Verification failed"
+      };
+    }
+  }
+  /**
+   * Parse expiration string to milliseconds
+   *
+   * @param expiresIn - Time string (e.g., "1y", "30d", "12h")
+   * @returns Milliseconds
+   */
+  parseExpiration(expiresIn) {
+    const match = expiresIn.match(/^(\d+)([smhdMy])$/);
+    if (!match) {
+      throw new Error(
+        `Invalid expiration format: ${expiresIn}. Supported: s (seconds), m (minutes), h (hours), d (days), M (months), y (years)`
+      );
+    }
+    const value = Number.parseInt(match[1], 10);
+    const unit = match[2];
+    switch (unit) {
+      case "s":
+        return value * 1e3;
+      case "m":
+        return value * 60 * 1e3;
+      case "h":
+        return value * 60 * 60 * 1e3;
+      case "d":
+        return value * 24 * 60 * 60 * 1e3;
+      case "M":
+        return value * 30 * 24 * 60 * 60 * 1e3;
+      // Approximate 30 days
+      case "y":
+        return value * 365 * 24 * 60 * 60 * 1e3;
+      // Approximate 365 days
+      default:
+        throw new Error(`Unknown time unit: ${unit}`);
+    }
+  }
+  /**
+   * Get information about a token without verifying signature
+   * Useful for debugging
+   *
+   * @param token - JWT token
+   * @returns Decoded payload (unverified)
+   */
+  decode(token) {
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3) {
+        return null;
+      }
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+      return payload;
+    } catch {
+      return null;
+    }
+  }
+};
+
+// bin/create-apikey.ts
+async function main() {
+  const args = process.argv.slice(2);
+  const options = {};
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--name" && args[i + 1]) {
+      options.name = args[i + 1];
+      i++;
+    } else if (args[i] === "--expires-in" && args[i + 1]) {
+      options.expiresIn = args[i + 1];
+      i++;
+    } else if (args[i] === "--help" || args[i] === "-h") {
+      console.log(`
+Chatter API Key Generator
+
+Usage:
+  npx chatter create-apikey [options]
+
+Options:
+  --name <name>          Name/label for the API key (default: "api-key")
+  --expires-in <time>    Expiration time (default: "365d")
+                         Formats: s=seconds, m=minutes, h=hours, d=days, M=months, y=years
+                         Examples: 30d, 12h, 1y, 6M
+
+Environment:
+  CHATTER_SECRET         Required. Secret key for signing JWT tokens
+
+Examples:
+  npx chatter create-apikey --name "mobile-app" --expires-in 365d
+  npx chatter create-apikey --name "test-key" --expires-in 1h
+      `);
+      process.exit(0);
+    }
+  }
+  const secret = process.env.CHATTER_SECRET;
+  if (!secret) {
+    console.error("\u274C Error: CHATTER_SECRET environment variable is not set");
+    console.error("\n   Please set it before running this command:");
+    console.error("   export CHATTER_SECRET=your-secret-key-here");
+    console.error("\n   Or prefix the command:");
+    console.error("   CHATTER_SECRET=your-secret npx chatter create-apikey\n");
+    process.exit(1);
+  }
+  const manager = new ApiKeyManager(secret);
+  const keyName = options.name || "api-key";
+  const expiresIn = options.expiresIn || "365d";
+  try {
+    const apiKey = await manager.create({
+      name: keyName,
+      expiresIn
+    });
+    const payload = manager.decode(apiKey);
+    if (!payload) {
+      throw new Error("Failed to decode generated API key");
+    }
+    const expiresAt = new Date((payload.exp || 0) * 1e3);
+    const issuedAt = new Date((payload.iat || 0) * 1e3);
+    console.log("\n\u2705 API Key generated successfully!\n");
+    console.log(`   Name:       ${keyName}`);
+    console.log(`   ID:         ${payload.sub}`);
+    console.log(`   Issued:     ${issuedAt.toISOString()}`);
+    console.log(`   Expires:    ${expiresAt.toISOString()} (${expiresIn})`);
+    console.log(`
+   API Key:
+   ${apiKey}
+`);
+    console.log("   Usage:");
+    console.log("   curl -X POST https://your-bot.example.com/api/public/chat \\");
+    console.log(`     -H "x-api-key: ${apiKey.slice(0, 50)}..." \\`);
+    console.log('     -H "Content-Type: application/json" \\');
+    console.log(`     -d '{"message": "Hello"}'`);
+    console.log("");
+  } catch (error) {
+    console.error("\u274C Error creating API key:", error);
+    process.exit(1);
+  }
+}
+main();

package/dist/index.js

@@ -7659,22 +7659,38 @@ function resolveStatic(configStaticDir) {
 }
 
 // src/middleware/cors.ts
-var cors = () => async (c, next) => {
-  c.header("access-control-allow-origin", "*");
-  c.header("access-control-allow-headers", "content-type, x-api-key, authorization");
-  c.header("access-control-allow-methods", "POST, GET, OPTIONS");
+var ALLOWED_HEADERS = "content-type, x-api-key, authorization";
+var ALLOWED_METHODS = "POST, GET, OPTIONS";
+var cors = (allowedOrigins) => async (c, next) => {
+  const requestOrigin = c.req.header("origin");
+  const allowAll = !allowedOrigins || allowedOrigins.length === 0 || allowedOrigins.includes("*");
+  const originHeader = resolveOrigin(requestOrigin, allowedOrigins, allowAll);
   if (c.req.method === "OPTIONS") {
     return new Response(null, {
       status: 204,
       headers: {
-        "access-control-allow-origin": "*",
-        "access-control-allow-headers": "content-type, x-api-key, authorization",
-        "access-control-allow-methods": "POST, GET, OPTIONS"
+        "access-control-allow-origin": originHeader,
+        "access-control-allow-headers": ALLOWED_HEADERS,
+        "access-control-allow-methods": ALLOWED_METHODS,
+        ...allowAll ? {} : { vary: "Origin" }
       }
     });
   }
+  c.header("access-control-allow-origin", originHeader);
+  c.header("access-control-allow-headers", ALLOWED_HEADERS);
+  c.header("access-control-allow-methods", ALLOWED_METHODS);
+  if (!allowAll) {
+    c.header("vary", "Origin");
+  }
   await next();
 };
+function resolveOrigin(requestOrigin, allowedOrigins, allowAll) {
+  if (allowAll) return "*";
+  if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
+    return requestOrigin;
+  }
+  return allowedOrigins[0];
+}
 
 // src/routes/demo.ts
 var import_hono = require("hono");
@@ -7784,14 +7800,8 @@ function getActiveSessions() {
 }
 
 // src/routes/demo.ts
-function checkDemoOrigin() {
-  const allowedOrigins = [
-    "https://bot.diegoalto.app",
-    "https://diegoalto.co.uk",
-    "http://diegoalto.co.uk",
-    "https://diegoalto.works",
-    "http://diegoalto.works"
-  ];
+function checkDemoOrigin(allowedOrigins) {
+  const allowAll = allowedOrigins.length === 0 || allowedOrigins.includes("*");
   return async (c, next) => {
     const origin = c.req.header("origin");
     const referer = c.req.header("referer");
@@ -7799,6 +7809,9 @@ function checkDemoOrigin() {
     if (host.startsWith("localhost:") || host.startsWith("127.0.0.1:")) {
       return next();
     }
+    if (allowAll) {
+      return next();
+    }
     if (origin) {
       const allowed = allowedOrigins.some((allowed2) => origin.startsWith(allowed2));
       if (allowed) return next();
@@ -7868,9 +7881,10 @@ function limitDemo() {
   };
 }
 function demoRoutes(deps) {
-  const { client, store, prompts } = deps;
+  const { client, store, config: config2, prompts } = deps;
   const app = new import_hono.Hono();
-  app.get("/api/demo/session", checkDemoOrigin(), limitSessionCreation(), (c) => {
+  const demoOrigins = config2.server?.allowedOrigins ?? [];
+  app.get("/api/demo/session", checkDemoOrigin(demoOrigins), limitSessionCreation(), (c) => {
     const session = createSession({
       maxRequests: 20,
       ttl: 3600
@@ -8213,12 +8227,10 @@ function publicRoutes(deps) {
   const app = new import_hono3.Hono();
   const requirePublicKey = createAuthMiddleware(deps);
   const { limitPublic: limitPublic2 } = createRateLimiter(config2);
+  const referrerOrigins = config2.server?.allowedOrigins?.length ? config2.server.allowedOrigins.filter((o) => o !== "*") : [config2.bot.publicUrl, "http://localhost:8181", "http://127.0.0.1:8181"];
   app.use("/api/public/*", validateSessionKey());
   app.use("/api/public/*", requirePublicKey);
-  app.use(
-    "/api/public/*",
-    requireReferrer([config2.bot.publicUrl, "http://localhost:8181", "http://127.0.0.1:8181"])
-  );
+  app.use("/api/public/*", requireReferrer(referrerOrigins));
   app.use("/api/public/*", limitPublic2());
   app.post("/api/public/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
@@ -8292,7 +8304,7 @@ async function createServer(config2) {
   }
   const app = new import_hono4.Hono();
   if (config2.server?.cors !== false) {
-    app.use("*", cors());
+    app.use("*", cors(config2.server?.allowedOrigins));
   }
   app.get("/healthz", (c) => c.text("ok"));
   app.get(

package/dist/index.mjs

@@ -7630,22 +7630,38 @@ function resolveStatic(configStaticDir) {
 }
 
 // src/middleware/cors.ts
-var cors = () => async (c, next) => {
-  c.header("access-control-allow-origin", "*");
-  c.header("access-control-allow-headers", "content-type, x-api-key, authorization");
-  c.header("access-control-allow-methods", "POST, GET, OPTIONS");
+var ALLOWED_HEADERS = "content-type, x-api-key, authorization";
+var ALLOWED_METHODS = "POST, GET, OPTIONS";
+var cors = (allowedOrigins) => async (c, next) => {
+  const requestOrigin = c.req.header("origin");
+  const allowAll = !allowedOrigins || allowedOrigins.length === 0 || allowedOrigins.includes("*");
+  const originHeader = resolveOrigin(requestOrigin, allowedOrigins, allowAll);
   if (c.req.method === "OPTIONS") {
     return new Response(null, {
       status: 204,
       headers: {
-        "access-control-allow-origin": "*",
-        "access-control-allow-headers": "content-type, x-api-key, authorization",
-        "access-control-allow-methods": "POST, GET, OPTIONS"
+        "access-control-allow-origin": originHeader,
+        "access-control-allow-headers": ALLOWED_HEADERS,
+        "access-control-allow-methods": ALLOWED_METHODS,
+        ...allowAll ? {} : { vary: "Origin" }
       }
     });
   }
+  c.header("access-control-allow-origin", originHeader);
+  c.header("access-control-allow-headers", ALLOWED_HEADERS);
+  c.header("access-control-allow-methods", ALLOWED_METHODS);
+  if (!allowAll) {
+    c.header("vary", "Origin");
+  }
   await next();
 };
+function resolveOrigin(requestOrigin, allowedOrigins, allowAll) {
+  if (allowAll) return "*";
+  if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
+    return requestOrigin;
+  }
+  return allowedOrigins[0];
+}
 
 // src/routes/demo.ts
 import { Hono } from "hono";
@@ -7755,14 +7771,8 @@ function getActiveSessions() {
 }
 
 // src/routes/demo.ts
-function checkDemoOrigin() {
-  const allowedOrigins = [
-    "https://bot.diegoalto.app",
-    "https://diegoalto.co.uk",
-    "http://diegoalto.co.uk",
-    "https://diegoalto.works",
-    "http://diegoalto.works"
-  ];
+function checkDemoOrigin(allowedOrigins) {
+  const allowAll = allowedOrigins.length === 0 || allowedOrigins.includes("*");
   return async (c, next) => {
     const origin = c.req.header("origin");
     const referer = c.req.header("referer");
@@ -7770,6 +7780,9 @@ function checkDemoOrigin() {
     if (host.startsWith("localhost:") || host.startsWith("127.0.0.1:")) {
       return next();
     }
+    if (allowAll) {
+      return next();
+    }
     if (origin) {
       const allowed = allowedOrigins.some((allowed2) => origin.startsWith(allowed2));
       if (allowed) return next();
@@ -7839,9 +7852,10 @@ function limitDemo() {
   };
 }
 function demoRoutes(deps) {
-  const { client, store, prompts } = deps;
+  const { client, store, config: config2, prompts } = deps;
   const app = new Hono();
-  app.get("/api/demo/session", checkDemoOrigin(), limitSessionCreation(), (c) => {
+  const demoOrigins = config2.server?.allowedOrigins ?? [];
+  app.get("/api/demo/session", checkDemoOrigin(demoOrigins), limitSessionCreation(), (c) => {
     const session = createSession({
       maxRequests: 20,
       ttl: 3600
@@ -8188,12 +8202,10 @@ function publicRoutes(deps) {
   const app = new Hono3();
   const requirePublicKey = createAuthMiddleware(deps);
   const { limitPublic: limitPublic2 } = createRateLimiter(config2);
+  const referrerOrigins = config2.server?.allowedOrigins?.length ? config2.server.allowedOrigins.filter((o) => o !== "*") : [config2.bot.publicUrl, "http://localhost:8181", "http://127.0.0.1:8181"];
   app.use("/api/public/*", validateSessionKey());
   app.use("/api/public/*", requirePublicKey);
-  app.use(
-    "/api/public/*",
-    requireReferrer([config2.bot.publicUrl, "http://localhost:8181", "http://127.0.0.1:8181"])
-  );
+  app.use("/api/public/*", requireReferrer(referrerOrigins));
   app.use("/api/public/*", limitPublic2());
   app.post("/api/public/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
@@ -8267,7 +8279,7 @@ async function createServer(config2) {
   }
   const app = new Hono4();
   if (config2.server?.cors !== false) {
-    app.use("*", cors());
+    app.use("*", cors(config2.server?.allowedOrigins));
   }
   app.get("/healthz", (c) => c.text("ok"));
   app.get(

package/dist/middleware/cors.d.ts

@@ -1,3 +1,10 @@
 import type { Context, Next } from "hono";
-export declare const cors: () => (c: Context, next: Next) => Promise<Response | undefined>;
+/**
+ * CORS middleware that validates requests against allowed origins.
+ *
+ * @param allowedOrigins - Array of permitted origins. When the array contains
+ *   `"*"` (or is empty/undefined), all origins are allowed. Otherwise only
+ *   the listed origins receive CORS headers.
+ */
+export declare const cors: (allowedOrigins?: string[]) => (c: Context, next: Next) => Promise<Response | undefined>;
 //# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,eAAO,MAAM,IAAI,SAAgB,GAAG,OAAO,EAAE,MAAM,IAAI,kCAetD,CAAC"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK1C;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,iBAAiB,MAAM,EAAE,MAAY,GAAG,OAAO,EAAE,MAAM,IAAI,kCAyB/E,CAAC"}

package/dist/routes/demo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAoHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EAkGlD"}
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAsHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EAqGlD"}

package/dist/routes/public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EA+DpD"}
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAkEpD"}

package/dist/types.d.ts

@@ -121,6 +121,15 @@ export interface ChatterConfig {
         port?: number;
         /** Enable CORS. Default: true */
         cors?: boolean;
+        /**
+         * Allowed origins for CORS and referrer checks.
+         * Requests from these domains will be permitted.
+         *
+         * @example ["https://myapp.com", "https://staging.myapp.com"]
+         *
+         * When not set, defaults to `["*"]` (all origins allowed).
+         */
+        allowedOrigins?: string[];
     };
     /** Custom route handler for advanced use cases */
     customRoutes?: (app: Hono, deps: ServerDependencies) => void;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,yCAAyC;QACzC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;IAGF,kDAAkD;IAClD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,yCAAyC;QACzC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IAGF,kDAAkD;IAClD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@diegoaltoworks/chatter",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Embeddable AI chatbot framework with RAG, authentication, and customizable widgets",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "bin": {
-    "chatter": "./bin/create-apikey.ts"
+    "chatter": "./dist/bin/create-apikey.js"
   },
   "exports": {
     ".": {
@@ -30,15 +30,16 @@
       "require": "./dist/mcp-server.js"
     }
   },
-  "files": ["dist", "bin", "README.md", "LICENSE"],
+  "files": ["dist", "README.md", "LICENSE"],
   "scripts": {
     "dev": "bun --watch src/index.ts",
-    "build": "bun run build:clean && bun run build:types && bun run build:esm && bun run build:cjs && bun run build:mcp && bun run build:client && bun run build:copy-client",
+    "build": "bun run build:clean && bun run build:types && bun run build:esm && bun run build:cjs && bun run build:mcp && bun run build:bin && bun run build:client && bun run build:copy-client",
     "build:clean": "rm -rf dist",
     "build:types": "tsc --emitDeclarationOnly --outDir dist",
     "build:esm": "esbuild src/index.ts --bundle --format=esm --outfile=dist/index.mjs --external:hono --external:openai --external:@libsql/client --external:jose --platform=node --target=node24",
     "build:cjs": "esbuild src/index.ts --bundle --format=cjs --outfile=dist/index.js --external:hono --external:openai --external:@libsql/client --external:jose --platform=node --target=node24",
     "build:mcp": "esbuild src/mcp-server.ts --bundle --format=esm --outfile=dist/mcp-server.mjs --external:@modelcontextprotocol/sdk --external:openai --external:@libsql/client --external:zod --platform=node --target=node24 && esbuild src/mcp-server.ts --bundle --format=cjs --outfile=dist/mcp-server.js --external:@modelcontextprotocol/sdk --external:openai --external:@libsql/client --external:zod --platform=node --target=node24",
+    "build:bin": "esbuild bin/create-apikey.ts --bundle --format=cjs --outfile=dist/bin/create-apikey.js --external:jose --platform=node --target=node18 --banner:js='#!/usr/bin/env node'",
     "build:client": "cd src/client && bun run build",
     "build:copy-client": "mkdir -p dist/static && cp src/client/dist/chatter.js src/client/dist/chatter.css dist/static/",
     "test": "bun test",

package/bin/create-apikey.ts

@@ -1,101 +0,0 @@
-#!/usr/bin/env node
-/**
- * CLI tool for creating Chatter API keys
- *
- * Usage:
- *   npx chatter create-apikey --name "my-key" --expires-in 365d
- *   bun run bin/create-apikey.ts --name "test" --expires-in 1y
- */
-
-import { ApiKeyManager } from "../src/auth/apikeys";
-
-async function main() {
-  // Parse command line arguments
-  const args = process.argv.slice(2);
-  const options: { name?: string; expiresIn?: string } = {};
-
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--name" && args[i + 1]) {
-      options.name = args[i + 1];
-      i++;
-    } else if (args[i] === "--expires-in" && args[i + 1]) {
-      options.expiresIn = args[i + 1];
-      i++;
-    } else if (args[i] === "--help" || args[i] === "-h") {
-      console.log(`
-Chatter API Key Generator
-
-Usage:
-  npx chatter create-apikey [options]
-
-Options:
-  --name <name>          Name/label for the API key (default: "api-key")
-  --expires-in <time>    Expiration time (default: "365d")
-                         Formats: s=seconds, m=minutes, h=hours, d=days, M=months, y=years
-                         Examples: 30d, 12h, 1y, 6M
-
-Environment:
-  CHATTER_SECRET         Required. Secret key for signing JWT tokens
-
-Examples:
-  npx chatter create-apikey --name "mobile-app" --expires-in 365d
-  npx chatter create-apikey --name "test-key" --expires-in 1h
-      `);
-      process.exit(0);
-    }
-  }
-
-  // Check for CHATTER_SECRET
-  const secret = process.env.CHATTER_SECRET;
-  if (!secret) {
-    console.error("❌ Error: CHATTER_SECRET environment variable is not set");
-    console.error("\n   Please set it before running this command:");
-    console.error("   export CHATTER_SECRET=your-secret-key-here");
-    console.error("\n   Or prefix the command:");
-    console.error("   CHATTER_SECRET=your-secret npx chatter create-apikey\n");
-    process.exit(1);
-  }
-
-  // Create API key manager
-  const manager = new ApiKeyManager(secret);
-
-  // Default values
-  const keyName = options.name || "api-key";
-  const expiresIn = options.expiresIn || "365d";
-
-  try {
-    // Create the API key
-    const apiKey = await manager.create({
-      name: keyName,
-      expiresIn,
-    });
-
-    // Decode to show details (without verification for display)
-    const payload = manager.decode(apiKey);
-    if (!payload) {
-      throw new Error("Failed to decode generated API key");
-    }
-
-    const expiresAt = new Date((payload.exp || 0) * 1000);
-    const issuedAt = new Date((payload.iat || 0) * 1000);
-
-    // Output the result
-    console.log("\n✅ API Key generated successfully!\n");
-    console.log(`   Name:       ${keyName}`);
-    console.log(`   ID:         ${payload.sub}`);
-    console.log(`   Issued:     ${issuedAt.toISOString()}`);
-    console.log(`   Expires:    ${expiresAt.toISOString()} (${expiresIn})`);
-    console.log(`\n   API Key:\n   ${apiKey}\n`);
-    console.log("   Usage:");
-    console.log("   curl -X POST https://your-bot.example.com/api/public/chat \\");
-    console.log(`     -H "x-api-key: ${apiKey.slice(0, 50)}..." \\`);
-    console.log('     -H "Content-Type: application/json" \\');
-    console.log('     -d \'{"message": "Hello"}\'');
-    console.log("");
-  } catch (error) {
-    console.error("❌ Error creating API key:", error);
-    process.exit(1);
-  }
-}
-
-main();