@diegoaltoworks/chatter 0.24.0 → 0.25.0

package/dist/core/buckets.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Retrieval bucket resolution — which slices of the knowledge base a single
+ * chat turn is allowed to see.
+ *
+ * Knowledge is ingested into named buckets (see ./loaders). By default a chat
+ * turn retrieves from `base` plus the bucket matching its mode, which keeps
+ * `private` knowledge off public surfaces. Role-gated deployments need more
+ * than that: a signed-in operator may be entitled to buckets an anonymous
+ * visitor is not, and the entitlement is only knowable per request.
+ *
+ * `bucketsFor` is that seam. Surfaces (routes, channels) call
+ * {@link resolveBuckets} with whatever sender identity they hold and pass the
+ * result to `prepareChat`. The security invariant lives here, in one pure
+ * function, rather than being re-derived by every surface:
+ *
+ *   **The hook can only widen retrieval for a caller the surface could name.**
+ *   Without a sender identity, its answer is clamped to the buckets the mode
+ *   would have retrieved anyway — so a hook asking for `private` from a public
+ *   surface gets it dropped, not honoured.
+ *
+ * Anonymous surfaces run the public pipeline, so their ceiling is the public
+ * defaults and private knowledge stays out of reach. Clamping to the mode
+ * defaults rather than always to the public ones keeps the two ways a hook can
+ * decline to widen — returning the defaults, or returning `undefined` —
+ * behaving identically; a ceiling that depended on which one a hook picked
+ * would be a trap rather than a guarantee.
+ *
+ * Narrowing is always allowed — a hook may hand back fewer buckets, or none
+ * at all, on any surface.
+ */
+import type { PipelineMode } from "./pipeline";
+/** Buckets a mode retrieves from when nothing overrides it. */
+export declare function defaultBuckets(mode: PipelineMode): string[];
+/** What a surface knows about the caller when it asks for buckets. */
+export interface BucketsForContext {
+    /** The pipeline the turn is running through */
+    mode: PipelineMode;
+    /**
+     * Stable identifier for the caller (JWT subject, channel sender id, ...).
+     * Absent on anonymous surfaces — see the clamp in {@link resolveBuckets}.
+     */
+    sender?: string;
+}
+/**
+ * Per-request retrieval bucket policy.
+ *
+ * Return the buckets this caller may retrieve from, or `undefined` to leave
+ * the mode defaults in place. May be async — role lookups usually are.
+ */
+export type BucketsFor = (ctx: BucketsForContext) => string[] | undefined | Promise<string[] | undefined>;
+/**
+ * Ask the configured `bucketsFor` hook which buckets this turn may retrieve
+ * from, and enforce the anonymous ceiling on its answer.
+ *
+ * Returns `undefined` when the caller should keep the mode defaults: no hook
+ * configured, or a hook that returned `undefined`. An explicitly empty array
+ * is honoured as "retrieve nothing" and is never silently widened back to the
+ * defaults — that fallback would hand a private-mode caller the `private`
+ * bucket precisely when the hook had refused it.
+ *
+ * Without a sender the answer is filtered down to `defaultBuckets(mode)`, so
+ * an unidentified caller can never end up with more than the surface would
+ * have retrieved on its own. Pass the sender to unlock the extra buckets an
+ * identified caller is entitled to.
+ *
+ * A rejected hook propagates: retrieval scope is a security decision, and a
+ * policy lookup that failed must not silently fall back to the defaults.
+ */
+export declare function resolveBuckets({ mode, sender, bucketsFor, }: {
+    mode: PipelineMode;
+    sender?: string;
+    bucketsFor?: BucketsFor;
+}): Promise<string[] | undefined>;
+//# sourceMappingURL=buckets.d.ts.map

package/dist/core/buckets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buckets.d.ts","sourceRoot":"","sources":["../../src/core/buckets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CAE3D;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,IAAI,EAAE,YAAY,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,iBAAiB,KACnB,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAsB1D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,MAAM,EACN,UAAU,GACX,EAAE;IACD,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAYhC"}

package/dist/core/buckets.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Retrieval bucket resolution tests.
+ *
+ * The security invariant — a hook can never widen retrieval for a caller the
+ * surface could not name, which on the public pipeline means private
+ * knowledge stays unreachable — is asserted here rather than per-route,
+ * because this is the single place that enforces it.
+ */
+export {};
+//# sourceMappingURL=buckets.test.d.ts.map

package/dist/core/buckets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buckets.test.d.ts","sourceRoot":"","sources":["../../src/core/buckets.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/core/pipeline.d.ts

@@ -32,9 +32,15 @@ export interface PreparedChat {
  * optional, and blank (or whitespace-only) values are ignored: omit them and
  * the prompt is exactly what it has always been.
  *
+ * `buckets` does the same for retrieval scope. It is taken at face value —
+ * this is the low-level primitive, and it trusts its caller. A surface that
+ * derives buckets from anything a request controls must run them through
+ * `resolveBuckets` (see ./buckets) first, which is where the anonymous
+ * ceiling is enforced.
+ *
  * @throws if the conversation contains no user message
  */
-export declare function prepareChat({ store, prompts, mode, messages, personaLayer, channelHint, }: {
+export declare function prepareChat({ store, prompts, mode, messages, personaLayer, channelHint, buckets, }: {
     store: VectorStore;
     prompts: PromptLoader;
     mode: PipelineMode;
@@ -43,5 +49,10 @@ export declare function prepareChat({ store, prompts, mode, messages, personaLay
     personaLayer?: string;
     /** Extra system-prompt section describing the delivery channel */
     channelHint?: string;
+    /**
+     * Retrieval buckets for this turn, replacing the mode default of
+     * `["base", mode]`. An empty array retrieves nothing.
+     */
+    buckets?: string[];
 }): Promise<PreparedChat>;
 //# sourceMappingURL=pipeline.d.ts.map

package/dist/core/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/core/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAOD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,WAAW,GACZ,EAAE;IACD,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBxB"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/core/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAOD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,OAAO,GACR,EAAE;IACD,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBxB"}

package/dist/core/retrieval.d.ts

@@ -1,6 +1,5 @@
 import { type Client as LibsqlClient } from "@libsql/client";
 import type OpenAI from "openai";
-import { type Bucket } from "./loaders";
 /**
  * How a {@link VectorStore} obtains its database connection: either credentials
  * to open its own, or an existing libsql client to reuse.
@@ -37,6 +36,17 @@ export declare class VectorStore {
     build(): Promise<void>;
     private cleanupStaleChunks;
     private static cosine;
-    query(q: string, k?: number, allowed?: Bucket[]): Promise<string[]>;
+    /**
+     * Retrieve top-k across allowed buckets; compute similarity in app (simple
+     * & portable).
+     *
+     * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+     * `chunks` table constrains nothing, so a deployment that ingests its own
+     * buckets can query them (`build` only writes and prunes the three the
+     * knowledge loader walks). Names are bound as query parameters, never
+     * interpolated. An empty list retrieves nothing, and short-circuits before
+     * the embedding call.
+     */
+    query(q: string, k?: number, allowed?: string[]): Promise<string[]>;
 }
 //# sourceMappingURL=retrieval.d.ts.map

package/dist/core/retrieval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retrieval.d.ts","sourceRoot":"","sources":["../../src/core/retrieval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,KAAK,MAAM,EAAiB,MAAM,WAAW,CAAC;AAyBvD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,CACA;IACE,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,KAAK,CAAC;CACxB,GACD;IACE,gFAAgF;IAChF,cAAc,EAAE,YAAY,CAAC;IAC7B,WAAW,CAAC,EAAE,KAAK,CAAC;IACpB,iBAAiB,CAAC,EAAE,KAAK,CAAC;CAC3B,CACJ,CAAC;AAEF,qBAAa,WAAW;IAUpB,OAAO,CAAC,MAAM;IAThB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAS;IAE7B,YACU,MAAM,EAAE,MAAM,EACtB,OAAO,EAAE,kBAAkB,EAS5B;IAGK,KAAK,kBA0FV;YAGa,kBAAkB;IA8BhC,OAAO,CAAC,MAAM,CAAC,MAAM;IAaf,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,SAAI,EAAE,OAAO,GAAE,MAAM,EAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB7E;CACF"}
+{"version":3,"file":"retrieval.d.ts","sourceRoot":"","sources":["../../src/core/retrieval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA0BjC;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,CACA;IACE,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,KAAK,CAAC;CACxB,GACD;IACE,gFAAgF;IAChF,cAAc,EAAE,YAAY,CAAC;IAC7B,WAAW,CAAC,EAAE,KAAK,CAAC;IACpB,iBAAiB,CAAC,EAAE,KAAK,CAAC;CAC3B,CACJ,CAAC;AAEF,qBAAa,WAAW;IAUpB,OAAO,CAAC,MAAM;IAThB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAS;IAE7B,YACU,MAAM,EAAE,MAAM,EACtB,OAAO,EAAE,kBAAkB,EAS5B;IAGK,KAAK,kBA0FV;YAGa,kBAAkB;IA8BhC,OAAO,CAAC,MAAM,CAAC,MAAM;IAYrB;;;;;;;;;;OAUG;IACG,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,SAAI,EAAE,OAAO,GAAE,MAAM,EAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAwB7E;CACF"}

package/dist/index.d.ts

@@ -16,6 +16,8 @@ export type { ChatBotConfig, ChatButtonConfig, ChatConfig, ChatMessage, ChatMode
 export { Chat, ChatBot, ChatButton } from "./client";
 export type { AnswerFn, AnswerFnInput, AnswerFnResult, AnswerOptions, AnswerUsage, } from "./core/answer";
 export { answerOnce, answerStream } from "./core/answer";
+export type { BucketsFor, BucketsForContext } from "./core/buckets";
+export { defaultBuckets, resolveBuckets } from "./core/buckets";
 export { detectLeakage, guardOutput, scrubOutput } from "./core/guardrails";
 export { completeOnce, completeStream, DEFAULT_MODEL } from "./core/llm";
 export { loadKnowledge } from "./core/loaders";
@@ -29,7 +31,7 @@ export type { MCPServerOptions, MCPTransportMode } from "./mcp-server";
 export { createMCPServer } from "./mcp-server";
 export { createAuthMiddleware } from "./middleware/auth";
 export { cors } from "./middleware/cors";
-export { createJWTMiddleware } from "./middleware/jwt";
+export { createJWTMiddleware, jwtSubject } from "./middleware/jwt";
 export { createRateLimiter } from "./middleware/ratelimit";
 export { createReferrerCheck } from "./middleware/referrer";
 export { createSessionMiddleware } from "./middleware/session";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EACV,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EACV,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -2847,8 +2847,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize) {
-      if (normalize !== false)
+    function getFullPath(resolver, id = "", normalize2) {
+      if (normalize2 !== false)
         id = normalizeId(id);
       const p = resolver.parse(id);
       return _getFullPath(resolver, p);
@@ -4244,7 +4244,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize(uri, options) {
+    function normalize2(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -4537,7 +4537,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize,
+      normalize: normalize2,
       resolve,
       resolveComponent,
       equal,
@@ -7550,16 +7550,19 @@ __export(index_exports, {
   createServer: () => createServer,
   createSession: () => createSession,
   createSessionMiddleware: () => createSessionMiddleware,
+  defaultBuckets: () => defaultBuckets,
   demoRoutes: () => demoRoutes,
   detectLeakage: () => detectLeakage,
   getActiveSessions: () => getActiveSessions,
   getSessionInfo: () => getSessionInfo,
   guardOutput: () => guardOutput,
+  jwtSubject: () => jwtSubject,
   loadKnowledge: () => loadKnowledge,
   openaiRoutes: () => openaiRoutes,
   prepareChat: () => prepareChat,
   privateRoutes: () => privateRoutes,
   publicRoutes: () => publicRoutes,
+  resolveBuckets: () => resolveBuckets,
   scrubOutput: () => scrubOutput,
   validateSession: () => validateSession
 });
@@ -7783,6 +7786,37 @@ async function* answerStream({
   yield* completeStream({ client, system, messages, temperature, model });
 }
 
+// src/core/buckets.ts
+function defaultBuckets(mode) {
+  return ["base", mode];
+}
+function isIdentified(sender) {
+  return typeof sender === "string" && sender.trim().length > 0;
+}
+function normalize(buckets) {
+  const out = [];
+  for (const raw of buckets) {
+    if (typeof raw !== "string") continue;
+    const bucket = raw.trim();
+    if (bucket && !out.includes(bucket)) out.push(bucket);
+  }
+  return out;
+}
+async function resolveBuckets({
+  mode,
+  sender,
+  bucketsFor
+}) {
+  if (!bucketsFor) return void 0;
+  const identified = isIdentified(sender);
+  const requested = await bucketsFor(identified ? { mode, sender } : { mode });
+  if (!Array.isArray(requested)) return void 0;
+  const cleaned = normalize(requested);
+  if (identified) return cleaned;
+  const ceiling = new Set(defaultBuckets(mode));
+  return cleaned.filter((bucket) => ceiling.has(bucket));
+}
+
 // src/core/loaders.ts
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
@@ -7821,14 +7855,15 @@ async function prepareChat({
   mode,
   messages,
   personaLayer,
-  channelHint
+  channelHint,
+  buckets
 }) {
   const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
   if (!lastUserMsg) {
     throw new Error("no user message found in conversation");
   }
   const { topK, label } = MODE_SETTINGS[mode];
-  const ctx = await store.query(lastUserMsg.content, topK, ["base", mode]);
+  const ctx = await store.query(lastUserMsg.content, topK, buckets ?? defaultBuckets(mode));
   const persona = personaLayer?.trim() || (mode === "private" ? prompts.privatePersona : prompts.publicPersona);
   const hint = channelHint?.trim();
   const system = [
@@ -8020,8 +8055,19 @@ var VectorStore = class _VectorStore {
     }
     return dot / (Math.sqrt(na) * Math.sqrt(nb));
   }
-  // Retrieve top-k across allowed buckets; compute similarity in app (simple & portable).
+  /**
+   * Retrieve top-k across allowed buckets; compute similarity in app (simple
+   * & portable).
+   *
+   * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+   * `chunks` table constrains nothing, so a deployment that ingests its own
+   * buckets can query them (`build` only writes and prunes the three the
+   * knowledge loader walks). Names are bound as query parameters, never
+   * interpolated. An empty list retrieves nothing, and short-circuits before
+   * the embedding call.
+   */
   async query(q, k = 6, allowed = ["base"]) {
+    if (allowed.length === 0) return [];
     const qv = (await this.client.embeddings.create({ model: EMB_MODEL, input: [q] })).data[0].embedding;
     const placeholders = allowed.map(() => "?").join(",");
     const res = await this.db.execute({
@@ -32297,7 +32343,8 @@ async function createMCPServer(config2) {
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("public");
+        const ctx = await store.query(lastUserMsg.content, 6, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.publicPersona,
@@ -32383,7 +32430,8 @@ ${ctx.join("\n\n")}`
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 8, ["base", "private"]);
+        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("private");
+        const ctx = await store.query(lastUserMsg.content, 8, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.privatePersona,
@@ -32513,6 +32561,10 @@ function resolveOrigin(requestOrigin, allowedOrigins, allowAll) {
 
 // src/middleware/jwt.ts
 var import_jose2 = require("jose");
+function jwtSubject(c) {
+  const sub = c.jwtSub;
+  return sub && sub.trim().length > 0 ? sub : void 0;
+}
 function createJWTMiddleware(config2) {
   let jwks = null;
   let spkiKey = null;
@@ -32802,7 +32854,8 @@ function demoRoutes(deps) {
       if (!lastUserMsg) {
         return c.json({ error: "no user message found in conversation" }, 400);
       }
-      const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+      const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("public");
+      const ctx = await store.query(lastUserMsg.content, 6, buckets);
       const system = [
         prompts.baseSystemRules,
         prompts.publicPersona,
@@ -32908,9 +32961,14 @@ function openaiRoutes(deps) {
     }
     const { stream: wantsStream3, temperature: rawTemperature } = body;
     const temperature = typeof rawTemperature === "number" && Number.isFinite(rawTemperature) ? Math.min(Math.max(rawTemperature, 0), 2) : void 0;
+    const buckets = await resolveBuckets({
+      mode,
+      sender: jwtSubject(c),
+      bucketsFor: config2.bucketsFor
+    });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode, messages }));
+      ({ system } = await prepareChat({ store, prompts, mode, messages, buckets }));
     } catch {
       return errorJson(c, 400, "Conversation must contain at least one user message");
     }
@@ -33007,9 +33065,14 @@ function privateRoutes(deps) {
     } else {
       return c.json({ error: "either 'message' or 'messages' required" }, 400);
     }
+    const buckets = await resolveBuckets({
+      mode: "private",
+      sender: jwtSubject(c),
+      bucketsFor: config2.bucketsFor
+    });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode: "private", messages }));
+      ({ system } = await prepareChat({ store, prompts, mode: "private", messages, buckets }));
     } catch {
       return c.json({ error: "no user message found in conversation" }, 400);
     }
@@ -33070,9 +33133,10 @@ function publicRoutes(deps) {
     } else {
       return c.json({ error: "either 'message' or 'messages' required" }, 400);
     }
+    const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode: "public", messages }));
+      ({ system } = await prepareChat({ store, prompts, mode: "public", messages, buckets }));
     } catch {
       return c.json({ error: "no user message found in conversation" }, 400);
     }
@@ -33273,16 +33337,19 @@ async function createServer(config2) {
   createServer,
   createSession,
   createSessionMiddleware,
+  defaultBuckets,
   demoRoutes,
   detectLeakage,
   getActiveSessions,
   getSessionInfo,
   guardOutput,
+  jwtSubject,
   loadKnowledge,
   openaiRoutes,
   prepareChat,
   privateRoutes,
   publicRoutes,
+  resolveBuckets,
   scrubOutput,
   validateSession
 });

package/dist/index.mjs

@@ -2851,8 +2851,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize) {
-      if (normalize !== false)
+    function getFullPath(resolver, id = "", normalize2) {
+      if (normalize2 !== false)
         id = normalizeId(id);
       const p = resolver.parse(id);
       return _getFullPath(resolver, p);
@@ -4248,7 +4248,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize(uri, options) {
+    function normalize2(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -4541,7 +4541,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize,
+      normalize: normalize2,
       resolve,
       resolveComponent,
       equal,
@@ -7749,6 +7749,37 @@ async function* answerStream({
   yield* completeStream({ client, system, messages, temperature, model });
 }
 
+// src/core/buckets.ts
+function defaultBuckets(mode) {
+  return ["base", mode];
+}
+function isIdentified(sender) {
+  return typeof sender === "string" && sender.trim().length > 0;
+}
+function normalize(buckets) {
+  const out = [];
+  for (const raw of buckets) {
+    if (typeof raw !== "string") continue;
+    const bucket = raw.trim();
+    if (bucket && !out.includes(bucket)) out.push(bucket);
+  }
+  return out;
+}
+async function resolveBuckets({
+  mode,
+  sender,
+  bucketsFor
+}) {
+  if (!bucketsFor) return void 0;
+  const identified = isIdentified(sender);
+  const requested = await bucketsFor(identified ? { mode, sender } : { mode });
+  if (!Array.isArray(requested)) return void 0;
+  const cleaned = normalize(requested);
+  if (identified) return cleaned;
+  const ceiling = new Set(defaultBuckets(mode));
+  return cleaned.filter((bucket) => ceiling.has(bucket));
+}
+
 // src/core/loaders.ts
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -7787,14 +7818,15 @@ async function prepareChat({
   mode,
   messages,
   personaLayer,
-  channelHint
+  channelHint,
+  buckets
 }) {
   const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
   if (!lastUserMsg) {
     throw new Error("no user message found in conversation");
   }
   const { topK, label } = MODE_SETTINGS[mode];
-  const ctx = await store.query(lastUserMsg.content, topK, ["base", mode]);
+  const ctx = await store.query(lastUserMsg.content, topK, buckets ?? defaultBuckets(mode));
   const persona = personaLayer?.trim() || (mode === "private" ? prompts.privatePersona : prompts.publicPersona);
   const hint = channelHint?.trim();
   const system = [
@@ -7986,8 +8018,19 @@ var VectorStore = class _VectorStore {
     }
     return dot / (Math.sqrt(na) * Math.sqrt(nb));
   }
-  // Retrieve top-k across allowed buckets; compute similarity in app (simple & portable).
+  /**
+   * Retrieve top-k across allowed buckets; compute similarity in app (simple
+   * & portable).
+   *
+   * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+   * `chunks` table constrains nothing, so a deployment that ingests its own
+   * buckets can query them (`build` only writes and prunes the three the
+   * knowledge loader walks). Names are bound as query parameters, never
+   * interpolated. An empty list retrieves nothing, and short-circuits before
+   * the embedding call.
+   */
   async query(q, k = 6, allowed = ["base"]) {
+    if (allowed.length === 0) return [];
     const qv = (await this.client.embeddings.create({ model: EMB_MODEL, input: [q] })).data[0].embedding;
     const placeholders = allowed.map(() => "?").join(",");
     const res = await this.db.execute({
@@ -32263,7 +32306,8 @@ async function createMCPServer(config2) {
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("public");
+        const ctx = await store.query(lastUserMsg.content, 6, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.publicPersona,
@@ -32349,7 +32393,8 @@ ${ctx.join("\n\n")}`
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 8, ["base", "private"]);
+        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("private");
+        const ctx = await store.query(lastUserMsg.content, 8, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.privatePersona,
@@ -32479,6 +32524,10 @@ function resolveOrigin(requestOrigin, allowedOrigins, allowAll) {
 
 // src/middleware/jwt.ts
 import { createRemoteJWKSet, importSPKI, jwtVerify as jwtVerify2 } from "jose";
+function jwtSubject(c) {
+  const sub = c.jwtSub;
+  return sub && sub.trim().length > 0 ? sub : void 0;
+}
 function createJWTMiddleware(config2) {
   let jwks = null;
   let spkiKey = null;
@@ -32768,7 +32817,8 @@ function demoRoutes(deps) {
       if (!lastUserMsg) {
         return c.json({ error: "no user message found in conversation" }, 400);
       }
-      const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+      const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor }) ?? defaultBuckets("public");
+      const ctx = await store.query(lastUserMsg.content, 6, buckets);
       const system = [
         prompts.baseSystemRules,
         prompts.publicPersona,
@@ -32874,9 +32924,14 @@ function openaiRoutes(deps) {
     }
     const { stream: wantsStream3, temperature: rawTemperature } = body;
     const temperature = typeof rawTemperature === "number" && Number.isFinite(rawTemperature) ? Math.min(Math.max(rawTemperature, 0), 2) : void 0;
+    const buckets = await resolveBuckets({
+      mode,
+      sender: jwtSubject(c),
+      bucketsFor: config2.bucketsFor
+    });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode, messages }));
+      ({ system } = await prepareChat({ store, prompts, mode, messages, buckets }));
     } catch {
       return errorJson(c, 400, "Conversation must contain at least one user message");
     }
@@ -32973,9 +33028,14 @@ function privateRoutes(deps) {
     } else {
       return c.json({ error: "either 'message' or 'messages' required" }, 400);
     }
+    const buckets = await resolveBuckets({
+      mode: "private",
+      sender: jwtSubject(c),
+      bucketsFor: config2.bucketsFor
+    });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode: "private", messages }));
+      ({ system } = await prepareChat({ store, prompts, mode: "private", messages, buckets }));
     } catch {
       return c.json({ error: "no user message found in conversation" }, 400);
     }
@@ -33036,9 +33096,10 @@ function publicRoutes(deps) {
     } else {
       return c.json({ error: "either 'message' or 'messages' required" }, 400);
     }
+    const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor });
     let system;
     try {
-      ({ system } = await prepareChat({ store, prompts, mode: "public", messages }));
+      ({ system } = await prepareChat({ store, prompts, mode: "public", messages, buckets }));
     } catch {
       return c.json({ error: "no user message found in conversation" }, 400);
     }
@@ -33240,16 +33301,19 @@ export {
   createServer,
   createSession,
   createSessionMiddleware,
+  defaultBuckets,
   demoRoutes,
   detectLeakage,
   getActiveSessions,
   getSessionInfo,
   guardOutput,
+  jwtSubject,
   loadKnowledge,
   openaiRoutes,
   prepareChat,
   privateRoutes,
   publicRoutes,
+  resolveBuckets,
   scrubOutput,
   validateSession
 };

package/dist/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAYpE,YAAY,EACV,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,sBA2S7D"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAapE,YAAY,EACV,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,sBAkT7D"}

package/dist/mcp-server.js

@@ -106,6 +106,37 @@ async function answerOnce({
   return completeOnce({ client, system, messages, temperature, model });
 }
 
+// src/core/buckets.ts
+function defaultBuckets(mode) {
+  return ["base", mode];
+}
+function isIdentified(sender) {
+  return typeof sender === "string" && sender.trim().length > 0;
+}
+function normalize(buckets) {
+  const out = [];
+  for (const raw of buckets) {
+    if (typeof raw !== "string") continue;
+    const bucket = raw.trim();
+    if (bucket && !out.includes(bucket)) out.push(bucket);
+  }
+  return out;
+}
+async function resolveBuckets({
+  mode,
+  sender,
+  bucketsFor
+}) {
+  if (!bucketsFor) return void 0;
+  const identified = isIdentified(sender);
+  const requested = await bucketsFor(identified ? { mode, sender } : { mode });
+  if (!Array.isArray(requested)) return void 0;
+  const cleaned = normalize(requested);
+  if (identified) return cleaned;
+  const ceiling = new Set(defaultBuckets(mode));
+  return cleaned.filter((bucket) => ceiling.has(bucket));
+}
+
 // src/core/prompts.ts
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
@@ -314,8 +345,19 @@ var VectorStore = class _VectorStore {
     }
     return dot / (Math.sqrt(na) * Math.sqrt(nb));
   }
-  // Retrieve top-k across allowed buckets; compute similarity in app (simple & portable).
+  /**
+   * Retrieve top-k across allowed buckets; compute similarity in app (simple
+   * & portable).
+   *
+   * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+   * `chunks` table constrains nothing, so a deployment that ingests its own
+   * buckets can query them (`build` only writes and prunes the three the
+   * knowledge loader walks). Names are bound as query parameters, never
+   * interpolated. An empty list retrieves nothing, and short-circuits before
+   * the embedding call.
+   */
   async query(q, k = 6, allowed = ["base"]) {
+    if (allowed.length === 0) return [];
     const qv = (await this.client.embeddings.create({ model: EMB_MODEL, input: [q] })).data[0].embedding;
     const placeholders = allowed.map(() => "?").join(",");
     const res = await this.db.execute({
@@ -560,7 +602,8 @@ async function createMCPServer(config) {
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor }) ?? defaultBuckets("public");
+        const ctx = await store.query(lastUserMsg.content, 6, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.publicPersona,
@@ -646,7 +689,8 @@ ${ctx.join("\n\n")}`
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 8, ["base", "private"]);
+        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config.bucketsFor }) ?? defaultBuckets("private");
+        const ctx = await store.query(lastUserMsg.content, 8, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.privatePersona,

package/dist/mcp-server.mjs

@@ -72,6 +72,37 @@ async function answerOnce({
   return completeOnce({ client, system, messages, temperature, model });
 }
 
+// src/core/buckets.ts
+function defaultBuckets(mode) {
+  return ["base", mode];
+}
+function isIdentified(sender) {
+  return typeof sender === "string" && sender.trim().length > 0;
+}
+function normalize(buckets) {
+  const out = [];
+  for (const raw of buckets) {
+    if (typeof raw !== "string") continue;
+    const bucket = raw.trim();
+    if (bucket && !out.includes(bucket)) out.push(bucket);
+  }
+  return out;
+}
+async function resolveBuckets({
+  mode,
+  sender,
+  bucketsFor
+}) {
+  if (!bucketsFor) return void 0;
+  const identified = isIdentified(sender);
+  const requested = await bucketsFor(identified ? { mode, sender } : { mode });
+  if (!Array.isArray(requested)) return void 0;
+  const cleaned = normalize(requested);
+  if (identified) return cleaned;
+  const ceiling = new Set(defaultBuckets(mode));
+  return cleaned.filter((bucket) => ceiling.has(bucket));
+}
+
 // src/core/prompts.ts
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -280,8 +311,19 @@ var VectorStore = class _VectorStore {
     }
     return dot / (Math.sqrt(na) * Math.sqrt(nb));
   }
-  // Retrieve top-k across allowed buckets; compute similarity in app (simple & portable).
+  /**
+   * Retrieve top-k across allowed buckets; compute similarity in app (simple
+   * & portable).
+   *
+   * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+   * `chunks` table constrains nothing, so a deployment that ingests its own
+   * buckets can query them (`build` only writes and prunes the three the
+   * knowledge loader walks). Names are bound as query parameters, never
+   * interpolated. An empty list retrieves nothing, and short-circuits before
+   * the embedding call.
+   */
   async query(q, k = 6, allowed = ["base"]) {
+    if (allowed.length === 0) return [];
     const qv = (await this.client.embeddings.create({ model: EMB_MODEL, input: [q] })).data[0].embedding;
     const placeholders = allowed.map(() => "?").join(",");
     const res = await this.db.execute({
@@ -526,7 +568,8 @@ async function createMCPServer(config) {
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 6, ["base", "public"]);
+        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor }) ?? defaultBuckets("public");
+        const ctx = await store.query(lastUserMsg.content, 6, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.publicPersona,
@@ -612,7 +655,8 @@ ${ctx.join("\n\n")}`
         if (!lastUserMsg) {
           throw new Error("No user message found in conversation");
         }
-        const ctx = await store.query(lastUserMsg.content, 8, ["base", "private"]);
+        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config.bucketsFor }) ?? defaultBuckets("private");
+        const ctx = await store.query(lastUserMsg.content, 8, buckets);
         const system = [
           prompts.baseSystemRules,
           prompts.privatePersona,

package/dist/middleware/jwt.d.ts

@@ -1,5 +1,15 @@
 import type { Context, Next } from "hono";
 import type { ChatterConfig } from "../types";
+/**
+ * The verified JWT subject attached by {@link createJWTMiddleware}, or
+ * `undefined` when the request carried no identity (unauthenticated route, or
+ * a token whose payload had no `sub`).
+ *
+ * Surfaces use this as the sender identity for per-request policy such as
+ * retrieval bucket gating, where "no identity" must mean anonymous rather
+ * than an empty-string user.
+ */
+export declare function jwtSubject(c: Context): string | undefined;
 /**
  * Create JWT authentication middleware for private API endpoints
  * Supports JWKS and public key PEM verification

package/dist/middleware/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,OAwBZ,OAAO,QAAQ,IAAI;;8BAa/D;AAGD,eAAO,MAAM,iBAAiB,MAhBe,OAAO,QAAQ,IAAI;;6BAgBS,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,OAwBZ,OAAO,QAAQ,IAAI;;8BAa/D;AAGD,eAAO,MAAM,iBAAiB,MAhBe,OAAO,QAAQ,IAAI;;6BAgBS,CAAC"}

package/dist/routes/demo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAsHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EAiHlD"}
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAsHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EAqHlD"}

package/dist/routes/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,KAAK,eAAe,EAAkC,MAAM,kBAAkB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,IAAI,CA8BxE;AASD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAgIpD"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,KAAK,eAAe,EAAkC,MAAM,kBAAkB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,IAAI,CA8BxE;AASD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAwIpD"}

package/dist/routes/private.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/routes/private.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,8EA6DrD"}
+{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/routes/private.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,8EAoErD"}

package/dist/routes/public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAsEpD"}
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EA0EpD"}

package/dist/types.d.ts

@@ -8,6 +8,7 @@ import type { Client as LibsqlClient } from "@libsql/client";
 import type { Hono } from "hono";
 import type OpenAI from "openai";
 import type { AnswerFn } from "./core/answer";
+import type { BucketsFor } from "./core/buckets";
 import type { PromptLoader } from "./core/prompts";
 import type { VectorStore } from "./core/retrieval";
 /**
@@ -156,6 +157,21 @@ export interface ChatterConfig {
      * errors. Unset: the built-in OpenAI completion is used.
      */
     answerFn?: AnswerFn;
+    /**
+     * Decides which knowledge buckets each chat turn may retrieve from, given
+     * the pipeline mode and — where the surface knows it — the sender's
+     * identity. Use it for role-gated knowledge: entitle a signed-in operator
+     * to buckets an anonymous visitor cannot see.
+     *
+     * Consulted by the chat routes, the OpenAI-compatible endpoints, the MCP
+     * chat tools and the demo route. Return `undefined` to keep the mode
+     * defaults (`base` plus the mode's own bucket). For a caller the surface
+     * could not identify, the answer is filtered down to those same defaults —
+     * the hook can narrow retrieval for an unnamed caller but never widen it.
+     *
+     * Unset: the mode defaults apply everywhere.
+     */
+    bucketsFor?: BucketsFor;
     /** Custom route handler for advanced use cases. May be async — see {@link CustomRoutes} */
     customRoutes?: CustomRoutes;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IAGF;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAC/C,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,EAAE,EAAE,YAAY,CAAC;IACjB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IAGF;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAGxB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAC/C,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,EAAE,EAAE,YAAY,CAAC;IACjB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegoaltoworks/chatter",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Embeddable AI chatbot framework with RAG, authentication, and customizable widgets",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",