@diegoaltoworks/chatter 0.43.0 → 0.44.0

package/dist/core/messages.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Inbound chat message normalization — the trust boundary for conversations.
+ *
+ * Every HTTP chat surface accepts a caller-supplied conversation, and the
+ * server owns the system prompt (guardrails + persona + retrieved context).
+ * Nothing a client sends may add to, or masquerade as, that prompt, so the
+ * only roles that survive normalization are `user` and `assistant`:
+ * `system`, `developer` and `tool` messages are dropped, not forwarded.
+ *
+ * Content is reduced to a plain string: strings pass through and OpenAI-style
+ * content-part arrays are flattened to their text parts. Anything else (image
+ * parts, tool calls, objects, numbers) carries no usable text and is skipped.
+ */
+import type { PipelineMessage } from "./pipeline";
+/**
+ * Normalize a raw `messages` array to the pipeline format.
+ *
+ * Returns `null` when the input is not a non-empty array, when any entry is
+ * not an object, or when nothing usable remains after filtering.
+ */
+export declare function normalizeMessages(raw: unknown): PipelineMessage[] | null;
+/** Outcome of normalizing a widget chat request body. */
+export type NormalizedChatBody = {
+    ok: true;
+    messages: PipelineMessage[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Normalize the widget chat body shape, which accepts either a single
+ * `message` string or a `messages` conversation array.
+ *
+ * The resulting messages have been through `normalizeMessages`, so a client
+ * cannot inject a system turn on these surfaces either.
+ */
+export declare function normalizeChatBody(body: unknown): NormalizedChatBody;
+//# sourceMappingURL=messages.d.ts.map

package/dist/core/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/core/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAWlD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,IAAI,CA8BxE;AAED,yDAAyD;AACzD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CA2BnE"}

package/dist/core/messages.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Inbound message normalization tests.
+ *
+ * The invariant under test is that a client cannot contribute a system turn
+ * and cannot smuggle non-text content into the conversation.
+ */
+export {};
+//# sourceMappingURL=messages.test.d.ts.map

package/dist/core/messages.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.test.d.ts","sourceRoot":"","sources":["../../src/core/messages.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/index.d.ts

@@ -22,6 +22,8 @@ export { defaultBuckets, resolveBuckets } from "./core/buckets";
 export { detectLeakage, guardOutput, scrubOutput } from "./core/guardrails";
 export { completeOnce, completeStream, DEFAULT_MODEL } from "./core/llm";
 export { loadKnowledge } from "./core/loaders";
+export type { NormalizedChatBody } from "./core/messages";
+export { normalizeChatBody, normalizeMessages } from "./core/messages";
 export type { PipelineMessage, PipelineMode, PreparedChat } from "./core/pipeline";
 export { prepareChat } from "./core/pipeline";
 export { PromptLoader } from "./core/prompts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAIvC,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EACV,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAIvC,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EACV,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -7559,6 +7559,8 @@ __export(index_exports, {
   guardOutput: () => guardOutput,
   jwtSubject: () => jwtSubject,
   loadKnowledge: () => loadKnowledge,
+  normalizeChatBody: () => normalizeChatBody,
+  normalizeMessages: () => normalizeMessages,
   openaiRoutes: () => openaiRoutes,
   prepareChat: () => prepareChat,
   privateRoutes: () => privateRoutes,
@@ -7845,6 +7847,52 @@ function loadKnowledge(root = "config/knowledge") {
   return docs;
 }
 
+// src/core/messages.ts
+function isClientRole(role) {
+  return role === "user" || role === "assistant";
+}
+function normalizeMessages(raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  const messages = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") return null;
+    const { role, content } = entry;
+    if (!isClientRole(role)) continue;
+    let text = null;
+    if (typeof content === "string") {
+      text = content;
+    } else if (Array.isArray(content)) {
+      text = content.filter(
+        (part) => !!part && typeof part === "object" && part.type === "text" && typeof part.text === "string"
+      ).map((part) => part.text).join("");
+    }
+    if (text === null) continue;
+    messages.push({ role, content: text });
+  }
+  return messages.length > 0 ? messages : null;
+}
+function normalizeChatBody(body) {
+  const source = body && typeof body === "object" ? body : {};
+  if (Array.isArray(source.messages)) {
+    if (source.messages.length === 0) {
+      return { ok: false, error: "messages array cannot be empty" };
+    }
+    const messages = normalizeMessages(source.messages);
+    if (!messages) {
+      return {
+        ok: false,
+        error: "messages must contain user/assistant messages with text content"
+      };
+    }
+    return { ok: true, messages };
+  }
+  const { message } = source;
+  if (message && typeof message !== "object") {
+    return { ok: true, messages: [{ role: "user", content: String(message) }] };
+  }
+  return { ok: false, error: "either 'message' or 'messages' required" };
+}
+
 // src/core/pipeline.ts
 var MODE_SETTINGS = {
   public: { topK: 6, label: "Context" },
@@ -32840,17 +32888,11 @@ function demoRoutes(deps) {
   app.post("/api/demo/chat", limitDemo(), async (c) => {
     try {
       const body = await c.req.json().catch(() => ({}));
-      let messages;
-      if (body?.messages && Array.isArray(body.messages)) {
-        messages = body.messages;
-        if (messages.length === 0) {
-          return c.json({ error: "messages array cannot be empty" }, 400);
-        }
-      } else if (body?.message) {
-        messages = [{ role: "user", content: String(body.message) }];
-      } else {
-        return c.json({ error: "either 'message' or 'messages' required" }, 400);
+      const normalized = normalizeChatBody(body);
+      if (!normalized.ok) {
+        return c.json({ error: normalized.error }, 400);
       }
+      const { messages } = normalized;
       const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
       if (!lastUserMsg) {
         return c.json({ error: "no user message found in conversation" }, 400);
@@ -32901,26 +32943,6 @@ ${ctx.join("\n\n")}`
 // src/routes/openai.ts
 var import_hono2 = require("hono");
 var import_streaming2 = require("hono/streaming");
-function normalizeMessages(raw) {
-  if (!Array.isArray(raw) || raw.length === 0) return null;
-  const messages = [];
-  for (const entry of raw) {
-    if (!entry || typeof entry !== "object") return null;
-    const { role, content } = entry;
-    if (role !== "user" && role !== "assistant") continue;
-    let text = null;
-    if (typeof content === "string") {
-      text = content;
-    } else if (Array.isArray(content)) {
-      text = content.filter(
-        (part) => !!part && typeof part === "object" && part.type === "text" && typeof part.text === "string"
-      ).map((part) => part.text).join("");
-    }
-    if (text === null) continue;
-    messages.push({ role, content: text });
-  }
-  return messages.length > 0 ? messages : null;
-}
 function errorJson(c, status, message) {
   return c.json(
     { error: { message, type: status === 401 ? "authentication_error" : "invalid_request_error" } },
@@ -33055,17 +33077,11 @@ function privateRoutes(deps) {
   app.use("/api/private/*", limitPrivate2());
   app.post("/api/private/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    let messages;
-    if (body?.messages && Array.isArray(body.messages)) {
-      messages = body.messages;
-      if (messages.length === 0) {
-        return c.json({ error: "messages array cannot be empty" }, 400);
-      }
-    } else if (body?.message) {
-      messages = [{ role: "user", content: String(body.message) }];
-    } else {
-      return c.json({ error: "either 'message' or 'messages' required" }, 400);
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
     }
+    const { messages } = normalized;
     const buckets = await resolveBuckets({
       mode: "private",
       sender: jwtSubject(c),
@@ -33123,17 +33139,11 @@ function publicRoutes(deps) {
   app.use("/api/public/*", limitPublic2());
   app.post("/api/public/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    let messages;
-    if (body?.messages && Array.isArray(body.messages)) {
-      messages = body.messages;
-      if (messages.length === 0) {
-        return c.json({ error: "messages array cannot be empty" }, 400);
-      }
-    } else if (body?.message) {
-      messages = [{ role: "user", content: String(body.message) }];
-    } else {
-      return c.json({ error: "either 'message' or 'messages' required" }, 400);
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
     }
+    const { messages } = normalized;
     const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor });
     let system;
     try {
@@ -33462,6 +33472,8 @@ function createShortener(config2, fetchImpl = fetch) {
   guardOutput,
   jwtSubject,
   loadKnowledge,
+  normalizeChatBody,
+  normalizeMessages,
   openaiRoutes,
   prepareChat,
   privateRoutes,

package/dist/index.mjs

@@ -7807,6 +7807,52 @@ function loadKnowledge(root = "config/knowledge") {
   return docs;
 }
 
+// src/core/messages.ts
+function isClientRole(role) {
+  return role === "user" || role === "assistant";
+}
+function normalizeMessages(raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  const messages = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") return null;
+    const { role, content } = entry;
+    if (!isClientRole(role)) continue;
+    let text = null;
+    if (typeof content === "string") {
+      text = content;
+    } else if (Array.isArray(content)) {
+      text = content.filter(
+        (part) => !!part && typeof part === "object" && part.type === "text" && typeof part.text === "string"
+      ).map((part) => part.text).join("");
+    }
+    if (text === null) continue;
+    messages.push({ role, content: text });
+  }
+  return messages.length > 0 ? messages : null;
+}
+function normalizeChatBody(body) {
+  const source = body && typeof body === "object" ? body : {};
+  if (Array.isArray(source.messages)) {
+    if (source.messages.length === 0) {
+      return { ok: false, error: "messages array cannot be empty" };
+    }
+    const messages = normalizeMessages(source.messages);
+    if (!messages) {
+      return {
+        ok: false,
+        error: "messages must contain user/assistant messages with text content"
+      };
+    }
+    return { ok: true, messages };
+  }
+  const { message } = source;
+  if (message && typeof message !== "object") {
+    return { ok: true, messages: [{ role: "user", content: String(message) }] };
+  }
+  return { ok: false, error: "either 'message' or 'messages' required" };
+}
+
 // src/core/pipeline.ts
 var MODE_SETTINGS = {
   public: { topK: 6, label: "Context" },
@@ -32802,17 +32848,11 @@ function demoRoutes(deps) {
   app.post("/api/demo/chat", limitDemo(), async (c) => {
     try {
       const body = await c.req.json().catch(() => ({}));
-      let messages;
-      if (body?.messages && Array.isArray(body.messages)) {
-        messages = body.messages;
-        if (messages.length === 0) {
-          return c.json({ error: "messages array cannot be empty" }, 400);
-        }
-      } else if (body?.message) {
-        messages = [{ role: "user", content: String(body.message) }];
-      } else {
-        return c.json({ error: "either 'message' or 'messages' required" }, 400);
+      const normalized = normalizeChatBody(body);
+      if (!normalized.ok) {
+        return c.json({ error: normalized.error }, 400);
       }
+      const { messages } = normalized;
       const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
       if (!lastUserMsg) {
         return c.json({ error: "no user message found in conversation" }, 400);
@@ -32863,26 +32903,6 @@ ${ctx.join("\n\n")}`
 // src/routes/openai.ts
 import { Hono as Hono2 } from "hono";
 import { stream as stream2 } from "hono/streaming";
-function normalizeMessages(raw) {
-  if (!Array.isArray(raw) || raw.length === 0) return null;
-  const messages = [];
-  for (const entry of raw) {
-    if (!entry || typeof entry !== "object") return null;
-    const { role, content } = entry;
-    if (role !== "user" && role !== "assistant") continue;
-    let text = null;
-    if (typeof content === "string") {
-      text = content;
-    } else if (Array.isArray(content)) {
-      text = content.filter(
-        (part) => !!part && typeof part === "object" && part.type === "text" && typeof part.text === "string"
-      ).map((part) => part.text).join("");
-    }
-    if (text === null) continue;
-    messages.push({ role, content: text });
-  }
-  return messages.length > 0 ? messages : null;
-}
 function errorJson(c, status, message) {
   return c.json(
     { error: { message, type: status === 401 ? "authentication_error" : "invalid_request_error" } },
@@ -33017,17 +33037,11 @@ function privateRoutes(deps) {
   app.use("/api/private/*", limitPrivate2());
   app.post("/api/private/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    let messages;
-    if (body?.messages && Array.isArray(body.messages)) {
-      messages = body.messages;
-      if (messages.length === 0) {
-        return c.json({ error: "messages array cannot be empty" }, 400);
-      }
-    } else if (body?.message) {
-      messages = [{ role: "user", content: String(body.message) }];
-    } else {
-      return c.json({ error: "either 'message' or 'messages' required" }, 400);
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
     }
+    const { messages } = normalized;
     const buckets = await resolveBuckets({
       mode: "private",
       sender: jwtSubject(c),
@@ -33085,17 +33099,11 @@ function publicRoutes(deps) {
   app.use("/api/public/*", limitPublic2());
   app.post("/api/public/chat", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    let messages;
-    if (body?.messages && Array.isArray(body.messages)) {
-      messages = body.messages;
-      if (messages.length === 0) {
-        return c.json({ error: "messages array cannot be empty" }, 400);
-      }
-    } else if (body?.message) {
-      messages = [{ role: "user", content: String(body.message) }];
-    } else {
-      return c.json({ error: "either 'message' or 'messages' required" }, 400);
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
     }
+    const { messages } = normalized;
     const buckets = await resolveBuckets({ mode: "public", bucketsFor: config2.bucketsFor });
     let system;
     try {
@@ -33425,6 +33433,8 @@ export {
   guardOutput,
   jwtSubject,
   loadKnowledge,
+  normalizeChatBody,
+  normalizeMessages,
   openaiRoutes,
   prepareChat,
   privateRoutes,

package/dist/routes/demo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAsHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EAqHlD"}
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../src/routes/demo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAsHnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,8EA+GlD"}

package/dist/routes/openai.d.ts

@@ -22,13 +22,6 @@
  *    Bearer` or `x-api-key`; widget-only session/demo keys are not valid.
  */
 import { Hono } from "hono";
-import { type PipelineMessage } from "../core/pipeline";
 import type { ServerDependencies } from "../types";
-/**
- * Normalize OpenAI-format messages to the pipeline format.
- * Accepts string content and text content-part arrays; drops system/tool
- * messages. Returns null when nothing usable remains.
- */
-export declare function normalizeMessages(raw: unknown): PipelineMessage[] | null;
 export declare function openaiRoutes(deps: ServerDependencies): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
 //# sourceMappingURL=openai.d.ts.map

package/dist/routes/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,KAAK,eAAe,EAAkC,MAAM,kBAAkB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,IAAI,CA8BxE;AASD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAwIpD"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAwIpD"}

package/dist/routes/private.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/routes/private.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,8EAoErD"}
+{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/routes/private.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,8EA4DrD"}

package/dist/routes/public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EA0EpD"}
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/routes/public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AASnD,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,8EAkEpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegoaltoworks/chatter",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Embeddable AI chatbot framework with RAG, authentication, and customizable widgets",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",