@diegoaltoworks/chatter 0.44.0 → 0.45.0

package/dist/server.mjs

@@ -0,0 +1,1497 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/server.ts
+import { createClient as createClient2 } from "@libsql/client";
+import { Hono as Hono5 } from "hono";
+import { serveStatic } from "hono/bun";
+import OpenAI from "openai";
+
+// src/auth/apikeys.ts
+import { randomUUID } from "node:crypto";
+import { jwtVerify, SignJWT } from "jose";
+var ApiKeyManager = class {
+  secretBytes;
+  constructor(secret) {
+    if (!secret) {
+      throw new Error("API key secret is required");
+    }
+    this.secretBytes = new TextEncoder().encode(secret);
+  }
+  /**
+   * Create a new API key
+   *
+   * @param options - API key options
+   * @returns JWT token string
+   */
+  async create(options = {}) {
+    const keyId = randomUUID();
+    const keyName = options.name || "api-key";
+    const expiresIn = options.expiresIn || "365d";
+    const expirationMs = this.parseExpiration(expiresIn);
+    const expiresAt = new Date(Date.now() + expirationMs);
+    const jwt = await new SignJWT({
+      name: keyName,
+      type: "api_key",
+      ...options.claims
+    }).setProtectedHeader({ alg: "HS256" }).setSubject(keyId).setIssuedAt().setExpirationTime(expiresAt).sign(this.secretBytes);
+    return jwt;
+  }
+  /**
+   * Verify an API key
+   *
+   * @param token - JWT token to verify
+   * @returns Verification result with payload if valid
+   */
+  async verify(token) {
+    try {
+      const { payload } = await jwtVerify(token, this.secretBytes);
+      if (payload.type !== "api_key") {
+        return {
+          valid: false,
+          error: "Token is not an API key"
+        };
+      }
+      return {
+        valid: true,
+        payload
+      };
+    } catch (error) {
+      return {
+        valid: false,
+        error: error instanceof Error ? error.message : "Verification failed"
+      };
+    }
+  }
+  /**
+   * Parse expiration string to milliseconds
+   *
+   * @param expiresIn - Time string (e.g., "1y", "30d", "12h")
+   * @returns Milliseconds
+   */
+  parseExpiration(expiresIn) {
+    const match = expiresIn.match(/^(\d+)([smhdMy])$/);
+    if (!match) {
+      throw new Error(
+        `Invalid expiration format: ${expiresIn}. Supported: s (seconds), m (minutes), h (hours), d (days), M (months), y (years)`
+      );
+    }
+    const value = Number.parseInt(match[1], 10);
+    const unit = match[2];
+    switch (unit) {
+      case "s":
+        return value * 1e3;
+      case "m":
+        return value * 60 * 1e3;
+      case "h":
+        return value * 60 * 60 * 1e3;
+      case "d":
+        return value * 24 * 60 * 60 * 1e3;
+      case "M":
+        return value * 30 * 24 * 60 * 60 * 1e3;
+      // Approximate 30 days
+      case "y":
+        return value * 365 * 24 * 60 * 60 * 1e3;
+      // Approximate 365 days
+      default:
+        throw new Error(`Unknown time unit: ${unit}`);
+    }
+  }
+  /**
+   * Get information about a token without verifying signature
+   * Useful for debugging
+   *
+   * @param token - JWT token
+   * @returns Decoded payload (unverified)
+   */
+  decode(token) {
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3) {
+        return null;
+      }
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+      return payload;
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/channels/senders.ts
+function createSenderRegistry() {
+  const senders = /* @__PURE__ */ new Map();
+  return {
+    register(name, sender) {
+      if (senders.has(name)) {
+        console.warn(`Channel sender "${name}" is already registered; overwriting.`);
+      }
+      senders.set(name, sender);
+    },
+    unregister(name) {
+      senders.delete(name);
+    },
+    available(name) {
+      return senders.has(name);
+    },
+    async sendText(name, chatId, text) {
+      const sender = senders.get(name);
+      if (!sender) return false;
+      try {
+        await sender.sendText(chatId, text);
+        return true;
+      } catch (error) {
+        console.warn(`Channel sender "${name}" sendText failed:`, error);
+        return false;
+      }
+    },
+    async sendVoice(name, chatId, payload) {
+      const sender = senders.get(name);
+      if (!sender?.sendVoice) return false;
+      try {
+        await sender.sendVoice(chatId, payload);
+        return true;
+      } catch (error) {
+        console.warn(`Channel sender "${name}" sendVoice failed:`, error);
+        return false;
+      }
+    },
+    async sendMedia(name, chatId, payload) {
+      const sender = senders.get(name);
+      if (!sender?.sendMedia) return false;
+      try {
+        await sender.sendMedia(chatId, payload);
+        return true;
+      } catch (error) {
+        console.warn(`Channel sender "${name}" sendMedia failed:`, error);
+        return false;
+      }
+    }
+  };
+}
+
+// src/core/prompts.ts
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+var PromptLoader = class {
+  constructor(promptsDir, bot) {
+    this.promptsDir = promptsDir;
+    this.bot = bot;
+  }
+  promptsDir;
+  bot;
+  /**
+   * Load a prompt template and interpolate variables
+   */
+  load(filename) {
+    const path = join(this.promptsDir, filename);
+    const template = readFileSync(path, "utf-8");
+    const personFirstName = this.bot.personName.split(" ")[0];
+    return template.replace(/\{\{botName\}\}/g, this.bot.name).replace(/\{\{personName\}\}/g, this.bot.personName).replace(/\{\{personFirstName\}\}/g, personFirstName);
+  }
+  /** Base system rules prompt */
+  get baseSystemRules() {
+    return this.load("base.txt");
+  }
+  /** Public persona prompt */
+  get publicPersona() {
+    return this.load("public.txt");
+  }
+  /** Private persona prompt */
+  get privatePersona() {
+    return this.load("private.txt");
+  }
+};
+
+// src/core/retrieval.ts
+import { createClient } from "@libsql/client";
+
+// src/core/loaders.ts
+import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join2 } from "node:path";
+function walk(dir) {
+  const items = [];
+  try {
+    for (const e of readdirSync(dir)) {
+      const p = join2(dir, e);
+      const st = statSync(p);
+      if (st.isDirectory()) items.push(...walk(p));
+      else if (p.endsWith(".md")) items.push(p);
+    }
+  } catch {
+  }
+  return items;
+}
+function loadKnowledge(root = "config/knowledge") {
+  const docs = [];
+  for (const bucket of ["base", "public", "private"]) {
+    const dir = join2(root, bucket);
+    for (const f of walk(dir)) {
+      docs.push({ id: f, text: readFileSync2(f, "utf8"), source: f, bucket });
+    }
+  }
+  return docs;
+}
+
+// src/core/retrieval.ts
+var EMB_MODEL = "text-embedding-3-large";
+function chunk(text, max = 900) {
+  const out = [];
+  let buf = "";
+  for (const line of text.replace(/\r/g, "").split("\n")) {
+    if (`${buf}
+${line}`.length > max) {
+      out.push(buf.trim());
+      buf = line;
+    } else buf += `
+${line}`;
+  }
+  if (buf.trim()) out.push(buf.trim());
+  return out;
+}
+async function sha256(input) {
+  const data = new TextEncoder().encode(input);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var VectorStore = class _VectorStore {
+  constructor(client, options) {
+    this.client = client;
+    this.db = options.databaseClient ? options.databaseClient : createClient({
+      url: options.databaseUrl,
+      authToken: options.databaseAuthToken
+    });
+    this.knowledgeDir = options.knowledgeDir || "./config/knowledge";
+  }
+  client;
+  /**
+   * The libsql client backing this store. When a client was injected this is
+   * that same instance, so callers holding it (e.g. `ServerDependencies.db`)
+   * and the store share one connection.
+   */
+  db;
+  knowledgeDir;
+  // On boot: ingest new chunks and embed only missing ones.
+  async build() {
+    console.log("\u{1F504} Building knowledge base...");
+    await this.db.execute(`
+      CREATE TABLE IF NOT EXISTS chunks (id TEXT PRIMARY KEY, bucket TEXT NOT NULL, source TEXT NOT NULL, text TEXT NOT NULL);
+    `);
+    await this.db.execute(`
+      CREATE TABLE IF NOT EXISTS embeddings (id TEXT PRIMARY KEY, model TEXT NOT NULL, embedding BLOB NOT NULL);
+    `);
+    await this.db.execute("CREATE INDEX IF NOT EXISTS idx_chunks_bucket ON chunks(bucket);");
+    const docs = loadKnowledge(this.knowledgeDir);
+    console.log(`\u{1F4DA} Loaded ${docs.length} knowledge documents`);
+    const rows = [];
+    for (const d of docs) {
+      for (const part of chunk(d.text)) {
+        const id = await sha256(`${d.bucket}|${d.source}|${part}`);
+        rows.push({ id, bucket: d.bucket, source: d.source, text: part });
+      }
+    }
+    console.log(`\u{1F4E6} Created ${rows.length} chunks from knowledge documents`);
+    await this.cleanupStaleChunks(rows.map((r) => r.id));
+    const tx = await this.db.transaction("write");
+    try {
+      for (const r of rows) {
+        await tx.execute({
+          sql: `INSERT INTO chunks(id,bucket,source,text) VALUES(?,?,?,?)
+                ON CONFLICT(id) DO NOTHING`,
+          args: [r.id, r.bucket, r.source, r.text]
+        });
+      }
+      await tx.commit();
+    } catch (e) {
+      await tx.rollback();
+      throw e;
+    }
+    const ids = rows.map((r) => r.id);
+    const missing = [];
+    for (let i = 0; i < ids.length; i += 500) {
+      const batch = ids.slice(i, i + 500);
+      const placeholders = batch.map(() => "?").join(",");
+      const res = await this.db.execute({
+        sql: `SELECT id FROM chunks WHERE id IN (${placeholders})
+              EXCEPT SELECT id FROM embeddings`,
+        args: batch
+      });
+      for (const row of res.rows) missing.push(String(row.id));
+    }
+    if (missing.length === 0) {
+      console.log("\u2705 No new chunks to embed - knowledge base is up to date");
+      return;
+    }
+    console.log(`\u{1F52E} Embedding ${missing.length} new/updated chunks with ${EMB_MODEL}...`);
+    const textById = new Map(rows.map((r) => [r.id, r.text]));
+    const BATCH = 96;
+    for (let i = 0; i < missing.length; i += BATCH) {
+      const batchIds = missing.slice(i, i + BATCH);
+      const inputs = batchIds.map((id) => textById.get(id) || "");
+      const emb = await this.client.embeddings.create({ model: EMB_MODEL, input: inputs });
+      const tx2 = await this.db.transaction("write");
+      try {
+        emb.data.forEach((d, idx) => {
+          const id = batchIds[idx];
+          tx2.execute({
+            sql: "INSERT INTO embeddings(id,model,embedding) VALUES(?,?,?)",
+            args: [id, EMB_MODEL, JSON.stringify(d.embedding)]
+          });
+        });
+        await tx2.commit();
+      } catch (e) {
+        await tx2.rollback();
+        throw e;
+      }
+    }
+    console.log(`\u2705 Successfully embedded ${missing.length} new chunks`);
+  }
+  // Remove chunks from database that no longer exist in markdown files
+  async cleanupStaleChunks(currentIds) {
+    const result = await this.db.execute("SELECT id FROM chunks");
+    const dbIds = result.rows.map((row) => String(row.id));
+    const currentIdSet = new Set(currentIds);
+    const staleIds = dbIds.filter((id) => !currentIdSet.has(id));
+    if (staleIds.length === 0) {
+      return;
+    }
+    console.log(`\u{1F9F9} Cleaning up ${staleIds.length} stale chunks...`);
+    const BATCH_SIZE = 500;
+    for (let i = 0; i < staleIds.length; i += BATCH_SIZE) {
+      const batch = staleIds.slice(i, i + BATCH_SIZE);
+      const placeholders = batch.map(() => "?").join(",");
+      await this.db.execute({
+        sql: `DELETE FROM chunks WHERE id IN (${placeholders})`,
+        args: batch
+      });
+    }
+    console.log(`\u2713 Cleaned up ${staleIds.length} stale chunks and their embeddings`);
+  }
+  static cosine(a, b) {
+    let dot = 0;
+    let na = 0;
+    let nb = 0;
+    for (let i = 0; i < a.length; i++) {
+      dot += a[i] * b[i];
+      na += a[i] * a[i];
+      nb += b[i] * b[i];
+    }
+    return dot / (Math.sqrt(na) * Math.sqrt(nb));
+  }
+  /**
+   * Retrieve top-k across allowed buckets; compute similarity in app (simple
+   * & portable).
+   *
+   * `allowed` is a bucket-name list rather than the {@link Bucket} union: the
+   * `chunks` table constrains nothing, so a deployment that ingests its own
+   * buckets can query them (`build` only writes and prunes the three the
+   * knowledge loader walks). Names are bound as query parameters, never
+   * interpolated. An empty list retrieves nothing, and short-circuits before
+   * the embedding call.
+   */
+  async query(q, k = 6, allowed = ["base"]) {
+    if (allowed.length === 0) return [];
+    const qv = (await this.client.embeddings.create({ model: EMB_MODEL, input: [q] })).data[0].embedding;
+    const placeholders = allowed.map(() => "?").join(",");
+    const res = await this.db.execute({
+      sql: `SELECT c.id, c.text, e.embedding
+            FROM chunks c
+            JOIN embeddings e ON e.id = c.id
+            WHERE c.bucket IN (${placeholders})`,
+      args: allowed
+    });
+    const scored = [];
+    for (const row of res.rows) {
+      const emb = JSON.parse(String(row.embedding));
+      const s = _VectorStore.cosine(qv, emb);
+      scored.push({ s, text: String(row.text) });
+    }
+    scored.sort((a, b) => b.s - a.s);
+    return scored.slice(0, k).map((r) => r.text);
+  }
+};
+
+// src/core/widgets.ts
+import { existsSync } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveStatic(configStaticDir) {
+  if (configStaticDir && existsSync(configStaticDir)) {
+    return { staticDir: configStaticDir };
+  }
+  try {
+    if (import.meta.url) {
+      const moduleDir = dirname(fileURLToPath(import.meta.url));
+      const staticDir = join3(moduleDir, "static");
+      if (existsSync(staticDir)) return { staticDir };
+    }
+  } catch {
+  }
+  try {
+    if (typeof __dirname !== "undefined") {
+      const staticDir = join3(__dirname, "static");
+      if (existsSync(staticDir)) return { staticDir };
+    }
+  } catch {
+  }
+  return { staticDir: null };
+}
+
+// src/middleware/cors.ts
+var ALLOWED_HEADERS = "content-type, x-api-key, authorization";
+var ALLOWED_METHODS = "POST, GET, OPTIONS";
+var cors = (allowedOrigins) => async (c, next) => {
+  const requestOrigin = c.req.header("origin");
+  const allowAll = !allowedOrigins || allowedOrigins.length === 0 || allowedOrigins.includes("*");
+  const originHeader = resolveOrigin(requestOrigin, allowedOrigins, allowAll);
+  if (c.req.method === "OPTIONS") {
+    return new Response(null, {
+      status: 204,
+      headers: {
+        "access-control-allow-origin": originHeader,
+        "access-control-allow-headers": ALLOWED_HEADERS,
+        "access-control-allow-methods": ALLOWED_METHODS,
+        ...allowAll ? {} : { vary: "Origin" }
+      }
+    });
+  }
+  c.header("access-control-allow-origin", originHeader);
+  c.header("access-control-allow-headers", ALLOWED_HEADERS);
+  c.header("access-control-allow-methods", ALLOWED_METHODS);
+  if (!allowAll) {
+    c.header("vary", "Origin");
+  }
+  await next();
+};
+function resolveOrigin(requestOrigin, allowedOrigins, allowAll) {
+  if (allowAll) return "*";
+  if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
+    return requestOrigin;
+  }
+  return allowedOrigins[0];
+}
+
+// src/routes/demo.ts
+import { Hono } from "hono";
+import { stream } from "hono/streaming";
+
+// src/core/guardrails.ts
+function detectLeakage(text) {
+  const flags = [
+    /system prompt/i,
+    /hidden instruction/i,
+    /here (are|is) (my|the) rules/i,
+    /BEGIN SYSTEM PROMPT/i,
+    /tool instructions/i
+  ];
+  return flags.some((rx) => rx.test(text));
+}
+function scrubOutput(text) {
+  return text.replace(/sk-[A-Za-z0-9]{15,}/g, "[REDACTED]").replace(/AIza[0-9A-Za-z_-]{30,}/g, "[REDACTED]");
+}
+function guardOutput(text) {
+  if (detectLeakage(text)) {
+    return "Sorry, I can't share internal instructions. How else can I help?";
+  }
+  return scrubOutput(text);
+}
+
+// src/core/llm.ts
+var DEFAULT_MODEL = "gpt-4o";
+async function completeOnce({
+  client,
+  system,
+  messages,
+  temperature = 0.2,
+  model = DEFAULT_MODEL
+}) {
+  const res = await client.chat.completions.create({
+    model,
+    temperature,
+    messages: [{ role: "system", content: system }, ...messages]
+  });
+  const text = res.choices[0]?.message?.content ?? "";
+  return {
+    content: guardOutput(text),
+    usage: res.usage || { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 }
+  };
+}
+async function* completeStream({
+  client,
+  system,
+  messages,
+  temperature = 0.2,
+  model = DEFAULT_MODEL
+}) {
+  const stream5 = await client.chat.completions.create({
+    model,
+    temperature,
+    stream: true,
+    messages: [{ role: "system", content: system }, ...messages]
+  });
+  for await (const chunk2 of stream5) {
+    const delta = chunk2.choices[0]?.delta?.content ?? "";
+    if (delta) yield scrubOutput(delta);
+  }
+}
+
+// src/core/answer.ts
+var noUsage = () => ({ prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 });
+async function runAnswerFn(answerFn, { system, messages, mode, sender }) {
+  const result = await answerFn({ system, messages, mode, sender });
+  const raw = typeof result === "string" ? result : result?.content;
+  const usage = typeof result === "string" ? void 0 : result?.usage;
+  return {
+    content: guardOutput(typeof raw === "string" ? raw : ""),
+    usage: usage ?? noUsage()
+  };
+}
+async function answerOnce({
+  answerFn,
+  client,
+  system,
+  messages,
+  mode,
+  sender,
+  temperature,
+  model
+}) {
+  if (answerFn) {
+    return runAnswerFn(answerFn, { system, messages, mode, sender });
+  }
+  return completeOnce({ client, system, messages, temperature, model });
+}
+async function* answerStream({
+  answerFn,
+  client,
+  system,
+  messages,
+  mode,
+  sender,
+  temperature,
+  model
+}) {
+  if (answerFn) {
+    const { content } = await runAnswerFn(answerFn, { system, messages, mode, sender });
+    if (content) yield content;
+    return;
+  }
+  yield* completeStream({ client, system, messages, temperature, model });
+}
+
+// src/core/buckets.ts
+function defaultBuckets(mode) {
+  return ["base", mode];
+}
+function isIdentified(sender) {
+  return typeof sender === "string" && sender.trim().length > 0;
+}
+function normalize(buckets) {
+  const out = [];
+  for (const raw of buckets) {
+    if (typeof raw !== "string") continue;
+    const bucket = raw.trim();
+    if (bucket && !out.includes(bucket)) out.push(bucket);
+  }
+  return out;
+}
+async function resolveBuckets({
+  mode,
+  sender,
+  bucketsFor
+}) {
+  if (!bucketsFor) return void 0;
+  const identified = isIdentified(sender);
+  const requested = await bucketsFor(identified ? { mode, sender } : { mode });
+  if (!Array.isArray(requested)) return void 0;
+  const cleaned = normalize(requested);
+  if (identified) return cleaned;
+  const ceiling = new Set(defaultBuckets(mode));
+  return cleaned.filter((bucket) => ceiling.has(bucket));
+}
+
+// src/core/messages.ts
+function isClientRole(role) {
+  return role === "user" || role === "assistant";
+}
+function normalizeMessages(raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  const messages = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") return null;
+    const { role, content } = entry;
+    if (!isClientRole(role)) continue;
+    let text = null;
+    if (typeof content === "string") {
+      text = content;
+    } else if (Array.isArray(content)) {
+      text = content.filter(
+        (part) => !!part && typeof part === "object" && part.type === "text" && typeof part.text === "string"
+      ).map((part) => part.text).join("");
+    }
+    if (text === null) continue;
+    messages.push({ role, content: text });
+  }
+  return messages.length > 0 ? messages : null;
+}
+function normalizeChatBody(body) {
+  const source = body && typeof body === "object" ? body : {};
+  if (Array.isArray(source.messages)) {
+    if (source.messages.length === 0) {
+      return { ok: false, error: "messages array cannot be empty" };
+    }
+    const messages = normalizeMessages(source.messages);
+    if (!messages) {
+      return {
+        ok: false,
+        error: "messages must contain user/assistant messages with text content"
+      };
+    }
+    return { ok: true, messages };
+  }
+  const { message } = source;
+  if (message && typeof message !== "object") {
+    return { ok: true, messages: [{ role: "user", content: String(message) }] };
+  }
+  return { ok: false, error: "either 'message' or 'messages' required" };
+}
+
+// src/core/session.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+var sessions = /* @__PURE__ */ new Map();
+var sessionSweeper = setInterval(
+  () => {
+    const now = Date.now();
+    for (const [key, data] of Array.from(sessions.entries())) {
+      if (now > data.expiresAt) {
+        sessions.delete(key);
+      }
+    }
+  },
+  5 * 60 * 1e3
+);
+sessionSweeper.unref?.();
+function createSession(options = {}) {
+  const { maxRequests = 20, ttl = 3600, metadata } = options;
+  const key = `session_${randomUUID2()}`;
+  const now = Date.now();
+  const session = {
+    key,
+    created: now,
+    requests: 0,
+    maxRequests,
+    expiresAt: now + ttl * 1e3,
+    ...metadata && { metadata }
+  };
+  sessions.set(key, session);
+  return session;
+}
+function validateSession(key) {
+  const session = sessions.get(key);
+  if (!session) return false;
+  const now = Date.now();
+  if (now > session.expiresAt) {
+    sessions.delete(key);
+    return false;
+  }
+  if (session.requests >= session.maxRequests) {
+    return false;
+  }
+  session.requests++;
+  return true;
+}
+function getSessionInfo(key) {
+  return sessions.get(key) || null;
+}
+function getActiveSessions() {
+  return sessions.size;
+}
+
+// src/routes/demo.ts
+function checkDemoOrigin(allowedOrigins) {
+  const allowAll = allowedOrigins.length === 0 || allowedOrigins.includes("*");
+  return async (c, next) => {
+    const origin = c.req.header("origin");
+    const referer = c.req.header("referer");
+    const host = c.req.header("host") || "";
+    if (host.startsWith("localhost:") || host.startsWith("127.0.0.1:")) {
+      return next();
+    }
+    if (allowAll) {
+      return next();
+    }
+    if (origin) {
+      const allowed = allowedOrigins.some((allowed2) => origin.startsWith(allowed2));
+      if (allowed) return next();
+    }
+    if (referer) {
+      const allowed = allowedOrigins.some((allowed2) => referer.startsWith(allowed2));
+      if (allowed) return next();
+    }
+    return c.json(
+      {
+        error: "Demo access restricted to authorized domains"
+      },
+      403
+    );
+  };
+}
+function limitSessionCreation() {
+  const buckets = /* @__PURE__ */ new Map();
+  const WINDOW_MS = 36e5;
+  const LIMIT = 10;
+  return async (c, next) => {
+    const ip = c.req.header("x-forwarded-for")?.split(",")[0].trim() || "unknown-ip";
+    const key = `session:${ip}`;
+    const now = Date.now();
+    const b = buckets.get(key) ?? { count: 0, windowStart: now };
+    if (now - b.windowStart >= WINDOW_MS) {
+      b.count = 0;
+      b.windowStart = now;
+    }
+    b.count += 1;
+    buckets.set(key, b);
+    if (b.count > LIMIT) {
+      return c.json(
+        {
+          error: "Session key limit exceeded (10 per hour). Please wait or use your own API key."
+        },
+        429
+      );
+    }
+    await next();
+  };
+}
+function limitDemo() {
+  const buckets = /* @__PURE__ */ new Map();
+  const WINDOW_MS = 6e4;
+  const LIMIT = 10;
+  return async (c, next) => {
+    const ip = c.req.header("x-forwarded-for")?.split(",")[0].trim() || "unknown-ip";
+    const key = `demo:${ip}`;
+    const now = Date.now();
+    const b = buckets.get(key) ?? { count: 0, windowStart: now };
+    if (now - b.windowStart >= WINDOW_MS) {
+      b.count = 0;
+      b.windowStart = now;
+    }
+    b.count += 1;
+    buckets.set(key, b);
+    if (b.count > LIMIT) {
+      return c.json(
+        {
+          error: "Demo rate limit exceeded (10 requests/minute). Please wait or use your own API key."
+        },
+        429
+      );
+    }
+    await next();
+  };
+}
+function demoRoutes(deps) {
+  const { client, store, config, prompts } = deps;
+  const app = new Hono();
+  const demoOrigins = config.server?.allowedOrigins ?? [];
+  app.get("/api/demo/session", checkDemoOrigin(demoOrigins), limitSessionCreation(), (c) => {
+    const session = createSession({
+      maxRequests: 20,
+      ttl: 3600
+      // 1 hour
+    });
+    console.log(
+      `[Demo] Created session: ${session.key.slice(0, 20)}... (${session.maxRequests} requests, ${3600}s TTL)`
+    );
+    return c.json({
+      key: session.key,
+      expiresIn: 3600,
+      maxRequests: session.maxRequests,
+      message: "Use this temporary key in the x-api-key header"
+    });
+  });
+  app.get("/api/demo/stats", (c) => {
+    return c.json({
+      activeSessions: getActiveSessions()
+    });
+  });
+  app.post("/api/demo/chat", limitDemo(), async (c) => {
+    try {
+      const body = await c.req.json().catch(() => ({}));
+      const normalized = normalizeChatBody(body);
+      if (!normalized.ok) {
+        return c.json({ error: normalized.error }, 400);
+      }
+      const { messages } = normalized;
+      const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
+      if (!lastUserMsg) {
+        return c.json({ error: "no user message found in conversation" }, 400);
+      }
+      const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor }) ?? defaultBuckets("public");
+      const ctx = await store.query(lastUserMsg.content, 6, buckets);
+      const system = [
+        prompts.baseSystemRules,
+        prompts.publicPersona,
+        `Context:
+${ctx.join("\n\n")}`
+      ].join("\n\n");
+      const url = new URL(c.req.url);
+      const wantsStream3 = url.searchParams.get("stream") === "1";
+      if (wantsStream3) {
+        return stream(c, async (s) => {
+          for await (const delta of answerStream({
+            answerFn: config.answerFn,
+            client,
+            system,
+            messages,
+            mode: "public"
+          })) {
+            await s.write(`data: ${JSON.stringify({ delta })}
+
+`);
+          }
+          await s.write("event: end\ndata: {}\n\n");
+        });
+      }
+      const out = await answerOnce({
+        answerFn: config.answerFn,
+        client,
+        system,
+        messages,
+        mode: "public"
+      });
+      return c.json({ reply: out.content });
+    } catch (error) {
+      const err = error;
+      console.error("Demo chat error:", err);
+      return c.json({ error: err.message || "Internal error" }, 500);
+    }
+  });
+  return app;
+}
+
+// src/routes/openai.ts
+import { Hono as Hono2 } from "hono";
+import { stream as stream2 } from "hono/streaming";
+
+// src/core/pipeline.ts
+var MODE_SETTINGS = {
+  public: { topK: 6, label: "Context" },
+  private: { topK: 8, label: "Internal Context" }
+};
+async function prepareChat({
+  store,
+  prompts,
+  mode,
+  messages,
+  personaLayer,
+  channelHint,
+  buckets
+}) {
+  const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
+  if (!lastUserMsg) {
+    throw new Error("no user message found in conversation");
+  }
+  const { topK, label } = MODE_SETTINGS[mode];
+  const ctx = await store.query(lastUserMsg.content, topK, buckets ?? defaultBuckets(mode));
+  const persona = personaLayer?.trim() || (mode === "private" ? prompts.privatePersona : prompts.publicPersona);
+  const hint = channelHint?.trim();
+  const system = [
+    prompts.baseSystemRules,
+    persona,
+    ...hint ? [hint] : [],
+    `${label}:
+${ctx.join("\n\n")}`
+  ].join("\n\n");
+  return { system, messages };
+}
+
+// src/middleware/jwt.ts
+import { createRemoteJWKSet, importSPKI, jwtVerify as jwtVerify2 } from "jose";
+function jwtSubject(c) {
+  const sub = c.jwtSub;
+  return sub && sub.trim().length > 0 ? sub : void 0;
+}
+function createJWTMiddleware(config) {
+  let jwks = null;
+  let spkiKey = null;
+  const jwtConfig = config.auth?.jwt;
+  async function verify(token) {
+    const opts = {};
+    if (jwtConfig?.issuer) opts.issuer = jwtConfig.issuer;
+    if (jwtConfig?.audience) opts.audience = jwtConfig.audience;
+    if (jwtConfig?.jwksUrl) {
+      jwks = jwks ?? createRemoteJWKSet(new URL(jwtConfig.jwksUrl));
+      const { payload } = await jwtVerify2(token, jwks, opts);
+      return payload;
+    }
+    if (jwtConfig?.publicKeyPem) {
+      spkiKey = spkiKey ?? await importSPKI(jwtConfig.publicKeyPem, "RS256");
+      const { payload } = await jwtVerify2(token, spkiKey, opts);
+      return payload;
+    }
+    throw new Error("JWT configuration missing (JWKS URL or PUBLIC KEY PEM).");
+  }
+  return async function requirePrivateJWT2(c, next) {
+    const hdr = c.req.header("authorization") ?? "";
+    if (!hdr.startsWith("Bearer ")) return c.json({ error: "Unauthorized" }, 401);
+    const token = hdr.slice("Bearer ".length);
+    try {
+      const payload = await verify(token);
+      c.jwtSub = String(payload.sub ?? "");
+      await next();
+    } catch {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+  };
+}
+var requirePrivateJWT = createJWTMiddleware({});
+
+// src/middleware/ratelimit.ts
+var DEMO_KEYS = ["chatter-api-key-here"];
+function getKeyFromIP(c) {
+  const h = c.req.header("x-forwarded-for");
+  if (h) return h.split(",")[0].trim();
+  return "unknown-ip";
+}
+function createRateLimiter(config) {
+  const buckets = /* @__PURE__ */ new Map();
+  const WINDOW_MS = 6e4;
+  const publicLimit = config.rateLimit?.public || 60;
+  const privateLimit = config.rateLimit?.private || 120;
+  function allow(key, limit) {
+    const now = Date.now();
+    const b = buckets.get(key) ?? { count: 0, windowStart: now };
+    if (now - b.windowStart >= WINDOW_MS) {
+      b.count = 0;
+      b.windowStart = now;
+    }
+    b.count += 1;
+    buckets.set(key, b);
+    return b.count <= limit;
+  }
+  return {
+    // Public: key is IP only
+    // Demo keys get 10x stricter rate limits
+    limitPublic() {
+      return async (c, next) => {
+        const apiKey = c.req.header("x-api-key");
+        const isDemoKey = apiKey ? DEMO_KEYS.includes(apiKey) : false;
+        const key = `pub:${getKeyFromIP(c)}`;
+        const limit = isDemoKey ? Math.floor(publicLimit / 10) : publicLimit;
+        if (!allow(key, limit)) {
+          return c.json(
+            {
+              error: isDemoKey ? "Demo rate limit exceeded. Please use your own API key for higher limits." : "Rate limit exceeded"
+            },
+            429
+          );
+        }
+        await next();
+      };
+    },
+    // Private: key is JWT subject only
+    limitPrivate() {
+      return async (c, next) => {
+        const sub = c.jwtSub;
+        const key = `private:${sub ?? "no-sub"}`;
+        if (!allow(key, privateLimit)) return c.json({ error: "Rate limit" }, 429);
+        await next();
+      };
+    }
+  };
+}
+var defaultLimiter = createRateLimiter({});
+var limitPublic = defaultLimiter.limitPublic;
+var limitPrivate = defaultLimiter.limitPrivate;
+
+// src/routes/openai.ts
+function errorJson(c, status, message) {
+  return c.json(
+    { error: { message, type: status === 401 ? "authentication_error" : "invalid_request_error" } },
+    status
+  );
+}
+function openaiRoutes(deps) {
+  const { client, store, config, prompts, apiKeyManager } = deps;
+  const app = new Hono2();
+  const { limitPublic: limitPublic2, limitPrivate: limitPrivate2 } = createRateLimiter(config);
+  const requirePrivateJWT2 = createJWTMiddleware(config);
+  const enablePublic = config.features?.enablePublicChat !== false;
+  const enablePrivate = config.features?.enablePrivateChat !== false;
+  const serverModel = config.openai.model || DEFAULT_MODEL;
+  async function requireApiKey(c, next) {
+    if (!apiKeyManager) {
+      return errorJson(c, 401, "API key authentication is not configured on this server");
+    }
+    const bearer = c.req.header("authorization") ?? "";
+    const key = bearer.startsWith("Bearer ") ? bearer.slice("Bearer ".length) : c.req.header("x-api-key");
+    if (!key) {
+      return errorJson(c, 401, "Missing API key (Authorization: Bearer or x-api-key header)");
+    }
+    try {
+      const result = await apiKeyManager.verify(key);
+      if (result.valid) return await next();
+    } catch {
+    }
+    return errorJson(c, 401, "Invalid API key");
+  }
+  const handleChatCompletions = (mode) => async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return errorJson(c, 400, "Request body must be a JSON object");
+    }
+    const messages = normalizeMessages(body.messages);
+    if (!messages) {
+      return errorJson(c, 400, "'messages' must be a non-empty array of user/assistant messages");
+    }
+    const { stream: wantsStream3, temperature: rawTemperature } = body;
+    const temperature = typeof rawTemperature === "number" && Number.isFinite(rawTemperature) ? Math.min(Math.max(rawTemperature, 0), 2) : void 0;
+    const buckets = await resolveBuckets({
+      mode,
+      sender: jwtSubject(c),
+      bucketsFor: config.bucketsFor
+    });
+    let system;
+    try {
+      ({ system } = await prepareChat({ store, prompts, mode, messages, buckets }));
+    } catch {
+      return errorJson(c, 400, "Conversation must contain at least one user message");
+    }
+    const id = `chatcmpl-${crypto.randomUUID()}`;
+    const created = Math.floor(Date.now() / 1e3);
+    if (wantsStream3 === true) {
+      c.header("Content-Type", "text/event-stream");
+      c.header("Cache-Control", "no-cache");
+      return stream2(c, async (s) => {
+        const chunk2 = (delta, finishReason) => `data: ${JSON.stringify({
+          id,
+          object: "chat.completion.chunk",
+          created,
+          model: serverModel,
+          choices: [{ index: 0, delta, finish_reason: finishReason }]
+        })}
+
+`;
+        await s.write(chunk2({ role: "assistant", content: "" }, null));
+        for await (const delta of answerStream({
+          answerFn: config.answerFn,
+          client,
+          system,
+          messages,
+          mode,
+          temperature,
+          model: serverModel
+        })) {
+          await s.write(chunk2({ content: delta }, null));
+        }
+        await s.write(chunk2({}, "stop"));
+        await s.write("data: [DONE]\n\n");
+      });
+    }
+    const out = await answerOnce({
+      answerFn: config.answerFn,
+      client,
+      system,
+      messages,
+      mode,
+      temperature,
+      model: serverModel
+    });
+    return c.json({
+      id,
+      object: "chat.completion",
+      created,
+      model: serverModel,
+      choices: [
+        { index: 0, message: { role: "assistant", content: out.content }, finish_reason: "stop" }
+      ],
+      usage: out.usage
+    });
+  };
+  if (enablePublic) {
+    app.use("/v1/*", requireApiKey);
+    app.use("/v1/*", limitPublic2());
+    app.post("/v1/chat/completions", handleChatCompletions("public"));
+  }
+  if (enablePrivate) {
+    app.use("/api/private/v1/*", requirePrivateJWT2);
+    app.use("/api/private/v1/*", limitPrivate2());
+    app.post("/api/private/v1/chat/completions", handleChatCompletions("private"));
+  }
+  return app;
+}
+
+// src/routes/private.ts
+import { Hono as Hono3 } from "hono";
+import { stream as stream3 } from "hono/streaming";
+function wantsStream(c) {
+  const url = new URL(c.req.url);
+  if (url.searchParams.get("stream") === "1") return true;
+  const acc = c.req.header("accept") ?? "";
+  return acc.includes("text/event-stream");
+}
+function privateRoutes(deps) {
+  const { client, store, config, prompts } = deps;
+  const app = new Hono3();
+  const requirePrivateJWT2 = createJWTMiddleware(config);
+  const { limitPrivate: limitPrivate2 } = createRateLimiter(config);
+  app.use("/api/private/*", requirePrivateJWT2);
+  app.use("/api/private/*", limitPrivate2());
+  app.post("/api/private/chat", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
+    }
+    const { messages } = normalized;
+    const buckets = await resolveBuckets({
+      mode: "private",
+      sender: jwtSubject(c),
+      bucketsFor: config.bucketsFor
+    });
+    let system;
+    try {
+      ({ system } = await prepareChat({ store, prompts, mode: "private", messages, buckets }));
+    } catch {
+      return c.json({ error: "no user message found in conversation" }, 400);
+    }
+    const model = config.openai.model;
+    const answerFn = config.answerFn;
+    if (wantsStream(c)) {
+      return stream3(c, async (s) => {
+        for await (const delta of answerStream({
+          answerFn,
+          client,
+          system,
+          messages,
+          mode: "private",
+          model
+        })) {
+          await s.write(`data: ${JSON.stringify({ delta })}
+
+`);
+        }
+        await s.write("event: end\ndata: {}\n\n");
+      });
+    }
+    const out = await answerOnce({ answerFn, client, system, messages, mode: "private", model });
+    return c.json({ reply: out.content });
+  });
+  return app;
+}
+
+// src/routes/public.ts
+import { Hono as Hono4 } from "hono";
+import { stream as stream4 } from "hono/streaming";
+
+// src/middleware/auth.ts
+function createAuthMiddleware(deps) {
+  const { apiKeyManager } = deps;
+  return async function requirePublicKey(c, next) {
+    const hdr = c.req.header("x-api-key");
+    if (hdr?.startsWith("session_")) {
+      console.log(`[Auth] Session key allowed: ${hdr.slice(0, 20)}...`);
+      await next();
+      return;
+    }
+    if (!apiKeyManager) {
+      console.log("[Auth] No API key manager configured");
+      return c.json({ error: "Unauthorized - API key authentication not configured" }, 401);
+    }
+    if (!hdr) {
+      console.log("[Auth] No API key provided");
+      return c.json({ error: "Unauthorized - Missing x-api-key header" }, 401);
+    }
+    try {
+      const result = await apiKeyManager.verify(hdr);
+      if (result.valid) {
+        const payload = result.payload;
+        console.log(`[Auth] JWT API key authorized: ${payload.name || payload.sub || "unknown"}`);
+        await next();
+        return;
+      }
+      console.log(`[Auth] JWT verification failed: ${result.error}`);
+    } catch (error) {
+      console.log(`[Auth] JWT verification error: ${error}`);
+    }
+    console.log(`[Auth] Invalid API key: ${hdr?.slice(0, 20) || "none"}`);
+    return c.json({ error: "Unauthorized" }, 401);
+  };
+}
+
+// src/middleware/referrer.ts
+var DEMO_KEYS2 = ["chatter-api-key-here"];
+function requireReferrer(allowedOrigins) {
+  return async (c, next) => {
+    const apiKey = c.req.header("x-api-key");
+    const isDemoKey = apiKey && DEMO_KEYS2.includes(apiKey);
+    const isSessionKey = apiKey?.startsWith("session_");
+    if (isDemoKey || isSessionKey) {
+      const referer = c.req.header("referer");
+      const origin = c.req.header("origin");
+      console.log(
+        `[Referrer] Checking ${isSessionKey ? "session" : "demo"} key: ${apiKey?.slice(0, 20)}...`
+      );
+      console.log(`[Referrer] Origin: ${origin || "none"}, Referer: ${referer || "none"}`);
+      const isAllowed = allowedOrigins.some((allowed) => {
+        if (origin === allowed) return true;
+        if (referer) {
+          if (referer === allowed) return true;
+          if (referer.startsWith(`${allowed}/`)) return true;
+          if (referer.startsWith(`${allowed}?`)) return true;
+        }
+        return false;
+      });
+      if (!isAllowed) {
+        console.log(`[Referrer] BLOCKED - not from allowed origins: ${allowedOrigins.join(", ")}`);
+        return c.json(
+          {
+            error: "Demo API keys only work on official demo pages. Please visit our website or use your own API key."
+          },
+          403
+        );
+      }
+      console.log("[Referrer] Allowed - origin matches");
+    }
+    await next();
+  };
+}
+
+// src/middleware/session.ts
+function validateSessionKey() {
+  return async (c, next) => {
+    const apiKey = c.req.header("x-api-key");
+    if (apiKey?.startsWith("session_")) {
+      console.log(`[Session] Validating key: ${apiKey.slice(0, 20)}...`);
+      const info = getSessionInfo(apiKey);
+      if (info) {
+        console.log(
+          `[Session] Key found - requests: ${info.requests}/${info.maxRequests}, expires: ${new Date(info.expiresAt).toISOString()}`
+        );
+      } else {
+        console.log("[Session] Key not found in session store");
+      }
+      const isValid = validateSession(apiKey);
+      if (!isValid) {
+        console.log("[Session] REJECTED - expired or quota exceeded");
+        return c.json(
+          {
+            error: "Session expired or quota exceeded. Please refresh the page to get a new session."
+          },
+          401
+        );
+      }
+      console.log("[Session] Valid - request count incremented");
+    }
+    await next();
+  };
+}
+
+// src/routes/public.ts
+function wantsStream2(c) {
+  const url = new URL(c.req.url);
+  if (url.searchParams.get("stream") === "1") return true;
+  const acc = c.req.header("accept") ?? "";
+  return acc.includes("text/event-stream");
+}
+function publicRoutes(deps) {
+  const { client, store, config, prompts } = deps;
+  const app = new Hono4();
+  const requirePublicKey = createAuthMiddleware(deps);
+  const { limitPublic: limitPublic2 } = createRateLimiter(config);
+  const referrerOrigins = config.server?.allowedOrigins?.length ? config.server.allowedOrigins.filter((o) => o !== "*") : [config.bot.publicUrl, "http://localhost:8181", "http://127.0.0.1:8181"];
+  app.use("/api/public/*", validateSessionKey());
+  app.use("/api/public/*", requirePublicKey);
+  app.use("/api/public/*", requireReferrer(referrerOrigins));
+  app.use("/api/public/*", limitPublic2());
+  app.post("/api/public/chat", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const normalized = normalizeChatBody(body);
+    if (!normalized.ok) {
+      return c.json({ error: normalized.error }, 400);
+    }
+    const { messages } = normalized;
+    const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor });
+    let system;
+    try {
+      ({ system } = await prepareChat({ store, prompts, mode: "public", messages, buckets }));
+    } catch {
+      return c.json({ error: "no user message found in conversation" }, 400);
+    }
+    const model = config.openai.model;
+    const answerFn = config.answerFn;
+    if (wantsStream2(c)) {
+      return stream4(c, async (s) => {
+        for await (const delta of answerStream({
+          answerFn,
+          client,
+          system,
+          messages,
+          mode: "public",
+          model
+        })) {
+          await s.write(`data: ${JSON.stringify({ delta })}
+
+`);
+        }
+        await s.write("event: end\ndata: {}\n\n");
+      });
+    }
+    const out = await answerOnce({ answerFn, client, system, messages, mode: "public", model });
+    return c.json({ reply: out.content });
+  });
+  return app;
+}
+
+// src/server.ts
+async function createServer(config) {
+  console.log(`\u{1F680} Starting ${config.bot.name}...`);
+  const knowledgeDir = config.knowledgeDir || "./config/knowledge";
+  const promptsDir = config.promptsDir || "./config/prompts";
+  const publicDir = config.publicDir || "./public";
+  const enablePublic = config.features?.enablePublicChat !== false;
+  const enablePrivate = config.features?.enablePrivateChat !== false;
+  const enableDemo = config.features?.enableDemoRoutes || false;
+  const enableOpenAICompat = config.features?.enableOpenAICompat !== false;
+  const headless = config.features?.headless === true;
+  const { staticDir } = resolveStatic(config.staticDir);
+  const client = new OpenAI({
+    apiKey: config.openai.apiKey
+  });
+  const db = createClient2({
+    url: config.database.url,
+    authToken: config.database.authToken
+  });
+  const store = new VectorStore(client, {
+    databaseClient: db,
+    knowledgeDir
+  });
+  await store.build();
+  console.log("\u2705 Knowledge base ready");
+  const prompts = new PromptLoader(promptsDir, config.bot);
+  let apiKeyManager;
+  const secret = process.env.CHATTER_SECRET || config.auth?.secret;
+  if (secret) {
+    apiKeyManager = new ApiKeyManager(secret);
+    console.log("\u2705 API key manager initialized");
+  } else if (config.auth?.apiKeyManager) {
+    apiKeyManager = config.auth.apiKeyManager;
+    console.log("\u2705 Custom API key manager configured");
+  }
+  const app = new Hono5();
+  if (config.server?.cors !== false) {
+    app.use("*", cors(config.server?.allowedOrigins));
+  }
+  app.get("/healthz", (c) => c.text("ok"));
+  app.get(
+    "/config",
+    (c) => c.json({
+      botName: config.bot.name,
+      publicUrl: config.bot.publicUrl,
+      clerkPublishableKey: config.auth?.clerk?.publishableKey || null,
+      clerkFrontendUrl: config.auth?.clerk?.frontendUrl || null,
+      branding: config.branding || {},
+      chat: config.chat || {}
+    })
+  );
+  if (!headless && staticDir) {
+    const relativePath = __require("node:path").relative(process.cwd(), staticDir);
+    app.get("/chatter.js", serveStatic({ path: `${relativePath}/chatter.js` }));
+    app.get("/chatter.css", serveStatic({ path: `${relativePath}/chatter.css` }));
+  }
+  if (!headless && publicDir) {
+    app.get("/", serveStatic({ path: `${publicDir}/index.html` }));
+    app.get("/chat", serveStatic({ path: `${publicDir}/chat.html` }));
+    app.get("/private", serveStatic({ path: `${publicDir}/private.html` }));
+    app.get("/vanilla/chat", serveStatic({ path: `${publicDir}/vanilla/chat.html` }));
+    app.get(
+      "/demo/widget-button-public",
+      serveStatic({ path: `${publicDir}/demo/widget-button-public.html` })
+    );
+    app.get(
+      "/demo/widget-button-private",
+      serveStatic({ path: `${publicDir}/demo/widget-button-private.html` })
+    );
+    app.get(
+      "/demo/widget-inline-public",
+      serveStatic({ path: `${publicDir}/demo/widget-inline-public.html` })
+    );
+    app.get(
+      "/demo/widget-inline-private",
+      serveStatic({ path: `${publicDir}/demo/widget-inline-private.html` })
+    );
+    app.get(
+      "/demo/react-button-public",
+      serveStatic({ path: `${publicDir}/demo/react-button-public.html` })
+    );
+    app.get(
+      "/demo/react-button-private",
+      serveStatic({ path: `${publicDir}/demo/react-button-private.html` })
+    );
+    app.get(
+      "/demo/react-inline-public",
+      serveStatic({ path: `${publicDir}/demo/react-inline-public.html` })
+    );
+    app.get(
+      "/demo/react-inline-private",
+      serveStatic({ path: `${publicDir}/demo/react-inline-private.html` })
+    );
+    app.get("/demo/public", serveStatic({ path: `${publicDir}/demo-public.html` }));
+    app.get("/demo/private", serveStatic({ path: `${publicDir}/demo-private.html` }));
+    app.get("/demo/chatbot", serveStatic({ path: `${publicDir}/demo-chatbot.html` }));
+    app.get("/demo/react", serveStatic({ path: `${publicDir}/react-demo.html` }));
+  }
+  const senders = createSenderRegistry();
+  const deps = { client, store, db, config, prompts, apiKeyManager, senders };
+  if (enablePublic) {
+    app.route("/", publicRoutes(deps));
+  }
+  if (enablePrivate) {
+    app.route("/", privateRoutes(deps));
+  }
+  if (enableDemo) {
+    app.route("/", demoRoutes(deps));
+  }
+  if (enableOpenAICompat) {
+    app.route("/", openaiRoutes(deps));
+  }
+  if (config.customRoutes) {
+    await config.customRoutes(app, deps);
+  }
+  const started = [];
+  if (config.channels && config.channels.length > 0) {
+    for (const channel of config.channels) {
+      try {
+        await channel.start(deps);
+        started.push(channel);
+        console.log(`\u2705 Channel "${channel.name}" started`);
+      } catch (error) {
+        console.error(`\u274C Channel "${channel.name}" failed to start:`, error);
+      }
+    }
+  }
+  console.log(`\u2705 ${config.bot.name} server ready`);
+  return Object.assign(app, {
+    // Scoped to this call's started channels, not global — two servers in
+    // one process each stop only their own. A channel's `stop()` throwing
+    // (sync or async) is caught per-channel so one misbehaving channel can't
+    // stop the rest from cleaning up.
+    stopChannels: async () => {
+      await Promise.allSettled(
+        started.map(async (channel) => {
+          try {
+            await channel.stop?.();
+          } catch (error) {
+            console.error(`Channel "${channel.name}" failed to stop:`, error);
+          }
+        })
+      );
+    }
+  });
+}
+export {
+  createServer
+};