@diegoaltoworks/chatter 0.47.0 → 0.48.0

package/dist/mcp-server.mjs

@@ -1,7 +1,5 @@
 // src/mcp-server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import OpenAI from "openai";
-import { z } from "zod";
 
 // src/core/guardrails.ts
 function detectLeakage(text) {
@@ -47,8 +45,8 @@ async function completeOnce({
 
 // src/core/answer.ts
 var noUsage = () => ({ prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 });
-async function runAnswerFn(answerFn, { system, messages, mode, sender }) {
-  const result = await answerFn({ system, messages, mode, sender });
+async function runAnswerFn(answerFn, { system, messages, mode, sender, conversationId }) {
+  const result = await answerFn({ system, messages, mode, sender, conversationId });
   const raw = typeof result === "string" ? result : result?.content;
   const usage = typeof result === "string" ? void 0 : result?.usage;
   return {
@@ -63,11 +61,12 @@ async function answerOnce({
   messages,
   mode,
   sender,
+  conversationId,
   temperature,
   model
 }) {
   if (answerFn) {
-    return runAnswerFn(answerFn, { system, messages, mode, sender });
+    return runAnswerFn(answerFn, { system, messages, mode, sender, conversationId });
   }
   return completeOnce({ client, system, messages, temperature, model });
 }
@@ -103,6 +102,62 @@ async function resolveBuckets({
   return cleaned.filter((bucket) => ceiling.has(bucket));
 }
 
+// src/core/logger.ts
+var LEVEL_ORDER = { debug: 0, info: 1, warn: 2, error: 3 };
+function createConsoleLogger(level = "info") {
+  const threshold = LEVEL_ORDER[level];
+  const write = (at) => (...args) => {
+    if (LEVEL_ORDER[at] < threshold) return;
+    console.error(`[${at}]`, ...args);
+  };
+  return {
+    debug: write("debug"),
+    info: write("info"),
+    warn: write("warn"),
+    error: write("error")
+  };
+}
+function resolveLogger(logger, level) {
+  return logger ?? createConsoleLogger(level);
+}
+
+// src/core/messages.ts
+function lastUserMessage(messages) {
+  return [...messages].reverse().find((m) => m.role === "user");
+}
+
+// src/core/pipeline.ts
+var MODE_SETTINGS = {
+  public: { topK: 6, label: "Context" },
+  private: { topK: 8, label: "Internal Context" }
+};
+async function prepareChat({
+  store,
+  prompts,
+  mode,
+  messages,
+  personaLayer,
+  channelHint,
+  buckets
+}) {
+  const lastUserMsg = lastUserMessage(messages);
+  if (!lastUserMsg) {
+    throw new Error("no user message found in conversation");
+  }
+  const { topK, label } = MODE_SETTINGS[mode];
+  const ctx = await store.query(lastUserMsg.content, topK, buckets ?? defaultBuckets(mode));
+  const persona = personaLayer?.trim() || (mode === "private" ? prompts.privatePersona : prompts.publicPersona);
+  const hint = channelHint?.trim();
+  const system = [
+    prompts.baseSystemRules,
+    persona,
+    ...hint ? [hint] : [],
+    `${label}:
+${ctx.join("\n\n")}`
+  ].join("\n\n");
+  return { system, messages, context: ctx };
+}
+
 // src/core/prompts.ts
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -195,6 +250,7 @@ var VectorStore = class _VectorStore {
       authToken: options.databaseAuthToken
     });
     this.knowledgeDir = options.knowledgeDir || "./config/knowledge";
+    this.logger = options.logger ?? createConsoleLogger();
   }
   client;
   /**
@@ -204,9 +260,10 @@ var VectorStore = class _VectorStore {
    */
   db;
   knowledgeDir;
+  logger;
   // On boot: ingest new chunks and embed only missing ones.
   async build() {
-    console.log("\u{1F504} Building knowledge base...");
+    this.logger.info("\u{1F504} Building knowledge base...");
     await this.db.execute(`
       CREATE TABLE IF NOT EXISTS chunks (id TEXT PRIMARY KEY, bucket TEXT NOT NULL, source TEXT NOT NULL, text TEXT NOT NULL);
     `);
@@ -215,7 +272,7 @@ var VectorStore = class _VectorStore {
     `);
     await this.db.execute("CREATE INDEX IF NOT EXISTS idx_chunks_bucket ON chunks(bucket);");
     const docs = loadKnowledge(this.knowledgeDir);
-    console.log(`\u{1F4DA} Loaded ${docs.length} knowledge documents`);
+    this.logger.info(`\u{1F4DA} Loaded ${docs.length} knowledge documents`);
     const rows = [];
     for (const d of docs) {
       for (const part of chunk(d.text)) {
@@ -223,21 +280,19 @@ var VectorStore = class _VectorStore {
         rows.push({ id, bucket: d.bucket, source: d.source, text: part });
       }
     }
-    console.log(`\u{1F4E6} Created ${rows.length} chunks from knowledge documents`);
+    this.logger.info(`\u{1F4E6} Created ${rows.length} chunks from knowledge documents`);
     await this.cleanupStaleChunks(rows.map((r) => r.id));
-    const tx = await this.db.transaction("write");
-    try {
-      for (const r of rows) {
-        await tx.execute({
+    const UPSERT_BATCH = 500;
+    for (let i = 0; i < rows.length; i += UPSERT_BATCH) {
+      const batch = rows.slice(i, i + UPSERT_BATCH);
+      await this.db.batch(
+        batch.map((r) => ({
           sql: `INSERT INTO chunks(id,bucket,source,text) VALUES(?,?,?,?)
                 ON CONFLICT(id) DO NOTHING`,
           args: [r.id, r.bucket, r.source, r.text]
-        });
-      }
-      await tx.commit();
-    } catch (e) {
-      await tx.rollback();
-      throw e;
+        })),
+        "write"
+      );
     }
     const ids = rows.map((r) => r.id);
     const missing = [];
@@ -252,32 +307,25 @@ var VectorStore = class _VectorStore {
       for (const row of res.rows) missing.push(String(row.id));
     }
     if (missing.length === 0) {
-      console.log("\u2705 No new chunks to embed - knowledge base is up to date");
+      this.logger.info("\u2705 No new chunks to embed - knowledge base is up to date");
       return;
     }
-    console.log(`\u{1F52E} Embedding ${missing.length} new/updated chunks with ${EMB_MODEL}...`);
+    this.logger.info(`\u{1F52E} Embedding ${missing.length} new/updated chunks with ${EMB_MODEL}...`);
     const textById = new Map(rows.map((r) => [r.id, r.text]));
     const BATCH = 96;
     for (let i = 0; i < missing.length; i += BATCH) {
       const batchIds = missing.slice(i, i + BATCH);
       const inputs = batchIds.map((id) => textById.get(id) || "");
       const emb = await this.client.embeddings.create({ model: EMB_MODEL, input: inputs });
-      const tx2 = await this.db.transaction("write");
-      try {
-        emb.data.forEach((d, idx) => {
-          const id = batchIds[idx];
-          tx2.execute({
-            sql: "INSERT INTO embeddings(id,model,embedding) VALUES(?,?,?)",
-            args: [id, EMB_MODEL, JSON.stringify(d.embedding)]
-          });
-        });
-        await tx2.commit();
-      } catch (e) {
-        await tx2.rollback();
-        throw e;
-      }
+      await this.db.batch(
+        emb.data.map((d, idx) => ({
+          sql: "INSERT INTO embeddings(id,model,embedding) VALUES(?,?,?)",
+          args: [batchIds[idx], EMB_MODEL, JSON.stringify(d.embedding)]
+        })),
+        "write"
+      );
     }
-    console.log(`\u2705 Successfully embedded ${missing.length} new chunks`);
+    this.logger.info(`\u2705 Successfully embedded ${missing.length} new chunks`);
   }
   // Remove chunks from database that no longer exist in markdown files
   async cleanupStaleChunks(currentIds) {
@@ -288,7 +336,7 @@ var VectorStore = class _VectorStore {
     if (staleIds.length === 0) {
       return;
     }
-    console.log(`\u{1F9F9} Cleaning up ${staleIds.length} stale chunks...`);
+    this.logger.info(`\u{1F9F9} Cleaning up ${staleIds.length} stale chunks...`);
     const BATCH_SIZE = 500;
     for (let i = 0; i < staleIds.length; i += BATCH_SIZE) {
       const batch = staleIds.slice(i, i + BATCH_SIZE);
@@ -298,7 +346,7 @@ var VectorStore = class _VectorStore {
         args: batch
       });
     }
-    console.log(`\u2713 Cleaned up ${staleIds.length} stale chunks and their embeddings`);
+    this.logger.info(`\u2713 Cleaned up ${staleIds.length} stale chunks and their embeddings`);
   }
   static cosine(a, b) {
     let dot = 0;
@@ -355,13 +403,11 @@ function getOrGenerateConversationId(providedId) {
 }
 
 // src/mcp-server/cost-tracker.ts
-function calculateCost(usage) {
+function calculateCost(usage, rates) {
   const promptTokens = usage.prompt_tokens || 0;
   const completionTokens = usage.completion_tokens || 0;
   const totalTokens = promptTokens + completionTokens;
-  const promptCost = promptTokens / 1e6 * 2.5;
-  const completionCost = completionTokens / 1e6 * 10;
-  const estimatedCost = promptCost + completionCost;
+  const estimatedCost = rates ? promptTokens / 1e6 * rates.promptPer1M + completionTokens / 1e6 * rates.completionPer1M : null;
   return {
     promptTokens,
     completionTokens,
@@ -374,15 +420,17 @@ function calculateCost(usage) {
 var MCPLogger = class {
   enableConsole;
   callback;
-  constructor(enableConsole = true, callback) {
+  logger;
+  constructor(enableConsole = true, callback, logger) {
     this.enableConsole = enableConsole;
     this.callback = callback;
+    this.logger = logger ?? createConsoleLogger();
   }
   /**
    * Log a chat interaction
    */
   async logChatInteraction(toolName, conversationId, conversationMessages, ragContext, response, duration, cost) {
-    const lastUserMsg = [...conversationMessages].reverse().find((m) => m.role === "user");
+    const lastUserMsg = lastUserMessage(conversationMessages);
     const logEvent = {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       toolName,
@@ -395,7 +443,7 @@ var MCPLogger = class {
       cost
     };
     if (this.enableConsole) {
-      console.log(
+      this.logger.info(
         JSON.stringify({
           event: "mcp_chat",
           ...logEvent
@@ -406,13 +454,13 @@ var MCPLogger = class {
       try {
         await this.callback(logEvent);
       } catch (err) {
-        console.error("Logging callback error:", err);
+        this.logger.error("Logging callback error:", err);
       }
     }
   }
 };
-function createLogger(enableConsole = true, callback) {
-  return new MCPLogger(enableConsole, callback);
+function createLogger(enableConsole = true, callback, logger) {
+  return new MCPLogger(enableConsole, callback, logger);
 }
 
 // src/mcp-server/rate-limiter.ts
@@ -494,14 +542,57 @@ function createRateLimiter(limit, windowMs = 6e4) {
   return limit ? new RateLimiter(limit, windowMs) : null;
 }
 
+// src/mcp-server/sdk.ts
+function wrapMissingMcpPeerError(packageName, cause) {
+  return new Error(
+    `The MCP server ('@diegoaltoworks/chatter/mcp') requires the optional peer dependency '${packageName}', which is not installed. Install it with \`bun add ${packageName}\` (or npm/pnpm/yarn) to use this feature.`,
+    { cause }
+  );
+}
+var cachedSdk;
+function loadMcpSdk() {
+  if (!cachedSdk) {
+    cachedSdk = import("@modelcontextprotocol/sdk/server/mcp.js").then((mod) => {
+      if (!mod.McpServer) throw new Error("module has no McpServer export");
+      return mod.McpServer;
+    }).catch((error) => {
+      cachedSdk = void 0;
+      throw wrapMissingMcpPeerError("@modelcontextprotocol/sdk", error);
+    });
+  }
+  return cachedSdk;
+}
+var cachedZod;
+function loadZod() {
+  if (!cachedZod) {
+    cachedZod = import("zod").then((mod) => {
+      if (!mod.z) throw new Error("module has no z export");
+      return mod.z;
+    }).catch((error) => {
+      cachedZod = void 0;
+      throw wrapMissingMcpPeerError("zod", error);
+    });
+  }
+  return cachedZod;
+}
+
+// src/mcp-server/tool-input.ts
+function resolveConversationMessages(message, messages) {
+  if (messages) return messages;
+  if (message) return [{ role: "user", content: message }];
+  throw new Error("Either 'message' or 'messages' is required");
+}
+
 // src/mcp-server.ts
 async function createMCPServer(config) {
-  console.log(`\u{1F680} Starting ${config.bot.name} MCP Server...`);
+  const log = resolveLogger(config.logger, config.logLevel);
+  log.info(`\u{1F680} Starting ${config.bot.name} MCP Server...`);
+  const [McpServer, z] = await Promise.all([loadMcpSdk(), loadZod()]);
   const knowledgeDir = config.knowledgeDir || "./config/knowledge";
   const promptsDir = config.promptsDir || "./config/prompts";
   const transportMode = config.transport || "stdio";
   const rateLimiter = createRateLimiter(config.toolRateLimit);
-  const logger = createLogger(config.logging?.console !== false, config.logging?.onChat);
+  const logger = createLogger(config.logging?.console !== false, config.logging?.onChat, log);
   const publicToolConfig = {
     enabled: config.tools?.public?.enabled !== false,
     name: config.tools?.public?.name || "chat_public",
@@ -515,19 +606,21 @@ async function createMCPServer(config) {
   const client = new OpenAI({
     apiKey: config.openai.apiKey
   });
+  const model = config.openai.model || DEFAULT_MODEL;
   const store = new VectorStore(client, {
     databaseUrl: config.database.url,
     databaseAuthToken: config.database.authToken,
-    knowledgeDir
+    knowledgeDir,
+    logger: log
   });
   await store.build();
-  console.log("\u2705 Knowledge base ready");
+  log.info("\u2705 Knowledge base ready");
   const prompts = new PromptLoader(promptsDir, config.bot);
   const server = new McpServer({
     name: config.bot.name,
     version: "1.0.0"
   });
-  console.log("\u2705 MCP server initialized");
+  log.info("\u2705 MCP server initialized");
   if (publicToolConfig.enabled) {
     const publicShape = {
       message: z.string().optional().describe("A single message to send (for simple queries)"),
@@ -556,34 +649,28 @@ async function createMCPServer(config) {
             `Rate limit exceeded for ${publicToolConfig.name}. Maximum ${config.toolRateLimit} requests per minute.`
           );
         }
-        let conversationMessages;
-        if (messages && Array.isArray(messages)) {
-          conversationMessages = messages;
-        } else if (message) {
-          conversationMessages = [{ role: "user", content: String(message) }];
-        } else {
-          throw new Error("Either 'message' or 'messages' is required");
-        }
-        const lastUserMsg = [...conversationMessages].reverse().find((m) => m.role === "user");
-        if (!lastUserMsg) {
+        const conversationMessages = resolveConversationMessages(message, messages);
+        if (!lastUserMessage(conversationMessages)) {
           throw new Error("No user message found in conversation");
         }
-        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor }) ?? defaultBuckets("public");
-        const ctx = await store.query(lastUserMsg.content, 6, buckets);
-        const system = [
-          prompts.baseSystemRules,
-          prompts.publicPersona,
-          `Context:
-${ctx.join("\n\n")}`
-        ].join("\n\n");
+        const buckets = await resolveBuckets({ mode: "public", bucketsFor: config.bucketsFor });
+        const { system, context: ctx } = await prepareChat({
+          store,
+          prompts,
+          mode: "public",
+          messages: conversationMessages,
+          buckets
+        });
         const result = await answerOnce({
           answerFn: config.answerFn,
           client,
           system,
           messages: conversationMessages,
-          mode: "public"
+          mode: "public",
+          conversationId: convId,
+          model
         });
-        const cost = calculateCost(result.usage);
+        const cost = calculateCost(result.usage, config.openai.pricing);
         const duration = Date.now() - startTime;
         await logger.logChatInteraction(
           publicToolConfig.name,
@@ -593,7 +680,7 @@ ${ctx.join("\n\n")}`
           result.content,
           duration,
           cost
-        ).catch((err) => console.error("Logging error:", err));
+        ).catch((err) => log.error("Logging error:", err));
         return {
           content: [
             {
@@ -613,7 +700,7 @@ ${ctx.join("\n\n")}`
         };
       }
     );
-    console.log(`\u2705 Registered tool: ${publicToolConfig.name}`);
+    log.info(`\u2705 Registered tool: ${publicToolConfig.name}`);
   }
   if (privateToolConfig.enabled) {
     const privateShape = {
@@ -643,34 +730,28 @@ ${ctx.join("\n\n")}`
             `Rate limit exceeded for ${privateToolConfig.name}. Maximum ${config.toolRateLimit} requests per minute.`
           );
         }
-        let conversationMessages;
-        if (messages && Array.isArray(messages)) {
-          conversationMessages = messages;
-        } else if (message) {
-          conversationMessages = [{ role: "user", content: String(message) }];
-        } else {
-          throw new Error("Either 'message' or 'messages' is required");
-        }
-        const lastUserMsg = [...conversationMessages].reverse().find((m) => m.role === "user");
-        if (!lastUserMsg) {
+        const conversationMessages = resolveConversationMessages(message, messages);
+        if (!lastUserMessage(conversationMessages)) {
           throw new Error("No user message found in conversation");
         }
-        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config.bucketsFor }) ?? defaultBuckets("private");
-        const ctx = await store.query(lastUserMsg.content, 8, buckets);
-        const system = [
-          prompts.baseSystemRules,
-          prompts.privatePersona,
-          `Internal Context:
-${ctx.join("\n\n")}`
-        ].join("\n\n");
+        const buckets = await resolveBuckets({ mode: "private", bucketsFor: config.bucketsFor });
+        const { system, context: ctx } = await prepareChat({
+          store,
+          prompts,
+          mode: "private",
+          messages: conversationMessages,
+          buckets
+        });
         const result = await answerOnce({
           answerFn: config.answerFn,
           client,
           system,
           messages: conversationMessages,
-          mode: "private"
+          mode: "private",
+          conversationId: convId,
+          model
         });
-        const cost = calculateCost(result.usage);
+        const cost = calculateCost(result.usage, config.openai.pricing);
         const duration = Date.now() - startTime;
         await logger.logChatInteraction(
           privateToolConfig.name,
@@ -680,7 +761,7 @@ ${ctx.join("\n\n")}`
           result.content,
           duration,
           cost
-        ).catch((err) => console.error("Logging error:", err));
+        ).catch((err) => log.error("Logging error:", err));
         return {
           content: [
             {
@@ -700,16 +781,16 @@ ${ctx.join("\n\n")}`
         };
       }
     );
-    console.log(`\u2705 Registered tool: ${privateToolConfig.name}`);
+    log.info(`\u2705 Registered tool: ${privateToolConfig.name}`);
   }
   const enabledTools = [
     publicToolConfig.enabled ? publicToolConfig.name : null,
     privateToolConfig.enabled ? privateToolConfig.name : null
   ].filter(Boolean);
   if (enabledTools.length === 0) {
-    console.warn("\u26A0\uFE0F  Warning: No MCP tools enabled");
+    log.warn("\u26A0\uFE0F  Warning: No MCP tools enabled");
   }
-  console.log(
+  log.info(
     `\u2705 ${config.bot.name} MCP Server ready (transport: ${transportMode}, tools: ${enabledTools.join(", ") || "none"})`
   );
   return server;

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,OAGjB,OAAO,QAAQ,IAAI;;8BAuC9D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,OAGjB,OAAO,QAAQ,IAAI;;8BA0C9D"}

package/dist/middleware/bodyLimit.d.ts

@@ -0,0 +1,11 @@
+/** Generous for chat text, small enough to bound worst-case parse/memory cost. */
+export declare const DEFAULT_MAX_REQUEST_BYTES = 262144;
+/**
+ * Rejects oversized chat request bodies before they reach JSON parsing.
+ * Wraps Hono's `bodyLimit` so the 413 body matches the caller's error shape
+ * instead of the plain-text 413 Hono sends by default. `toError` defaults to
+ * this API's usual `{ error }` shape; the OpenAI-compatible routes pass
+ * their own `{ error: { message, type } }` formatter.
+ */
+export declare function chatBodyLimit(maxSize?: number, toError?: (message: string) => unknown): import("hono").MiddlewareHandler;
+//# sourceMappingURL=bodyLimit.d.ts.map

package/dist/middleware/bodyLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodyLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/bodyLimit.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE,MAAkC,EAC3C,OAAO,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAA2C,oCAM1E"}

package/dist/middleware/clientKey.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from "hono";
+/**
+ * Resolves the caller identity IP-keyed rate limiters bucket on.
+ *
+ * `X-Forwarded-For` is set by the client unless something in front of
+ * Chatter (nginx, Cloudflare, a cloud load balancer) overwrites it with the
+ * real socket address. Trusting it unconditionally lets an attacker rotate a
+ * fake value on every request and bypass per-IP limits entirely. Pass
+ * `trustProxy: true` only when such a proxy is guaranteed to be in front —
+ * otherwise every caller collapses onto one shared bucket, which is coarse
+ * but not bypassable, and pair it with a fronting proxy that does the real
+ * per-client limiting.
+ */
+export declare function clientRateLimitKey(c: Context, trustProxy: boolean): string;
+//# sourceMappingURL=clientKey.d.ts.map

package/dist/middleware/clientKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientKey.d.ts","sourceRoot":"","sources":["../../src/middleware/clientKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAK1E"}

package/dist/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK1C;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,oBAAqB,MAAM,EAAE,SAAe,OAAO,QAAQ,IAAI,kCAyB/E,CAAC"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM1C;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,oBAAqB,MAAM,EAAE,SAAe,OAAO,QAAQ,IAAI,kCA2B/E,CAAC"}

package/dist/middleware/jwt.d.ts

@@ -17,7 +17,4 @@ export declare function jwtSubject(c: Context): string | undefined;
 export declare function createJWTMiddleware(config: ChatterConfig): (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
     error: string;
 }, 401, "json">) | undefined>;
-export declare const requirePrivateJWT: (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
-    error: string;
-}, 401, "json">) | undefined>;
 //# sourceMappingURL=jwt.d.ts.map

package/dist/middleware/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,OAwBZ,OAAO,QAAQ,IAAI;;8BAa/D;AAGD,eAAO,MAAM,iBAAiB,MAhBe,OAAO,QAAQ,IAAI;;6BAgBS,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,OAwBZ,OAAO,QAAQ,IAAI;;8BAa/D"}

package/dist/middleware/originMatch.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared origin/referer matching for anything that gates on
+ * `allowedOrigins` — demo access, referrer checks. Centralized so every
+ * caller gets the same boundary-aware comparison instead of each
+ * reimplementing (and re-breaking) it.
+ */
+/**
+ * True when `origin` exactly equals one of `allowedOrigins`, or `referer`
+ * equals one or is prefixed by one followed by `/` or `?`. A naive
+ * `referer.startsWith(allowed)` would let `https://example.com.evil.com`
+ * match an allowed `https://example.com` — the boundary check rejects that.
+ */
+export declare function matchesAllowedOrigin(origin: string | undefined, referer: string | undefined, allowedOrigins: string[]): boolean;
+/**
+ * Same as {@link matchesAllowedOrigin}, plus any-port localhost/127.0.0.1 —
+ * for local-dev convenience on surfaces that would otherwise require an
+ * explicit `allowedOrigins` entry per dev port.
+ *
+ * `Origin`/`Referer` are only browser-enforced for browser-driven requests —
+ * a direct (non-browser) client can set either to anything, same as it could
+ * `Host`. This function is therefore not a substitute for real access
+ * control; callers should only reach for it where an always-on localhost
+ * allowance is an accepted tradeoff (typically gated behind an explicit
+ * opt-in), never as a blanket replacement for `matchesAllowedOrigin`.
+ */
+export declare function matchesAllowedOriginOrLocalhost(origin: string | undefined, referer: string | undefined, allowedOrigins: string[]): boolean;
+//# sourceMappingURL=originMatch.d.ts.map

package/dist/middleware/originMatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"originMatch.d.ts","sourceRoot":"","sources":["../../src/middleware/originMatch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAUT;AAoBD;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAGT"}

package/dist/middleware/ratelimit.d.ts

@@ -12,10 +12,4 @@ export declare function createRateLimiter(config: ChatterConfig): {
         error: string;
     }, 429, "json">) | undefined>;
 };
-export declare const limitPublic: () => (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
-    error: string;
-}, 429, "json">) | undefined>;
-export declare const limitPrivate: () => (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
-    error: string;
-}, 429, "json">) | undefined>;
 //# sourceMappingURL=ratelimit.d.ts.map

package/dist/middleware/ratelimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ratelimit.d.ts","sourceRoot":"","sources":["../../src/middleware/ratelimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkB9C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa;IAsBnD,WAAW,QACQ,OAAO,QAAQ,IAAI;;;IAwBtC,YAAY,QACO,OAAO,QAAQ,IAAI;;;EAQzC;AAID,eAAO,MAAM,WAAW,YArCD,OAAO,QAAQ,IAAI;;6BAqCW,CAAC;AACtD,eAAO,MAAM,YAAY,YAbF,OAAO,QAAQ,IAAI;;6BAaa,CAAC"}
+{"version":3,"file":"ratelimit.d.ts","sourceRoot":"","sources":["../../src/middleware/ratelimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQ9C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa;IAWnD,WAAW,QACQ,OAAO,QAAQ,IAAI;;;IAwBtC,YAAY,QACO,OAAO,QAAQ,IAAI;;;EAQzC"}

package/dist/middleware/referrer.d.ts

@@ -3,11 +3,15 @@
  * Validates that requests with demo API keys come from allowed origins
  */
 import type { Context, Next } from "hono";
+import { type Logger } from "../core/logger";
 /**
  * Middleware to check if the request comes from an allowed origin
  * Only applies to demo API keys and session keys - production keys bypass this check
+ *
+ * @param demoApiKeys - API key values treated as demo keys (see
+ * `ChatterConfig.rateLimit.demoApiKeys`). Unset: no key is a demo key.
  */
-export declare function requireReferrer(allowedOrigins: string[]): (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
+export declare function requireReferrer(allowedOrigins: string[], demoApiKeys?: string[], logger?: Logger): (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
     error: string;
 }, 403, "json">) | undefined>;
 export declare const createReferrerCheck: typeof requireReferrer;

package/dist/middleware/referrer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"referrer.d.ts","sourceRoot":"","sources":["../../src/middleware/referrer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI1C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OACrC,OAAO,QAAQ,IAAI;;8BA8CrC;AAGD,eAAO,MAAM,mBAAmB,wBAAkB,CAAC"}
+{"version":3,"file":"referrer.d.ts","sourceRoot":"","sources":["../../src/middleware/referrer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGlE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,cAAc,EAAE,MAAM,EAAE,EACxB,WAAW,GAAE,MAAM,EAAO,EAC1B,MAAM,GAAE,MAA8B,OAErB,OAAO,QAAQ,IAAI;;8BAkCrC;AAGD,eAAO,MAAM,mBAAmB,wBAAkB,CAAC"}

package/dist/middleware/securityHeaders.d.ts

@@ -0,0 +1,20 @@
+import type { Context, Next } from "hono";
+import type { ChatterConfig } from "../types";
+/**
+ * Sets baseline security headers on every response: a Content-Security-Policy
+ * (governs pages this server itself renders — see `server.contentSecurityPolicy`),
+ * `X-Content-Type-Options` to stop MIME sniffing, and HSTS (see
+ * `server.strictTransportSecurity`). HSTS is only sent when the request
+ * actually arrived over HTTPS (directly, or via a trusted proxy's
+ * `X-Forwarded-Proto` — see `rateLimit.trustProxy`) or `NODE_ENV=production`.
+ * A browser ignores HSTS delivered over plain HTTP (RFC 6797 §8.1), so this
+ * gate is about not asserting a guarantee the deployment doesn't back, not
+ * about avoiding a localhost lockout.
+ *
+ * Headers are set after `next()` so they still land on a handler that
+ * returns a raw `Response` (e.g. from `config.customRoutes`) rather than
+ * `c.json`/`c.text` — Hono only merges headers set before `next()` into
+ * responses it builds itself.
+ */
+export declare function securityHeaders(config: ChatterConfig): (c: Context, next: Next) => Promise<void>;
+//# sourceMappingURL=securityHeaders.d.ts.map