@diegoaltoworks/chatter 0.50.0 → 0.51.0

package/README.md

@@ -26,6 +26,12 @@
 - ⚡ **High Performance**: Built on Hono with streaming support
 - 🛡️ **Security First**: Rate limiting, CORS, referrer checking, and input guardrails
 - 💸 **Usage Metering**: Per-caller and global daily caps for paid features, multi-instance safe, via `@diegoaltoworks/chatter/usage` ([guide](./docs/usage.md))
+- 💬 **Channels**: Built-in WhatsApp transport plus a Channel SPI for plugging in any other one — allowlist/mute gates, reply rate-limiting, and a shared inbound pipeline every channel reuses ([WhatsApp guide](./docs/channels.md), [build your own](./docs/build-a-channel.md))
+- 🧩 **Flows**: Multi-turn, schema-driven slot-filling for structured conversations, with hybrid keyword + LLM intent matching ([guide](./docs/flows.md))
+- 🖼️ **Images**: On-demand generation and editing with cache-before-spend ordering and optional Cloudinary upload ([guide](./docs/images.md))
+- 🎭 **Personas**: Windowed, per-contact prompt layers and named greetings from a JSON registry ([guide](./docs/personas.md))
+- 🗂️ **Conversation History**: Structural, multi-turn context store, multi-instance safe and host-replaceable ([guide](./docs/history.md))
+- ⏰ **Scheduler**: Exactly-once outbound scheduling with a fire-time grace window, multi-instance safe ([guide](./docs/scheduler.md))
 - 📦 **Framework Agnostic**: Works with any JavaScript framework or vanilla JS
 - 🎯 **TypeScript**: Fully typed for excellent developer experience
 
@@ -84,13 +90,23 @@ is runtime-neutral. Development and the quality gates run on Bun.
 
 ## Documentation
 
-Complete guides for setup, deployment, and integration:
+Complete guides for setup, deployment, and integration — see
+[docs/index.md](./docs/index.md) for the full, ordered walkthrough:
 
 - **[Requirements](./docs/requirements.md)** - OpenAI, Turso, Clerk setup and pricing
 - **[Server Setup](./docs/server.md)** - Configuration, knowledge base, prompts, API keys
 - **[Client Integration](./docs/client.md)** - Widgets, React components, theming
+- **[UI Integrations](./docs/integrations.md)** - OpenAI-compatible API, headless mode, bring-your-own-brain
 - **[Usage Metering](./docs/usage.md)** - Daily spend caps for paid features
+- **[Personas](./docs/personas.md)** - Dynamic prompt layers and named greetings
+- **[WhatsApp Channel](./docs/channels.md)** - Link a WhatsApp number as a transport
+- **[Building a Channel](./docs/build-a-channel.md)** - Plug in a new transport
+- **[Flows](./docs/flows.md)** - Multi-turn, schema-driven slot-filling flows
+- **[Images](./docs/images.md)** - Generate and cache images on demand
+- **[Conversation History](./docs/history.md)** - Structural, host-replaceable multi-turn context
+- **[Scheduler](./docs/scheduler.md)** - Exactly-once outbound scheduling
 - **[Deployment](./docs/deployment.md)** - Google Cloud Run, Fly.io, Railway, VPS
+- **[Packaging](./docs/packaging.md)** - The subpath contract and the release chain
 - **[Testing](./docs/testing.md)** - Comprehensive testing guide
 - **[Sprint Review](./docs/sprint-review.md)** - Cross-module & security-invariant audit
 - **[FAQs](./docs/faqs.md)** - Troubleshooting and common questions

package/dist/channels/gates.d.ts

@@ -59,8 +59,24 @@ export declare function decideChannelAction(msg: ChannelMessage, config: Channel
  * Sliding-window rate limiter (pure, injectable clock): true = allowed and
  * counted. One instance guards one budget — callers wanting separate DM and
  * group budgets create two (see {@link underReplyRateLimit}).
+ *
+ * Keyed by chatId, which — unlike an IP — a caller can't rotate at will, but
+ * a long-lived deployment still accumulates one entry per chat it has ever
+ * seen, including chats that never come back. A global sweep (same shape as
+ * `windowBucket.ts`'s) runs at most once per window, on a call for any key,
+ * and drops every key whose entries have all fallen out of the window —
+ * bounding the map to chats active within roughly the last two windows
+ * instead of growing for the life of the process. `allow.size()` reports
+ * the current key count, for tests asserting eviction actually happened.
+ *
+ * @internal `size` is an observability hook for this module's own tests, not
+ * part of the public contract — callers should treat the return value as a
+ * plain `(key: string) => boolean`.
  */
-export declare function createSlidingWindowRateLimiter(maxPerWindow: number, windowMs: number, now?: () => number): (key: string) => boolean;
+export declare function createSlidingWindowRateLimiter(maxPerWindow: number, windowMs: number, now?: () => number): {
+    (key: string): boolean;
+    size: () => number;
+};
 /**
  * Routes a chat to its DM or group rate limiter so a flood in one can't
  * spend the other's budget — a DM flood used to be entirely unthrottled

package/dist/channels/gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/channels/gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,eAAe,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,YAAY,EAAE,OAAO,CAAC;IACtB,sHAAsH;IACtH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kIAAkI;IAClI,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAC9C,OAAO,CAQT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,GAAG,aAAa,CAUjG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,SAGD,MAAM,KAAG,OAAO,CAY5C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,iBAAiB,CAAC,EACvD,QAAQ,EAAE;IAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;CAAE,GAChF,OAAO,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5D,qHAAqH;AACrH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,UAAU,CAAC,EACjD,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAET"}
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/channels/gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,eAAe,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,YAAY,EAAE,OAAO,CAAC;IACtB,sHAAsH;IACtH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kIAAkI;IAClI,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAC9C,OAAO,CAQT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,GAAG,aAAa,CAUjG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB;UAcR,MAAM,GAAG,OAAO;;EAiBrC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,iBAAiB,CAAC,EACvD,QAAQ,EAAE;IAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;CAAE,GAChF,OAAO,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5D,qHAAqH;AACrH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,UAAU,CAAC,EACjD,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAET"}

package/dist/channels/index.d.ts

@@ -42,7 +42,7 @@ export interface Channel {
     stop?(): void | Promise<void>;
 }
 export * from "./gates";
-export { createInboundPipeline, type InboundPipelineConfig, type InboundPipelineDeps, type InboundPipelineOutcome, type InboundReplySender, type InboundTurn, } from "./pipeline";
+export { createInboundPipeline, type InboundPipeline, type InboundPipelineConfig, type InboundPipelineDeps, type InboundPipelineOutcome, type InboundReplySender, type InboundTurn, } from "./pipeline";
 export type { ChannelSender, ChannelSenderRegistry } from "./senders";
 export { createSenderRegistry } from "./senders";
 //# sourceMappingURL=index.d.ts.map

package/dist/channels/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channels/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,MAAM,WAAW,OAAO;IACtB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channels/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,MAAM,WAAW,OAAO;IACtB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC"}

package/dist/channels/index.js

@@ -51,18 +51,31 @@ function decideChannelAction(msg, config) {
 }
 function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
   const log = /* @__PURE__ */ new Map();
-  return function allow(key) {
-    const cutoff = now() - windowMs;
+  let lastSweep = now();
+  function sweep(current) {
+    if (current - lastSweep < windowMs) return;
+    lastSweep = current;
+    const cutoff = current - windowMs;
+    for (const [key, entries] of log) {
+      if (!entries.some((t) => t > cutoff)) log.delete(key);
+    }
+  }
+  function allow(key) {
+    const current = now();
+    sweep(current);
+    const cutoff = current - windowMs;
     const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
     if (entries.length >= maxPerWindow) {
       if (entries.length > 0) log.set(key, entries);
       else log.delete(key);
       return false;
     }
-    entries.push(now());
+    entries.push(current);
     log.set(key, entries);
     return true;
-  };
+  }
+  allow.size = () => log.size;
+  return allow;
 }
 function underReplyRateLimit(msg, limiters) {
   return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);

package/dist/channels/index.mjs

@@ -18,18 +18,31 @@ function decideChannelAction(msg, config) {
 }
 function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
   const log = /* @__PURE__ */ new Map();
-  return function allow(key) {
-    const cutoff = now() - windowMs;
+  let lastSweep = now();
+  function sweep(current) {
+    if (current - lastSweep < windowMs) return;
+    lastSweep = current;
+    const cutoff = current - windowMs;
+    for (const [key, entries] of log) {
+      if (!entries.some((t) => t > cutoff)) log.delete(key);
+    }
+  }
+  function allow(key) {
+    const current = now();
+    sweep(current);
+    const cutoff = current - windowMs;
     const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
     if (entries.length >= maxPerWindow) {
       if (entries.length > 0) log.set(key, entries);
       else log.delete(key);
       return false;
     }
-    entries.push(now());
+    entries.push(current);
     log.set(key, entries);
     return true;
-  };
+  }
+  allow.size = () => log.size;
+  return allow;
 }
 function underReplyRateLimit(msg, limiters) {
   return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);

package/dist/channels/whatsapp/index.js

@@ -624,18 +624,31 @@ function decideChannelAction(msg, config) {
 }
 function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
   const log = /* @__PURE__ */ new Map();
-  return function allow(key) {
-    const cutoff = now() - windowMs;
+  let lastSweep = now();
+  function sweep(current) {
+    if (current - lastSweep < windowMs) return;
+    lastSweep = current;
+    const cutoff = current - windowMs;
+    for (const [key, entries] of log) {
+      if (!entries.some((t) => t > cutoff)) log.delete(key);
+    }
+  }
+  function allow(key) {
+    const current = now();
+    sweep(current);
+    const cutoff = current - windowMs;
     const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
     if (entries.length >= maxPerWindow) {
       if (entries.length > 0) log.set(key, entries);
       else log.delete(key);
       return false;
     }
-    entries.push(now());
+    entries.push(current);
     log.set(key, entries);
     return true;
-  };
+  }
+  allow.size = () => log.size;
+  return allow;
 }
 function underReplyRateLimit(msg, limiters) {
   return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);

package/dist/channels/whatsapp/index.mjs

@@ -562,18 +562,31 @@ function decideChannelAction(msg, config) {
 }
 function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
   const log = /* @__PURE__ */ new Map();
-  return function allow(key) {
-    const cutoff = now() - windowMs;
+  let lastSweep = now();
+  function sweep(current) {
+    if (current - lastSweep < windowMs) return;
+    lastSweep = current;
+    const cutoff = current - windowMs;
+    for (const [key, entries] of log) {
+      if (!entries.some((t) => t > cutoff)) log.delete(key);
+    }
+  }
+  function allow(key) {
+    const current = now();
+    sweep(current);
+    const cutoff = current - windowMs;
     const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
     if (entries.length >= maxPerWindow) {
       if (entries.length > 0) log.set(key, entries);
       else log.delete(key);
       return false;
     }
-    entries.push(now());
+    entries.push(current);
     log.set(key, entries);
     return true;
-  };
+  }
+  allow.size = () => log.size;
+  return allow;
 }
 function underReplyRateLimit(msg, limiters) {
   return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);

package/dist/index.js

@@ -1294,7 +1294,7 @@ function createRateLimiter2(config) {
   const limiter = createWindowBucketLimiter(6e4);
   const publicLimit = config.rateLimit?.public || 60;
   const privateLimit = config.rateLimit?.private || 120;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   const demoApiKeys = config.rateLimit?.demoApiKeys ?? [];
   return {
     // Public: key is IP only
@@ -1396,7 +1396,7 @@ function isHttps(c, trustProxy) {
 function securityHeaders(config) {
   const csp = config.server?.contentSecurityPolicy || DEFAULT_CSP;
   const hsts = config.server?.strictTransportSecurity ?? DEFAULT_HSTS;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   return async (c, next) => {
     await next();
     c.header("content-security-policy", csp);
@@ -1498,7 +1498,7 @@ function demoRoutes(deps) {
   const app = new import_hono.Hono();
   const demoOrigins = config.server?.allowedOrigins ?? [];
   const allowLocalhostDemo = config.server?.allowLocalhostDemo ?? false;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   app.get(
     "/api/demo/session",
     checkDemoOrigin(demoOrigins, allowLocalhostDemo),

package/dist/index.mjs

@@ -1221,7 +1221,7 @@ function createRateLimiter2(config) {
   const limiter = createWindowBucketLimiter(6e4);
   const publicLimit = config.rateLimit?.public || 60;
   const privateLimit = config.rateLimit?.private || 120;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   const demoApiKeys = config.rateLimit?.demoApiKeys ?? [];
   return {
     // Public: key is IP only
@@ -1323,7 +1323,7 @@ function isHttps(c, trustProxy) {
 function securityHeaders(config) {
   const csp = config.server?.contentSecurityPolicy || DEFAULT_CSP;
   const hsts = config.server?.strictTransportSecurity ?? DEFAULT_HSTS;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   return async (c, next) => {
     await next();
     c.header("content-security-policy", csp);
@@ -1425,7 +1425,7 @@ function demoRoutes(deps) {
   const app = new Hono();
   const demoOrigins = config.server?.allowedOrigins ?? [];
   const allowLocalhostDemo = config.server?.allowLocalhostDemo ?? false;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   app.get(
     "/api/demo/session",
     checkDemoOrigin(demoOrigins, allowLocalhostDemo),

package/dist/middleware/clientKey.d.ts

@@ -5,11 +5,11 @@ import type { Context } from "hono";
  * `X-Forwarded-For` is set by the client unless something in front of
  * Chatter (nginx, Cloudflare, a cloud load balancer) overwrites it with the
  * real socket address. Trusting it unconditionally lets an attacker rotate a
- * fake value on every request and bypass per-IP limits entirely. Pass
- * `trustProxy: true` only when such a proxy is guaranteed to be in front —
- * otherwise every caller collapses onto one shared bucket, which is coarse
- * but not bypassable, and pair it with a fronting proxy that does the real
- * per-client limiting.
+ * fake value on every request and bypass per-IP limits entirely, so
+ * `trustProxy` defaults to `false`: pass `trustProxy: true` only when such a
+ * proxy is guaranteed to be in front. Left `false`, every caller collapses
+ * onto one shared bucket, which is coarse but not bypassable — pair it with
+ * a fronting proxy that does the real per-client limiting.
  */
 export declare function clientRateLimitKey(c: Context, trustProxy: boolean): string;
 //# sourceMappingURL=clientKey.d.ts.map

package/dist/middleware/securityHeaders.d.ts

@@ -9,7 +9,9 @@ import type { ChatterConfig } from "../types";
  * `X-Forwarded-Proto` — see `rateLimit.trustProxy`) or `NODE_ENV=production`.
  * A browser ignores HSTS delivered over plain HTTP (RFC 6797 §8.1), so this
  * gate is about not asserting a guarantee the deployment doesn't back, not
- * about avoiding a localhost lockout.
+ * about avoiding a localhost lockout. `trustProxy` defaults to `false`: a
+ * deployment reachable directly must opt in before a client-suppliable
+ * header is trusted for anything.
  *
  * Headers are set after `next()` so they still land on a handler that
  * returns a raw `Response` (e.g. from `config.customRoutes`) rather than

package/dist/middleware/securityHeaders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityHeaders.d.ts","sourceRoot":"","sources":["../../src/middleware/securityHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiB9C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,OAKlC,OAAO,QAAQ,IAAI,mBAQrC"}
+{"version":3,"file":"securityHeaders.d.ts","sourceRoot":"","sources":["../../src/middleware/securityHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,OAKlC,OAAO,QAAQ,IAAI,mBAQrC"}

package/dist/server.js

@@ -796,7 +796,7 @@ function isHttps(c, trustProxy) {
 function securityHeaders(config) {
   const csp = config.server?.contentSecurityPolicy || DEFAULT_CSP;
   const hsts = config.server?.strictTransportSecurity ?? DEFAULT_HSTS;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   return async (c, next) => {
     await next();
     c.header("content-security-policy", csp);
@@ -996,7 +996,7 @@ function demoRoutes(deps) {
   const app = new import_hono.Hono();
   const demoOrigins = config.server?.allowedOrigins ?? [];
   const allowLocalhostDemo = config.server?.allowLocalhostDemo ?? false;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   app.get(
     "/api/demo/session",
     checkDemoOrigin(demoOrigins, allowLocalhostDemo),
@@ -1129,7 +1129,7 @@ function createRateLimiter(config) {
   const limiter = createWindowBucketLimiter(6e4);
   const publicLimit = config.rateLimit?.public || 60;
   const privateLimit = config.rateLimit?.private || 120;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   const demoApiKeys = config.rateLimit?.demoApiKeys ?? [];
   return {
     // Public: key is IP only

package/dist/server.mjs

@@ -761,7 +761,7 @@ function isHttps(c, trustProxy) {
 function securityHeaders(config) {
   const csp = config.server?.contentSecurityPolicy || DEFAULT_CSP;
   const hsts = config.server?.strictTransportSecurity ?? DEFAULT_HSTS;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   return async (c, next) => {
     await next();
     c.header("content-security-policy", csp);
@@ -961,7 +961,7 @@ function demoRoutes(deps) {
   const app = new Hono();
   const demoOrigins = config.server?.allowedOrigins ?? [];
   const allowLocalhostDemo = config.server?.allowLocalhostDemo ?? false;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   app.get(
     "/api/demo/session",
     checkDemoOrigin(demoOrigins, allowLocalhostDemo),
@@ -1094,7 +1094,7 @@ function createRateLimiter(config) {
   const limiter = createWindowBucketLimiter(6e4);
   const publicLimit = config.rateLimit?.public || 60;
   const privateLimit = config.rateLimit?.private || 120;
-  const trustProxy = config.rateLimit?.trustProxy ?? true;
+  const trustProxy = config.rateLimit?.trustProxy ?? false;
   const demoApiKeys = config.rateLimit?.demoApiKeys ?? [];
   return {
     // Public: key is IP only

package/dist/types.d.ts

@@ -153,8 +153,10 @@ export interface ChatterConfig {
          * Only set this when Chatter sits behind a reverse proxy (nginx,
          * Cloudflare, a cloud load balancer) that overwrites client-supplied
          * XFF with the real socket address — otherwise a caller can rotate a
-         * fake value per request and bypass limits entirely. When `false`,
-         * every caller shares one bucket per limiter. Default: true.
+         * fake value per request and bypass limits entirely. When `false`
+         * (the default), every caller shares one bucket per limiter — coarse
+         * but not spoofable, and the safe choice for a directly-exposed
+         * server. Default: false.
          */
         trustProxy?: boolean;
         /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,OAAO,CAAC,EAAE,YAAY,CAAC;KACxB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;;;WAOG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B;;;;;;;;WAQG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;;;;;WAQG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;;;;;;;;WAYG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B;;;;;;WAMG;QACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;KAC1C,CAAC;IAGF;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAGxB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;IAG5B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAGrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAC/C,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,EAAE,EAAE,YAAY,CAAC;IACjB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;IACF;;;;;OAKG;IACH,OAAO,EAAE,qBAAqB,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IAGrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE;QACN,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,OAAO,CAAC,EAAE,YAAY,CAAC;KACxB,CAAC;IAGF,QAAQ,EAAE;QACR,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAGF,IAAI,CAAC,EAAE;QACL,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,qEAAqE;QACrE,aAAa,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,KAAK,EAAE,OAAO,CAAC;gBAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAC3F,CAAC;QACF,6CAA6C;QAC7C,GAAG,CAAC,EAAE;YACJ,oCAAoC;YACpC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0BAA0B;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,4BAA4B;YAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,2CAA2C;YAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,0BAA0B;QAC1B,KAAK,CAAC,EAAE;YACN,4BAA4B;YAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,6BAA6B;YAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;KACH,CAAC;IAGF,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kDAAkD;QAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,2DAA2D;QAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6DAA6D;QAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;;;;;WASG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAGF,MAAM,CAAC,EAAE;QACP,iCAAiC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iCAAiC;QACjC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B;;;;;;;;WAQG;QACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B;;;;;;;;WAQG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;;;;;;;;WAYG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B;;;;;;WAMG;QACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;KAC1C,CAAC;IAGF;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAGxB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;IAG5B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAGrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAC/C,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,EAAE,EAAE,YAAY,CAAC;IACjB,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,6BAA6B;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,+CAA+C;IAC/C,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3F,CAAC;IACF;;;;;OAKG;IACH,OAAO,EAAE,qBAAqB,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE;QACR,uBAAuB;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB;QACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;QACrC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegoaltoworks/chatter",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Embeddable AI chatbot framework with RAG, authentication, and customizable widgets",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",