rushy-sdk 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Roman Dmytriev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,81 @@
+# rushy-sdk
+
+Один пакет для подключения чата Rushy к продукту: серверный вход `rushy-sdk/host` и React-хук `rushy-sdk/react`. Требуется Node.js 22 или новее. React нужен только клиентскому входу.
+
+```bash
+npm install rushy-sdk
+```
+
+## Хост: Next.js Route Handler
+
+`getSessionUser` — функция вашего продукта, которая проверяет серверную сессию по запросу и возвращает пользователя или `null`. Разместите обработчик в `app/api/rushy/chat/route.ts`:
+
+```ts
+import { createRushyChatHandler } from "rushy-sdk/host";
+import { getSessionUser } from "@/lib/session";
+
+const handler = createRushyChatHandler({
+  gatewayUrl: process.env.RUSHY_GATEWAY_URL!,
+  hostSecret: new TextEncoder().encode(process.env.RUSHY_HOST_SECRET!),
+  getUser: async (request) => {
+    const user = await getSessionUser(request);
+    return user ? { id: user.id, name: user.name } : null;
+  },
+});
+
+export const POST = handler;
+```
+
+## MCP-эндпоинт хоста
+
+Разместите обработчик в `app/api/rushy/mcp/route.ts`. Сервисный токен задаётся в настройках
+MCP-сервера Onyx и должен содержать не менее 32 байт. `X-Rushy-Identity` подписывает шлюз Rushy;
+инструмент получает проверенное утверждение и сам проверяет права пользователя в продукте.
+
+```ts
+import { createRushyMcpHandler, defineRushyTool } from "rushy-sdk/host";
+import { z } from "zod";
+import { getOrderForUser } from "@/lib/orders";
+
+const getOrder = defineRushyTool({
+  name: "get_order",
+  description: "Получить заказ по идентификатору",
+  input: z.object({ orderId: z.string().min(1) }),
+  handler: async ({ orderId }, { identity, signal }) => {
+    // Проверка доступа остаётся в продукте: identity.sub — пользователь хоста.
+    return getOrderForUser(identity.sub, orderId, { signal });
+  },
+});
+
+export const POST = createRushyMcpHandler({
+  serviceToken: process.env.RUSHY_MCP_SERVICE_TOKEN!,
+  identitySecret: new TextEncoder().encode(process.env.RUSHY_IDENTITY_SECRET!),
+  audience: "my-host",
+  tools: [getOrder],
+});
+```
+
+## Клиент: React
+
+```tsx
+"use client";
+
+import { useRushyChat } from "rushy-sdk/react";
+
+export function Chat() {
+  const { messages, send, stop, status } = useRushyChat({ endpoint: "/api/rushy/chat" });
+  return (
+    <section>
+      {messages.map((message, index) => <p key={index}>{message.text}</p>)}
+      <button onClick={() => void send("Привет")}>Отправить</button>
+      {status === "streaming" && <button onClick={stop}>Остановить</button>}
+    </section>
+  );
+}
+```
+
+## Безопасность
+
+- Пользователь определяется только из проверенной сессии хоста в `getUser`; идентификатор из тела запроса не принимается.
+- `RUSHY_HOST_SECRET` хранится только на сервере и должен содержать не менее 32 байт после кодирования.
+- Адрес шлюза задавайте во внутренней сети; не публикуйте шлюз наружу.

package/dist/chunk-NOF7HANN.js

@@ -0,0 +1,93 @@
+// ../contracts/src/tokens.ts
+import { z } from "zod";
+var unixSeconds = z.number().int().positive();
+var tokenExchangeRequestSchema = z.strictObject({
+  v: z.literal(1),
+  hostUserId: z.string().min(1).max(128),
+  displayName: z.string().max(200).optional(),
+  iat: unixSeconds,
+  nonce: z.string().min(16).max(128)
+});
+var MAX_BROWSER_TOKEN_TTL = 900;
+var MAX_ASSERTION_TTL = 60;
+var rushyTokenClaimsSchema = z.strictObject({
+  v: z.literal(1),
+  sub: z.string().min(1).max(128),
+  name: z.string().max(200).optional(),
+  iat: unixSeconds,
+  exp: unixSeconds,
+  jti: z.string().min(1)
+}).refine((c) => c.exp > c.iat && c.exp - c.iat <= MAX_BROWSER_TOKEN_TTL, {
+  message: "\u0442\u043E\u043A\u0435\u043D \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0436\u0438\u0432\u0451\u0442 \u043D\u0435 \u0434\u043E\u043B\u044C\u0448\u0435 15 \u043C\u0438\u043D\u0443\u0442"
+});
+var identityAssertionSchema = z.strictObject({
+  v: z.literal(1),
+  iss: z.literal("rushy-gateway"),
+  aud: z.string().min(1),
+  sub: z.string().min(1).max(128),
+  iat: unixSeconds,
+  exp: unixSeconds,
+  cid: z.string().min(1)
+}).refine((a) => a.exp > a.iat && a.exp - a.iat <= MAX_ASSERTION_TTL, {
+  message: "identity assertion \u0436\u0438\u0432\u0451\u0442 \u043D\u0435 \u0434\u043E\u043B\u044C\u0448\u0435 60 \u0441\u0435\u043A\u0443\u043D\u0434"
+});
+
+// ../contracts/src/ui-event.ts
+import { z as z2 } from "zod";
+var citationSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  documentId: z2.string().min(1),
+  title: z2.string(),
+  // Только http(s): ссылка пойдёт в href интерфейса хоста, javascript:/data: — это XSS.
+  url: z2.url({ protocol: /^https?$/ }).optional()
+});
+var errorCodeSchema = z2.enum([
+  "upstream_unavailable",
+  "upstream_error",
+  "rate_limited",
+  "unauthorized",
+  "forbidden",
+  "stream_interrupted"
+]);
+var uiEventSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("assistant.delta"), text: z2.string() }),
+  z2.object({ type: z2.literal("reasoning.delta"), text: z2.string() }),
+  z2.object({ type: z2.literal("tool.started"), id: z2.string(), name: z2.string() }),
+  z2.object({ type: z2.literal("tool.finished"), id: z2.string(), ok: z2.boolean() }),
+  z2.object({ type: z2.literal("citation"), citation: citationSchema }),
+  z2.object({ type: z2.literal("message.completed"), messageId: z2.string() }),
+  z2.object({ type: z2.literal("error"), code: errorCodeSchema, retryable: z2.boolean() })
+]);
+
+// ../contracts/src/channel-envelope.ts
+import { z as z3 } from "zod";
+var attachmentRefSchema = z3.strictObject({
+  kind: z3.enum(["file", "image", "voice"]),
+  // Непрозрачная ссылка транспорта (Telegram file_id). URL с токеном бота сюда не кладётся.
+  transportRef: z3.string().min(1),
+  mimeType: z3.string().optional(),
+  sizeBytes: z3.number().int().nonnegative().optional()
+});
+var channelEnvelopeSchema = z3.strictObject({
+  schemaVersion: z3.literal(1),
+  requestId: z3.string().min(1),
+  channel: z3.enum(["telegram", "web", "embedded"]),
+  actor: z3.strictObject({ externalUserId: z3.string().min(1) }),
+  conversation: z3.strictObject({
+    externalConversationId: z3.string().min(1),
+    threadId: z3.string().optional(),
+    messageId: z3.string().optional(),
+    replyToMessageId: z3.string().optional()
+  }),
+  content: z3.strictObject({
+    text: z3.string().optional(),
+    attachments: z3.array(attachmentRefSchema).optional()
+  }),
+  receivedAt: z3.iso.datetime()
+});
+
+export {
+  uiEventSchema,
+  tokenExchangeRequestSchema,
+  identityAssertionSchema
+};

package/dist/host.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+
+declare const identityAssertionSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    iss: z.ZodLiteral<"rushy-gateway">;
+    aud: z.ZodString;
+    sub: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    cid: z.ZodString;
+}, z.core.$strict>;
+type IdentityAssertion = z.infer<typeof identityAssertionSchema>;
+
+type IdentityErrorCode = "invalid_signature" | "expired" | "malformed" | "wrong_audience" | "weak_secret";
+declare class IdentityError extends Error {
+    readonly code: IdentityErrorCode;
+    constructor(code: IdentityErrorCode);
+}
+declare function verifyIdentityAssertion(jws: string, secret: Uint8Array, expectedAud: string, now?: number): Promise<IdentityAssertion>;
+
+interface RushyChatUser {
+    id: string;
+    name?: string;
+}
+interface RushyChatHandlerOptions {
+    gatewayUrl: string;
+    hostSecret: Uint8Array;
+    getUser: (req: Request) => Promise<RushyChatUser | null>;
+    fetch?: typeof fetch;
+}
+declare function createRushyChatHandler(opts: RushyChatHandlerOptions): (req: Request) => Promise<Response>;
+
+interface RushyToolContext {
+    identity: IdentityAssertion;
+    signal: AbortSignal;
+}
+interface RushyTool<S extends z.ZodType = z.ZodType> {
+    name: string;
+    description: string;
+    input: S;
+    handler(input: z.infer<S>, ctx: RushyToolContext): Promise<unknown>;
+}
+declare function defineRushyTool<S extends z.ZodType>(tool: RushyTool<S>): RushyTool<S>;
+interface RushyMcpHandlerOptions {
+    serviceToken: string;
+    identitySecret: Uint8Array;
+    audience: string;
+    tools: RushyTool[];
+    serverInfo?: {
+        name: string;
+        version: string;
+    };
+    now?: () => number;
+}
+declare function createRushyMcpHandler(opts: RushyMcpHandlerOptions): (req: Request) => Promise<Response>;
+
+export { type IdentityAssertion, IdentityError, type RushyChatHandlerOptions, type RushyChatUser, type RushyMcpHandlerOptions, type RushyTool, type RushyToolContext, createRushyChatHandler, createRushyMcpHandler, defineRushyTool, identityAssertionSchema, verifyIdentityAssertion };

package/dist/host.js

@@ -0,0 +1,288 @@
+import {
+  identityAssertionSchema,
+  tokenExchangeRequestSchema
+} from "./chunk-NOF7HANN.js";
+
+// ../identity/src/jws.ts
+import { randomBytes } from "crypto";
+import { decodeProtectedHeader, errors, jwtVerify, SignJWT } from "jose";
+var MIN_SECRET_BYTES = 32;
+function assertStrongSecret(secret) {
+  if (secret.byteLength < MIN_SECRET_BYTES) throw new IdentityError("weak_secret");
+}
+var IdentityError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "IdentityError";
+  }
+  code;
+};
+function unixNow(now) {
+  return now ?? Math.floor(Date.now() / 1e3);
+}
+async function verifiedPayload(jws, secret, now) {
+  assertStrongSecret(secret);
+  try {
+    if (decodeProtectedHeader(jws).alg !== "HS256") {
+      throw new IdentityError("invalid_signature");
+    }
+    const { payload } = await jwtVerify(jws, secret, {
+      algorithms: ["HS256"],
+      currentDate: new Date(now * 1e3)
+    });
+    return payload;
+  } catch (error) {
+    if (error instanceof IdentityError) throw error;
+    if (error instanceof errors.JWTExpired) throw new IdentityError("expired");
+    if (error instanceof errors.JWSInvalid || error instanceof errors.JWTInvalid) {
+      throw new IdentityError("malformed");
+    }
+    throw new IdentityError("invalid_signature");
+  }
+}
+async function signHostRequest(claims, secret, now) {
+  assertStrongSecret(secret);
+  const payload = tokenExchangeRequestSchema.safeParse({
+    ...claims,
+    v: 1,
+    iat: unixNow(now),
+    nonce: randomBytes(16).toString("base64url")
+  });
+  if (!payload.success) throw new IdentityError("malformed");
+  return new SignJWT(payload.data).setProtectedHeader({ alg: "HS256" }).sign(secret);
+}
+async function verifyIdentityAssertion(jws, secret, expectedAud, now) {
+  const parsed = identityAssertionSchema.safeParse(
+    await verifiedPayload(jws, secret, unixNow(now))
+  );
+  if (!parsed.success) throw new IdentityError("malformed");
+  if (parsed.data.aud !== expectedAud) throw new IdentityError("wrong_audience");
+  return parsed.data;
+}
+
+// ../host-sdk/src/handler.ts
+function createRushyChatHandler(opts) {
+  const fetchFn = opts.fetch ?? globalThis.fetch;
+  const gatewayEndpoint = opts.gatewayUrl.endsWith("/v1/chat") ? opts.gatewayUrl : `${opts.gatewayUrl.replace(/\/+$/, "")}/v1/chat`;
+  return async (req) => {
+    const user = await opts.getUser(req);
+    if (!user) {
+      return new Response(JSON.stringify({ error: "unauthorized" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const token = await signHostRequest(
+      {
+        hostUserId: user.id,
+        ...user.name ? { displayName: user.name } : {}
+      },
+      opts.hostSecret
+    );
+    let clientPayload = {};
+    try {
+      const parsed = await req.json();
+      if (typeof parsed === "object" && parsed !== null) {
+        clientPayload = parsed;
+      }
+    } catch {
+    }
+    const forwardPayload = {};
+    if ("message" in clientPayload) {
+      forwardPayload.message = clientPayload.message;
+    }
+    if ("conversationId" in clientPayload && typeof clientPayload.conversationId === "string") {
+      forwardPayload.conversationId = clientPayload.conversationId;
+    }
+    const gatewayResponse = await fetchFn(gatewayEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Rushy-Request": token
+      },
+      body: JSON.stringify(forwardPayload),
+      // Пользователь закрыл чат — шлюз и Onyx прекращают генерацию, а не жгут токены LLM впустую.
+      signal: req.signal
+    });
+    const headers = new Headers();
+    const contentType = gatewayResponse.headers.get("content-type");
+    if (contentType) {
+      headers.set("content-type", contentType);
+    } else {
+      headers.set("content-type", "application/x-ndjson");
+    }
+    const correlationId = gatewayResponse.headers.get("x-correlation-id");
+    if (correlationId) headers.set("x-correlation-id", correlationId);
+    return new Response(gatewayResponse.body, {
+      status: gatewayResponse.status,
+      statusText: gatewayResponse.statusText,
+      headers
+    });
+  };
+}
+
+// ../host-sdk/src/mcp.ts
+import { createHash, timingSafeEqual } from "crypto";
+import { z } from "zod";
+var MAX_BODY_BYTES = 64 * 1024;
+var TOOL_NAME = /^[a-z][a-z0-9_]{0,63}$/;
+var SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"];
+var DEFAULT_VERSION = "2025-06-18";
+var RESPONSE_HEADERS = {
+  "Content-Type": "application/json",
+  "Cache-Control": "no-store"
+};
+function isZodObject(value) {
+  const def = value?._zod?.def;
+  return def?.type === "object";
+}
+function defineRushyTool(tool) {
+  if (!TOOL_NAME.test(tool.name)) {
+    throw new Error("invalid_tool_name");
+  }
+  if (!isZodObject(tool.input)) {
+    throw new Error("invalid_tool_input");
+  }
+  return tool;
+}
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: RESPONSE_HEADERS });
+}
+function rpcResult(id, result) {
+  return jsonResponse({ jsonrpc: "2.0", id, result });
+}
+function rpcError(id, code, message) {
+  return jsonResponse({ jsonrpc: "2.0", id, error: { code, message } });
+}
+function toolError(id, text) {
+  return rpcResult(id, { isError: true, content: [{ type: "text", text }] });
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+async function readBody(req) {
+  const reader = req.body.getReader();
+  const chunks = [];
+  let byteLength = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    byteLength += value.byteLength;
+    if (byteLength > MAX_BODY_BYTES) {
+      await reader.cancel().catch(() => void 0);
+      return null;
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function createRushyMcpHandler(opts) {
+  if (new TextEncoder().encode(opts.serviceToken).byteLength < 32) {
+    throw new Error("weak_service_token");
+  }
+  const expectedAuthorization = createHash("sha256").update(`Bearer ${opts.serviceToken}`).digest();
+  const tools = new Map(opts.tools.map((tool) => [defineRushyTool(tool).name, tool]));
+  if (tools.size !== opts.tools.length) throw new Error("duplicate_tool_name");
+  const schemas = opts.tools.map((tool) => {
+    const { $schema: _schema, ...inputSchema } = z.toJSONSchema(tool.input);
+    return { name: tool.name, description: tool.description, inputSchema };
+  });
+  const serverInfo = opts.serverInfo ?? { name: "rushy-host", version: "0.2.0" };
+  return async (req) => {
+    if (req.method !== "POST") {
+      return new Response(null, {
+        status: 405,
+        headers: { ...RESPONSE_HEADERS, Allow: "POST" }
+      });
+    }
+    const suppliedAuthorization = createHash("sha256").update(req.headers.get("Authorization") ?? "").digest();
+    if (!timingSafeEqual(suppliedAuthorization, expectedAuthorization)) {
+      return jsonResponse({ error: "unauthorized" }, 401);
+    }
+    let body;
+    try {
+      body = await readBody(req);
+    } catch {
+      return rpcError(null, -32700, "Parse error");
+    }
+    if (body === null) return jsonResponse({ error: "payload_too_large" }, 413);
+    let message;
+    try {
+      message = JSON.parse(body);
+    } catch {
+      return rpcError(null, -32700, "Parse error");
+    }
+    if (!isPlainObject(message) || message.jsonrpc !== "2.0" || typeof message.method !== "string") {
+      return rpcError(null, -32600, "Invalid Request");
+    }
+    const id = message.id;
+    if (id === void 0) {
+      return new Response(null, { status: 202, headers: RESPONSE_HEADERS });
+    }
+    if (id !== null && typeof id !== "string" && (typeof id !== "number" || !Number.isFinite(id))) {
+      return rpcError(null, -32600, "Invalid Request");
+    }
+    if (message.method === "initialize") {
+      const params2 = isPlainObject(message.params) ? message.params : {};
+      const requestedVersion = params2.protocolVersion;
+      const protocolVersion = typeof requestedVersion === "string" && SUPPORTED_VERSIONS.includes(requestedVersion) ? requestedVersion : DEFAULT_VERSION;
+      return rpcResult(id, {
+        protocolVersion,
+        capabilities: { tools: { listChanged: false } },
+        serverInfo
+      });
+    }
+    if (message.method === "ping") return rpcResult(id, {});
+    if (message.method === "tools/list") return rpcResult(id, { tools: schemas });
+    if (message.method !== "tools/call") return rpcError(id, -32601, "Method not found");
+    const params = isPlainObject(message.params) ? message.params : {};
+    const tool = typeof params.name === "string" ? tools.get(params.name) : void 0;
+    if (!tool) return rpcError(id, -32602, "Invalid params");
+    let identity;
+    try {
+      identity = await verifyIdentityAssertion(
+        req.headers.get("X-Rushy-Identity") ?? "",
+        opts.identitySecret,
+        opts.audience,
+        opts.now?.()
+      );
+    } catch {
+      return toolError(id, "unauthorized");
+    }
+    let parsed;
+    try {
+      parsed = tool.input.safeParse(params.arguments);
+    } catch {
+      return toolError(id, "invalid_arguments");
+    }
+    if (!parsed.success) return toolError(id, "invalid_arguments");
+    try {
+      const value = await tool.handler(parsed.data, { identity, signal: req.signal });
+      const serialized = JSON.stringify(value);
+      const text = serialized ?? "null";
+      return rpcResult(id, {
+        content: [{ type: "text", text }],
+        ...isPlainObject(value) ? { structuredContent: value } : {}
+      });
+    } catch {
+      return toolError(id, "tool_failed");
+    }
+  };
+}
+export {
+  IdentityError,
+  createRushyChatHandler,
+  createRushyMcpHandler,
+  defineRushyTool,
+  identityAssertionSchema,
+  verifyIdentityAssertion
+};

package/dist/react.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+
+declare const citationSchema: z.ZodObject<{
+    index: z.ZodNumber;
+    documentId: z.ZodString;
+    title: z.ZodString;
+    url: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+type Citation = z.infer<typeof citationSchema>;
+declare const errorCodeSchema: z.ZodEnum<{
+    upstream_unavailable: "upstream_unavailable";
+    upstream_error: "upstream_error";
+    rate_limited: "rate_limited";
+    unauthorized: "unauthorized";
+    forbidden: "forbidden";
+    stream_interrupted: "stream_interrupted";
+}>;
+type ErrorCode = z.infer<typeof errorCodeSchema>;
+
+interface ChatMessage {
+    role: "user" | "assistant";
+    text: string;
+    citations: Citation[];
+    tools: {
+        id: string;
+        name: string;
+        ok?: boolean;
+    }[];
+}
+type ChatStatus = "idle" | "streaming" | "error";
+interface UseRushyChatOptions {
+    endpoint: string;
+}
+interface UseRushyChatResult {
+    messages: ChatMessage[];
+    send: (text: string) => Promise<void>;
+    stop: () => void;
+    status: ChatStatus;
+    error?: ErrorCode;
+}
+declare function useRushyChat(options: UseRushyChatOptions): UseRushyChatResult;
+
+export { type ChatMessage, type ChatStatus, type UseRushyChatOptions, type UseRushyChatResult, useRushyChat };

package/dist/react.js

@@ -0,0 +1,220 @@
+import {
+  uiEventSchema
+} from "./chunk-NOF7HANN.js";
+
+// ../react/src/use-rushy-chat.ts
+import { useCallback, useRef, useState } from "react";
+
+// ../react/src/citation-markers.ts
+var COMPLETE_MARKER = /\[\[(\d+)\]\]\([^)]*\)/g;
+var TRAILING_PARTIAL = /\[\[\d*(?:\]\]?(?:\([^)]*)?)?$/;
+function normalizeCitationMarkers(text) {
+  return text.replace(COMPLETE_MARKER, "[$1]").replace(TRAILING_PARTIAL, "");
+}
+
+// ../react/src/use-rushy-chat.ts
+function useRushyChat(options) {
+  const [messages, setMessages] = useState([]);
+  const [status, setStatus] = useState("idle");
+  const [error, setError] = useState(void 0);
+  const conversationIdRef = useRef(null);
+  const abortControllerRef = useRef(null);
+  const stop = useCallback(() => {
+    if (abortControllerRef.current) {
+      abortControllerRef.current.abort();
+      abortControllerRef.current = null;
+    }
+    setStatus("idle");
+  }, []);
+  const send = useCallback(
+    async (text) => {
+      if (!text.trim()) {
+        return;
+      }
+      setError(void 0);
+      setStatus("streaming");
+      const userMessage = {
+        role: "user",
+        text,
+        citations: [],
+        tools: []
+      };
+      setMessages((prev) => [...prev, userMessage]);
+      const controller = new AbortController();
+      abortControllerRef.current = controller;
+      try {
+        const payload = {
+          message: text
+        };
+        if (conversationIdRef.current) {
+          payload.conversationId = conversationIdRef.current;
+        }
+        const response = await fetch(options.endpoint, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(payload),
+          signal: controller.signal
+        });
+        if (!response.ok) {
+          if (response.status === 401) {
+            setError("unauthorized");
+          } else if (response.status === 403) {
+            setError("forbidden");
+          } else if (response.status === 429) {
+            setError("rate_limited");
+          } else if (response.status >= 500) {
+            setError("upstream_unavailable");
+          } else {
+            setError("upstream_error");
+          }
+          setStatus("error");
+          return;
+        }
+        if (!response.body) {
+          setError("upstream_unavailable");
+          setStatus("error");
+          return;
+        }
+        const assistantMessage = {
+          role: "assistant",
+          text: "",
+          citations: [],
+          tools: []
+        };
+        setMessages((prev) => [...prev, assistantMessage]);
+        const updateAssistant = () => {
+          setMessages((prev) => {
+            if (prev.length === 0) return prev;
+            const updated = [...prev];
+            updated[updated.length - 1] = {
+              role: "assistant",
+              // Наружу — текст без служебной разметки Onyx; сырой копится в assistantMessage.
+              text: normalizeCitationMarkers(assistantMessage.text),
+              citations: [...assistantMessage.citations],
+              tools: assistantMessage.tools.map((t) => ({ ...t }))
+            };
+            return updated;
+          });
+        };
+        const reader = response.body.getReader();
+        const abortHandler = () => {
+          try {
+            void reader.cancel();
+          } catch {
+          }
+        };
+        controller.signal.addEventListener("abort", abortHandler, { once: true });
+        const decoder = new TextDecoder();
+        let buffer = "";
+        let isFirstLine = true;
+        const processLine = (line) => {
+          const trimmed = line.trim();
+          if (!trimmed) return true;
+          let parsed;
+          try {
+            parsed = JSON.parse(trimmed);
+          } catch {
+            return true;
+          }
+          if (isFirstLine) {
+            isFirstLine = false;
+            if (typeof parsed === "object" && parsed !== null && "type" in parsed && parsed.type === "conversation" && "id" in parsed && typeof parsed.id === "string") {
+              conversationIdRef.current = parsed.id;
+              return true;
+            }
+          }
+          const eventResult = uiEventSchema.safeParse(parsed);
+          if (!eventResult.success) {
+            return true;
+          }
+          const event = eventResult.data;
+          switch (event.type) {
+            case "assistant.delta": {
+              assistantMessage.text += event.text;
+              updateAssistant();
+              break;
+            }
+            case "citation": {
+              assistantMessage.citations.push(event.citation);
+              updateAssistant();
+              break;
+            }
+            case "tool.started": {
+              assistantMessage.tools.push({ id: event.id, name: event.name });
+              updateAssistant();
+              break;
+            }
+            case "tool.finished": {
+              const existing = assistantMessage.tools.find((t) => t.id === event.id);
+              if (existing) {
+                existing.ok = event.ok;
+              } else {
+                assistantMessage.tools.push({ id: event.id, name: "", ok: event.ok });
+              }
+              updateAssistant();
+              break;
+            }
+            case "error": {
+              setError(event.code);
+              setStatus("error");
+              return false;
+            }
+            case "message.completed":
+            case "reasoning.delta":
+              break;
+          }
+          return true;
+        };
+        let chunk = await reader.read();
+        while (!chunk.done) {
+          buffer += decoder.decode(chunk.value, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() ?? "";
+          for (const line of lines) {
+            const continueReading = processLine(line);
+            if (!continueReading) {
+              return;
+            }
+          }
+          chunk = await reader.read();
+        }
+        controller.signal.removeEventListener("abort", abortHandler);
+        if (controller.signal.aborted) {
+          setStatus("idle");
+          return;
+        }
+        if (buffer.trim()) {
+          const continueReading = processLine(buffer);
+          if (!continueReading) {
+            return;
+          }
+        }
+        setStatus("idle");
+      } catch {
+        if (controller.signal.aborted) {
+          setStatus("idle");
+          return;
+        }
+        setError("upstream_unavailable");
+        setStatus("error");
+      } finally {
+        if (abortControllerRef.current === controller) {
+          abortControllerRef.current = null;
+        }
+      }
+    },
+    [options.endpoint]
+  );
+  return {
+    messages,
+    send,
+    stop,
+    status,
+    error
+  };
+}
+export {
+  useRushyChat
+};

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "rushy-sdk",
+  "version": "0.2.0",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    "./host": {
+      "types": "./dist/host.d.ts",
+      "import": "./dist/host.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "jose": "6.2.12"
+  },
+  "peerDependencies": {
+    "zod": "^4.3.0",
+    "react": ">=19"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@rushy/host-sdk": "workspace:*",
+    "@rushy/react": "workspace:*",
+    "tsup": "8.5.1",
+    "zod": "4.6.5"
+  }
+}