
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@volara/widget
Advanced tools
Volara embeddable chat widget — a one-line <script> drop-in chat launcher for any website.
Drop a live chat launcher onto any website with a single line of HTML. No framework, no build step on your side, no backend to run. The widget is a tiny, self-contained script that renders a floating button and a chat panel, and talks to Volara over a public, domain-restricted widget key.
<script src="https://cdn.volara.chat/widget.js" data-key="YOUR_WIDGET_KEY" async></script>
Paste that just before </body> (or anywhere in the page — async keeps it out
of your critical path) and you're done.
Heads up: the
cdn.volara.chathost is still being set up. Until it's live you can self-host the builtdist/widget.jsfrom your own static host or CDN and point thesrcat it — everything else works the same.
The widget key is public and safe to ship in your HTML. It only works on the domains you allow-list, and it cannot read or write anything outside the chat session it opens. It is not your secret API key — never put the secret key on a web page.
Configure everything with data-* attributes on the same <script> tag:
| Attribute | Required | Default | What it does |
|---|---|---|---|
data-key | yes | — | Your public widget key. |
data-api | no | https://api.volara.chat | Override the API base URL (mostly for staging/self-host). |
data-color | no | #f97316 (Volara bloom) | Accent color for the launcher, header, and your bubbles. |
data-position | no | bottom-right | bottom-right or bottom-left. |
Example with customization:
<script
src="https://cdn.volara.chat/widget.js"
data-key="wgt_live_abc123"
data-color="#2563eb"
data-position="bottom-left"
async
></script>
localStorage so returning visitors keep their history (scoped per widget key).All requests use the public widget key and a short-lived session token the server issues. The secret API key never touches the browser.
| Call | Purpose |
|---|---|
POST /api/widget/session | Start a session, get a sessionToken. |
POST /api/widget/messages (Bearer token) | Send a visitor message. |
GET /api/widget/messages?since=… (Bearer) | Poll for agent / AI replies. |
The widget builds with a single dev dependency (esbuild).
bun install
bun run --filter @volara/widget build
# emits dist/widget.js (minified, for the CDN) and dist/widget.dev.js (readable)
Open demo.html in a browser to try the dev build locally. Point data-api at
your local backend to test the full flow.
MIT — see LICENSE.
FAQs
Volara embeddable chat widget — a one-line <script> drop-in chat launcher for any website.
The npm package @volara/widget receives a total of 0 weekly downloads. As such, @volara/widget popularity was classified as not popular.
We found that @volara/widget demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.