refactor(attachments): drop nanoid and use the blob URL as the id (CHAT-31)

[rpvilo]

Closes CHAT-31.

nanoid was a runtime dependency for one line: the id in the default attachment convert. That call site already calls URL.createObjectURL(file), which returns a fresh blob:<origin>/<uuid> on every call — so the blob URL now doubles as the id. @floating-ui/dom is the package's only runtime dependency.

• Unique per item, including the same file added twice; works over plain http (no secure-context requirement, unlike crypto.randomUUID).
• No SSR concern: toAttachmentItem takes a File, so it only runs on the client.
• Nothing in the package parses ids; a custom convert can still supply its own (e.g. a storage key).

Also:

• nanoid removed from the root package.json — the app only listed it because it compiles the package source.
• README and quick-start now say one runtime dep, not two.
• New tests/attachments.test.ts: id equals the blob URL; same file twice gets distinct ids.
• Changeset: patch.

Summary by CodeRabbit

• Changes
  • Attachment IDs now use their corresponding blob URLs, while repeated conversions of the same file still produce distinct IDs.
  • The chat package no longer lists nanoid as a runtime dependency.
• Documentation
  • Updated the quick-start guide and package README to reflect the runtime dependency change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
intentface-chat	Ready	Preview	Oct 13, 2026 5:09pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f6975410-3472-446f-8b43-84c6713d9885

📥 Commits

Reviewing files that changed from the base of the PR and between e16ad77 and bc78ffd.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .changeset/drop-nanoid.md
• content/docs/quick-start.mdx
• package.json
• packages/chat/README.md
• packages/chat/package.json
• packages/chat/src/attachments/attachments.tsx
• packages/chat/tests/attachments.test.ts

💤 Files with no reviewable changes (1)

• package.json

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: verify
• GitHub Check: react-doctor
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

📓 Path-based instructions (2)

Source excerpt: Published primitives use **namespace exports**, not `Object.assign`, and the root is explicit: ``, never ``.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• packages/chat/package.json
• packages/chat/README.md
• packages/chat/src/attachments/attachments.tsx
• packages/chat/tests/attachments.test.ts

Source excerpt: Every component must use the compound component pattern — via `Object.assign` in `components/ai/` and `components/ui/`, via namespace exports in `packages/chat/` (see Component Architecture above).

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• packages/chat/src/attachments/attachments.tsx

🔇 Additional comments (6)

packages/chat/src/attachments/attachments.tsx (1)

39-44: LGTM!

packages/chat/tests/attachments.test.ts (1)

1-19: LGTM!

.changeset/drop-nanoid.md (1)

1-5: LGTM!

packages/chat/package.json (1)

103-103: LGTM!

content/docs/quick-start.mdx (1)

15-17: LGTM!

packages/chat/README.md (1)

60-62: LGTM!

📝 Walkthrough

The default attachment conversion now uses its blob URL as both the attachment ID and URL. The package removes nanoid from its runtime dependencies, and tests cover matching and distinct IDs.

Changes: Attachment ID update

Layer / File(s)	Summary
Use blob URLs as attachment IDs packages/chat/src/attachments/attachments.tsx, packages/chat/tests/attachments.test.ts, .changeset/drop-nanoid.md	toAttachmentItem assigns the generated blob URL to both id and url. Tests check that these values match and that repeated conversions produce distinct IDs. The changeset records the behavior.
Remove nanoid dependency package.json, packages/chat/package.json, content/docs/quick-start.mdx, packages/chat/README.md	The manifests remove nanoid. The documentation lists @floating-ui/dom as the only runtime dependency.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to bc78f

The default attachment ID now matches its blob URL, and the package no longer needs nanoid at runtime. No actionable behavior or dependency issue is established, so the change appears ready for normal checks.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: removing nanoid and using the blob URL as the attachment ID.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit bc78ffd.}