@aprovan/chat-backend 0.1.0-dev.4d82df8

package/src/routes/chat.ts

@@ -0,0 +1,235 @@
+import { withTracing } from "@posthog/ai";
+import {
+  streamText,
+  convertToModelMessages,
+  wrapLanguageModel,
+  stepCountIs,
+  jsonSchema,
+  type LanguageModelMiddleware,
+  type UIMessage,
+  type Tool,
+} from "ai";
+import { Hono } from "hono";
+import { z } from "zod";
+import { CHAT_PROMPT_ALLOWLIST } from "../fallback-prompts.js";
+import {
+  evictGatewaySession,
+  getGatewaySession,
+  getCachedTools,
+  setCachedTools,
+} from "../gateway-session.js";
+import { getPrompt, compilePrompt, getPostHogClient } from "../posthog.js";
+import {
+  getOpenRouterKey,
+  createOpenRouterProvider,
+} from "../providers/openrouter.js";
+import { getToolDocs, makeHttpGatewayClient } from "../tool-docs.js";
+import type { AppVariables } from "../types.js";
+
+const chatBodySchema = z.object({
+  id: z.string(),
+  messages: z.array(z.any()),
+  trigger: z.string(),
+  model: z.string().optional(),
+  metadata: z.unknown().optional(),
+  prompt: z
+    .object({
+      id: z.string(),
+      vars: z
+        .object({
+          compilers: z.array(z.string()).optional(),
+        })
+        .optional(),
+    })
+    .optional(),
+});
+
+// Retry once (200 ms backoff) if the provider rejects before the first
+// streamed byte. Once doStream() resolves (headers received, 2xx), the
+// connection is committed and mid-stream errors surface as error UI parts.
+const retryAtStartMiddleware: LanguageModelMiddleware = {
+  specificationVersion: "v3",
+  async wrapStream({ doStream }) {
+    try {
+      return await doStream();
+    } catch {
+      await new Promise<void>((r) => setTimeout(r, 200));
+      return doStream();
+    }
+  },
+};
+
+export const chatRoute = new Hono<{ Variables: AppVariables }>();
+
+interface GatewayToolEntry {
+  provider: string;
+  name: string;
+  operation: string;
+  description?: string;
+  inputSchema?: unknown;
+}
+
+async function fetchGatewayTools(
+  gatewayUrl: string,
+  bearerToken: string,
+): Promise<GatewayToolEntry[]> {
+  const res = await fetch(`${gatewayUrl}/tools`, {
+    headers: { Authorization: `Bearer ${bearerToken}` },
+  });
+  if (!res.ok) return [];
+  const data = (await res.json()) as { tools: GatewayToolEntry[] };
+  return data.tools ?? [];
+}
+
+function buildTools(
+  gatewayTools: GatewayToolEntry[],
+  gatewayUrl: string,
+  bearerToken: string,
+): Record<string, Tool> {
+  const tools: Record<string, Tool> = {};
+
+  for (const t of gatewayTools) {
+    // Replace dots with underscores — some models reject dots in function names.
+    const toolKey = t.name.replace(/\./g, "_");
+
+    const rawSchema =
+      t.inputSchema && typeof t.inputSchema === "object"
+        ? t.inputSchema
+        : { type: "object", properties: {} };
+
+    const parameters = jsonSchema<Record<string, unknown>>(
+      rawSchema as Parameters<typeof jsonSchema>[0],
+    );
+
+    const execute = async (args: Record<string, unknown>): Promise<unknown> => {
+      const res = await fetch(`${gatewayUrl}/tools/${t.provider}/${t.operation}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${bearerToken}`,
+        },
+        body: JSON.stringify(args),
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({ error: res.statusText }));
+        return { error: (err as { error?: string }).error ?? res.statusText };
+      }
+      return res.json();
+    };
+
+    tools[toolKey] = {
+      description: t.description ?? `Call ${t.name}`,
+      parameters,
+      execute,
+    } as unknown as Tool;
+  }
+
+  return tools;
+}
+
+chatRoute.post("/", async (c) => {
+  const body = await c.req.json().catch(() => null);
+  const parsed = chatBodySchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request body" }, 400);
+  }
+
+  const { messages, model: requestedModel, prompt: promptBody } = parsed.data;
+  const claims = c.get("claims");
+  const workspaceId = c.get("workspaceId");
+  const workspace = c.get("workspace");
+
+  if (requestedModel !== undefined && !workspace.limits.maxModels.includes(requestedModel)) {
+    return c.json(
+      { error: "Model not allowed on your current plan", model: requestedModel },
+      403,
+    );
+  }
+
+  const promptId = promptBody?.id ?? "chat-patchwork-widget";
+  if (!CHAT_PROMPT_ALLOWLIST.has(promptId)) {
+    return c.json({ error: "Unknown prompt id" }, 400);
+  }
+
+  // Gateway tools are additive — chat works without them.
+  const gatewayUrl = process.env["GATEWAY_URL"]?.replace(/\/$/, "");
+  let sessionToken: string | null = null;
+
+  if (gatewayUrl) {
+    const authHeader = c.req.header("Authorization") ?? "";
+    const cognitoToken = authHeader.replace(/^Bearer /, "");
+    try {
+      const session = await getGatewaySession(claims, workspaceId, cognitoToken);
+      sessionToken = session.token;
+    } catch {
+      // Non-fatal — continue without gateway tools
+    }
+  }
+
+  let gatewayTools: GatewayToolEntry[] = [];
+  if (sessionToken && gatewayUrl) {
+    const cached = getCachedTools(claims.sub) as GatewayToolEntry[] | undefined;
+    if (cached) {
+      gatewayTools = cached;
+    } else {
+      gatewayTools = await fetchGatewayTools(gatewayUrl, sessionToken).catch(
+        () => [] as GatewayToolEntry[],
+      );
+      if (gatewayTools.length === 0) {
+        evictGatewaySession(claims.sub);
+      } else {
+        setCachedTools(claims.sub, gatewayTools);
+      }
+    }
+  }
+
+  const tools =
+    sessionToken && gatewayUrl
+      ? buildTools(gatewayTools, gatewayUrl, sessionToken)
+      : {};
+
+  // Load system prompt from PostHog (cached, with fallback to bundled copy)
+  const gatewayClient = gatewayUrl ? makeHttpGatewayClient(gatewayUrl) : null;
+  const [promptResult, toolDocs] = await Promise.all([
+    getPrompt(promptId),
+    getToolDocs(gatewayClient).catch(() => ""),
+  ]);
+  const compilers = (promptBody?.vars?.compilers ?? []).join(", ");
+  const systemPrompt = compilePrompt(promptResult.prompt, {
+    compilers,
+    tool_docs: toolDocs,
+  });
+
+  const apiKey = await getOpenRouterKey();
+  const provider = createOpenRouterProvider(apiKey);
+  const modelId = requestedModel ?? workspace.limits.maxModels[0] ?? "openrouter/auto";
+  const baseModel = provider(modelId);
+
+  const phClient = getPostHogClient();
+  const tracedModel =
+    phClient && promptResult.source !== "code_fallback"
+      ? withTracing(baseModel, phClient, {
+          posthogDistinctId: claims.sub,
+          posthogProperties: {
+            $ai_prompt_name: promptResult.name,
+            $ai_prompt_version: promptResult.version,
+          },
+        })
+      : baseModel;
+
+  const model = wrapLanguageModel({
+    model: tracedModel,
+    middleware: retryAtStartMiddleware,
+  });
+
+  const result = streamText({
+    model,
+    system: systemPrompt,
+    messages: await convertToModelMessages(messages as UIMessage[]),
+    stopWhen: stepCountIs(workspace.limits.maxToolSteps),
+    maxOutputTokens: workspace.limits.maxTokensPerRequest,
+    tools,
+  });
+
+  return result.toUIMessageStreamResponse();
+});

package/src/routes/edit.ts

@@ -0,0 +1,57 @@
+import { withTracing } from "@posthog/ai";
+import { streamText } from "ai";
+import { Hono } from "hono";
+import { z } from "zod";
+import { EDIT_PROMPT_ID } from "../fallback-prompts.js";
+import { getPrompt, compilePrompt, getPostHogClient } from "../posthog.js";
+import {
+  getOpenRouterKey,
+  createOpenRouterProvider,
+} from "../providers/openrouter.js";
+import type { AppVariables } from "../types.js";
+
+const editBodySchema = z.object({
+  code: z.string(),
+  prompt: z.string(),
+});
+
+const MODEL_ID = "openrouter/auto";
+
+export const editRoute = new Hono<{ Variables: AppVariables }>();
+
+editRoute.post("/", async (c) => {
+  const body = await c.req.json().catch(() => null);
+  const parsed = editBodySchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request body" }, 400);
+  }
+
+  const promptResult = await getPrompt(EDIT_PROMPT_ID);
+  const systemPrompt = compilePrompt(promptResult.prompt, {
+    code: parsed.data.code,
+  });
+
+  const apiKey = await getOpenRouterKey();
+  const provider = createOpenRouterProvider(apiKey);
+  const baseModel = provider(MODEL_ID);
+
+  const phClient = getPostHogClient();
+  const model =
+    phClient && promptResult.source !== "code_fallback"
+      ? withTracing(baseModel, phClient, {
+          posthogDistinctId: "chat-api",
+          posthogProperties: {
+            $ai_prompt_name: promptResult.name,
+            $ai_prompt_version: promptResult.version,
+          },
+        })
+      : baseModel;
+
+  const result = streamText({
+    model,
+    system: systemPrompt,
+    messages: [{ role: "user", content: parsed.data.prompt }],
+  });
+
+  return result.toTextStreamResponse();
+});

package/src/routes/health.ts

@@ -0,0 +1,7 @@
+import { Hono } from "hono";
+
+const health = new Hono();
+
+health.get("/health", (c) => c.json({ status: "ok" }));
+
+export { health };

package/src/routes/proxy.ts

@@ -0,0 +1,60 @@
+/**
+ * POST /api/proxy/:ns/:proc
+ *
+ * Forwards the request body to `POST <gateway>/tools/:ns/:proc` using the
+ * caller's gateway session bearer. This keeps tool invocations server-side
+ * (credentials never reach the browser).
+ */
+
+import { Hono } from "hono";
+import { evictGatewaySession, GatewaySessionError, getGatewaySession } from "../gateway-session.js";
+import type { AppVariables } from "../types.js";
+
+export const proxy = new Hono<{ Variables: AppVariables }>();
+
+proxy.post("/:ns/:proc{.*}", async (c) => {
+  const claims = c.get("claims");
+  const workspaceId = c.get("workspaceId");
+
+  const ns = c.req.param("ns");
+  const proc = c.req.param("proc");
+
+  const authHeader = c.req.header("Authorization")!;
+  const cognitoToken = authHeader.slice("Bearer ".length);
+
+  let sessionToken: string;
+  try {
+    const session = await getGatewaySession(claims, workspaceId, cognitoToken);
+    sessionToken = session.token;
+  } catch (err) {
+    if (err instanceof GatewaySessionError && err.status === 401) {
+      return c.json({ error: "Gateway session setup failed" }, 401);
+    }
+    return c.json({ error: "Failed to connect to gateway" }, 502);
+  }
+
+  let body: unknown = {};
+  try {
+    body = await c.req.json();
+  } catch {
+    // empty body is fine
+  }
+
+  const gatewayUrl = process.env["GATEWAY_URL"]!.replace(/\/$/, "");
+  const res = await fetch(`${gatewayUrl}/tools/${ns}/${proc}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${sessionToken}`,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (res.status === 401) {
+    evictGatewaySession(claims.sub);
+    return c.json({ error: "Gateway authentication failed" }, 502);
+  }
+
+  const responseData = await res.json();
+  return c.json(responseData, res.status as 200);
+});

package/src/routes/services.ts

@@ -0,0 +1,82 @@
+/**
+ * GET /api/services
+ *
+ * Fetches the gateway's tool list and returns a service summary the frontend
+ * uses to populate namespace suggestions and the ServicesInspector panel.
+ *
+ * Response shape:
+ *   { namespaces: string[], services: ServiceInfo[] }
+ *
+ * where ServiceInfo matches the frontend's expected `ServiceInfo` type:
+ *   { namespace: string, name: string, description?: string }
+ */
+
+import { Hono } from "hono";
+import { evictGatewaySession, GatewaySessionError, getGatewaySession } from "../gateway-session.js";
+import type { AppVariables } from "../types.js";
+
+export interface ServiceInfo {
+  namespace: string;
+  name: string;
+  procedure: string;
+  description: string;
+  parameters?: Record<string, unknown>;
+}
+
+export const services = new Hono<{ Variables: AppVariables }>();
+
+services.get("/", async (c) => {
+  const claims = c.get("claims");
+  const workspaceId = c.get("workspaceId");
+
+  const authHeader = c.req.header("Authorization")!;
+  const cognitoToken = authHeader.slice("Bearer ".length);
+
+  let sessionToken: string;
+  try {
+    const session = await getGatewaySession(claims, workspaceId, cognitoToken);
+    sessionToken = session.token;
+  } catch (err) {
+    if (err instanceof GatewaySessionError && err.status === 401) {
+      return c.json({ error: "Gateway session setup failed" }, 401);
+    }
+    return c.json({ error: "Failed to connect to gateway" }, 502);
+  }
+
+  const gatewayUrl = process.env["GATEWAY_URL"]!.replace(/\/$/, "");
+  const res = await fetch(`${gatewayUrl}/tools`, {
+    headers: { Authorization: `Bearer ${sessionToken}` },
+  });
+
+  if (res.status === 401) {
+    evictGatewaySession(claims.sub);
+    return c.json({ error: "Gateway authentication failed" }, 502);
+  }
+
+  if (!res.ok) {
+    return c.json({ error: "Gateway tools fetch failed" }, 502);
+  }
+
+  const data = await res.json() as {
+    tools: Array<{
+      provider: string;
+      name: string;
+      operation: string;
+      description?: string;
+      inputSchema?: unknown;
+    }>;
+    workspace_id: string;
+  };
+
+  const serviceList: ServiceInfo[] = data.tools.map((t) => ({
+    namespace: t.provider,
+    name: t.name,
+    procedure: t.operation,
+    description: t.description ?? "",
+    parameters: t.inputSchema as Record<string, unknown> | undefined,
+  }));
+
+  const namespaces = Array.from(new Set(data.tools.map((t) => t.provider)));
+
+  return c.json({ namespaces, services: serviceList });
+});

package/src/routes/workspaces.ts

@@ -0,0 +1,89 @@
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { BatchGetCommand, DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb";
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { listWorkspaceMemberships } from "../middleware/workspace.js";
+import { getSessionWorkspaceId, setSessionWorkspaceId } from "../session.js";
+import type { AppVariables, WorkspaceItem } from "../types.js";
+
+let ddbClient: DynamoDBDocumentClient | null = null;
+
+function getDdb() {
+  if (!ddbClient) {
+    ddbClient = DynamoDBDocumentClient.from(
+      new DynamoDBClient({ region: process.env["AWS_REGION"] }),
+    );
+  }
+  return ddbClient;
+}
+
+async function batchGetWorkspaces(
+  workspaceIds: string[],
+): Promise<WorkspaceItem[]> {
+  if (workspaceIds.length === 0) return [];
+  const tableName = process.env["WORKSPACE_TABLE_NAME"]!;
+  const result = await getDdb().send(
+    new BatchGetCommand({
+      RequestItems: {
+        [tableName]: { Keys: workspaceIds.map((id) => ({ workspaceId: id })) },
+      },
+    }),
+  );
+  return (result.Responses?.[tableName] ?? []) as WorkspaceItem[];
+}
+
+export const workspacesRoute = new Hono<{ Variables: AppVariables }>();
+
+workspacesRoute.get("/", async (c) => {
+  const claims = c.get("claims");
+  const userSub = claims.sub;
+
+  const [workspaceIds, activeWorkspaceId] = await Promise.all([
+    listWorkspaceMemberships(userSub),
+    getSessionWorkspaceId(userSub),
+  ]);
+
+  const workspaces = await batchGetWorkspaces(workspaceIds);
+
+  const effectiveActiveId =
+    activeWorkspaceId && workspaceIds.includes(activeWorkspaceId)
+      ? activeWorkspaceId
+      : (workspaceIds[0] ?? null);
+
+  const sorted = workspaceIds
+    .map((id) => workspaces.find((w) => w.workspaceId === id))
+    .filter((w): w is WorkspaceItem => w !== undefined);
+
+  return c.json({
+    workspaces: sorted.map((w) => ({
+      workspaceId: w.workspaceId,
+      name: w.name,
+      plan: w.plan,
+      active: w.workspaceId === effectiveActiveId,
+    })),
+    activeWorkspaceId: effectiveActiveId,
+  });
+});
+
+const setActiveSchema = z.object({
+  workspaceId: z.string().min(1),
+});
+
+workspacesRoute.put(
+  "/active",
+  zValidator("json", setActiveSchema),
+  async (c) => {
+    const claims = c.get("claims");
+    const userSub = claims.sub;
+    const { workspaceId } = c.req.valid("json");
+
+    const workspaceIds = await listWorkspaceMemberships(userSub);
+    if (!workspaceIds.includes(workspaceId)) {
+      return c.json({ error: "Not a member of this workspace" }, 403);
+    }
+
+    await setSessionWorkspaceId(userSub, workspaceId);
+    return c.json({ activeWorkspaceId: workspaceId });
+  },
+);

package/src/session.ts

@@ -0,0 +1,80 @@
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient,
+  GetCommand,
+  PutCommand,
+} from "@aws-sdk/lib-dynamodb";
+
+const SESSION_CACHE_TTL_MS = 15_000;
+
+interface SessionCacheEntry {
+  activeWorkspaceId: string | null;
+  fetchedAt: number;
+}
+
+const sessionCache = new Map<string, SessionCacheEntry>();
+
+let ddbClient: DynamoDBDocumentClient | null = null;
+
+function getDdb() {
+  if (!ddbClient) {
+    ddbClient = DynamoDBDocumentClient.from(
+      new DynamoDBClient({ region: process.env["AWS_REGION"] }),
+    );
+  }
+  return ddbClient;
+}
+
+function tableName(): string {
+  return process.env["USER_SESSIONS_TABLE_NAME"]!;
+}
+
+export async function getSessionWorkspaceId(
+  userSub: string,
+): Promise<string | null> {
+  const now = Date.now();
+  const cached = sessionCache.get(userSub);
+  if (cached && now - cached.fetchedAt < SESSION_CACHE_TTL_MS) {
+    return cached.activeWorkspaceId;
+  }
+
+  const result = await getDdb().send(
+    new GetCommand({
+      TableName: tableName(),
+      Key: { userSub },
+    }),
+  );
+
+  const activeWorkspaceId =
+    (result.Item?.activeWorkspaceId as string | undefined) ?? null;
+  sessionCache.set(userSub, { activeWorkspaceId, fetchedAt: now });
+  return activeWorkspaceId;
+}
+
+export async function setSessionWorkspaceId(
+  userSub: string,
+  workspaceId: string,
+): Promise<void> {
+  await getDdb().send(
+    new PutCommand({
+      TableName: tableName(),
+      Item: {
+        userSub,
+        activeWorkspaceId: workspaceId,
+        updatedAt: new Date().toISOString(),
+      },
+    }),
+  );
+  sessionCache.set(userSub, {
+    activeWorkspaceId: workspaceId,
+    fetchedAt: Date.now(),
+  });
+}
+
+export function clearSessionCache(userSub: string): void {
+  sessionCache.delete(userSub);
+}
+
+export function resetSessionCache(): void {
+  sessionCache.clear();
+}

package/src/tool-docs.ts

@@ -0,0 +1,77 @@
+export interface ToolInfo {
+  namespace: string;
+  name: string;
+  description?: string;
+}
+
+export interface GatewayClient {
+  listTools(): Promise<ToolInfo[]>;
+}
+
+// Module-scope cache — 60 s TTL, survives Lambda warm invocations
+let _cachedToolDocs = "";
+let _toolDocsCachedAt = 0;
+const TOOL_DOCS_TTL_MS = 60_000;
+
+export async function getToolDocs(
+  gateway: GatewayClient | null,
+): Promise<string> {
+  if (!gateway) return "";
+
+  const now = Date.now();
+  if (_cachedToolDocs && now - _toolDocsCachedAt < TOOL_DOCS_TTL_MS) {
+    return _cachedToolDocs;
+  }
+
+  const tools = await gateway.listTools();
+  _cachedToolDocs = renderToolDocs(tools);
+  _toolDocsCachedAt = now;
+  return _cachedToolDocs;
+}
+
+function renderToolDocs(tools: ToolInfo[]): string {
+  if (tools.length === 0) return "";
+
+  const byNamespace = new Map<string, ToolInfo[]>();
+  for (const tool of tools) {
+    const existing = byNamespace.get(tool.namespace) ?? [];
+    existing.push(tool);
+    byNamespace.set(tool.namespace, existing);
+  }
+
+  const namespaces = [...byNamespace.keys()];
+  let doc = `## Services\n\nThe following services are available for generated widgets to call:\n\n`;
+
+  for (const [ns, nsTools] of byNamespace) {
+    doc += `### \`${ns}\`\n`;
+    for (const tool of nsTools) {
+      doc += `- \`${ns}.${tool.name}()\``;
+      if (tool.description) doc += `: ${tool.description}`;
+      doc += "\n";
+    }
+    doc += "\n";
+  }
+
+  const firstNs = namespaces[0] ?? "service";
+  const firstTool = byNamespace.get(firstNs)?.[0]?.name ?? "example";
+  doc += `**Usage in widgets:**
+\`\`\`tsx
+// Services are available as global namespaces
+const result = await ${firstNs}.${firstTool}({ /* args */ });
+\`\`\`
+
+Make sure to handle loading states and errors when calling services.
+`;
+
+  return doc;
+}
+
+export function makeHttpGatewayClient(gatewayUrl: string): GatewayClient {
+  return {
+    async listTools(): Promise<ToolInfo[]> {
+      const res = await fetch(`${gatewayUrl}/tools`);
+      if (!res.ok) throw new Error(`Gateway returned ${res.status}`);
+      return res.json() as Promise<ToolInfo[]>;
+    },
+  };
+}