@bdocs/plugin-ask-ai 0.3.0 → 0.4.0

package/dist/server/index.mjs

@@ -1,36 +1,31 @@
+import { a as createAdapterHeaders, c as checkInputSafety, d as buildUserPrompt, n as rateLimit, r as pickClientContext, s as DEFAULT_DENY_PATTERNS } from "../rate-limit-eZ04302C.mjs";
 import OpenAI from "openai";
+//#region src/server/errors.ts
+const AI_NOT_CONFIGURED = "AI_NOT_CONFIGURED";
+const AI_PROVIDER_ERROR = "AI_PROVIDER_ERROR";
+const AI_TIMEOUT = "AI_TIMEOUT";
+const ADAPTER_ERROR = "ADAPTER_ERROR";
+/** Never return arbitrary upstream/parser messages to an untrusted client. */
+function toPublicProviderError() {
+	return AI_PROVIDER_ERROR;
+}
+//#endregion
 //#region src/server/handler.ts
 const STREAM_TIMEOUT_MS = 6e4;
-const DOCS_START = "<<<DOCS_START>>>";
-const DOCS_END = "<<<DOCS_END>>>";
-function escapeDocsMarkers(s) {
-	return s.replace(/<<<DOCS_(START|END)>>>/g, "<DOCS_$1>");
-}
-function buildUserPrompt(question, context) {
-	if (!context || !context.content) return `${DOCS_START}\n(no documentation page in scope — reply "Not in docs." for any Boltdocs question)\n${DOCS_END}\n\nUser Question: ${question}`;
-	return [
-		DOCS_START,
-		`[Page: ${context.page}]`,
-		escapeDocsMarkers(context.content),
-		DOCS_END,
-		"",
-		`User Question: ${question}`
-	].join("\n");
-}
 async function streamLLMResponse(options, onEvent) {
-	const { model, systemPrompt, question, context, maxOutputTokens, baseURL, env, signal, provider = "openai", providerEnvKey = "OPENAI_API_KEY", devMode = false } = options;
+	const { model, systemPrompt, question, context, maxOutputTokens, baseURL, env, signal, provider = "openai", providerEnvKey = "OPENAI_API_KEY", devMode = false, temperature = .3, topP = 1 } = options;
 	const apiKey = env[providerEnvKey];
 	if (!apiKey) {
 		onEvent({
 			type: "error",
-			data: `${providerEnvKey} is not set in the server environment.`
+			data: AI_NOT_CONFIGURED
 		});
 		return;
 	}
 	const userPrompt = buildUserPrompt(question, context);
 	const openai = new OpenAI({
 		apiKey,
-		baseURL: baseURL || env.OPENAI_BASE_URL || void 0
+		baseURL: baseURL || (provider === "openai" ? env.OPENAI_BASE_URL : void 0)
 	});
 	const timeoutController = new AbortController();
 	const combinedController = new AbortController();
@@ -38,7 +33,9 @@ async function streamLLMResponse(options, onEvent) {
 	const onExternalAbort = () => {
 		if (!combinedController.signal.aborted) combinedController.abort();
 	};
+	let timedOut = false;
 	const onTimeoutAbort = () => {
+		timedOut = true;
 		if (!combinedController.signal.aborted) combinedController.abort();
 	};
 	if (externalSignal) if (externalSignal.aborted) onExternalAbort();
@@ -50,6 +47,8 @@ async function streamLLMResponse(options, onEvent) {
 		const stream = await openai.chat.completions.create({
 			model,
 			max_tokens: maxOutputTokens,
+			temperature,
+			top_p: topP,
 			stream: true,
 			stream_options: { include_usage: true },
 			messages: [{
@@ -75,6 +74,13 @@ async function streamLLMResponse(options, onEvent) {
 				completionTokens = usage.completion_tokens ?? completionTokens;
 			}
 		}
+		if (timedOut) {
+			onEvent({
+				type: "error",
+				data: AI_TIMEOUT
+			});
+			return;
+		}
 		if (devMode && (promptTokens > 0 || completionTokens > 0)) onEvent({
 			type: "usage",
 			data: {
@@ -87,11 +93,11 @@ async function streamLLMResponse(options, onEvent) {
 			}
 		});
 		if (!externalSignal?.aborted && !combinedController.signal.aborted) onEvent({ type: "done" });
-	} catch (err) {
-		if (externalSignal?.aborted || combinedController.signal.aborted) return;
+	} catch {
+		if (externalSignal?.aborted) return;
 		onEvent({
 			type: "error",
-			data: err instanceof Error ? err.message : "OpenAI request failed"
+			data: timedOut ? AI_TIMEOUT : toPublicProviderError()
 		});
 	} finally {
 		clearTimeout(timeoutId);
@@ -100,4 +106,315 @@ async function streamLLMResponse(options, onEvent) {
 	}
 }
 //#endregion
-export { streamLLMResponse };
+//#region src/server/adapters/sse.ts
+function eventToSse(event) {
+	switch (event.type) {
+		case "context": return `data: ${JSON.stringify({ context: event.data })}\n\n`;
+		case "text": return `data: ${JSON.stringify({ text: event.data })}\n\n`;
+		case "usage": return `data: ${JSON.stringify({ usage: event.data })}\n\n`;
+		case "error": return `data: ${JSON.stringify({ error: event.data })}\n\n`;
+		case "done": return "";
+	}
+}
+const DONE_SSE = "data: [DONE]\n\n";
+//#endregion
+//#region src/server/adapters/security.ts
+function isAuthorized(config, headers) {
+	if (!config.secretKey) return true;
+	return headers.get("x-boltdocs-ask-ai-key") === config.secretKey;
+}
+function validateClientContext(config, body, headers) {
+	if (!body || typeof body !== "object" || !("context" in body)) return null;
+	if (config.allowClientContext || Boolean(config.secretKey) && isAuthorized(config, headers)) return null;
+	return "CLIENT_CONTEXT_NOT_ALLOWED";
+}
+function validateQuestion(config, body) {
+	const question = body && typeof body === "object" && "question" in body ? body.question : void 0;
+	const safety = checkInputSafety(typeof question === "string" ? question : "", config.maxInputChars ?? 2e3, DEFAULT_DENY_PATTERNS);
+	return safety.ok ? null : safety.reason;
+}
+function checkAdapterRateLimit(config, ip) {
+	return rateLimit(ip, config.rateLimitPerMinute ?? 30);
+}
+//#endregion
+//#region src/server/adapters/stream-options.ts
+function createStreamOptions(config, question, context, env, signal) {
+	const provider = config.provider ?? "openai";
+	const providerEnvKey = config.providerEnvKey ?? "OPENAI_API_KEY";
+	const providerEnv = {
+		[providerEnvKey]: env[providerEnvKey],
+		OPENAI_BASE_URL: env.OPENAI_BASE_URL
+	};
+	return {
+		model: config.model,
+		systemPrompt: config.systemPrompt,
+		question,
+		context,
+		maxOutputTokens: config.maxOutputTokens ?? 600,
+		baseURL: config.baseURL,
+		env: providerEnv,
+		provider,
+		providerEnvKey,
+		signal,
+		devMode: config.devMode ?? false,
+		temperature: config.temperature,
+		topP: config.topP
+	};
+}
+//#endregion
+//#region src/server/adapters/aws.ts
+async function handleAwsAskAi(event, config, env = process.env) {
+	const requestHeaders = new Headers(event.headers ?? {});
+	const responseHeaders = createAdapterHeaders(config, requestHeaders.get("origin"));
+	if (event.httpMethod === "OPTIONS") return {
+		statusCode: 200,
+		headers: responseHeaders,
+		body: ""
+	};
+	if (event.httpMethod !== "POST") return {
+		statusCode: 405,
+		headers: responseHeaders,
+		body: JSON.stringify({ error: "Method Not Allowed" })
+	};
+	try {
+		const bodyText = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
+		if (new TextEncoder().encode(bodyText).byteLength > (config.maxRequestBytes ?? 65536)) return {
+			statusCode: 413,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: "REQUEST_TOO_LARGE" })
+		};
+		const payload = bodyText ? JSON.parse(bodyText) : {};
+		if (!isAuthorized(config, requestHeaders)) return {
+			statusCode: 401,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: "UNAUTHORIZED" })
+		};
+		const contextError = validateClientContext(config, payload, requestHeaders);
+		if (contextError) return {
+			statusCode: 403,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: contextError })
+		};
+		const questionError = validateQuestion(config, payload);
+		if (questionError) return {
+			statusCode: 400,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: questionError })
+		};
+		const rate = checkAdapterRateLimit(config, requestHeaders.get("x-forwarded-for") || "unknown");
+		if (!rate.ok) return {
+			statusCode: 429,
+			headers: {
+				...responseHeaders,
+				"Retry-After": String(rate.retryAfter)
+			},
+			body: JSON.stringify({ error: "RATE_LIMITED" })
+		};
+		const question = payload.question;
+		const context = pickClientContext(payload, config.contextChars ?? 6e3);
+		const parts = [];
+		await streamLLMResponse(createStreamOptions(config, question, context, env), (event) => {
+			const sse = eventToSse(event);
+			if (sse) parts.push(sse);
+		});
+		parts.push(DONE_SSE);
+		return {
+			statusCode: 200,
+			headers: responseHeaders,
+			body: parts.join("")
+		};
+	} catch {
+		return {
+			statusCode: 500,
+			headers: responseHeaders,
+			body: `data: ${JSON.stringify({ error: ADAPTER_ERROR })}\n\n${DONE_SSE}`
+		};
+	}
+}
+//#endregion
+//#region src/server/adapters/netlify.ts
+async function handleNetlifyAskAi(event, config, env = process.env) {
+	const requestHeaders = new Headers(event.headers ?? {});
+	const responseHeaders = createAdapterHeaders(config, requestHeaders.get("origin"));
+	if (event.httpMethod === "OPTIONS") return {
+		statusCode: 200,
+		headers: responseHeaders,
+		body: ""
+	};
+	if (event.httpMethod !== "POST") return {
+		statusCode: 405,
+		headers: responseHeaders,
+		body: JSON.stringify({ error: "Method Not Allowed" })
+	};
+	try {
+		const bodyText = event.body ?? "";
+		if (new TextEncoder().encode(bodyText).byteLength > (config.maxRequestBytes ?? 65536)) return {
+			statusCode: 413,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: "REQUEST_TOO_LARGE" })
+		};
+		const payload = bodyText ? JSON.parse(bodyText) : {};
+		if (!isAuthorized(config, requestHeaders)) return {
+			statusCode: 401,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: "UNAUTHORIZED" })
+		};
+		const contextError = validateClientContext(config, payload, requestHeaders);
+		if (contextError) return {
+			statusCode: 403,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: contextError })
+		};
+		const questionError = validateQuestion(config, payload);
+		if (questionError) return {
+			statusCode: 400,
+			headers: responseHeaders,
+			body: JSON.stringify({ error: questionError })
+		};
+		const rate = checkAdapterRateLimit(config, requestHeaders.get("x-forwarded-for") || "unknown");
+		if (!rate.ok) return {
+			statusCode: 429,
+			headers: {
+				...responseHeaders,
+				"Retry-After": String(rate.retryAfter)
+			},
+			body: JSON.stringify({ error: "RATE_LIMITED" })
+		};
+		const question = payload.question;
+		const context = pickClientContext(payload, config.contextChars ?? 6e3);
+		const parts = [];
+		await streamLLMResponse(createStreamOptions(config, question, context, env), (event) => {
+			const sse = eventToSse(event);
+			if (sse) parts.push(sse);
+		});
+		parts.push(DONE_SSE);
+		return {
+			statusCode: 200,
+			headers: responseHeaders,
+			body: parts.join("")
+		};
+	} catch {
+		return {
+			statusCode: 500,
+			headers: responseHeaders,
+			body: `data: ${JSON.stringify({ error: ADAPTER_ERROR })}\n\n${DONE_SSE}`
+		};
+	}
+}
+//#endregion
+//#region src/server/adapters/vercel.ts
+async function handleVercelAskAi(req, res, config, env = process.env) {
+	const requestHeaders = new Headers(req.headers ?? {});
+	const responseHeaders = createAdapterHeaders(config, requestHeaders.get("origin"));
+	for (const [key, value] of Object.entries(responseHeaders)) res.setHeader(key, value);
+	if (req.method === "OPTIONS") {
+		res.status(200).end();
+		return;
+	}
+	if (req.method !== "POST") {
+		res.status(405).end("Method Not Allowed");
+		return;
+	}
+	try {
+		if (!isAuthorized(config, requestHeaders)) {
+			res.status(401).json({ error: "UNAUTHORIZED" });
+			return;
+		}
+		const contextError = validateClientContext(config, req.body, requestHeaders);
+		if (contextError) {
+			res.status(403).json({ error: contextError });
+			return;
+		}
+		const questionError = validateQuestion(config, req.body);
+		if (questionError) {
+			res.status(400).json({ error: questionError });
+			return;
+		}
+		const rate = checkAdapterRateLimit(config, requestHeaders.get("x-forwarded-for") || "unknown");
+		if (!rate.ok) {
+			res.setHeader("Retry-After", String(rate.retryAfter));
+			res.status(429).json({ error: "RATE_LIMITED" });
+			return;
+		}
+		const question = req.body.question;
+		await streamLLMResponse(createStreamOptions(config, question, pickClientContext(req.body, config.contextChars ?? 6e3), env), (event) => {
+			const sse = eventToSse(event);
+			if (sse) res.write(sse);
+		});
+		res.write("data: [DONE]\n\n");
+		res.end();
+	} catch {
+		res.write(`data: ${JSON.stringify({ error: ADAPTER_ERROR })}\n\ndata: [DONE]\n\n`);
+		res.end();
+	}
+}
+//#endregion
+//#region src/server/adapters/web.ts
+async function handleWebAskAi(request, config, env = process.env) {
+	const corsHeaders = createAdapterHeaders(config, request.headers.get("origin"));
+	if (request.method === "OPTIONS") return new Response(null, {
+		status: 200,
+		headers: corsHeaders
+	});
+	if (request.method !== "POST") return new Response(JSON.stringify({ error: "Method Not Allowed" }), {
+		status: 405,
+		headers: corsHeaders
+	});
+	try {
+		const bodyText = await request.text();
+		if (new TextEncoder().encode(bodyText).byteLength > (config.maxRequestBytes ?? 65536)) return new Response(JSON.stringify({ error: "REQUEST_TOO_LARGE" }), {
+			status: 413,
+			headers: corsHeaders
+		});
+		const payload = bodyText ? JSON.parse(bodyText) : {};
+		if (!isAuthorized(config, request.headers)) return new Response(JSON.stringify({ error: "UNAUTHORIZED" }), {
+			status: 401,
+			headers: corsHeaders
+		});
+		const contextError = validateClientContext(config, payload, request.headers);
+		if (contextError) return new Response(JSON.stringify({ error: contextError }), {
+			status: 403,
+			headers: corsHeaders
+		});
+		const questionError = validateQuestion(config, payload);
+		if (questionError) return new Response(JSON.stringify({ error: questionError }), {
+			status: 400,
+			headers: corsHeaders
+		});
+		const rate = checkAdapterRateLimit(config, request.headers.get("x-forwarded-for") || "unknown");
+		if (!rate.ok) {
+			corsHeaders["Retry-After"] = String(rate.retryAfter);
+			return new Response(JSON.stringify({ error: "RATE_LIMITED" }), {
+				status: 429,
+				headers: corsHeaders
+			});
+		}
+		const question = payload.question;
+		const context = pickClientContext(payload, config.contextChars ?? 6e3);
+		const encoder = new TextEncoder();
+		const stream = new ReadableStream({ async start(controller) {
+			try {
+				await streamLLMResponse(createStreamOptions(config, question, context, env, request.signal), (event) => {
+					const sse = eventToSse(event);
+					if (sse) controller.enqueue(encoder.encode(sse));
+				});
+				controller.enqueue(encoder.encode(DONE_SSE));
+			} catch {
+				controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: ADAPTER_ERROR })}\n\n`));
+			} finally {
+				controller.close();
+			}
+		} });
+		return new Response(stream, {
+			status: 200,
+			headers: corsHeaders
+		});
+	} catch {
+		return new Response(`data: ${JSON.stringify({ error: ADAPTER_ERROR })}\n\n${DONE_SSE}`, {
+			status: 500,
+			headers: corsHeaders
+		});
+	}
+}
+//#endregion
+export { handleAwsAskAi, handleNetlifyAskAi, handleVercelAskAi, handleWebAskAi, streamLLMResponse };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bdocs/plugin-ask-ai",
-  "version": "0.3.0",
-  "description": "Context-aware AI assistant querying plugin for Boltdocs. OpenAI-powered, page-scoped, streaming. Ships the `<AskAiBubble />` and `<AskAiDialog />` client components for manual composition in custom layouts.",
+  "version": "0.4.0",
+  "description": "Secure, page-scoped streaming AI assistant for Boltdocs with provider presets, hardened server adapters, automatic floating UI, and customizable client components.",
   "files": [
     "dist"
   ],
@@ -23,25 +23,32 @@
   "license": "MIT",
   "type": "module",
   "dependencies": {
-    "@bdocs/dui": "^0.3.0",
+    "@bdocs/dui": "^0.6.0",
+    "clsx": "2.1.1",
     "openai": "^4.77.0",
     "streamdown": "^1.0.0",
+    "tailwind-merge": "3.5.0",
     "zod": "^3.23.0"
   },
   "peerDependencies": {
+    "boltdocs": ">=3.3.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "vite": "^7.0.0 || ^8.0.0"
+    "vite": "^8.1.0"
   },
   "devDependencies": {
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "jsdom": "^24.1.3",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "tsdown": "^0.21.7",
     "typescript": "^5.9.3",
-    "boltdocs": "3.2.1"
+    "boltdocs": "3.4.0",
+    "tsdown-config": "1.0.0"
   },
   "scripts": {
     "build": "tsdown --config-loader unrun",