@od-oneapp/ai-platform 0.1.0

package/src/server/routes/agent-route.ts

@@ -0,0 +1,224 @@
+/**
+ * @fileoverview Factory for creating agent API route handlers.
+ * @module @od-oneapp/ai-platform/routes
+ */
+
+import { type AgentRouteConfig, type UserContext } from './types';
+
+/** Default maximum body size (1MB) */
+const DEFAULT_MAX_BODY_SIZE = 1024 * 1024;
+
+async function readRequestBody(req: Request, maxBodySize: number): Promise<string> {
+  if (!req.body) {
+    return req.text();
+  }
+
+  const reader = req.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+
+    total += value.byteLength;
+    if (total > maxBodySize) {
+      throw new Error('Request body too large');
+    }
+
+    chunks.push(value);
+  }
+
+  const buffer = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+
+  return new TextDecoder().decode(buffer);
+}
+
+/**
+ * Successful agent route response.
+ */
+export interface AgentRouteSuccess {
+  readonly success: true;
+  readonly userContext: UserContext | null;
+  readonly body: unknown;
+}
+
+/**
+ * Creates a route handler factory for agent API endpoints.
+ * Handles authentication, rate limiting, body size validation, and error handling.
+ *
+ * @param config - Route handler configuration
+ * @returns Request handler function
+ *
+ * @example
+ * ```ts
+ * // In Next.js App Router
+ * import { createAgentRouteHandler } from '@od-oneapp/ai-platform/routes';
+ *
+ * const handler = createAgentRouteHandler({
+ *   auth: async (req) => {
+ *     const session = await getSession(req);
+ *     if (!session) throw new Error('Unauthorized');
+ *     return { userId: session.userId };
+ *   },
+ *   rateLimiter: {
+ *     check: async (key) => ({ allowed: true, remaining: 99, resetAt: new Date() }),
+ *   },
+ *   maxBodySize: 512 * 1024, // 512KB
+ * });
+ *
+ * export async function POST(req: Request) {
+ *   return handler(req);
+ * }
+ * ```
+ */
+export function createAgentRouteHandler(
+  config: AgentRouteConfig = {},
+): (req: Request) => Promise<Response> {
+  const { auth, tracer, rateLimiter, maxBodySize = DEFAULT_MAX_BODY_SIZE, onError } = config;
+
+  return async (req: Request): Promise<Response> => {
+    const span = tracer?.startSpan('agent-route-handler');
+
+    try {
+      // Check content-length against maxBodySize
+      const contentLength = req.headers.get('content-length');
+      if (contentLength) {
+        const size = parseInt(contentLength, 10);
+        if (!isNaN(size) && size > maxBodySize) {
+          span?.end();
+          return new Response(
+            JSON.stringify({
+              error: 'Request body too large',
+              maxSize: maxBodySize,
+              receivedSize: size,
+            }),
+            {
+              status: 413,
+              headers: { 'Content-Type': 'application/json' },
+            },
+          );
+        }
+      }
+
+      // Run authentication if provided
+      let userContext: UserContext | null = null;
+      if (auth) {
+        try {
+          userContext = await auth(req);
+        } catch (authError) {
+          span?.end();
+          return new Response(
+            JSON.stringify({
+              error: 'Unauthorized',
+              message: authError instanceof Error ? authError.message : 'Authentication failed',
+            }),
+            {
+              status: 401,
+              headers: { 'Content-Type': 'application/json' },
+            },
+          );
+        }
+      }
+
+      // Run rate limiter if provided (use userId if available, fallback to IP or anonymous)
+      if (rateLimiter) {
+        const rateLimitKey =
+          userContext?.userId ?? req.headers.get('x-forwarded-for') ?? 'anonymous';
+        const rateLimitResult = await rateLimiter.check(rateLimitKey);
+
+        if (!rateLimitResult.allowed) {
+          span?.end();
+          return new Response(
+            JSON.stringify({
+              error: 'Too many requests',
+              remaining: rateLimitResult.remaining,
+              resetAt: rateLimitResult.resetAt.toISOString(),
+            }),
+            {
+              status: 429,
+              headers: {
+                'Content-Type': 'application/json',
+                'X-RateLimit-Remaining': String(rateLimitResult.remaining),
+                'X-RateLimit-Reset': rateLimitResult.resetAt.toISOString(),
+                'Retry-After': String(
+                  Math.ceil((rateLimitResult.resetAt.getTime() - Date.now()) / 1000),
+                ),
+              },
+            },
+          );
+        }
+      }
+
+      // Parse JSON body
+      let body: unknown;
+      try {
+        const text = await readRequestBody(req, maxBodySize);
+        body = text ? JSON.parse(text) : null;
+      } catch (error) {
+        span?.end();
+        const isTooLarge =
+          error instanceof Error && error.message.toLowerCase().includes('too large');
+        return new Response(
+          JSON.stringify({
+            error: isTooLarge ? 'Request body too large' : 'Invalid JSON',
+            message: isTooLarge
+              ? `Max size ${maxBodySize} bytes`
+              : 'Request body must be valid JSON',
+          }),
+          {
+            status: isTooLarge ? 413 : 400,
+            headers: { 'Content-Type': 'application/json' },
+          },
+        );
+      }
+
+      // Return success response
+      const successResponse: AgentRouteSuccess = {
+        success: true,
+        userContext,
+        body,
+      };
+
+      span?.end();
+      return new Response(JSON.stringify(successResponse), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      });
+    } catch (error) {
+      // Record error in tracer
+      if (tracer && error instanceof Error) {
+        tracer.recordError(error);
+      }
+      span?.end();
+
+      // Use custom error handler if provided
+      if (onError) {
+        return onError(error, req);
+      }
+
+      // Default error response (sanitize message in production)
+      const isDev = process.env.NODE_ENV === 'development';
+      return new Response(
+        JSON.stringify({
+          error: 'Internal server error',
+          message: isDev
+            ? error instanceof Error
+              ? error.message
+              : 'Unknown error'
+            : 'An unexpected error occurred',
+        }),
+        {
+          status: 500,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      );
+    }
+  };
+}

package/src/server/routes/agent-routes.ts

@@ -0,0 +1,191 @@
+/**
+ * @fileoverview Agent route handler factory for Next.js/Fetch-compatible routes.
+ *
+ * Creates POST handlers that handle request parsing, session initialization,
+ * user message persistence, agent execution, and optional stream resumption.
+ *
+ * Migrated from @repo/ai/server/agent-routes.ts
+ *
+ * @module @od-oneapp/ai-platform/server/routes/agent-routes
+ */
+
+import { createAgentUIStreamResponse } from '../../shared';
+import {
+  defaultGetMessageText,
+  defaultValidateMessages,
+  inMemoryInitializeSession,
+  type InitializeSessionFn,
+  type PersistMessageFn,
+  type SetupResumableStreamFn,
+} from '../messages/extraction';
+
+import type { SDKAgent, SDKUIMessage, JSONValue } from '../../shared';
+
+
+/**
+ * Create a JSON error response.
+ * Consistent error format for agent route handlers.
+ */
+function jsonError(error: string, status: number = 400): Response {
+  return new Response(JSON.stringify({ error }), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+/**
+ * Options for creating an agent route handler.
+ */
+export interface AgentRouteHandlerOptions {
+  /**
+   * AI SDK Agent instance (ToolLoopAgent, etc.)
+   * Using generic Agent type to support all agent variants
+   */
+  agent?: SDKAgent | unknown;
+  /**
+   * Custom executor when an Agent is not used (e.g., streamText patterns).
+   */
+  execute?: (params: {
+    messages: SDKUIMessage[];
+    sessionId: string;
+    isNew: boolean;
+    body: Record<string, JSONValue>;
+  }) => Promise<Response>;
+  /** Whether to send reasoning tokens to the client. */
+  sendReasoning?: boolean;
+  /**
+   * Optional error mapper for createAgentUIStreamResponse.
+   * Returns error message string or undefined to use default error handling.
+   */
+  onError?: (error: unknown, context: { sessionId: string }) => string | undefined;
+  /**
+   * Optional options resolver for createAgentUIStreamResponse.
+   */
+  resolveOptions?: (params: {
+    body: unknown;
+    messages: SDKUIMessage[];
+    sessionId: string;
+  }) => Record<string, JSONValue>;
+  /** Session initializer function. Defaults to in-memory. */
+  initializeSession?: InitializeSessionFn;
+  /** Persist user messages to storage. */
+  persistUserMessage?: PersistMessageFn;
+  /** Set up resumable stream for the response. */
+  setupResumableStream?: SetupResumableStreamFn;
+  /** Message array validator. */
+  validateMessages?: (messages: unknown) => messages is SDKUIMessage[];
+  /** Extract text from a UIMessage. */
+  getMessageText?: (message: SDKUIMessage) => string;
+}
+
+/**
+ * Create a Next.js/Fetch-compatible POST handler for AI SDK agents.
+ *
+ * Handles request parsing, session initialization, user message persistence,
+ * agent execution, and optional stream resumption.
+ *
+ * @param options - Route handler configuration
+ * @returns POST handler function
+ *
+ * @example
+ * ```ts
+ * import { createAgentRouteHandler } from '@od-oneapp/ai-platform/server';
+ *
+ * const POST = createAgentRouteHandler({
+ *   agent: myToolLoopAgent,
+ *   sendReasoning: true,
+ *   initializeSession: myDbSessionInit,
+ *   persistUserMessage: myDbPersist,
+ * });
+ *
+ * export { POST };
+ * ```
+ */
+export function createAgentRouteHandler(options: AgentRouteHandlerOptions) {
+  const {
+    agent,
+    execute,
+    sendReasoning = true,
+    onError,
+    resolveOptions,
+    initializeSession = inMemoryInitializeSession,
+    persistUserMessage,
+    setupResumableStream,
+    validateMessages = defaultValidateMessages,
+    getMessageText = defaultGetMessageText,
+  } = options;
+
+  return async function POST(req: Request): Promise<Response> {
+    const body = await req.json().catch(() => null);
+
+    if (!body || typeof body !== 'object') {
+      return jsonError('Invalid request body', 400);
+    }
+
+    const { messages, id, ...rest } = body as { messages?: unknown; id?: string };
+
+    if (!validateMessages(messages)) {
+      return jsonError('Invalid request: messages must be an array', 400);
+    }
+
+    const uiMessages = messages;
+    const { sessionId, isNew } = await initializeSession(id);
+
+    // Persist latest user message if provided
+    if (persistUserMessage && uiMessages.length > 0) {
+      const lastUser =
+        typeof uiMessages.findLast === 'function'
+          ? uiMessages.findLast(m => m.role === 'user')
+          : [...uiMessages].reverse().find(m => m.role === 'user');
+
+      if (lastUser) {
+        const text = getMessageText(lastUser);
+        if (text) {
+          await persistUserMessage(sessionId, text, { autoTitle: isNew });
+        }
+      }
+    }
+
+    let response: Response;
+
+    if (execute) {
+      const bodyObj: Record<string, unknown> = { messages: uiMessages, ...rest };
+      if (id !== undefined) {
+        bodyObj.id = id;
+      }
+
+      response = await execute({
+        messages: uiMessages,
+        sessionId,
+        isNew,
+        body: bodyObj as Record<string, JSONValue>,
+      });
+    } else if (agent) {
+      response = await createAgentUIStreamResponse({
+        agent: agent as SDKAgent,
+        uiMessages,
+        sendReasoning,
+        options: resolveOptions?.({
+          body: { messages: uiMessages, id, ...rest },
+          messages: uiMessages,
+          sessionId,
+           
+        }) as any,
+        onError: onError
+          ? (error: unknown) => {
+              const errorMessage = onError(error, { sessionId });
+              return errorMessage ?? 'An error occurred';
+            }
+          : undefined,
+      });
+    } else {
+      return jsonError('No agent or execute handler provided', 500);
+    }
+
+    if (setupResumableStream) {
+      await setupResumableStream(response, sessionId);
+    }
+
+    return response;
+  };
+}

package/src/server/routes/embed-config.ts

@@ -0,0 +1,181 @@
+/**
+ * @fileoverview Factory for creating embed configuration route handlers.
+ * @module @od-oneapp/ai-platform/routes
+ */
+
+import { type EmbedConfig, type EmbedConfigRouteConfig } from './types';
+
+/**
+ * Creates an embed configuration route handler.
+ * Validates embed tokens and returns configuration with proper CORS headers.
+ *
+ * @param config - Embed config route configuration
+ * @returns Request handler function
+ *
+ * @example
+ * ```ts
+ * // In Next.js App Router
+ * import { createEmbedConfigRoute } from '@od-oneapp/ai-platform/routes';
+ *
+ * const handler = createEmbedConfigRoute({
+ *   validateToken: async (token) => {
+ *     const embed = await db.embeds.findFirst({
+ *       where: { token, active: true },
+ *     });
+ *     if (!embed) return null;
+ *     return {
+ *       agentId: embed.agentId,
+ *       allowedTools: embed.allowedTools,
+ *       theme: embed.theme,
+ *       maxMessages: embed.maxMessages,
+ *     };
+ *   },
+ *   allowedOrigins: ['https://example.com', 'https://app.example.com'],
+ * });
+ *
+ * export async function GET(req: Request) {
+ *   return handler(req);
+ * }
+ * ```
+ */
+export function createEmbedConfigRoute(
+  config: EmbedConfigRouteConfig,
+): (req: Request) => Promise<Response> {
+  const { validateToken, allowedOrigins } = config;
+
+  return async (req: Request): Promise<Response> => {
+    const origin = req.headers.get('origin');
+
+    // Check origin against allowedOrigins
+    // - undefined: all origins allowed
+    // - []: no origins allowed (deny all)
+    // - ['...', '...']: only listed origins allowed
+    if (allowedOrigins !== undefined) {
+      if (allowedOrigins.length === 0 || !origin || !allowedOrigins.includes(origin)) {
+        return new Response(
+          JSON.stringify({
+            error: 'Forbidden',
+            message: 'Origin not allowed',
+          }),
+          {
+            status: 403,
+            headers: { 'Content-Type': 'application/json' },
+          },
+        );
+      }
+    }
+
+    // Extract token from query params
+    const url = new URL(req.url);
+    const token = url.searchParams.get('token');
+
+    if (!token) {
+      return new Response(
+        JSON.stringify({
+          error: 'Bad Request',
+          message: 'Token parameter is required',
+        }),
+        {
+          status: 400,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      );
+    }
+
+    // Validate token
+    let embedConfig: EmbedConfig | null;
+    try {
+      embedConfig = await validateToken(token);
+    } catch {
+      return new Response(
+        JSON.stringify({
+          error: 'Internal Server Error',
+          message: 'Failed to validate token',
+        }),
+        {
+          status: 500,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      );
+    }
+
+    if (!embedConfig) {
+      return new Response(
+        JSON.stringify({
+          error: 'Not Found',
+          message: 'Invalid or expired token',
+        }),
+        {
+          status: 404,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      );
+    }
+
+    // Build CORS headers
+    const corsHeaders: Record<string, string> = {
+      'Content-Type': 'application/json',
+      'Cache-Control': 'private, max-age=300', // Cache for 5 minutes
+    };
+
+    if (origin) {
+      corsHeaders['Access-Control-Allow-Origin'] = origin;
+      corsHeaders['Access-Control-Allow-Methods'] = 'GET, OPTIONS';
+      corsHeaders['Access-Control-Allow-Headers'] = 'Content-Type';
+      corsHeaders['Access-Control-Max-Age'] = '86400'; // 24 hours
+    }
+
+    // Return embed config
+    return new Response(JSON.stringify(embedConfig), {
+      status: 200,
+      headers: corsHeaders,
+    });
+  };
+}
+
+/**
+ * Creates a CORS preflight handler for embed config routes.
+ *
+ * @param allowedOrigins - List of allowed origins
+ * @returns Preflight handler function
+ *
+ * @example
+ * ```ts
+ * import { createEmbedConfigPreflight } from '@od-oneapp/ai-platform/routes';
+ *
+ * const preflight = createEmbedConfigPreflight(['https://example.com']);
+ *
+ * export async function OPTIONS(req: Request) {
+ *   return preflight(req);
+ * }
+ * ```
+ */
+export function createEmbedConfigPreflight(
+  allowedOrigins?: readonly string[],
+): (req: Request) => Response {
+  return (req: Request): Response => {
+    const origin = req.headers.get('origin');
+
+    // Check origin
+    if (allowedOrigins && allowedOrigins.length > 0) {
+      if (!origin || !allowedOrigins.includes(origin)) {
+        return new Response(null, { status: 403 });
+      }
+    }
+
+    const corsHeaders: Record<string, string> = {
+      'Access-Control-Allow-Methods': 'GET, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+      'Access-Control-Max-Age': '86400',
+    };
+
+    if (origin) {
+      corsHeaders['Access-Control-Allow-Origin'] = origin;
+    }
+
+    return new Response(null, {
+      status: 204,
+      headers: corsHeaders,
+    });
+  };
+}