@proveanything/smartlinks 1.8.0 → 1.8.2

package/dist/docs/iframe-streaming-parent-changes.md

@@ -0,0 +1,308 @@
+# Iframe Streaming Parent Changes
+
+This note describes the parent-side changes needed to support AI streaming when an embedded SmartLinks app is running in iframe proxy mode.
+
+If you are using the SDK `IframeResponder` directly, this is already implemented in the SDK changes. You only need this document if your parent application has its own iframe proxy handler and does not rely on `IframeResponder`.
+
+## Goal
+
+Keep the existing architecture:
+
+- local mode: child calls API directly
+- iframe proxy mode: child never owns auth state and streams through the parent
+
+This keeps user/session authority in the parent while making AI streaming behave like the rest of the SDK transport.
+
+## What changed
+
+Previously, proxy mode only supported one-shot request/response messages:
+
+- `_smartlinksProxyRequest`
+- `_smartlinksProxyResponse`
+
+Streaming now adds a second protocol for long-lived responses:
+
+- `_smartlinksProxyStreamRequest`
+- `_smartlinksProxyStream`
+- `_smartlinksProxyStreamAbort`
+
+## New parent message handling
+
+### 1. Listen for stream requests
+
+The iframe child may now send this message:
+
+```ts
+{
+  _smartlinksProxyStreamRequest: true,
+  id: string,
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
+  path: string,
+  body?: any,
+  headers?: Record<string, string>
+}
+```
+
+Parent behavior:
+
+- treat this like a proxied API request
+- build the real API URL from your configured base URL plus `path`
+- send the request using the parent's current auth/session context
+- expect an SSE / streaming response body
+- keep the request open until the stream ends or is aborted
+
+### 2. Forward stream lifecycle messages back to the child
+
+The parent should send messages back to the iframe using this envelope:
+
+```ts
+{
+  _smartlinksProxyStream: true,
+  id: string,
+  phase: 'open' | 'event' | 'end' | 'error',
+  data?: any,
+  error?: string,
+  status?: number
+}
+```
+
+Phases:
+
+- `open`
+  - optional but recommended
+  - indicates the upstream streaming request was accepted and a body exists
+- `event`
+  - contains one parsed JSON event from an SSE `data:` frame
+  - send one message per logical event payload
+- `end`
+  - sent once when the stream finishes normally
+- `error`
+  - sent if the upstream request fails before or during streaming
+
+### 3. Support abort from the child
+
+The child may stop reading early and send:
+
+```ts
+{
+  _smartlinksProxyStreamAbort: true,
+  id: string
+}
+```
+
+Parent behavior:
+
+- look up the active stream by `id`
+- abort the underlying fetch / reader
+- clean up any local state for that stream
+- do not keep streaming after abort
+
+## SSE forwarding rules
+
+The upstream AI endpoints return SSE-like frames. The parent should:
+
+- read the response body as a stream
+- buffer text until line boundaries
+- collect `data:` lines for a single event
+- join multi-line `data:` payloads with `\n`
+- ignore blank events
+- stop on `data: [DONE]`
+- JSON-parse each event payload
+- forward parsed payloads to the iframe as `_smartlinksProxyStream` with `phase: 'event'`
+
+Minimal parsing behavior:
+
+1. accumulate bytes into text
+2. split on `\r?\n`
+3. collect each `data:` line
+4. on blank line, finalize the event
+5. if payload is `[DONE]`, finish
+6. otherwise `JSON.parse(payload)` and forward
+
+## Auth and session expectations
+
+The parent remains the source of truth for auth.
+
+That means the parent stream handler should:
+
+- use the same auth headers/token source as normal proxied requests
+- not require the iframe to know the bearer token or API key
+- naturally pick up the current logged-in user when the stream starts
+- cancel active streams if your app invalidates session state on logout or account switch
+
+In practice, the stream request should use the same header-building logic as your normal parent proxy transport.
+
+## Error handling expectations
+
+If the upstream fetch returns a non-2xx status:
+
+- try to read the JSON error body
+- derive a useful message
+- send one `_smartlinksProxyStream` message with `phase: 'error'`
+- include `status` when available
+- do not send `end` afterward
+
+If the stream body is missing unexpectedly:
+
+- send `phase: 'error'`
+
+If JSON parsing fails for a single event chunk:
+
+- safest behavior is to ignore that malformed chunk and continue
+
+## State the parent should keep
+
+Track active streams in a map keyed by `id`:
+
+```ts
+Map<string, AbortController>
+```
+
+Recommended cleanup points:
+
+- on normal stream end
+- on error
+- on child abort
+- on iframe detach/unmount
+- on parent auth reset/logout if you want all in-flight streams cancelled immediately
+
+## Parent implementation outline
+
+```ts
+const activeStreams = new Map<string, AbortController>()
+
+window.addEventListener('message', async (event) => {
+  const msg = event.data
+
+  if (msg?._smartlinksProxyStreamAbort && msg.id) {
+    activeStreams.get(msg.id)?.abort()
+    activeStreams.delete(msg.id)
+    return
+  }
+
+  if (msg?._smartlinksProxyStreamRequest && msg.id) {
+    const controller = new AbortController()
+    activeStreams.set(msg.id, controller)
+
+    try {
+      const response = await fetch(buildUrl(msg.path), {
+        method: msg.method,
+        headers: msg.headers,
+        body: msg.body ? JSON.stringify(msg.body) : undefined,
+        signal: controller.signal,
+      })
+
+      if (!response.ok || !response.body) {
+        postError(...)
+        return
+      }
+
+      postOpen(...)
+      await forwardSse(response.body, parsed => postEvent(...parsed))
+      postEnd(...)
+    } catch (err) {
+      if (err?.name !== 'AbortError') postError(...)
+    } finally {
+      activeStreams.delete(msg.id)
+    }
+  }
+})
+```
+
+## Exact protocol summary
+
+### Child → parent
+
+Standard stream request:
+
+```ts
+{
+  _smartlinksProxyStreamRequest: true,
+  id,
+  method,
+  path,
+  body,
+  headers
+}
+```
+
+Abort request:
+
+```ts
+{
+  _smartlinksProxyStreamAbort: true,
+  id
+}
+```
+
+### Parent → child
+
+Open:
+
+```ts
+{
+  _smartlinksProxyStream: true,
+  id,
+  phase: 'open'
+}
+```
+
+Event:
+
+```ts
+{
+  _smartlinksProxyStream: true,
+  id,
+  phase: 'event',
+  data: parsedJsonEvent
+}
+```
+
+End:
+
+```ts
+{
+  _smartlinksProxyStream: true,
+  id,
+  phase: 'end'
+}
+```
+
+Error:
+
+```ts
+{
+  _smartlinksProxyStream: true,
+  id,
+  phase: 'error',
+  error: 'message',
+  status?: number
+}
+```
+
+## What does not change
+
+These parts of the parent iframe integration stay the same:
+
+- normal `_smartlinksProxyRequest` request/response flow
+- upload proxy flow
+- auth login/logout postMessage handling
+- route/deep-link handling
+- resize handling
+
+This is an additive protocol, not a replacement.
+
+## Current SDK reference
+
+The SDK implementation lives in:
+
+- [src/http.ts](src/http.ts)
+- [src/iframeResponder.ts](src/iframeResponder.ts)
+- [src/types/iframeResponder.ts](src/types/iframeResponder.ts)
+- [src/api/ai.ts](src/api/ai.ts)
+
+## Practical recommendation
+
+If your parent already uses `IframeResponder`, prefer upgrading to the SDK version with these changes instead of re-implementing the protocol manually.
+
+If your parent has a custom iframe bridge, implement exactly the three new message types above and reuse your existing auth/header logic from normal proxied requests.

package/dist/http.d.ts

@@ -167,6 +167,15 @@ export declare function patch<T>(path: string, body: any, extraHeaders?: Record<
  * Returns the parsed JSON as T, or throws an Error.
  */
 export declare function requestWithOptions<T>(path: string, options: RequestInit): Promise<T>;
+/**
+ * Internal helper that performs a streaming request using the shared auth and proxy transport.
+ * The response is expected to be `text/event-stream` with JSON payloads in `data:` frames.
+ */
+export declare function requestStream<T>(path: string, options?: {
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    body?: any;
+    headers?: Record<string, string>;
+}): Promise<AsyncIterable<T>>;
 /**
  * Internal helper that performs a DELETE request to `${baseURL}${path}`,
  * injecting headers for apiKey or bearerToken if present.

package/dist/http.js

@@ -13,6 +13,18 @@ var __rest = (this && this.__rest) || function (s, e) {
         }
     return t;
 };
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function verb(n) { if (g[n]) i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
 import { SmartlinksApiError, SmartlinksOfflineError } from "./types/error";
 import { idbGet, idbSet, idbClear } from './persistentCache';
 let baseURL = null;
@@ -514,15 +526,178 @@ export function invalidateCache(urlPattern) {
 }
 // Map of pending proxy requests: id -> {resolve, reject}
 const proxyPending = {};
+const proxyStreamPending = new Map();
 function generateProxyId() {
     return "proxy_" + Math.random().toString(36).slice(2) + Date.now();
 }
+async function createFetchError(response, url) {
+    let responseBody;
+    try {
+        responseBody = await response.json();
+    }
+    catch (_a) {
+        responseBody = null;
+    }
+    const errBody = normalizeErrorResponse(responseBody, response.status);
+    return new SmartlinksApiError(`Error ${errBody.code}: ${errBody.message}`, response.status, errBody, url);
+}
+function createProxyStreamIterable(id) {
+    const queue = [];
+    const waiters = [];
+    let done = false;
+    let failure = null;
+    const flushDone = () => {
+        while (waiters.length) {
+            const waiter = waiters.shift();
+            waiter === null || waiter === void 0 ? void 0 : waiter.resolve({ value: undefined, done: true });
+        }
+    };
+    const flushError = (error) => {
+        while (waiters.length) {
+            const waiter = waiters.shift();
+            waiter === null || waiter === void 0 ? void 0 : waiter.reject(error);
+        }
+    };
+    const iterator = {
+        next() {
+            if (queue.length) {
+                return Promise.resolve({ value: queue.shift(), done: false });
+            }
+            if (failure) {
+                return Promise.reject(failure);
+            }
+            if (done) {
+                return Promise.resolve({ value: undefined, done: true });
+            }
+            return new Promise((resolve, reject) => {
+                waiters.push({ resolve, reject });
+            });
+        },
+        async return() {
+            if (!done && !failure) {
+                done = true;
+                proxyStreamPending.delete(id);
+                try {
+                    window.parent.postMessage({ _smartlinksProxyStreamAbort: true, id }, '*');
+                }
+                catch (_a) { }
+            }
+            flushDone();
+            return { value: undefined, done: true };
+        },
+        async throw(error) {
+            failure = error || new Error('Proxy stream failed');
+            done = true;
+            proxyStreamPending.delete(id);
+            flushError(failure);
+            throw failure;
+        },
+    };
+    return {
+        push(value) {
+            if (done || failure)
+                return;
+            const waiter = waiters.shift();
+            if (waiter) {
+                waiter.resolve({ value, done: false });
+                return;
+            }
+            queue.push(value);
+        },
+        finish() {
+            if (done || failure)
+                return;
+            done = true;
+            proxyStreamPending.delete(id);
+            flushDone();
+        },
+        fail(error) {
+            if (done || failure)
+                return;
+            failure = error;
+            done = true;
+            proxyStreamPending.delete(id);
+            flushError(error);
+        },
+        iterable: {
+            [Symbol.asyncIterator]() {
+                return iterator;
+            },
+        },
+    };
+}
+function parseSsePayload(payload) {
+    if (!payload || payload === '[DONE]')
+        return undefined;
+    try {
+        return JSON.parse(payload);
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+function parseSseStream(stream) {
+    return __asyncGenerator(this, arguments, function* parseSseStream_1() {
+        const reader = stream.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let dataLines = [];
+        while (true) {
+            const { done, value } = yield __await(reader.read());
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split(/\r?\n/);
+            buffer = lines.pop() || '';
+            for (const rawLine of lines) {
+                const line = rawLine.trimEnd();
+                if (!line) {
+                    if (!dataLines.length)
+                        continue;
+                    const parsed = parseSsePayload(dataLines.join('\n'));
+                    dataLines = [];
+                    if (parsed !== undefined) {
+                        yield yield __await(parsed);
+                    }
+                    continue;
+                }
+                if (line.startsWith('data:')) {
+                    dataLines.push(line.slice(5).trimStart());
+                }
+            }
+        }
+        if (dataLines.length) {
+            const parsed = parseSsePayload(dataLines.join('\n'));
+            if (parsed !== undefined) {
+                yield yield __await(parsed);
+            }
+        }
+    });
+}
 // Shared listener for proxy responses
 function ensureProxyListener() {
     if (window._smartlinksProxyListener)
         return;
     window.addEventListener("message", (event) => {
         const msg = event.data;
+        if ((msg === null || msg === void 0 ? void 0 : msg._smartlinksProxyStream) && msg.id) {
+            const pendingStream = proxyStreamPending.get(msg.id);
+            if (!pendingStream)
+                return;
+            if (msg.phase === 'event') {
+                pendingStream.push(msg.data);
+                return;
+            }
+            if (msg.phase === 'end') {
+                pendingStream.finish();
+                return;
+            }
+            if (msg.phase === 'error') {
+                pendingStream.fail(new Error(msg.error || 'Proxy stream failed'));
+                return;
+            }
+            return;
+        }
         if (!msg || !msg._smartlinksProxyResponse || !msg.id)
             return;
         logDebug('[smartlinks] proxy:response', { id: msg.id, ok: !msg.error, keys: Object.keys(msg) });
@@ -539,6 +714,32 @@ function ensureProxyListener() {
     });
     window._smartlinksProxyListener = true;
 }
+async function proxyStreamRequest(method, path, body, headers) {
+    ensureProxyListener();
+    const payloadBody = (typeof FormData !== 'undefined' && body instanceof FormData)
+        ? serializeFormDataForProxy(body)
+        : body;
+    const id = generateProxyId();
+    const streamController = createProxyStreamIterable(id);
+    proxyStreamPending.set(id, streamController);
+    const msg = {
+        _smartlinksProxyStreamRequest: true,
+        id,
+        method,
+        path,
+        body: payloadBody,
+        headers,
+    };
+    logDebug('[smartlinks] proxy:stream postMessage', {
+        id,
+        method,
+        path,
+        headers: headers ? redactHeaders(headers) : undefined,
+        hasBody: !!body,
+    });
+    window.parent.postMessage(msg, '*');
+    return streamController.iterable;
+}
 // Proxy request implementation
 function serializeFormDataForProxy(fd) {
     const entries = [];
@@ -1105,6 +1306,41 @@ export async function requestWithOptions(path, options) {
     }
     return fetchPromise;
 }
+/**
+ * Internal helper that performs a streaming request using the shared auth and proxy transport.
+ * The response is expected to be `text/event-stream` with JSON payloads in `data:` frames.
+ */
+export async function requestStream(path, options) {
+    const method = (options === null || options === void 0 ? void 0 : options.method) || 'POST';
+    const body = options === null || options === void 0 ? void 0 : options.body;
+    const extraHeaders = (options === null || options === void 0 ? void 0 : options.headers) || {};
+    const headers = Object.assign(Object.assign(Object.assign({}, extraHeaders), getApiHeaders()), { Accept: 'text/event-stream' });
+    if (!(typeof FormData !== 'undefined' && body instanceof FormData) && body !== undefined && !Object.keys(headers).some(k => k.toLowerCase() === 'content-type')) {
+        headers['Content-Type'] = 'application/json';
+    }
+    if (proxyMode) {
+        logDebug('[smartlinks] stream via proxy', { path, method });
+        return proxyStreamRequest(method, path, body, headers);
+    }
+    if (!baseURL) {
+        throw new Error("HTTP client is not initialized. Call initializeApi(...) first.");
+    }
+    const url = `${baseURL}${path}`;
+    logDebug('[smartlinks] stream fetch', { url, method, headers: redactHeaders(headers), body: safeBodyPreview(body) });
+    const response = await fetch(url, {
+        method,
+        headers,
+        body: body === undefined ? undefined : (body instanceof FormData ? body : JSON.stringify(body)),
+    });
+    logDebug('[smartlinks] stream response', { url, status: response.status, ok: response.ok });
+    if (!response.ok) {
+        throw await createFetchError(response, url);
+    }
+    if (!response.body) {
+        throw new Error('Streaming response body is unavailable in this environment');
+    }
+    return parseSseStream(response.body);
+}
 /**
  * Internal helper that performs a DELETE request to `${baseURL}${path}`,
  * injecting headers for apiKey or bearerToken if present.

package/dist/iframeResponder.d.ts

@@ -31,6 +31,7 @@ export declare class IframeResponder {
     private options;
     private cache;
     private uploads;
+    private activeStreams;
     private isInitialLoad;
     private messageHandler;
     private resizeHandler;
@@ -59,6 +60,9 @@ export declare class IframeResponder {
     private handleRouteChange;
     private handleStandardMessage;
     private handleProxyRequest;
+    private handleProxyStreamAbort;
+    private handleProxyStreamRequest;
+    private forwardProxyStream;
     private getCachedResponse;
     private handleUpload;
     private sendResponse;