Form Copilot

.do/deploy.template.yaml

@@ -0,0 +1,28 @@
+spec:
+  name: form-copilot
+  services:
+    - name: web
+      github:
+        repo: SimplePDF/simplepdf-embed
+        branch: main
+        deploy_on_push: false
+      source_dir: /form-copilot
+      environment_slug: node-js
+      build_command: npm run build
+      run_command: npm start
+      http_port: 3000
+      instance_count: 1
+      instance_size_slug: apps-s-1vcpu-1gb
+      envs:
+        - key: VITE_SIMPLEPDF_COMPANY_IDENTIFIER
+          scope: BUILD_TIME
+          type: GENERAL
+        - key: SHARED_API_KEYS
+          scope: RUN_TIME
+          type: SECRET
+        - key: REDIS_URL
+          scope: RUN_TIME
+          type: SECRET
+        - key: IP_HASH_SALT
+          scope: RUN_TIME
+          type: SECRET

form-copilot/.cta.json

@@ -0,0 +1,19 @@
+{
+  "projectName": "form-copilot",
+  "mode": "file-router",
+  "typescript": true,
+  "packageManager": "npm",
+  "includeExamples": false,
+  "tailwind": true,
+  "addOnOptions": {},
+  "envVarValues": {},
+  "git": false,
+  "install": true,
+  "routerOnly": false,
+  "version": 1,
+  "framework": "react",
+  "chosenAddOns": [
+    "biome",
+    "nitro"
+  ]
+}

form-copilot/.env.example

@@ -0,0 +1,102 @@
+# =============================================================================
+# Access keys (OPTIONAL: drives the invite-link `?share=<id>` flow)
+# =============================================================================
+#
+# Leave SHARED_API_KEYS unset and the demo runs in BYOK-only mode: every
+# visitor brings their own provider key via the in-app Model Picker, and
+# the stream goes browser-direct (never through this server). This is
+# the easiest setup if you only need it for yourself.
+#
+# Set SHARED_API_KEYS to skip BYOK and let non-technical viewers chat
+# without pasting a key. Each entry maps a share id to an api key, a
+# model handle, and a per-IP lifetime cap on chat turns. Visitors land
+# on `?share=<id>` and the server pays for the LLM under your account.
+# Requests without a recognized `?share=<id>` still return 401 and the
+# client falls back to BYOK.
+#
+# Shape (per share id):
+#
+#   {
+#     "<share_id>": {
+#       "api_key": "<provider api key>",
+#       "model": "<anthropic_haiku_4_5 | deepseek_v4_flash>",
+#       "rate_limit_turns_lifetime": 20
+#     }
+#   }
+#
+# Each share id has its own per-IP lifetime counter. With REDIS_URL set
+# (see below), counters survive restarts and are shared across containers.
+# Without REDIS_URL, counters live in memory per container (fine for
+# single-instance / BYOK-only deployments). The reserved id "__default__"
+# is rejected at parse time. Example with two invites on two providers:
+#
+#   SHARED_API_KEYS='{"preview-alice":{"api_key":"sk-ant-...","model":"anthropic_haiku_4_5","rate_limit_turns_lifetime":5},"customer-acme":{"api_key":"sk-...","model":"deepseek_v4_flash","rate_limit_turns_lifetime":100}}'
+#
+# Visitors then open `http://localhost:3001/?share=preview-alice` (or
+# the equivalent on your hosted domain).
+#
+# -----------------------------------------------------------------------------
+# Base64 fallback (recommended for hosted deploys)
+# -----------------------------------------------------------------------------
+# Some hosts (DigitalOcean App Platform, Render, fly.io app specs) mangle
+# embedded or surrounding quotes when storing JSON-shaped env vars. The
+# parser accepts a base64-encoded payload as an alternative: plain JSON
+# is tried first, base64-then-JSON second. Either works.
+#
+# Portable one-liner (macOS + Linux):
+#
+#   printf '%s' '{"preview-alice":{"api_key":"sk-ant-...","model":"anthropic_haiku_4_5","rate_limit_turns_lifetime":5}}' | base64 | tr -d '\n'
+#
+# Paste the resulting ASCII-only string as the value, with no surrounding
+# quotes. The parser also auto-strips one wrapping pair of single or
+# double quotes if your host shell-escapes the value into the env.
+SHARED_API_KEYS=
+
+# =============================================================================
+# Client configuration
+# =============================================================================
+
+# SimplePDF company identifier. The subdomain piece of
+# <companyIdentifier>.simplepdf.com that serves the embedded editor.
+# Exposed to the browser (VITE_ prefix) because the iframe src is built
+# client-side. REQUIRED: the app throws at startup if unset.
+#
+# `form-copilot` is the public demo workspace and whitelists
+# `http://localhost:3001`, so the iframe loads as-is for local dev. To
+# host this on your own domain, set this to your own SimplePDF
+# Premium company identifier and whitelist your serving origin in the
+# SimplePDF dashboard.
+VITE_SIMPLEPDF_COMPANY_IDENTIFIER=form-copilot
+
+
+# Optional. Gates the TanStack Router devtools panel + chatty monitoring
+# logs. Leave unset in production / CI; set to "true" for local dev.
+# VITE_ENABLE_DEVTOOLS=true
+
+# =============================================================================
+# Rate-limit storage (optional; required for multi-container deployments)
+# =============================================================================
+
+# Connection URL to a Redis-protocol-compatible instance (Valkey, Redis,
+# KeyDB, etc.). Required for hosted deployments where you want
+# per-(share, IP) lifetime counters to survive restarts AND be shared
+# across multiple containers. Without it, counters live in memory per
+# container (fine for local dev, single-instance hosts, or BYOK-only
+# deployments).
+#
+# DO Managed Caching for Valkey: $15/mo single-node, drop-in protocol-
+# compatible. The dashboard returns a `rediss://default:<password>@<host>:25061/0`
+# URL. The password is INSIDE the URL, so this value is a secret and must
+# be stored as such (the deploy.template.yaml at the repo root marks it
+# `type: SECRET`).
+# REDIS_URL=rediss://default:<password>@<host>:25061/0
+
+# REQUIRED when REDIS_URL is set (the server refuses to boot otherwise).
+# Salts the SHA-256 IP hash used in Redis keys (rl:<share>:<hash>).
+# Without a salt, a leak of the Redis snapshot lets anyone brute-force the
+# ~4B IPv4 space in minutes. With a salt, the brute force needs the
+# server-side secret too. Optional in BYOK-only mode (no REDIS_URL set),
+# since hashes never persist beyond the process.
+#
+# Generate with: openssl rand -hex 32
+# IP_HASH_SALT=

form-copilot/.gitignore

@@ -0,0 +1,13 @@
+node_modules
+.DS_Store
+dist
+dist-ssr
+*.local
+.env
+.nitro
+.tanstack
+.wrangler
+.output
+.vinxi
+__unconfig*
+todos.json

form-copilot/.vscode/settings.json

@@ -0,0 +1,35 @@
+{
+  "files.watcherExclude": {
+    "**/routeTree.gen.ts": true
+  },
+  "search.exclude": {
+    "**/routeTree.gen.ts": true
+  },
+  "files.readonlyInclude": {
+    "**/routeTree.gen.ts": true
+  },
+  "[javascript]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[javascriptreact]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[json]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[jsonc]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[css]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "editor.codeActionsOnSave": {
+    "source.organizeImports.biome": "explicit"
+  }
+}

form-copilot/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) SimplePDF Engineering <engineering@simplepdf.com>
+(https://simplepdf.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.