@deslop/scope 0.1.1254 → 0.1.1256

package/dist/client/index.html

@@ -15,7 +15,7 @@
 		<link rel="manifest" href="/manifest.webmanifest" />
 
 		<title>Scope</title>
-		<script type="module" crossorigin src="/assets/index-0qg-BjQU.js"></script>
+		<script type="module" crossorigin src="/assets/index-DndFZKLB.js"></script>
 		<link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-WkwZ5CU-.js">
 		<link rel="modulepreload" crossorigin href="/assets/effect-DGdI2y-R.js">
 		<link rel="modulepreload" crossorigin href="/assets/react-COyt-gOi.js">

package/dist/server.js

@@ -6106,6 +6106,36 @@ const has$4 = /*#__PURE__*/ dual(2, (self, key) => Object.hasOwn(self, key));
 */
 const get$11 = /*#__PURE__*/ dual(2, (self, key) => Object.hasOwn(self, key) ? some$1(self[key]) : none());
 /**
+* Removes a key from a record.
+*
+* **When to use**
+*
+* Use to create a shallow copy of a record without one property.
+*
+* **Details**
+*
+* If the key is not present, the result is still a shallow copy of the original
+* record.
+*
+* **Example** (Removing a key)
+*
+* ```ts import.meta.vitest
+* import { Record } from "effect"
+*
+* Record.remove({ a: 1, b: 2 }, "a") // => { b: 2 }
+* ```
+*
+* @stability stable
+* @category mutations
+* @since 2.0.0
+*/
+const remove$6 = /*#__PURE__*/ dual(2, (self, key) => {
+	if (!has$4(self, key)) return { ...self };
+	const out = { ...self };
+	delete out[key];
+	return out;
+});
+/**
 * Maps a record into another record by applying a transformation function to each of its values.
 *
 * **Example** (Mapping record values)
@@ -39547,6 +39577,25 @@ function Redacted$1(value, options) {
 	});
 	return make$60(schema.ast, { value });
 }
+/**
+* Decodes a value and wraps it in `Redacted<A>`. Unlike {@link Redacted} which
+* expects the input to already be a `Redacted` instance, this schema decodes
+* the raw value and wraps it.
+*
+* @see {@link Redacted} for schemas whose input is already a `Redacted` value.
+* @stability stable
+* @category schemas
+* @since 4.0.0
+*/
+function RedactedFromValue(value, options) {
+	return decodeTo(Redacted$1(toType(value), {
+		label: options?.label,
+		disallowJsonEncode: options?.disallowEncode
+	}), {
+		decode: transform$3((t) => make$65(t, { label: options?.label })),
+		encode: options?.disallowEncode ? forbidden((oe) => "Cannot encode Redacted" + (isSome(oe) && typeof oe.value.label === "string" ? ` with label: "${oe.value.label}"` : "")) : transform$3(value$2)
+	})(value);
+}
 const immerable = /*#__PURE__*/ globalThis.Symbol.for("immer-draftable");
 const payloadToken = {};
 function makeClass(Inherited, identifier, struct$1, annotations, proto) {
@@ -53670,6 +53719,14 @@ const compressBody = /*#__PURE__*/ dual((args) => isHttpClientRequest(args[0]),
 	return map$5(compressBody$1(self.body, algorithm, options), (body) => body === self.body ? self : makeWith$1(self.method, self.url, self.urlParams, self.hash, set$2(updateContentLength(self.headers, body), "content-encoding", algorithm), body));
 });
 /**
+* Encodes a value as a JSON request body and sets it on the request, failing with `HttpBodyError` if encoding fails.
+*
+* @stability unstable
+* @category combinators
+* @since 4.0.0
+*/
+const bodyJson = /*#__PURE__*/ dual(2, (self, body) => map$5(json$1(body), (body) => setBody$1(self, body)));
+/**
 * Sets a JSON request body using unsafe JSON encoding.
 *
 * **When to use**
@@ -54224,6 +54281,14 @@ const endSpanWithStatusError = (fiber, span, request, response) => {
 	span.end(fiber.getRef(TracerTimingEnabled) ? fiber.getRef(Clock).currentTimeNanosUnsafe() : BigInt(0), exit);
 };
 /**
+* Appends an effectful transformation of the request object before sending it.
+*
+* @stability unstable
+* @category mapping
+* @since 4.0.0
+*/
+const mapRequestEffect = /*#__PURE__*/ dual(2, (self, f) => makeWith(self.postprocess, (request) => flatMap$3(self.preprocess(request), f)));
+/**
 * Retries common transient errors, such as rate limiting, timeouts or network issues.
 *
 * **When to use**
@@ -88854,6 +88919,71 @@ function failureOptions(error, status) {
 }
 var CurrentUser = class extends Service$2()("@deslop/runtime/auth/lib/utils/CurrentUser") {};
 var RpcAuth = class extends Service$1()("@deslop/runtime/auth/lib/utils/RpcAuth", { error: AuthError }) {};
+Literals([
+	"anthropic",
+	"openrouter",
+	"opencode-zen",
+	"opencode-go"
+]);
+// ../../packages/runtime/src/ai/service.ts
+var AiUnavailable = class extends TaggedError()("AiUnavailable", { message: String$6 }) {};
+fromJsonString(Struct({ error: Struct({ message: String$6 }) }));
+var AiGateway = class AiGateway extends Service$2()("@deslop/runtime/ai/service/AiGateway") {
+	static layer = effect(this, gen(function* () {
+		const gateway = yield* option(String$5("GATEWAY_URL"));
+		const local = yield* localAuth;
+		const app = yield* String$5("APP_URL");
+		const client = yield* HttpClient;
+		const store = toSchemaStore(yield* KeyValueStore, Record$1(String$6, RedactedFromValue(String$6)));
+		const grants = yield* make$45(getOrElse(yield* store.get("ai-gateway-grants"), () => ({})));
+		const lock = yield* make$72(1);
+		return AiGateway.of({
+			apiUrl: (provider) => match$8(gateway, {
+				onNone: () => fail$6(AiUnavailable.make({ message: "Start the app with --gateway" })),
+				onSome: (url) => succeed$5(`${url}/ai/${provider}${match$1(provider === "openrouter", {
+					onFalse: () => "",
+					onTrue: () => "/v1"
+				})}`)
+			}),
+			authorize: (userId) => (http) => pipe(mapRequestEffect(http, (request) => gen(function* () {
+				if (local) return request;
+				const token = (yield* get$1(grants))[userId];
+				if (token === void 0) return yield* new HttpClientError({ reason: new TransportError({
+					description: "AI access is unavailable; sign in again to enroll with Gateway",
+					request
+				}) });
+				return setHeader$1(request, "authorization", `Bearer ${value$2(token)}`);
+			})), tap((response) => pipe(gen(function* () {
+				if (local || response.headers["x-gateway-grant-refused"] === void 0 || !exists(gateway, (url) => startsWith(`${url}/ai/`)(response.request.url))) return;
+				const current = yield* get$1(grants);
+				const token = current[userId];
+				if (token === void 0 || response.request.headers["authorization"] !== `Bearer ${value$2(token)}`) return;
+				const next = remove$6(current, userId);
+				yield* pipe(store.set("ai-gateway-grants", next), ignore$1({
+					log: "Warn",
+					message: "The rejected AI grant could not be removed from storage"
+				}));
+				yield* set(grants, next);
+			}), withPermit(lock)))),
+			enroll: fnUntraced(function* (userId, headers) {
+				return yield* pipe(gen(function* () {
+					if (local || isNone(gateway) || (yield* get$1(grants))[userId] !== void 0) return;
+					const response = yield* client.execute(yield* bodyJson(post(`${getOrElse(gateway, () => "")}/ai/grants`, { headers: match$1(headers["authorization"] !== void 0, {
+						onFalse: () => ({ cookie: headers["cookie"] ?? "" }),
+						onTrue: () => ({ authorization: headers["authorization"] })
+					}) }), { app }));
+					const result = yield* schemaBodyJson$1(Struct({ token: String$6 }))(response);
+					const next = {
+						...yield* get$1(grants),
+						[userId]: make$65(result.token)
+					};
+					yield* store.set("ai-gateway-grants", next);
+					yield* set(grants, next);
+				}), withPermit(lock), timeout$1("10 seconds"), catch_$2(() => logWarning("AI Gateway enrollment failed")));
+			})
+		});
+	}));
+};
 // ../../packages/runtime/src/auth/service.ts
 function rejected(message) {
 	return mapError$2((cause) => {
@@ -88872,12 +89002,18 @@ function rejected(message) {
 function developer() {
 	return succeed$5(DEVELOPER);
 }
+function enrolled(user, headers) {
+	return gen(function* () {
+		const gateway = getOrUndefined(yield* context(), AiGateway);
+		if (gateway !== void 0) yield* gateway.enroll(user.id, headers);
+	});
+}
 const unavailable = text$1("The authorization service is temporarily unavailable; retry later", {
 	headers: { "retry-after": "5" },
 	status: 503
 });
 var Auth = class Auth extends Service$2()("@deslop/runtime/auth/service/Auth") {
-	static makeContext = (auth) => pipe(make$81(Auth, auth), add$3(RpcAuth, RpcAuth.of((effect, request) => pipe(auth.user(request.headers), tap$1(() => {
+	static makeContext = (auth) => pipe(make$81(Auth, auth), add$3(RpcAuth, RpcAuth.of((effect, request) => pipe(auth.user(request.headers), tap$1((user) => enrolled(user, request.headers)), tap$1(() => {
 		if (isStreamSchema(request.rpc.successSchema)) return annotateCurrentSpan("rpc.stream", true);
 		return void_$1;
 	}), flatMap$3((user) => raceFirst(provideService(effect, CurrentUser, user), pipe(delay(auth.user(request.headers), "5 minutes"), retry({ while: (error) => error.error === "temporarily_unavailable" }), forever)))))));
@@ -88912,6 +89048,7 @@ middleware()(gen(function* () {
 			if (user.failure.error === "temporarily_unavailable") return unavailable;
 			return text$1("Sign in first", { status: 401 });
 		}
+		yield* enrolled(user.success, (yield* HttpServerRequest).headers);
 		return yield* provideService(app, CurrentUser, user.success);
 	});
 }));
@@ -88934,6 +89071,7 @@ function layerMcpAuth(resource) {
 					status: 401
 				});
 			}
+			yield* enrolled(user.success, headers);
 			return yield* provideService(app, CurrentUser, user.success);
 		});
 	})).layer;
@@ -89032,7 +89170,7 @@ function layerKeyValueStore(directory) {
 		});
 	})), provide$2(layerFileSystem(directory)));
 }
-unwrap$7(map$5(dataDirectory, layerKeyValueStore));
+const layerDataStore = unwrap$7(map$5(dataDirectory, layerKeyValueStore));
 const layerProtocol = mergeAll$1(layerSchemaBinary(), succeed$6(MaxBodySize)(mebibytes(10)), effect(TracerDisabledWhen, map$5(TracerDisabledWhen, (previous) => (request) => {
 	const path = headNonEmpty(split$1(request.url, "?"));
 	return previous(request) || path === "/api/rpc" && toLowerCase(request.headers["upgrade"] ?? "") === "websocket" || startsWith("/assets/")(path) || contains([
@@ -89324,6 +89462,11 @@ const SETTINGS = {
 		flag: "auth",
 		schema: SecureOrigin
 	},
+	GATEWAY_URL: {
+		description: "Deslop Gateway origin for AI calls",
+		flag: "gateway",
+		schema: Origin
+	},
 	HOST: {
 		description: `Listen address; defaults to ${DEFAULT_HOST}`,
 		flag: "host",
@@ -89355,7 +89498,7 @@ function server(app) {
 	return pipe(serve(pipe(mergeAll$1(app.routes, layerRoutes, layerIcon(app.icon), layerWeb, layerAnnounce), provide$2(match$8(fromUndefinedOr(app.middleware), {
 		onNone: () => empty$10,
 		onSome: (middleware$1) => middleware()(middleware$1).layer
-	})), provide$2(Auth.layer)), {
+	})), provide$2(Auth.layer), provideMerge(pipe(AiGateway.layer, provide$2(layerDataStore)))), {
 		disableLogger: true,
 		middleware: guard
 	}), provide$2(mergeAll$1(layerProtocol, match$1(app.telemetry === false, {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@deslop/scope",
-	"version": "0.1.1254",
+	"version": "0.1.1256",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/MP281X/deslop.git",
@@ -32,5 +32,5 @@
 	"engines": {
 		"node": ">=26"
 	},
-	"fingerprint": "27809f25e06673c0c3320e3d058b0cdfad3fdd9cff85e48fc2210a219b8c67f8"
+	"fingerprint": "d9fbb4cb322dc4f972433644bd127eb3d2f01072cc4124fabc9d215182f0b30b"
 }