@valbuild/server 0.94.0 → 0.96.0

package/dist/valbuild-server.esm.js

@@ -2374,8 +2374,8 @@ class ValOps {
   }
 
   // #region createPatch
-  async createPatch(path, patch, patchId, parentRef, authorId) {
-    const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId);
+  async createPatch(path, patch, patchId, parentRef, sessionId, authorId) {
+    const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId);
     if (result.isErr(saveRes)) {
       console.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
       if (saveRes.error.errorType === "patch-head-conflict") {
@@ -2579,6 +2579,76 @@ class ValOpsFS extends ValOps {
   async onInit() {
     // do nothing
   }
+  async getPresignedAuthNonce(project, corsOrigin, auth) {
+    const authHeader = "pat" in auth ? {
+      "x-val-pat": auth.pat
+    } : {
+      Authorization: `Bearer ${auth.apiKey}`
+    };
+    try {
+      const res = await fetch(`${this.contentUrl}/v1/${project}/presigned-auth-nonce`, {
+        method: "POST",
+        headers: {
+          ...authHeader,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          corsOrigin
+        })
+      });
+      if (res.ok) {
+        const json = await res.json();
+        const parsed = z.object({
+          nonce: z.string(),
+          expiresAt: z.string()
+        }).safeParse(json);
+        if (parsed.success) {
+          return {
+            status: "success",
+            data: {
+              nonce: parsed.data.nonce,
+              baseUrl: `${this.contentUrl}/v1/${project}`
+            }
+          };
+        }
+        console.error("Could not parse presigned auth nonce response. Error: " + fromError(parsed.error));
+        return {
+          status: "error",
+          statusCode: 500,
+          error: {
+            message: "Could not get presigned auth nonce. The response from the content host was not in the expected format."
+          }
+        };
+      }
+      if (res.status === 401) {
+        return {
+          status: "error",
+          statusCode: 401,
+          error: {
+            message: "Could not get presigned auth nonce. The local PAT was rejected by the content host. Try re-running `val login`."
+          }
+        };
+      }
+      const unknownErrorMessage = `Could not get presigned auth nonce. HTTP error: ${res.status} ${res.statusText}`;
+      console.error(unknownErrorMessage);
+      return {
+        status: "error",
+        statusCode: 500,
+        error: {
+          message: unknownErrorMessage
+        }
+      };
+    } catch (e) {
+      console.error("Could not get presigned auth nonce (connection error?):", e);
+      return {
+        status: "error",
+        statusCode: 500,
+        error: {
+          message: `Could not get presigned auth nonce. Error: ${e instanceof Error ? e.message : JSON.stringify(e)}`
+        }
+      };
+    }
+  }
   async getCommitSummary() {
     return {
       error: {
@@ -2767,11 +2837,17 @@ class ValOpsFS extends ValOps {
           parentPatchId: dir
         });
       } else {
-        if (includes && includes.length > 0 && !includes.includes(parsedPatch.data.patchId)) {
+        const patchId = parsedPatch.data.patchId;
+        if (includes && includes.length > 0 && !includes.includes(patchId)) {
           return;
         }
-        patches[parsedPatch.data.patchId] = {
-          ...parsedPatch.data,
+        patches[patchId] = {
+          path: parsedPatch.data.path,
+          patch: parsedPatch.data.patch,
+          parentRef: parsedPatch.data.parentRef,
+          baseSha: parsedPatch.data.baseSha,
+          createdAt: parsedPatch.data.createdAt,
+          authorId: parsedPatch.data.authorId,
           appliedAt: null
         };
       }
@@ -2942,7 +3018,7 @@ class ValOpsFS extends ValOps {
       };
     }
   }
-  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId) {
+  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId) {
     const patchDir = this.getParentPatchIdFromParentRef(parentRef);
     try {
       const baseSha = await this.getBaseSha();
@@ -2952,6 +3028,7 @@ class ValOpsFS extends ValOps {
         parentRef,
         path,
         authorId,
+        sessionId,
         baseSha,
         coreVersion: Internal.VERSION.core,
         createdAt: new Date().toISOString()
@@ -3390,12 +3467,6 @@ class ValOpsFS extends ValOps {
     return result.ok(Object.fromEntries(Object.entries(patches.patches).map(([patchId, value]) => [patchId, this.getParentPatchIdFromParentRef(value.parentRef)])));
   }
 
-  // #region profiles
-  async getProfiles() {
-    // We do not have profiles in FS mode
-    return [];
-  }
-
   // #region fs file path helpers
   getPatchesDir() {
     return path__default.join(this.rootDir, ValOpsFS.VAL_DIR, "patches");
@@ -3504,7 +3575,9 @@ const FSPatch = z.object({
   parentRef: ParentRef,
   authorId: z.string().refine(p => true).nullable(),
   createdAt: z.string().datetime(),
-  coreVersion: z.string().nullable() // TODO: use this to check if patch is compatible with current core version?
+  coreVersion: z.string().nullable(),
+  // TODO: use this to check if patch is compatible with current core version?
+  sessionId: z.string().nullable()
 });
 const FSPatchBase = z.object({
   baseSha: z.string().refine(p => true),
@@ -3606,17 +3679,6 @@ const CommitResponse = z.object({
   commit: CommitSha,
   branch: z.string()
 });
-const ProfilesResponse = z.object({
-  profiles: z.array(z.object({
-    profileId: z.string(),
-    fullName: z.string(),
-    email: z.string().optional(),
-    // TODO: make this required once this can be guaranteed
-    avatar: z.object({
-      url: z.string()
-    }).nullable()
-  }))
-});
 const NonceResponse = z.object({
   nonce: z.string(),
   url: z.string()
@@ -3908,7 +3970,7 @@ class ValOpsHttp extends ValOps {
         return {
           status: "error",
           error: {
-            message: "Could not get nonce." + message
+            message: "Could not get nonce. " + message
           }
         };
       }
@@ -4067,7 +4129,7 @@ class ValOpsHttp extends ValOps {
       };
     }
   }
-  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId) {
+  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId) {
     const baseSha = await this.getBaseSha();
     return fetch(`${this.contentUrl}/v1/${this.project}/patches`, {
       method: "POST",
@@ -4079,6 +4141,7 @@ class ValOpsHttp extends ValOps {
         path,
         patch,
         authorId,
+        sessionId,
         patchId,
         parentPatchId: parentRef.type === "patch" ? parentRef.patchId : null,
         baseSha,
@@ -4502,31 +4565,6 @@ class ValOpsHttp extends ValOps {
       };
     }
   }
-
-  // #region profiles
-  async getProfiles() {
-    var _res$headers$get6;
-    const res = await fetch(`${this.contentUrl}/v1/${this.project}/profiles`, {
-      headers: {
-        ...this.authHeaders,
-        "Content-Type": "application/json"
-      }
-    });
-    if (res.ok) {
-      const parsed = ProfilesResponse.safeParse(await res.json());
-      if (parsed.error) {
-        console.error("Could not parse profiles response", parsed.error);
-        throw Error(`Could not get profiles from remote server: wrong format. You might need to upgrade Val.`);
-      }
-      return parsed.data.profiles;
-    }
-    if ((_res$headers$get6 = res.headers.get("Content-Type")) !== null && _res$headers$get6 !== void 0 && _res$headers$get6.includes("application/json")) {
-      const json = await res.json();
-      const message = getErrorMessageFromUnknownJson(json, "Unknown error");
-      throw Error(`Could not get profiles (status: ${res.status}): ${message}`);
-    }
-    throw Error(`Could not get profiles. Got status: ${res.status}`);
-  }
 }
 
 const host = process.env.VAL_CONTENT_URL || DEFAULT_CONTENT_HOST;
@@ -4679,6 +4717,24 @@ function hasRemoteFileSchema(schema) {
 
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const ValServer = (valModules, options, callbacks) => {
+  const AIContentBlock = z.union([z.object({
+    type: z.literal("text"),
+    text: z.string()
+  }), z.object({
+    type: z.literal("image_url"),
+    url: z.string()
+  })]);
+  const AIMessageContent = z.union([z.string(), z.array(AIContentBlock)]);
+  const ProfilesResponse = z.object({
+    profiles: z.array(z.object({
+      profileId: z.string(),
+      fullName: z.string(),
+      email: z.string().optional(),
+      avatar: z.object({
+        url: z.string()
+      }).nullable()
+    }))
+  });
   let serverOps;
   if (options.mode === "fs") {
     serverOps = new ValOpsFS(options.valContentUrl, options.cwd, valModules, {
@@ -5466,15 +5522,38 @@ const ValServer = (valModules, options, callbacks) => {
           };
         }
         if (serverOps instanceof ValOpsFS) {
-          // In FS mode we do not use the remote server at all and just return an url that points to this server
-          // which has an endpoint that handles this
-          // A bit hacky perhaps, but we want to have as similar semantics as possible in client code when it comes to FS / HTTP
+          // In FS mode patch-file uploads are buffered through this server (no remote round-trip),
+          // so baseUrl points at /api/val/upload. AI image uploads, however, go straight to the
+          // content host — we resolve a contentBaseUrl + a PAT-issued nonce here so the browser
+          // can POST directly without exposing the PAT.
           const host = `/api/val`;
+          let contentBaseUrl = null;
+          let contentAuthNonce = null;
+          if (!options.project) {
+            console.warn("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
+          } else {
+            const authDataRes = await getRemoteFileAuth();
+            if (authDataRes.status !== 200) {
+              console.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
+            } else {
+              const corsOrigin = "*"; // TODO: add cors origin
+              const presignedAuthNonce = await serverOps.getPresignedAuthNonce(options.project, corsOrigin, authDataRes.json.remoteFileAuth);
+              if (presignedAuthNonce.status === "success") {
+                contentBaseUrl = presignedAuthNonce.data.baseUrl;
+                contentAuthNonce = presignedAuthNonce.data.nonce;
+              } else {
+                console.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
+              }
+            }
+          }
           return {
             status: 200,
             json: {
               nonce: null,
-              baseUrl: `${host}/upload` // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
+              baseUrl: `${host}/upload`,
+              // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
+              contentBaseUrl,
+              contentAuthNonce
             }
           };
         }
@@ -5500,7 +5579,9 @@ const ValServer = (valModules, options, callbacks) => {
           status: 200,
           json: {
             nonce: presignedAuthNonce.data.nonce,
-            baseUrl: presignedAuthNonce.data.baseUrl
+            baseUrl: presignedAuthNonce.data.baseUrl,
+            contentBaseUrl: presignedAuthNonce.data.baseUrl,
+            contentAuthNonce: presignedAuthNonce.data.nonce
           }
         };
       }
@@ -5528,10 +5609,11 @@ const ValServer = (valModules, options, callbacks) => {
         }
         const patches = req.body.patches;
         let parentRef = req.body.parentRef;
+        const sessionId = req.body.sessionId ?? null;
         const authorId = "id" in auth ? auth.id : null;
         const newPatchIds = [];
         for (const patch of patches) {
-          const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, authorId);
+          const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId);
           if (result.isErr(createPatchRes)) {
             if (createPatchRes.error.errorType === "patch-head-conflict") {
               return {
@@ -5892,13 +5974,87 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        const profiles = await serverOps.getProfiles();
-        return {
-          status: 200,
-          json: {
-            profiles
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          if (serverOps instanceof ValOpsFS && authDataRes.json.errorCode === "pat-error") {
+            return {
+              status: 200,
+              json: {
+                profiles: []
+              }
+            };
+          }
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        const execFetch = async headers => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/profiles`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "GET",
+              headers
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              const isAuthError = upstreamRes.status === 401 || upstreamRes.status === 403;
+              return {
+                status: isAuthError ? 401 : 500,
+                json: {
+                  message: isAuthError ? `Profile authentication failed: ${upstreamRes.status} ${text}` : `Profiles failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const parseRes = ProfilesResponse.safeParse(await upstreamRes.json());
+            if (!parseRes.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse profiles response: " + fromError(parseRes.error).toString()
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: {
+                profiles: parseRes.data.profiles
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "Profiles request failed"
+              }
+            };
           }
         };
+        if (serverOps instanceof ValOpsFS) {
+          return execFetch(getProfileAuthHeaders(authData, null, "application/json"));
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not configured"
+            }
+          };
+        }
+        return withAuth(options.valSecret, cookies, "profiles", data => {
+          return execFetch(getProfileAuthHeaders(authData, data, "application/json"));
+        });
       }
     },
     "/commit-summary": {
@@ -6080,84 +6236,750 @@ const ValServer = (valModules, options, callbacks) => {
         }
       }
     },
-    //#region files
-    "/files": {
-      GET: async req => {
-        const query = req.query;
-        const filePath = req.path;
-        // NOTE: no auth here since you would need the patch_id to get something that is not published.
-        // For everything that is published, well they are already public so no auth required there...
-        // We could imagine adding auth just to be a 200% certain,
-        // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
-        // So: 1) patch ids are not possible to guess (but possible to brute force)
-        //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
-        //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
-        // Thus: attack surface + ease of attack + benefit = low probability of attack
-        // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-        let cacheControl;
-        let fileBuffer;
-        let mimeType;
-        const remote = query.remote === "true";
-        if (query.patch_id) {
-          fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id, remote);
-          mimeType = Internal.filenameToMimeType(filePath);
-          // TODO: reenable this:
-          // cacheControl = "public, max-age=20000, immutable";
-        } else {
-          if (serverOps instanceof ValOpsHttp && remote) {
-            console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
-          }
-          fileBuffer = await serverOps.getBinaryFile(filePath);
+    //#region ai proxy
+    "/ai/initialize": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-        if (fileBuffer) {
+        if (!options.project) {
           return {
-            status: 200,
-            headers: {
-              // TODO: we could use ETag and return 304 instead
-              "Content-Type": mimeType || "application/octet-stream",
-              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
-            },
-            body: bufferToReadableStream(fileBuffer)
+            status: 401,
+            json: {
+              message: "Project is not configured"
+            }
           };
-        } else {
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
           return {
-            status: 404,
+            status: 401,
             json: {
-              message: "File not found"
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        const execFetch = async headers => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/initialize`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "POST",
+              headers,
+              body: JSON.stringify({})
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI initialize failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const json = await upstreamRes.json();
+            const wsUrl = options.valContentUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:") + `/v1/${options.project}/ai/connect`;
+            return {
+              status: 200,
+              json: {
+                nonce: json.nonce,
+                wsUrl
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI initialize error"
+              }
+            };
+          }
+        };
+        if (serverOps instanceof ValOpsFS) {
+          return execFetch(getProfileAuthHeaders(authData, null, "application/json"));
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not configured"
             }
           };
         }
+        return withAuth(options.valSecret, cookies, "ai/initialize", data => {
+          return execFetch(getProfileAuthHeaders(authData, data, "application/json"));
+        });
       }
-    }
-  };
-};
-function formatPatchSourceError(error) {
-  if ("message" in error) {
-    return error.message;
-  } else if (Array.isArray(error)) {
-    return error.map(formatPatchSourceError).join("\n");
-  } else {
-    const _exhaustiveCheck = error;
-    return "Unknown patch source error: " + JSON.stringify(_exhaustiveCheck);
-  }
-}
-function verifyCallbackReq(stateCookie, queryParams) {
-  if (typeof stateCookie !== "string") {
-    return {
-      success: false,
-      error: "No state cookie"
-    };
-  }
-  const {
-    code,
-    state: tokenFromQuery
-  } = queryParams;
-  if (typeof code !== "string") {
-    return {
-      success: false,
-      error: "No code query param"
-    };
-  }
+    },
+    "/ai/sessions": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        const execFetch = async headers => {
+          try {
+            const SessionsResponse = z.object({
+              sessions: z.array(z.object({
+                id: z.string(),
+                name: z.string().nullable(),
+                createdAt: z.string(),
+                updatedAt: z.string()
+              })),
+              nextCursor: z.object({
+                updatedAt: z.string(),
+                id: z.string()
+              }).nullable().optional()
+            });
+            const params = new URLSearchParams();
+            if (req.query.limit) params.set("limit", req.query.limit);
+            if (req.query.cursor_updatedAt) {
+              params.set("cursor_updatedAt", req.query.cursor_updatedAt);
+            }
+            if (req.query.cursor_id) {
+              params.set("cursor_id", req.query.cursor_id);
+            }
+            const qs = params.toString();
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/sessions${qs ? `?${qs}` : ""}`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              headers
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI sessions failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const json = SessionsResponse.safeParse(await upstreamRes.json());
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI sessions response: " + fromError(json.error).toString()
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: json.data
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI sessions error"
+              }
+            };
+          }
+        };
+        if (serverOps instanceof ValOpsFS) {
+          return execFetch(getProfileAuthHeaders(authData, null, "application/json"));
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not configured"
+            }
+          };
+        }
+        return withAuth(options.valSecret, cookies, "ai/sessions", data => {
+          return execFetch(getProfileAuthHeaders(authData, data, "application/json"));
+        });
+      },
+      PATCH: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const pathParts = (req.path || "").split("/").filter(Boolean);
+        const sessionId = pathParts[0];
+        if (!sessionId) {
+          return {
+            status: 500,
+            json: {
+              message: "Missing sessionId in path"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        const execFetch = async headers => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/sessions/${encodeURIComponent(sessionId)}`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "PATCH",
+              headers,
+              body: JSON.stringify({
+                name: req.body.name
+              })
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI session rename failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: {}
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI session rename error"
+              }
+            };
+          }
+        };
+        if (serverOps instanceof ValOpsFS) {
+          return execFetch(getProfileAuthHeaders(authData, null, "application/json"));
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not configured"
+            }
+          };
+        }
+        return withAuth(options.valSecret, cookies, "ai/sessions/rename", data => {
+          return execFetch(getProfileAuthHeaders(authData, data, "application/json"));
+        });
+      }
+    },
+    "/ai/messages": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const pathParts = (req.path || "").split("/").filter(Boolean);
+        const sessionId = pathParts[0];
+        if (!sessionId) {
+          return {
+            status: 500,
+            json: {
+              message: "Missing sessionId in path"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        const execFetch = async headers => {
+          try {
+            const SessionMessagesResponse = z.object({
+              messages: z.array(z.object({
+                role: z.string(),
+                content: AIMessageContent
+              })),
+              nextCursor: z.object({
+                updatedAt: z.string(),
+                id: z.string()
+              }).nullable().optional()
+            });
+            const params = new URLSearchParams();
+            if (req.query.limit) params.set("limit", req.query.limit);
+            if (req.query.cursor_updatedAt) params.set("cursor_updatedAt", req.query.cursor_updatedAt);
+            if (req.query.cursor_id) params.set("cursor_id", req.query.cursor_id);
+            const qs = params.toString();
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/sessions/${encodeURIComponent(sessionId)}/messages` + (qs ? `?${qs}` : "");
+            const upstreamRes = await fetch(upstreamUrl, {
+              headers
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI session messages failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const json = SessionMessagesResponse.safeParse(await upstreamRes.json());
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI session messages response: " + fromError(json.error).toString()
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: json.data
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI session messages error"
+              }
+            };
+          }
+        };
+        if (serverOps instanceof ValOpsFS) {
+          return execFetch(getProfileAuthHeaders(authData, null, "application/json"));
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not configured"
+            }
+          };
+        }
+        return withAuth(options.valSecret, cookies, "ai/sessions/messages", data => {
+          return execFetch(getProfileAuthHeaders(authData, data, "application/json"));
+        });
+      }
+    },
+    "/ai/session-image-to-patch-file": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        let headers;
+        if (serverOps instanceof ValOpsFS) {
+          headers = getProfileAuthHeaders(authData, null, "application/json");
+        } else {
+          if (!("id" in auth) || !auth.id) {
+            return {
+              status: 401,
+              json: {
+                message: "Unauthorized"
+              }
+            };
+          }
+          headers = getProfileAuthHeaders(authData, {
+            sub: auth.id
+          }, "application/json");
+        }
+        const execFetch = async () => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/patches/${encodeURIComponent(req.body.patchId)}/files/from-session-file`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "POST",
+              headers,
+              body: JSON.stringify({
+                files: req.body.files.map(f => ({
+                  filePath: f.filePath,
+                  key: f.key,
+                  ...(f.isRemote !== undefined ? {
+                    isRemote: f.isRemote
+                  } : {})
+                }))
+              })
+            });
+            if (!upstreamRes.ok) {
+              var _upstreamJson;
+              const text = await upstreamRes.text();
+              let upstreamJson = null;
+              try {
+                upstreamJson = JSON.parse(text);
+              } catch {
+                upstreamJson = null;
+              }
+              if (upstreamRes.status === 400 && upstreamJson) {
+                return {
+                  status: 400,
+                  json: {
+                    message: upstreamJson.message ?? `AI session image to patch failed: ${text}`,
+                    ...(upstreamJson.details ? {
+                      details: upstreamJson.details
+                    } : {})
+                  }
+                };
+              }
+              return {
+                status: 500,
+                json: {
+                  message: `AI session image to patch failed: ${upstreamRes.status} ${((_upstreamJson = upstreamJson) === null || _upstreamJson === void 0 ? void 0 : _upstreamJson.message) ?? text}`
+                }
+              };
+            }
+            const rawUpstreamJson = await upstreamRes.json();
+            const UpstreamResponse = z.object({
+              patchId: z.string(),
+              files: z.array(z.object({
+                filePath: z.string(),
+                metadata: z.object({
+                  width: z.number(),
+                  height: z.number(),
+                  mimeType: z.string()
+                })
+              }))
+            });
+            const json = UpstreamResponse.safeParse(rawUpstreamJson);
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI session image patch response: " + fromError(json.error).toString()
+                }
+              };
+            }
+            if (json.data.patchId !== req.body.patchId) {
+              return {
+                status: 500,
+                json: {
+                  message: `AI session image to patch upstream returned mismatched patchId: expected '${req.body.patchId}', got '${json.data.patchId}'`
+                }
+              };
+            }
+            if (serverOps instanceof ValOpsFS) {
+              // Mirror the binaries from the content host into local patch
+              // storage so /files?patch_id=... can serve them. Match upstream
+              // entries to client-provided keys by filePath.
+              const keysByFilePath = new Map(req.body.files.map(f => [f.filePath, f.key]));
+              for (const file of json.data.files) {
+                const sessionKey = keysByFilePath.get(file.filePath);
+                if (!sessionKey) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `AI session image to patch: upstream returned file '${file.filePath}' which was not in the request`
+                    }
+                  };
+                }
+                const downloadUrl = `${options.valContentUrl}/v1/${options.project}/ai/images?key=${encodeURIComponent(sessionKey)}`;
+                let binaryRes;
+                try {
+                  binaryRes = await fetch(downloadUrl, {
+                    headers
+                  });
+                } catch (err) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not download AI session image '${file.filePath}' from content host: ${err instanceof Error ? err.message : String(err)}`
+                    }
+                  };
+                }
+                if (!binaryRes.ok) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not download AI session image '${file.filePath}' from content host: ${binaryRes.status} ${binaryRes.statusText}`
+                    }
+                  };
+                }
+                const arrayBuffer = await binaryRes.arrayBuffer();
+                const base64 = Buffer.from(arrayBuffer).toString("base64");
+                const dataUrl = `data:${file.metadata.mimeType};base64,${base64}`;
+                const type = file.metadata.mimeType.startsWith("image/") ? "image" : "file";
+                const saveRes = await serverOps.saveBase64EncodedBinaryFileFromPatch(file.filePath, req.body.parentRef, req.body.patchId, dataUrl, type, file.metadata);
+                if (saveRes.error) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not save AI session image '${file.filePath}' to local patch storage: ${saveRes.error.message}`
+                    }
+                  };
+                }
+              }
+            }
+            return {
+              status: 200,
+              json: {
+                patchId: req.body.patchId,
+                files: json.data.files
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI session image to patch error"
+              }
+            };
+          }
+        };
+        return execFetch();
+      }
+    },
+    "/ai/images": {
+      PATCH: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        let headers;
+        if (serverOps instanceof ValOpsFS) {
+          headers = getProfileAuthHeaders(authData, null, "application/json");
+        } else {
+          if (!("id" in auth) || !auth.id) {
+            return {
+              status: 401,
+              json: {
+                message: "Unauthorized"
+              }
+            };
+          }
+          headers = getProfileAuthHeaders(authData, {
+            sub: auth.id
+          }, "application/json");
+        }
+        const execFetch = async () => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/images`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "PATCH",
+              headers,
+              body: JSON.stringify({
+                key: req.body.key,
+                metadata: req.body.metadata,
+                contentType: req.body.contentType
+              })
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI images patch failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const UpstreamResponse = z.object({
+              key: z.string()
+            });
+            const json = UpstreamResponse.safeParse(await upstreamRes.json());
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI images patch response: " + fromError(json.error).toString()
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: {
+                key: json.data.key
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI images patch error"
+              }
+            };
+          }
+        };
+        return execFetch();
+      }
+    },
+    //#region files
+    "/files": {
+      GET: async req => {
+        const query = req.query;
+        const filePath = req.path;
+        // NOTE: no auth here since you would need the patch_id to get something that is not published.
+        // For everything that is published, well they are already public so no auth required there...
+        // We could imagine adding auth just to be a 200% certain,
+        // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
+        // So: 1) patch ids are not possible to guess (but possible to brute force)
+        //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
+        //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
+        // Thus: attack surface + ease of attack + benefit = low probability of attack
+        // If we couldn't argue that patch ids are secret enough, then this would be a problem.
+        let cacheControl;
+        let fileBuffer;
+        let mimeType;
+        const remote = query.remote === "true";
+        if (query.patch_id) {
+          fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id, remote);
+          mimeType = Internal.filenameToMimeType(filePath);
+          // TODO: reenable this:
+          // cacheControl = "public, max-age=20000, immutable";
+        } else {
+          if (serverOps instanceof ValOpsHttp && remote) {
+            console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
+          }
+          fileBuffer = await serverOps.getBinaryFile(filePath);
+        }
+        if (fileBuffer) {
+          return {
+            status: 200,
+            headers: {
+              // TODO: we could use ETag and return 304 instead
+              "Content-Type": mimeType || "application/octet-stream",
+              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+            },
+            body: bufferToReadableStream(fileBuffer)
+          };
+        } else {
+          return {
+            status: 404,
+            json: {
+              message: "File not found"
+            }
+          };
+        }
+      }
+    }
+  };
+};
+function formatPatchSourceError(error) {
+  if ("message" in error) {
+    return error.message;
+  } else if (Array.isArray(error)) {
+    return error.map(formatPatchSourceError).join("\n");
+  } else {
+    const _exhaustiveCheck = error;
+    return "Unknown patch source error: " + JSON.stringify(_exhaustiveCheck);
+  }
+}
+function verifyCallbackReq(stateCookie, queryParams) {
+  if (typeof stateCookie !== "string") {
+    return {
+      success: false,
+      error: "No state cookie"
+    };
+  }
+  const {
+    code,
+    state: tokenFromQuery
+  } = queryParams;
+  if (typeof code !== "string") {
+    return {
+      success: false,
+      error: "No code query param"
+    };
+  }
   if (typeof tokenFromQuery !== "string") {
     return {
       success: false,
@@ -6301,6 +7123,21 @@ async function withAuth(secret, cookies, errorMessageType, handler) {
     };
   }
 }
+function getProfileAuthHeaders(auth, data, type) {
+  if ("pat" in auth) {
+    return {
+      "x-val-pat": auth.pat,
+      "Content-Type": type
+    };
+  }
+  if ("apiKey" in auth && data) {
+    return {
+      ...getAuthHeaders(auth.apiKey, type),
+      "x-val-profile-id": data.sub
+    };
+  }
+  throw new Error("Invalid auth");
+}
 function getAuthHeaders(token, type) {
   if (!type) {
     return {