@valbuild/server 0.95.0 → 0.96.0

package/dist/valbuild-server.cjs.dev.js

@@ -2610,6 +2610,76 @@ class ValOpsFS extends ValOps {
   async onInit() {
     // do nothing
   }
+  async getPresignedAuthNonce(project, corsOrigin, auth) {
+    const authHeader = "pat" in auth ? {
+      "x-val-pat": auth.pat
+    } : {
+      Authorization: `Bearer ${auth.apiKey}`
+    };
+    try {
+      const res = await fetch(`${this.contentUrl}/v1/${project}/presigned-auth-nonce`, {
+        method: "POST",
+        headers: {
+          ...authHeader,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          corsOrigin
+        })
+      });
+      if (res.ok) {
+        const json = await res.json();
+        const parsed = zod.z.object({
+          nonce: zod.z.string(),
+          expiresAt: zod.z.string()
+        }).safeParse(json);
+        if (parsed.success) {
+          return {
+            status: "success",
+            data: {
+              nonce: parsed.data.nonce,
+              baseUrl: `${this.contentUrl}/v1/${project}`
+            }
+          };
+        }
+        console.error("Could not parse presigned auth nonce response. Error: " + zodValidationError.fromError(parsed.error));
+        return {
+          status: "error",
+          statusCode: 500,
+          error: {
+            message: "Could not get presigned auth nonce. The response from the content host was not in the expected format."
+          }
+        };
+      }
+      if (res.status === 401) {
+        return {
+          status: "error",
+          statusCode: 401,
+          error: {
+            message: "Could not get presigned auth nonce. The local PAT was rejected by the content host. Try re-running `val login`."
+          }
+        };
+      }
+      const unknownErrorMessage = `Could not get presigned auth nonce. HTTP error: ${res.status} ${res.statusText}`;
+      console.error(unknownErrorMessage);
+      return {
+        status: "error",
+        statusCode: 500,
+        error: {
+          message: unknownErrorMessage
+        }
+      };
+    } catch (e) {
+      console.error("Could not get presigned auth nonce (connection error?):", e);
+      return {
+        status: "error",
+        statusCode: 500,
+        error: {
+          message: `Could not get presigned auth nonce. Error: ${e instanceof Error ? e.message : JSON.stringify(e)}`
+        }
+      };
+    }
+  }
   async getCommitSummary() {
     return {
       error: {
@@ -3931,7 +4001,7 @@ class ValOpsHttp extends ValOps {
         return {
           status: "error",
           error: {
-            message: "Could not get nonce." + message
+            message: "Could not get nonce. " + message
           }
         };
       }
@@ -4678,6 +4748,14 @@ function hasRemoteFileSchema(schema) {
 
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const ValServer = (valModules, options, callbacks) => {
+  const AIContentBlock = zod.z.union([zod.z.object({
+    type: zod.z.literal("text"),
+    text: zod.z.string()
+  }), zod.z.object({
+    type: zod.z.literal("image_url"),
+    url: zod.z.string()
+  })]);
+  const AIMessageContent = zod.z.union([zod.z.string(), zod.z.array(AIContentBlock)]);
   const ProfilesResponse = zod.z.object({
     profiles: zod.z.array(zod.z.object({
       profileId: zod.z.string(),
@@ -5475,15 +5553,38 @@ const ValServer = (valModules, options, callbacks) => {
           };
         }
         if (serverOps instanceof ValOpsFS) {
-          // In FS mode we do not use the remote server at all and just return an url that points to this server
-          // which has an endpoint that handles this
-          // A bit hacky perhaps, but we want to have as similar semantics as possible in client code when it comes to FS / HTTP
+          // In FS mode patch-file uploads are buffered through this server (no remote round-trip),
+          // so baseUrl points at /api/val/upload. AI image uploads, however, go straight to the
+          // content host — we resolve a contentBaseUrl + a PAT-issued nonce here so the browser
+          // can POST directly without exposing the PAT.
           const host = `/api/val`;
+          let contentBaseUrl = null;
+          let contentAuthNonce = null;
+          if (!options.project) {
+            console.warn("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
+          } else {
+            const authDataRes = await getRemoteFileAuth();
+            if (authDataRes.status !== 200) {
+              console.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
+            } else {
+              const corsOrigin = "*"; // TODO: add cors origin
+              const presignedAuthNonce = await serverOps.getPresignedAuthNonce(options.project, corsOrigin, authDataRes.json.remoteFileAuth);
+              if (presignedAuthNonce.status === "success") {
+                contentBaseUrl = presignedAuthNonce.data.baseUrl;
+                contentAuthNonce = presignedAuthNonce.data.nonce;
+              } else {
+                console.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
+              }
+            }
+          }
           return {
             status: 200,
             json: {
               nonce: null,
-              baseUrl: `${host}/upload` // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
+              baseUrl: `${host}/upload`,
+              // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
+              contentBaseUrl,
+              contentAuthNonce
             }
           };
         }
@@ -5509,7 +5610,9 @@ const ValServer = (valModules, options, callbacks) => {
           status: 200,
           json: {
             nonce: presignedAuthNonce.data.nonce,
-            baseUrl: presignedAuthNonce.data.baseUrl
+            baseUrl: presignedAuthNonce.data.baseUrl,
+            contentBaseUrl: presignedAuthNonce.data.baseUrl,
+            contentAuthNonce: presignedAuthNonce.data.nonce
           }
         };
       }
@@ -6179,7 +6282,7 @@ const ValServer = (valModules, options, callbacks) => {
         }
         if (!options.project) {
           return {
-            status: 500,
+            status: 401,
             json: {
               message: "Project is not configured"
             }
@@ -6188,7 +6291,7 @@ const ValServer = (valModules, options, callbacks) => {
         const authDataRes = await getRemoteFileAuth();
         if (authDataRes.status !== 200) {
           return {
-            status: 500,
+            status: 401,
             json: {
               message: authDataRes.json.message
             }
@@ -6481,14 +6584,19 @@ const ValServer = (valModules, options, callbacks) => {
             const SessionMessagesResponse = zod.z.object({
               messages: zod.z.array(zod.z.object({
                 role: zod.z.string(),
-                content: zod.z.string()
+                content: AIMessageContent
               })),
               nextCursor: zod.z.object({
                 updatedAt: zod.z.string(),
                 id: zod.z.string()
               }).nullable().optional()
             });
-            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/sessions/${encodeURIComponent(sessionId)}/messages`;
+            const params = new URLSearchParams();
+            if (req.query.limit) params.set("limit", req.query.limit);
+            if (req.query.cursor_updatedAt) params.set("cursor_updatedAt", req.query.cursor_updatedAt);
+            if (req.query.cursor_id) params.set("cursor_id", req.query.cursor_id);
+            const qs = params.toString();
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/sessions/${encodeURIComponent(sessionId)}/messages` + (qs ? `?${qs}` : "");
             const upstreamRes = await fetch(upstreamUrl, {
               headers
             });
@@ -6539,6 +6647,292 @@ const ValServer = (valModules, options, callbacks) => {
         });
       }
     },
+    "/ai/session-image-to-patch-file": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        let headers;
+        if (serverOps instanceof ValOpsFS) {
+          headers = getProfileAuthHeaders(authData, null, "application/json");
+        } else {
+          if (!("id" in auth) || !auth.id) {
+            return {
+              status: 401,
+              json: {
+                message: "Unauthorized"
+              }
+            };
+          }
+          headers = getProfileAuthHeaders(authData, {
+            sub: auth.id
+          }, "application/json");
+        }
+        const execFetch = async () => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/patches/${encodeURIComponent(req.body.patchId)}/files/from-session-file`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "POST",
+              headers,
+              body: JSON.stringify({
+                files: req.body.files.map(f => ({
+                  filePath: f.filePath,
+                  key: f.key,
+                  ...(f.isRemote !== undefined ? {
+                    isRemote: f.isRemote
+                  } : {})
+                }))
+              })
+            });
+            if (!upstreamRes.ok) {
+              var _upstreamJson;
+              const text = await upstreamRes.text();
+              let upstreamJson = null;
+              try {
+                upstreamJson = JSON.parse(text);
+              } catch {
+                upstreamJson = null;
+              }
+              if (upstreamRes.status === 400 && upstreamJson) {
+                return {
+                  status: 400,
+                  json: {
+                    message: upstreamJson.message ?? `AI session image to patch failed: ${text}`,
+                    ...(upstreamJson.details ? {
+                      details: upstreamJson.details
+                    } : {})
+                  }
+                };
+              }
+              return {
+                status: 500,
+                json: {
+                  message: `AI session image to patch failed: ${upstreamRes.status} ${((_upstreamJson = upstreamJson) === null || _upstreamJson === void 0 ? void 0 : _upstreamJson.message) ?? text}`
+                }
+              };
+            }
+            const rawUpstreamJson = await upstreamRes.json();
+            const UpstreamResponse = zod.z.object({
+              patchId: zod.z.string(),
+              files: zod.z.array(zod.z.object({
+                filePath: zod.z.string(),
+                metadata: zod.z.object({
+                  width: zod.z.number(),
+                  height: zod.z.number(),
+                  mimeType: zod.z.string()
+                })
+              }))
+            });
+            const json = UpstreamResponse.safeParse(rawUpstreamJson);
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI session image patch response: " + zodValidationError.fromError(json.error).toString()
+                }
+              };
+            }
+            if (json.data.patchId !== req.body.patchId) {
+              return {
+                status: 500,
+                json: {
+                  message: `AI session image to patch upstream returned mismatched patchId: expected '${req.body.patchId}', got '${json.data.patchId}'`
+                }
+              };
+            }
+            if (serverOps instanceof ValOpsFS) {
+              // Mirror the binaries from the content host into local patch
+              // storage so /files?patch_id=... can serve them. Match upstream
+              // entries to client-provided keys by filePath.
+              const keysByFilePath = new Map(req.body.files.map(f => [f.filePath, f.key]));
+              for (const file of json.data.files) {
+                const sessionKey = keysByFilePath.get(file.filePath);
+                if (!sessionKey) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `AI session image to patch: upstream returned file '${file.filePath}' which was not in the request`
+                    }
+                  };
+                }
+                const downloadUrl = `${options.valContentUrl}/v1/${options.project}/ai/images?key=${encodeURIComponent(sessionKey)}`;
+                let binaryRes;
+                try {
+                  binaryRes = await fetch(downloadUrl, {
+                    headers
+                  });
+                } catch (err) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not download AI session image '${file.filePath}' from content host: ${err instanceof Error ? err.message : String(err)}`
+                    }
+                  };
+                }
+                if (!binaryRes.ok) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not download AI session image '${file.filePath}' from content host: ${binaryRes.status} ${binaryRes.statusText}`
+                    }
+                  };
+                }
+                const arrayBuffer = await binaryRes.arrayBuffer();
+                const base64 = Buffer.from(arrayBuffer).toString("base64");
+                const dataUrl = `data:${file.metadata.mimeType};base64,${base64}`;
+                const type = file.metadata.mimeType.startsWith("image/") ? "image" : "file";
+                const saveRes = await serverOps.saveBase64EncodedBinaryFileFromPatch(file.filePath, req.body.parentRef, req.body.patchId, dataUrl, type, file.metadata);
+                if (saveRes.error) {
+                  return {
+                    status: 500,
+                    json: {
+                      message: `Could not save AI session image '${file.filePath}' to local patch storage: ${saveRes.error.message}`
+                    }
+                  };
+                }
+              }
+            }
+            return {
+              status: 200,
+              json: {
+                patchId: req.body.patchId,
+                files: json.data.files
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI session image to patch error"
+              }
+            };
+          }
+        };
+        return execFetch();
+      }
+    },
+    "/ai/images": {
+      PATCH: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not configured"
+            }
+          };
+        }
+        const authDataRes = await getRemoteFileAuth();
+        if (authDataRes.status !== 200) {
+          return {
+            status: 500,
+            json: {
+              message: authDataRes.json.message
+            }
+          };
+        }
+        const authData = authDataRes.json.remoteFileAuth;
+        let headers;
+        if (serverOps instanceof ValOpsFS) {
+          headers = getProfileAuthHeaders(authData, null, "application/json");
+        } else {
+          if (!("id" in auth) || !auth.id) {
+            return {
+              status: 401,
+              json: {
+                message: "Unauthorized"
+              }
+            };
+          }
+          headers = getProfileAuthHeaders(authData, {
+            sub: auth.id
+          }, "application/json");
+        }
+        const execFetch = async () => {
+          try {
+            const upstreamUrl = `${options.valContentUrl}/v1/${options.project}/ai/images`;
+            const upstreamRes = await fetch(upstreamUrl, {
+              method: "PATCH",
+              headers,
+              body: JSON.stringify({
+                key: req.body.key,
+                metadata: req.body.metadata,
+                contentType: req.body.contentType
+              })
+            });
+            if (!upstreamRes.ok) {
+              const text = await upstreamRes.text();
+              return {
+                status: 500,
+                json: {
+                  message: `AI images patch failed: ${upstreamRes.status} ${text}`
+                }
+              };
+            }
+            const UpstreamResponse = zod.z.object({
+              key: zod.z.string()
+            });
+            const json = UpstreamResponse.safeParse(await upstreamRes.json());
+            if (!json.success) {
+              return {
+                status: 500,
+                json: {
+                  message: "Could not parse AI images patch response: " + zodValidationError.fromError(json.error).toString()
+                }
+              };
+            }
+            return {
+              status: 200,
+              json: {
+                key: json.data.key
+              }
+            };
+          } catch (err) {
+            return {
+              status: 500,
+              json: {
+                message: err instanceof Error ? err.message : "AI images patch error"
+              }
+            };
+          }
+        };
+        return execFetch();
+      }
+    },
     //#region files
     "/files": {
       GET: async req => {