@valbuild/core 0.147.0 → 0.148.2

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @valbuild/core
 
+## 0.148.2
+
+### Patch Changes
+
+- [#889](https://github.com/valbuild/val/pull/889) [`dc7c8cc`](https://github.com/valbuild/val/commit/dc7c8ccd82f643e662d00225fabec411b5d39e3a) Thanks [@freekh](https://github.com/freekh)! - Val is quieter in your app's console. Errors and warnings you can act on still
+  print, now prefixed with `[val]` so you can filter them. Val's own debug
+  output, which used to reach your terminal and browser console, is now off by
+  default. That includes the `Invalid JWT` line that printed on every request
+  with an expired session cookie, the "verifying draft mode" and polling notices,
+  and the Studio's sync and WebSocket chatter.
+
+  To turn the debug output back on, for example when reporting a bug:
+
+  - on the server, set `VAL_DEBUG=1`
+  - in the browser, run `localStorage.setItem("val:debug", "1")` in the console.
+    It takes effect immediately, with no reload. Remove the key to turn it off
+    again.
+
+## 0.148.0
+
+### Patch Changes
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - Remote files served from a project's own site (addresses like
+  `https://www.acme.no/_val/file/…`) are now checked for whether that address
+  still serves the project. When a custom domain has been removed or moved to
+  another project, the image or file is reported, and **Fix** on the Studio's
+  Validate page — or `val validate --fix` — points it at the project's permanent
+  `<id>.valstart.dev` address. Nothing is uploaded or downloaded: only the address
+  changes.
+
+  Remote file addresses with a `/_val` prefix after the host are now recognised.
+
 ## 0.147.0
 
 ### Minor Changes

package/dist/declarations/src/index.d.ts

@@ -105,6 +105,7 @@ export { getSourcePathFromRoute, isPageRouter, routePatternOf, } from "./getSour
 export { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf, UNSAFE_URL_SCHEMES, } from "./externalUrlSchemes.js";
 export type { ExternalUrlSchemePolicy, SchemeRejection, } from "./externalUrlSchemes.js";
 import { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf } from "./externalUrlSchemes.js";
+import { isDebugEnabled } from "./log.js";
 export declare const FATAL_ERROR_TYPES: readonly ["no-schema", "no-source", "invalid-id", "no-module", "invalid-patch"];
 export type FatalErrorType = (typeof FATAL_ERROR_TYPES)[number];
 export declare const DEFAULT_CONTENT_HOST = "https://content.val.build";
@@ -138,6 +139,15 @@ export declare const DEFAULT_APP_HOST = "https://admin.val.build";
  */
 export declare const DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 declare const Internal: {
+    /** Val's console output. See `log.ts` for which levels print, and when. */
+    log: {
+        error(...args: unknown[]): void;
+        warn(...args: unknown[]): void;
+        info(...args: unknown[]): void;
+        debug(...args: unknown[]): void;
+    };
+    isDebugEnabled: typeof isDebugEnabled;
+    VAL_DEBUG_STORAGE_KEY: string;
     VERSION: {
         core: string;
     };

package/dist/declarations/src/log.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Val's console output, and the one place that decides what reaches it.
+ *
+ * Val runs inside someone else's app: the server in their dev server and their
+ * production logs, the Studio in their browser tab. Everything Val prints lands
+ * in a console that belongs to a developer who did not write the code printing
+ * it, so the levels are split by who the line is FOR:
+ *
+ * - `error` and `warn` are for that developer -- something broke, or something
+ *   they can fix -- and always print.
+ * - `info` and `debug` are for whoever is debugging Val, and print only when
+ *   asked for: `VAL_DEBUG=1` in the environment of a server, or
+ *   `localStorage.setItem("val:debug", "1")` in a browser. Both are read on
+ *   every call, so turning it on in a live tab needs no reload.
+ *
+ * In Node `console.debug` IS `console.log`, so a bare `console.debug` is not
+ * quiet on a server: it went to the developer's terminal on every request.
+ * That is why `no-console` is on for the packages that run in a host app, and
+ * this file is the exemption.
+ *
+ * Every line gets a `[val]` prefix, so a developer can filter Val out (or in).
+ * Arguments are otherwise passed through as they are, so an `Error` still
+ * prints with its stack.
+ */
+/** The localStorage key that turns `debug` and `info` on in a browser. */
+export declare const VAL_DEBUG_STORAGE_KEY = "val:debug";
+export declare function isDebugEnabled(): boolean;
+export declare const log: {
+    error(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    info(...args: unknown[]): void;
+    debug(...args: unknown[]): void;
+};

package/dist/declarations/src/remote/fileHash.d.ts

@@ -1,3 +1,2 @@
-import { Buffer } from "buffer";
 export declare function hashToRemoteFileHash(hash: string): string;
-export declare function getFileHash(text: Buffer): string;
+export declare function getFileHash(bytes: Uint8Array): string;

package/dist/declarations/src/schema/validation/ValidationFix.d.ts

@@ -1,2 +1,2 @@
-export declare const ValidationFix: readonly ["image:add-metadata", "image:check-metadata", "image:upload-remote", "image:download-remote", "image:check-remote", "images:check-remote", "images:upload-remote", "file:add-metadata", "file:check-metadata", "file:upload-remote", "file:download-remote", "file:check-remote", "files:check-remote", "files:upload-remote", "video:add-metadata", "video:upload-remote", "video:download-remote", "videos:add-metadata", "videos:check-remote", "videos:upload-remote", "keyof:check-keys", "image:check-gallery", "file:check-gallery", "video:check-gallery", "router:check-route", "locale:check-locale", "router:check-locale-param", "images:check-unique-folder", "files:check-unique-folder", "images:check-all-files", "files:check-all-files", "videos:check-unique-folder", "videos:check-all-files", "jsonValues:extract-entry", "record:fill-keys", "external:upload", "view:check-module"];
+export declare const ValidationFix: readonly ["image:add-metadata", "image:check-metadata", "image:upload-remote", "image:download-remote", "image:check-remote", "images:check-remote", "images:upload-remote", "file:add-metadata", "file:check-metadata", "file:upload-remote", "file:download-remote", "file:check-remote", "files:check-remote", "files:upload-remote", "video:add-metadata", "video:upload-remote", "video:download-remote", "videos:add-metadata", "videos:check-remote", "videos:upload-remote", "keyof:check-keys", "image:check-gallery", "file:check-gallery", "video:check-gallery", "router:check-route", "locale:check-locale", "router:check-locale-param", "images:check-unique-folder", "files:check-unique-folder", "images:check-all-files", "files:check-all-files", "videos:check-unique-folder", "videos:check-all-files", "jsonValues:extract-entry", "record:fill-keys", "external:upload", "view:check-module", "remote:rewrite-host"];
 export type ValidationFix = (typeof ValidationFix)[number];

package/dist/{index-63547301.cjs.dev.js → index-858ec9e8.cjs.dev.js}

@@ -2764,6 +2764,122 @@ var discriminatedUnion = function discriminatedUnion(key) {
   return new DiscriminatedUnionSchema(key, objects);
 };
 
+function _toArray(r) {
+  return _arrayWithHoles(r) || _iterableToArray(r) || result._unsupportedIterableToArray(r) || _nonIterableRest();
+}
+
+/**
+ * Val's console output, and the one place that decides what reaches it.
+ *
+ * Val runs inside someone else's app: the server in their dev server and their
+ * production logs, the Studio in their browser tab. Everything Val prints lands
+ * in a console that belongs to a developer who did not write the code printing
+ * it, so the levels are split by who the line is FOR:
+ *
+ * - `error` and `warn` are for that developer -- something broke, or something
+ *   they can fix -- and always print.
+ * - `info` and `debug` are for whoever is debugging Val, and print only when
+ *   asked for: `VAL_DEBUG=1` in the environment of a server, or
+ *   `localStorage.setItem("val:debug", "1")` in a browser. Both are read on
+ *   every call, so turning it on in a live tab needs no reload.
+ *
+ * In Node `console.debug` IS `console.log`, so a bare `console.debug` is not
+ * quiet on a server: it went to the developer's terminal on every request.
+ * That is why `no-console` is on for the packages that run in a host app, and
+ * this file is the exemption.
+ *
+ * Every line gets a `[val]` prefix, so a developer can filter Val out (or in).
+ * Arguments are otherwise passed through as they are, so an `Error` still
+ * prints with its stack.
+ */
+
+var PREFIX = "[val]";
+
+/** The localStorage key that turns `debug` and `info` on in a browser. */
+var VAL_DEBUG_STORAGE_KEY = "val:debug";
+function isOn(value) {
+  return value !== undefined && value !== null && value !== "" && value !== "0" && value !== "false";
+}
+function fromEnv() {
+  var _process$env;
+  // `typeof` first: a browser bundle may have no `process` at all.
+  if (typeof process === "undefined") {
+    return undefined;
+  }
+  return (_process$env = process.env) === null || _process$env === void 0 ? void 0 : _process$env.VAL_DEBUG;
+}
+function fromLocalStorage() {
+  // Not in Node, even where it has a `localStorage`: from Node 25 merely
+  // touching it without `--localstorage-file` prints a warning of its own.
+  if (!("window" in globalThis)) {
+    return undefined;
+  }
+  try {
+    var storage = Reflect.get(globalThis, "localStorage");
+    if (_typeof(storage) === "object" && storage !== null && "getItem" in storage && typeof storage.getItem === "function") {
+      var value = storage.getItem(VAL_DEBUG_STORAGE_KEY);
+      return typeof value === "string" ? value : null;
+    }
+  } catch (_unused) {
+    // A sandboxed frame or blocked site data throws on access.
+  }
+  return undefined;
+}
+function isDebugEnabled() {
+  return isOn(fromEnv()) || isOn(fromLocalStorage());
+}
+function withPrefix(args) {
+  var _args = _toArray(args),
+    first = _args[0],
+    rest = result._arrayLikeToArray(_args).slice(1);
+  if (typeof first === "string") {
+    if (/^\[val\]/i.test(first)) {
+      return args;
+    }
+    return ["".concat(PREFIX, " ").concat(first)].concat(_toConsumableArray(rest));
+  }
+  return [PREFIX].concat(_toConsumableArray(args));
+}
+
+/*
+ * `console` is looked up on every call rather than captured, so a test that
+ * spies on `console.warn` after this module loaded still sees the call.
+ */
+var log = {
+  error: function error() {
+    var _console;
+    for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
+      args[_key] = arguments[_key];
+    }
+    (_console = console).error.apply(_console, _toConsumableArray(withPrefix(args)));
+  },
+  warn: function warn() {
+    var _console2;
+    for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
+      args[_key2] = arguments[_key2];
+    }
+    (_console2 = console).warn.apply(_console2, _toConsumableArray(withPrefix(args)));
+  },
+  info: function info() {
+    if (isDebugEnabled()) {
+      var _console3;
+      for (var _len3 = arguments.length, args = new Array(_len3), _key3 = 0; _key3 < _len3; _key3++) {
+        args[_key3] = arguments[_key3];
+      }
+      (_console3 = console).info.apply(_console3, _toConsumableArray(withPrefix(args)));
+    }
+  },
+  debug: function debug() {
+    if (isDebugEnabled()) {
+      var _console4;
+      for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
+        args[_key4] = arguments[_key4];
+      }
+      (_console4 = console).debug.apply(_console4, _toConsumableArray(withPrefix(args)));
+    }
+  }
+};
+
 function _objectWithoutPropertiesLoose(r, e) {
   if (null == r) return {};
   var t = {};
@@ -2786,7 +2902,14 @@ function _objectWithoutProperties(e, t) {
   return i;
 }
 
-var RegEx$1 = /^(https?:\/\/[^/]+)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
+/**
+ * The host part may carry a `/_val` prefix: a ref served by the platform
+ * loader names `https://www.acme.no/_val/file/…`, because a customer's site
+ * can have a `/file/…` route of its own. The prefix is part of `remoteHost`,
+ * so `createRemoteRef(remoteHost, …)` writes it back unchanged. See valbuild/home
+ * `docs/remote-files-on-platform.md`, "The ref".
+ */
+var RegEx$1 = /^(https?:\/\/[^/]+(?:\/_val)?)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
 function splitRemoteRef(ref) {
   if (ref[0] === "/") {
     return {
@@ -5035,7 +5158,7 @@ var RichTextSchema = /*#__PURE__*/function (_Schema) {
                       return hrefSchema["executeValidate"](hrefPath, node.href);
                     } else {
                       var exhaustiveCheck = hrefSchema;
-                      console.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
+                      log.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
                       return false;
                     }
                   };
@@ -15286,7 +15409,7 @@ function collectObjectRecursive(item, collector) {
     }
     return;
   } else {
-    console.warn("Unknown type encountered when hashing object", _typeof(item), item);
+    log.warn("Unknown type encountered when hashing object", _typeof(item), item);
   }
 }
 
@@ -16121,8 +16244,8 @@ function hashToRemoteFileHash(hash) {
   return hash.slice(0, 12 // 12 hex characters = 6 bytes = 48 bits = 2^48 = 281474976710656 possibilities or 1 in 281474976710656 or using birthday problem estimate with 10K files: p = (k, n) => (k*k)/(2x2**n) and p(10_000,12*4) = 1.7763568394002505e-7 chance of collision which should be good enough
   );
 }
-function getFileHash(text) {
-  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(text)));
+function getFileHash(bytes) {
+  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(bytes)));
 }
 
 var cache$1 = new WeakMap();
@@ -16798,7 +16921,7 @@ function isInlineRender(container) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.147.0",
+	version: "0.148.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -16885,6 +17008,10 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  */
 var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
+  /** Val's console output. See `log.ts` for which levels print, and when. */
+  log: log,
+  isDebugEnabled: isDebugEnabled,
+  VAL_DEBUG_STORAGE_KEY: VAL_DEBUG_STORAGE_KEY,
   VERSION: {
     core: corePackageJson.version
   },

package/dist/{index-cb122769.esm.js → index-a91ac6a3.esm.js}

@@ -2762,6 +2762,122 @@ var discriminatedUnion = function discriminatedUnion(key) {
   return new DiscriminatedUnionSchema(key, objects);
 };
 
+function _toArray(r) {
+  return _arrayWithHoles(r) || _iterableToArray(r) || _unsupportedIterableToArray(r) || _nonIterableRest();
+}
+
+/**
+ * Val's console output, and the one place that decides what reaches it.
+ *
+ * Val runs inside someone else's app: the server in their dev server and their
+ * production logs, the Studio in their browser tab. Everything Val prints lands
+ * in a console that belongs to a developer who did not write the code printing
+ * it, so the levels are split by who the line is FOR:
+ *
+ * - `error` and `warn` are for that developer -- something broke, or something
+ *   they can fix -- and always print.
+ * - `info` and `debug` are for whoever is debugging Val, and print only when
+ *   asked for: `VAL_DEBUG=1` in the environment of a server, or
+ *   `localStorage.setItem("val:debug", "1")` in a browser. Both are read on
+ *   every call, so turning it on in a live tab needs no reload.
+ *
+ * In Node `console.debug` IS `console.log`, so a bare `console.debug` is not
+ * quiet on a server: it went to the developer's terminal on every request.
+ * That is why `no-console` is on for the packages that run in a host app, and
+ * this file is the exemption.
+ *
+ * Every line gets a `[val]` prefix, so a developer can filter Val out (or in).
+ * Arguments are otherwise passed through as they are, so an `Error` still
+ * prints with its stack.
+ */
+
+var PREFIX = "[val]";
+
+/** The localStorage key that turns `debug` and `info` on in a browser. */
+var VAL_DEBUG_STORAGE_KEY = "val:debug";
+function isOn(value) {
+  return value !== undefined && value !== null && value !== "" && value !== "0" && value !== "false";
+}
+function fromEnv() {
+  var _process$env;
+  // `typeof` first: a browser bundle may have no `process` at all.
+  if (typeof process === "undefined") {
+    return undefined;
+  }
+  return (_process$env = process.env) === null || _process$env === void 0 ? void 0 : _process$env.VAL_DEBUG;
+}
+function fromLocalStorage() {
+  // Not in Node, even where it has a `localStorage`: from Node 25 merely
+  // touching it without `--localstorage-file` prints a warning of its own.
+  if (!("window" in globalThis)) {
+    return undefined;
+  }
+  try {
+    var storage = Reflect.get(globalThis, "localStorage");
+    if (_typeof(storage) === "object" && storage !== null && "getItem" in storage && typeof storage.getItem === "function") {
+      var value = storage.getItem(VAL_DEBUG_STORAGE_KEY);
+      return typeof value === "string" ? value : null;
+    }
+  } catch (_unused) {
+    // A sandboxed frame or blocked site data throws on access.
+  }
+  return undefined;
+}
+function isDebugEnabled() {
+  return isOn(fromEnv()) || isOn(fromLocalStorage());
+}
+function withPrefix(args) {
+  var _args = _toArray(args),
+    first = _args[0],
+    rest = _arrayLikeToArray(_args).slice(1);
+  if (typeof first === "string") {
+    if (/^\[val\]/i.test(first)) {
+      return args;
+    }
+    return ["".concat(PREFIX, " ").concat(first)].concat(_toConsumableArray(rest));
+  }
+  return [PREFIX].concat(_toConsumableArray(args));
+}
+
+/*
+ * `console` is looked up on every call rather than captured, so a test that
+ * spies on `console.warn` after this module loaded still sees the call.
+ */
+var log = {
+  error: function error() {
+    var _console;
+    for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
+      args[_key] = arguments[_key];
+    }
+    (_console = console).error.apply(_console, _toConsumableArray(withPrefix(args)));
+  },
+  warn: function warn() {
+    var _console2;
+    for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
+      args[_key2] = arguments[_key2];
+    }
+    (_console2 = console).warn.apply(_console2, _toConsumableArray(withPrefix(args)));
+  },
+  info: function info() {
+    if (isDebugEnabled()) {
+      var _console3;
+      for (var _len3 = arguments.length, args = new Array(_len3), _key3 = 0; _key3 < _len3; _key3++) {
+        args[_key3] = arguments[_key3];
+      }
+      (_console3 = console).info.apply(_console3, _toConsumableArray(withPrefix(args)));
+    }
+  },
+  debug: function debug() {
+    if (isDebugEnabled()) {
+      var _console4;
+      for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
+        args[_key4] = arguments[_key4];
+      }
+      (_console4 = console).debug.apply(_console4, _toConsumableArray(withPrefix(args)));
+    }
+  }
+};
+
 function _objectWithoutPropertiesLoose(r, e) {
   if (null == r) return {};
   var t = {};
@@ -2784,7 +2900,14 @@ function _objectWithoutProperties(e, t) {
   return i;
 }
 
-var RegEx$1 = /^(https?:\/\/[^/]+)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
+/**
+ * The host part may carry a `/_val` prefix: a ref served by the platform
+ * loader names `https://www.acme.no/_val/file/…`, because a customer's site
+ * can have a `/file/…` route of its own. The prefix is part of `remoteHost`,
+ * so `createRemoteRef(remoteHost, …)` writes it back unchanged. See valbuild/home
+ * `docs/remote-files-on-platform.md`, "The ref".
+ */
+var RegEx$1 = /^(https?:\/\/[^/]+(?:\/_val)?)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
 function splitRemoteRef(ref) {
   if (ref[0] === "/") {
     return {
@@ -5033,7 +5156,7 @@ var RichTextSchema = /*#__PURE__*/function (_Schema) {
                       return hrefSchema["executeValidate"](hrefPath, node.href);
                     } else {
                       var exhaustiveCheck = hrefSchema;
-                      console.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
+                      log.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
                       return false;
                     }
                   };
@@ -15284,7 +15407,7 @@ function collectObjectRecursive(item, collector) {
     }
     return;
   } else {
-    console.warn("Unknown type encountered when hashing object", _typeof(item), item);
+    log.warn("Unknown type encountered when hashing object", _typeof(item), item);
   }
 }
 
@@ -16119,8 +16242,8 @@ function hashToRemoteFileHash(hash) {
   return hash.slice(0, 12 // 12 hex characters = 6 bytes = 48 bits = 2^48 = 281474976710656 possibilities or 1 in 281474976710656 or using birthday problem estimate with 10K files: p = (k, n) => (k*k)/(2x2**n) and p(10_000,12*4) = 1.7763568394002505e-7 chance of collision which should be good enough
   );
 }
-function getFileHash(text) {
-  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(text)));
+function getFileHash(bytes) {
+  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(bytes)));
 }
 
 var cache$1 = new WeakMap();
@@ -16796,7 +16919,7 @@ function isInlineRender(container) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.147.0",
+	version: "0.148.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -16883,6 +17006,10 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  */
 var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
+  /** Val's console output. See `log.ts` for which levels print, and when. */
+  log: log,
+  isDebugEnabled: isDebugEnabled,
+  VAL_DEBUG_STORAGE_KEY: VAL_DEBUG_STORAGE_KEY,
   VERSION: {
     core: corePackageJson.version
   },

package/dist/{index-989ebd80.cjs.prod.js → index-c21fa511.cjs.prod.js}

@@ -2764,6 +2764,122 @@ var discriminatedUnion = function discriminatedUnion(key) {
   return new DiscriminatedUnionSchema(key, objects);
 };
 
+function _toArray(r) {
+  return _arrayWithHoles(r) || _iterableToArray(r) || result._unsupportedIterableToArray(r) || _nonIterableRest();
+}
+
+/**
+ * Val's console output, and the one place that decides what reaches it.
+ *
+ * Val runs inside someone else's app: the server in their dev server and their
+ * production logs, the Studio in their browser tab. Everything Val prints lands
+ * in a console that belongs to a developer who did not write the code printing
+ * it, so the levels are split by who the line is FOR:
+ *
+ * - `error` and `warn` are for that developer -- something broke, or something
+ *   they can fix -- and always print.
+ * - `info` and `debug` are for whoever is debugging Val, and print only when
+ *   asked for: `VAL_DEBUG=1` in the environment of a server, or
+ *   `localStorage.setItem("val:debug", "1")` in a browser. Both are read on
+ *   every call, so turning it on in a live tab needs no reload.
+ *
+ * In Node `console.debug` IS `console.log`, so a bare `console.debug` is not
+ * quiet on a server: it went to the developer's terminal on every request.
+ * That is why `no-console` is on for the packages that run in a host app, and
+ * this file is the exemption.
+ *
+ * Every line gets a `[val]` prefix, so a developer can filter Val out (or in).
+ * Arguments are otherwise passed through as they are, so an `Error` still
+ * prints with its stack.
+ */
+
+var PREFIX = "[val]";
+
+/** The localStorage key that turns `debug` and `info` on in a browser. */
+var VAL_DEBUG_STORAGE_KEY = "val:debug";
+function isOn(value) {
+  return value !== undefined && value !== null && value !== "" && value !== "0" && value !== "false";
+}
+function fromEnv() {
+  var _process$env;
+  // `typeof` first: a browser bundle may have no `process` at all.
+  if (typeof process === "undefined") {
+    return undefined;
+  }
+  return (_process$env = process.env) === null || _process$env === void 0 ? void 0 : _process$env.VAL_DEBUG;
+}
+function fromLocalStorage() {
+  // Not in Node, even where it has a `localStorage`: from Node 25 merely
+  // touching it without `--localstorage-file` prints a warning of its own.
+  if (!("window" in globalThis)) {
+    return undefined;
+  }
+  try {
+    var storage = Reflect.get(globalThis, "localStorage");
+    if (_typeof(storage) === "object" && storage !== null && "getItem" in storage && typeof storage.getItem === "function") {
+      var value = storage.getItem(VAL_DEBUG_STORAGE_KEY);
+      return typeof value === "string" ? value : null;
+    }
+  } catch (_unused) {
+    // A sandboxed frame or blocked site data throws on access.
+  }
+  return undefined;
+}
+function isDebugEnabled() {
+  return isOn(fromEnv()) || isOn(fromLocalStorage());
+}
+function withPrefix(args) {
+  var _args = _toArray(args),
+    first = _args[0],
+    rest = result._arrayLikeToArray(_args).slice(1);
+  if (typeof first === "string") {
+    if (/^\[val\]/i.test(first)) {
+      return args;
+    }
+    return ["".concat(PREFIX, " ").concat(first)].concat(_toConsumableArray(rest));
+  }
+  return [PREFIX].concat(_toConsumableArray(args));
+}
+
+/*
+ * `console` is looked up on every call rather than captured, so a test that
+ * spies on `console.warn` after this module loaded still sees the call.
+ */
+var log = {
+  error: function error() {
+    var _console;
+    for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
+      args[_key] = arguments[_key];
+    }
+    (_console = console).error.apply(_console, _toConsumableArray(withPrefix(args)));
+  },
+  warn: function warn() {
+    var _console2;
+    for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
+      args[_key2] = arguments[_key2];
+    }
+    (_console2 = console).warn.apply(_console2, _toConsumableArray(withPrefix(args)));
+  },
+  info: function info() {
+    if (isDebugEnabled()) {
+      var _console3;
+      for (var _len3 = arguments.length, args = new Array(_len3), _key3 = 0; _key3 < _len3; _key3++) {
+        args[_key3] = arguments[_key3];
+      }
+      (_console3 = console).info.apply(_console3, _toConsumableArray(withPrefix(args)));
+    }
+  },
+  debug: function debug() {
+    if (isDebugEnabled()) {
+      var _console4;
+      for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
+        args[_key4] = arguments[_key4];
+      }
+      (_console4 = console).debug.apply(_console4, _toConsumableArray(withPrefix(args)));
+    }
+  }
+};
+
 function _objectWithoutPropertiesLoose(r, e) {
   if (null == r) return {};
   var t = {};
@@ -2786,7 +2902,14 @@ function _objectWithoutProperties(e, t) {
   return i;
 }
 
-var RegEx$1 = /^(https?:\/\/[^/]+)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
+/**
+ * The host part may carry a `/_val` prefix: a ref served by the platform
+ * loader names `https://www.acme.no/_val/file/…`, because a customer's site
+ * can have a `/file/…` route of its own. The prefix is part of `remoteHost`,
+ * so `createRemoteRef(remoteHost, …)` writes it back unchanged. See valbuild/home
+ * `docs/remote-files-on-platform.md`, "The ref".
+ */
+var RegEx$1 = /^(https?:\/\/[^/]+(?:\/_val)?)\/file\/p\/([^/]+)\/b\/([^/]+)\/v\/([^/]+)\/h\/([^/]+)\/f\/([^/]+)\/p\/(.+)$/;
 function splitRemoteRef(ref) {
   if (ref[0] === "/") {
     return {
@@ -5035,7 +5158,7 @@ var RichTextSchema = /*#__PURE__*/function (_Schema) {
                       return hrefSchema["executeValidate"](hrefPath, node.href);
                     } else {
                       var exhaustiveCheck = hrefSchema;
-                      console.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
+                      log.error("Exhaustive check failed in RichText (anchor href validation)", exhaustiveCheck);
                       return false;
                     }
                   };
@@ -15286,7 +15409,7 @@ function collectObjectRecursive(item, collector) {
     }
     return;
   } else {
-    console.warn("Unknown type encountered when hashing object", _typeof(item), item);
+    log.warn("Unknown type encountered when hashing object", _typeof(item), item);
   }
 }
 
@@ -16121,8 +16244,8 @@ function hashToRemoteFileHash(hash) {
   return hash.slice(0, 12 // 12 hex characters = 6 bytes = 48 bits = 2^48 = 281474976710656 possibilities or 1 in 281474976710656 or using birthday problem estimate with 10K files: p = (k, n) => (k*k)/(2x2**n) and p(10_000,12*4) = 1.7763568394002505e-7 chance of collision which should be good enough
   );
 }
-function getFileHash(text) {
-  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(text)));
+function getFileHash(bytes) {
+  return hashToRemoteFileHash(getSHA256Hash(new Uint8Array(bytes)));
 }
 
 var cache$1 = new WeakMap();
@@ -16798,7 +16921,7 @@ function isInlineRender(container) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.147.0",
+	version: "0.148.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -16885,6 +17008,10 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  */
 var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
+  /** Val's console output. See `log.ts` for which levels print, and when. */
+  log: log,
+  isDebugEnabled: isDebugEnabled,
+  VAL_DEBUG_STORAGE_KEY: VAL_DEBUG_STORAGE_KEY,
   VERSION: {
     core: corePackageJson.version
   },

package/dist/valbuild-core.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-63547301.cjs.dev.js');
+var dist_valbuildCore = require('./index-858ec9e8.cjs.dev.js');
 require('./result-bb1f436e.cjs.dev.js');
 
 

package/dist/valbuild-core.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-989ebd80.cjs.prod.js');
+var dist_valbuildCore = require('./index-c21fa511.cjs.prod.js');
 require('./result-787e35f6.cjs.prod.js');
 
 

package/dist/valbuild-core.esm.js

@@ -1,2 +1,2 @@
-export { H as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, a4 as CODE_LANGUAGES, a5 as COLOR_FORMATS, a3 as CodeSchema, a2 as ColorSchema, e as DEFAULT_APP_HOST, a6 as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, u as DEFAULT_FONT_ACCEPT, f as DEFAULT_STATIC_HOST, o as DEFAULT_VAL_REMOTE_HOST, x as DEFAULT_VIDEO_ACCEPT, y as DEFAULT_VIDEO_RENDITIONS, z as DEFAULT_VIDEO_SEGMENT_DURATION, C as DateSchema, a7 as DateTimeSchema, ad as DiscriminatedUnionSchema, ae as EnumSchema, F as FATAL_ERROR_TYPES, v as FONT_MIME_TYPES, t as FileSchema, G as GenericSelector, r as ImageSchema, I as Internal, a8 as KeyOfSchema, af as LiteralSchema, Z as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, ac as RichTextSchema, ab as RouteSchema, Q as SETTINGS_MODULE_CONVENTION, S as Schema, E as SettingsSchema, q as StringSchema, T as THEME_LOGO_DIRECTORY, K as THEME_RADIUS_LENGTHS, J as THEME_RADIUS_STEPS, av as UNSAFE_URL_SCHEMES, V as VAL_EXTENSION, a9 as ValViewSchema, w as VideoSchema, L as assistantAvailability, k as computeSchemaSha, j as computeSourcesSha, h as computeValModuleShas, $ as declaredKeySetOf, p as derefPatch, ar as describeSchemeRejection, ag as deserializeSchema, a1 as discriminatedUnionBranchOf, g as extractValModules, ao as getSourcePathFromRoute, n as hasMediaSchema, l as hasRemoteFileSchema, i as initVal, as as isCheckableScheme, ai as isInlineRender, ap as isPageRouter, U as isRootModuleFilePath, aa as isValViewSource, Y as localeOfValue, X as localeTagError, an as matchRoutePattern, a0 as missingDeclaredKeys, m as modules, aj as parseNextJsRoutePattern, ak as parseTanStackRoutePattern, ah as previewScope, at as rejectScheme, W as resolveSettingsModule, aq as routePatternOf, au as schemeOf, al as tanStackSegmentsOfRoutePath, am as validateUrlAgainstPattern } from './index-cb122769.esm.js';
+export { H as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, a4 as CODE_LANGUAGES, a5 as COLOR_FORMATS, a3 as CodeSchema, a2 as ColorSchema, e as DEFAULT_APP_HOST, a6 as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, u as DEFAULT_FONT_ACCEPT, f as DEFAULT_STATIC_HOST, o as DEFAULT_VAL_REMOTE_HOST, x as DEFAULT_VIDEO_ACCEPT, y as DEFAULT_VIDEO_RENDITIONS, z as DEFAULT_VIDEO_SEGMENT_DURATION, C as DateSchema, a7 as DateTimeSchema, ad as DiscriminatedUnionSchema, ae as EnumSchema, F as FATAL_ERROR_TYPES, v as FONT_MIME_TYPES, t as FileSchema, G as GenericSelector, r as ImageSchema, I as Internal, a8 as KeyOfSchema, af as LiteralSchema, Z as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, ac as RichTextSchema, ab as RouteSchema, Q as SETTINGS_MODULE_CONVENTION, S as Schema, E as SettingsSchema, q as StringSchema, T as THEME_LOGO_DIRECTORY, K as THEME_RADIUS_LENGTHS, J as THEME_RADIUS_STEPS, av as UNSAFE_URL_SCHEMES, V as VAL_EXTENSION, a9 as ValViewSchema, w as VideoSchema, L as assistantAvailability, k as computeSchemaSha, j as computeSourcesSha, h as computeValModuleShas, $ as declaredKeySetOf, p as derefPatch, ar as describeSchemeRejection, ag as deserializeSchema, a1 as discriminatedUnionBranchOf, g as extractValModules, ao as getSourcePathFromRoute, n as hasMediaSchema, l as hasRemoteFileSchema, i as initVal, as as isCheckableScheme, ai as isInlineRender, ap as isPageRouter, U as isRootModuleFilePath, aa as isValViewSource, Y as localeOfValue, X as localeTagError, an as matchRoutePattern, a0 as missingDeclaredKeys, m as modules, aj as parseNextJsRoutePattern, ak as parseTanStackRoutePattern, ah as previewScope, at as rejectScheme, W as resolveSettingsModule, aq as routePatternOf, au as schemeOf, al as tanStackSegmentsOfRoutePath, am as validateUrlAgainstPattern } from './index-a91ac6a3.esm.js';
 import './result-daff1cae.esm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/core",
-  "version": "0.147.0",
+  "version": "0.148.2",
   "private": false,
   "description": "Val - supercharged hard-coded content",
   "repository": {

package/patch/dist/valbuild-core-patch.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-63547301.cjs.dev.js');
+var dist_valbuildCore = require('../../dist/index-858ec9e8.cjs.dev.js');
 var result = require('../../dist/result-bb1f436e.cjs.dev.js');
 var util = require('../../dist/util-b213092b.cjs.dev.js');
 

package/patch/dist/valbuild-core-patch.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-989ebd80.cjs.prod.js');
+var dist_valbuildCore = require('../../dist/index-c21fa511.cjs.prod.js');
 var result = require('../../dist/result-787e35f6.cjs.prod.js');
 var util = require('../../dist/util-030d8a1f.cjs.prod.js');
 

package/patch/dist/valbuild-core-patch.esm.js

@@ -1,5 +1,5 @@
-import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-cb122769.esm.js';
-export { P as PatchError } from '../../dist/index-cb122769.esm.js';
+import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-a91ac6a3.esm.js';
+export { P as PatchError } from '../../dist/index-a91ac6a3.esm.js';
 import { f as isNonEmpty, e as err, o as ok, m as map, g as flatMap, i as isErr, h as flatMapReduce, j as filterOrElse, k as mapErr, l as map$1, n as all, p as flatten, q as allT } from '../../dist/result-daff1cae.esm.js';
 import { p as pipe } from '../../dist/util-18613e99.esm.js';