@valbuild/core 0.97.0 → 0.97.4

package/dist/{index-50fd9c06.esm.js → index-6aa8e224.esm.js}

@@ -274,23 +274,29 @@ function _inherits(t, e) {
   }), e && _setPrototypeOf(t, e);
 }
 
+// Identity symbols are registered in the global Symbol registry so that
+// multiple bundled copies of @valbuild/core (e.g. the editor SPA bundle vs.
+// the host Next.js bundle) resolve to the same Symbol instance. Without
+// this, a value produced by one copy reads as `undefined` when accessed
+// via these keys from the other copy — extractValModules running in the
+// SPA against `.val.ts` modules loaded from the host bundle was hitting
+// this exact failure mode.
 /**
  * @internal
  */
-var GetSchema = Symbol("GetSchema");
-/**
+var GetSchema = Symbol["for"]("@valbuild/core/GetSchema");
 /**
  * @internal
  */
-var Path = Symbol("Path");
+var Path = Symbol["for"]("@valbuild/core/Path");
 /**
  * @internal
  */
-var GetSource = Symbol("GetSource");
+var GetSource = Symbol["for"]("@valbuild/core/GetSource");
 /**
  * @internal
  */
-var ValError = Symbol("ValError");
+var ValError = Symbol["for"]("@valbuild/core/ValError");
 var GenericSelector = /*#__PURE__*/_createClass(function GenericSelector(valOrExpr, path, schema, error) {
   _classCallCheck(this, GenericSelector);
   this[Path] = path;
@@ -2884,7 +2890,15 @@ function splitRemoteRef(ref) {
       error: "Invalid remote ref: " + ref
     };
   }
-  if (match[7].indexOf("public/val/") !== 0) {
+  if (match[7].indexOf("public/") !== 0) {
+    return {
+      status: "error",
+      error: "Invalid remote ref: " + ref
+    };
+  }
+  if (match[7].split("/").some(function (segment) {
+    return segment === "." || segment === "..";
+  })) {
     return {
       status: "error",
       error: "Invalid remote ref: " + ref
@@ -3048,13 +3062,17 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
           // Should! never happen
           src);
         } else if (_this2.mediaOptions) {
-          // Media collection: validate key (path/URL) and entry (metadata)
+          // Media collection: validate key (path/URL) and entry (metadata).
+          // Gallery entries are keyed by their file path and the metadata is
+          // derived, so surface entry errors on the key rather than the value.
           var keyErr = _this2.validateMediaKey(subPath, key);
           if (keyErr) {
+            _this2.markKeyErrorsAtPath(keyErr, subPath);
             error = error ? _objectSpread2(_objectSpread2({}, error), keyErr) : keyErr;
           }
           var entryErr = _this2.validateMediaEntry(subPath, elem);
           if (entryErr) {
+            _this2.markKeyErrorsAtPath(entryErr, subPath);
             error = error ? _objectSpread2(_objectSpread2({}, error), entryErr) : entryErr;
           }
         } else {
@@ -3073,6 +3091,19 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     value: function isRemoteUrl(url) {
       return url.startsWith("https://") || url.startsWith("http://");
     }
+
+    /** Marks the validation errors reported at `path` as key errors (in place). */
+  }, {
+    key: "markKeyErrorsAtPath",
+    value: function markKeyErrorsAtPath(errors, path) {
+      if (errors && errors[path]) {
+        errors[path] = errors[path].map(function (err) {
+          return _objectSpread2(_objectSpread2({}, err), {}, {
+            keyError: true
+          });
+        });
+      }
+    }
   }, {
     key: "validateMediaKey",
     value: function validateMediaKey(path, key) {
@@ -4897,6 +4928,9 @@ function router(router, item) {
 /**
  * Define a collection of images.
  *
+ * All options are optional: `s.images()` accepts any image type (`"image/*"`) in
+ * the default `/public/val` directory, with nullable alt text and remote disabled.
+ *
  * @example
  * ```typescript
  * const schema = s.images({
@@ -4915,9 +4949,9 @@ function router(router, item) {
  * ```
  */
 var images = function images(options) {
-  var _options$directory, _options$alt, _options$remote;
-  var directory = (_options$directory = options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
-  var altSchema = (_options$alt = options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
+  var _options$directory, _options$alt, _options$accept, _options$remote;
+  var directory = (_options$directory = options === null || options === void 0 ? void 0 : options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
+  var altSchema = (_options$alt = options === null || options === void 0 ? void 0 : options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
   var itemSchema = new ObjectSchema({
     width: new NumberSchema(undefined, false),
     height: new NumberSchema(undefined, false),
@@ -4926,9 +4960,9 @@ var images = function images(options) {
   }, false);
   return new RecordSchema(itemSchema, false, [], null, null, {
     type: "images",
-    accept: options.accept,
+    accept: (_options$accept = options === null || options === void 0 ? void 0 : options.accept) !== null && _options$accept !== void 0 ? _options$accept : "image/*",
     directory: directory,
-    remote: (_options$remote = options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
+    remote: (_options$remote = options === null || options === void 0 ? void 0 : options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
     altSchema: altSchema
   });
 };
@@ -5034,6 +5068,9 @@ var initRemote = function initRemote(config) {
   }
   return remote;
 };
+
+// NOTE: the segments must match the ref built by createRemoteRef below and the RegEx in splitRemoteRef.
+
 function createRemoteRef(remoteHost, _ref2) {
   var publicProjectId = _ref2.publicProjectId,
     coreVersion = _ref2.coreVersion,
@@ -5110,149 +5147,158 @@ function modules(config, modules) {
   };
 }
 
-var DEFAULT_VAL_REMOTE_HOST = "https://remote.val.build";
-function convertRemoteSource(src) {
-  if (src !== null && src !== void 0 && src.patch_id) {
-    var splitRemoteRefDataRes = splitRemoteRef(src[FILE_REF_PROP]);
-    if (splitRemoteRefDataRes.status === "success") {
-      return {
-        url: "/api/val/files/" + splitRemoteRefDataRes.filePath + "?patch_id=".concat(src["patch_id"], "&remote=true&ref=").concat(encodeURIComponent(src[FILE_REF_PROP])),
-        metadata: src.metadata
-      };
-    } else {
-      console.warn("Internal Val error: failed to split remote ref: ".concat(src[FILE_REF_PROP], ". The data format is different than what is expected. Check Val versions for mismatches."), splitRemoteRefDataRes.error);
-    }
+function _regeneratorValues(e) {
+  if (null != e) {
+    var t = e["function" == typeof Symbol && Symbol.iterator || "@@iterator"],
+      r = 0;
+    if (t) return t.call(e);
+    if ("function" == typeof e.next) return e;
+    if (!isNaN(e.length)) return {
+      next: function () {
+        return e && r >= e.length && (e = void 0), {
+          value: e && e[r++],
+          done: !e
+        };
+      }
+    };
   }
-  return {
-    url: src[FILE_REF_PROP],
-    metadata: src.metadata
-  };
+  throw new TypeError(typeof e + " is not iterable");
 }
 
-var PatchError = /*#__PURE__*/_createClass(function PatchError(message) {
-  _classCallCheck(this, PatchError);
-  this.message = message;
-});
-
-/**
- * NOTE: MAY mutate the input document.
- */
-
-function derefPath(path) {
-  var dereffedPath = [];
-  var referencedPath = null;
-  var _iterator = _createForOfIteratorHelper(path),
-    _step;
+function _regeneratorDefine(e, r, n, t) {
+  var i = Object.defineProperty;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var segment = _step.value;
-      if (segment.startsWith("$")) {
-        var dereffedSegment = segment.slice(1);
-        dereffedPath.push(dereffedSegment);
-        referencedPath = [];
-        var _iterator2 = _createForOfIteratorHelper(path.slice(dereffedPath.length)),
-          _step2;
-        try {
-          for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-            var _segment = _step2.value;
-            if (_segment.startsWith("$")) {
-              return err(new PatchError("Cannot reference within reference: ".concat(_segment, ". Path: ").concat(path.join("/"))));
-            }
-            referencedPath.push(_segment);
+    i({}, "", {});
+  } catch (e) {
+    i = 0;
+  }
+  _regeneratorDefine = function (e, r, n, t) {
+    function o(r, n) {
+      _regeneratorDefine(e, r, function (e) {
+        return this._invoke(r, n, e);
+      });
+    }
+    r ? i ? i(e, r, {
+      value: n,
+      enumerable: !t,
+      configurable: !t,
+      writable: !t
+    }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2));
+  }, _regeneratorDefine(e, r, n, t);
+}
+
+function _regenerator() {
+  /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */
+  var e,
+    t,
+    r = "function" == typeof Symbol ? Symbol : {},
+    n = r.iterator || "@@iterator",
+    o = r.toStringTag || "@@toStringTag";
+  function i(r, n, o, i) {
+    var c = n && n.prototype instanceof Generator ? n : Generator,
+      u = Object.create(c.prototype);
+    return _regeneratorDefine(u, "_invoke", function (r, n, o) {
+      var i,
+        c,
+        u,
+        f = 0,
+        p = o || [],
+        y = !1,
+        G = {
+          p: 0,
+          n: 0,
+          v: e,
+          a: d,
+          f: d.bind(e, 4),
+          d: function (t, r) {
+            return i = t, c = 0, u = e, G.n = r, a;
           }
-        } catch (err) {
-          _iterator2.e(err);
-        } finally {
-          _iterator2.f();
+        };
+      function d(r, n) {
+        for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) {
+          var o,
+            i = p[t],
+            d = G.p,
+            l = i[2];
+          r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0));
         }
-        break;
-      } else {
-        dereffedPath.push(segment);
+        if (o || r > 1) return a;
+        throw y = !0, n;
       }
-    }
-  } catch (err) {
-    _iterator.e(err);
-  } finally {
-    _iterator.f();
+      return function (o, p, l) {
+        if (f > 1) throw TypeError("Generator is already running");
+        for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) {
+          i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u);
+          try {
+            if (f = 2, i) {
+              if (c || (o = "next"), t = i[o]) {
+                if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object");
+                if (!t.done) return t;
+                u = t.value, c < 2 && (c = 0);
+              } else 1 === c && (t = i.return) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1);
+              i = e;
+            } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break;
+          } catch (t) {
+            i = e, c = 1, u = t;
+          } finally {
+            f = 1;
+          }
+        }
+        return {
+          value: t,
+          done: y
+        };
+      };
+    }(r, o, i), !0), u;
   }
-  return ok([dereffedPath, referencedPath]);
+  var a = {};
+  function Generator() {}
+  function GeneratorFunction() {}
+  function GeneratorFunctionPrototype() {}
+  t = Object.getPrototypeOf;
+  var c = [][n] ? t(t([][n]())) : (_regeneratorDefine(t = {}, n, function () {
+      return this;
+    }), t),
+    u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c);
+  function f(e) {
+    return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e;
+  }
+  return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine(u), _regeneratorDefine(u, o, "Generator"), _regeneratorDefine(u, n, function () {
+    return this;
+  }), _regeneratorDefine(u, "toString", function () {
+    return "[object Generator]";
+  }), (_regenerator = function () {
+    return {
+      w: i,
+      m: f
+    };
+  })();
 }
-function derefPatch(patch, document, ops) {
-  var fileUpdates = {};
-  var dereferencedPatch = [];
-  var _iterator3 = _createForOfIteratorHelper(patch),
-    _step3;
+
+function asyncGeneratorStep(n, t, e, r, o, a, c) {
   try {
-    for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-      var op = _step3.value;
-      if (op.op === "replace") {
-        var maybeDerefRes = derefPath(op.path);
-        if (isErr(maybeDerefRes)) {
-          return maybeDerefRes;
-        }
-        var _maybeDerefRes$value = _slicedToArray(maybeDerefRes.value, 2),
-          dereffedPath = _maybeDerefRes$value[0],
-          referencedPath = _maybeDerefRes$value[1];
-        if (referencedPath) {
-          var maybeValue = ops.get(document, dereffedPath);
-          if (isOk(maybeValue)) {
-            var value = maybeValue.value;
-            if (isFile(value)) {
-              if (referencedPath.length > 0) {
-                return err(new PatchError("Cannot sub-reference file reference at path: ".concat(dereffedPath.join("/"))));
-              }
-              if (typeof op.value !== "string") {
-                return err(new PatchError("Expected base64 encoded string value for file reference, got ".concat(JSON.stringify(op.value))));
-              }
-              fileUpdates[value[FILE_REF_PROP]] = op.value;
-              // } else if (isRemote(value)) {
-              //   if (!remotePatches[value[REMOTE_REF_PROP]]) {
-              //     remotePatches[value[REMOTE_REF_PROP]] = [];
-              //   }
-              //   remotePatches[value[REMOTE_REF_PROP]].push({
-              //     op: "replace",
-              //     path: referencedPath,
-              //     value: op.value,
-              //   });
-            } else {
-              return err(new PatchError("Unknown reference: ".concat(JSON.stringify(op), " at path: ").concat(dereffedPath.join("/"))));
-            }
-          } else {
-            return maybeValue;
-          }
-        } else {
-          dereferencedPatch.push(op);
-        }
-      } else if (op.op === "file") {
-        if (!op.filePath.startsWith("/public")) {
-          return err(new PatchError("Path must start with /public"));
-        }
-        if (typeof op.value !== "string") {
-          return err(new PatchError("File operation must have a value that is typeof string. Found: ".concat(_typeof(op.value))));
-        }
-        fileUpdates[op.filePath] = op.value;
-      } else {
-        var _maybeDerefRes = derefPath(op.path);
-        if (isErr(_maybeDerefRes)) {
-          return _maybeDerefRes;
-        }
-        var _maybeDerefRes$value2 = _slicedToArray(_maybeDerefRes.value, 2),
-          _referencedPath = _maybeDerefRes$value2[1];
-        if (_referencedPath) {
-          throw new Error("Unimplemented operation: ".concat(JSON.stringify(op)));
-        }
-        dereferencedPatch.push(op);
-      }
-    }
-  } catch (err) {
-    _iterator3.e(err);
-  } finally {
-    _iterator3.f();
+    var i = n[a](c),
+      u = i.value;
+  } catch (n) {
+    return void e(n);
   }
-  return ok({
-    fileUpdates: fileUpdates,
-    dereferencedPatch: dereferencedPatch
-  });
+  i.done ? t(u) : Promise.resolve(u).then(r, o);
+}
+function _asyncToGenerator(n) {
+  return function () {
+    var t = this,
+      e = arguments;
+    return new Promise(function (r, o) {
+      var a = n.apply(t, e);
+      function _next(n) {
+        asyncGeneratorStep(a, r, o, _next, _throw, "next", n);
+      }
+      function _throw(n) {
+        asyncGeneratorStep(a, r, o, _next, _throw, "throw", n);
+      }
+      _next(void 0);
+    });
+  };
 }
 
 /**
@@ -5588,6 +5634,352 @@ var getSHA256Hash = function getSHA256Hash(bits) {
   return createHash().update(bits).digest("hex");
 };
 
+// Lazily constructed: this module is also evaluated inside the QuickJS
+// sandbox (when user val modules import @valbuild/core), and that sandbox
+// has no `TextEncoder` global. `hash()` is never called from inside the
+// sandbox, so deferring construction avoids a ReferenceError at import time.
+var textEncoder;
+function getTextEncoder() {
+  if (!textEncoder) {
+    textEncoder = new TextEncoder();
+  }
+  return textEncoder;
+}
+function hash(input) {
+  if (_typeof(input) === "object") {
+    return hashObject(input);
+  }
+  return getSHA256Hash(getTextEncoder().encode(input));
+}
+function hashObject(obj) {
+  var collector = [];
+  collectObjectRecursive(obj, collector);
+  return getSHA256Hash(getTextEncoder().encode(collector.join("")));
+}
+function collectObjectRecursive(item, collector) {
+  if (typeof item === "string") {
+    collector.push("\"", item, "\"");
+    return;
+  } else if (typeof item === "number") {
+    collector.push(item.toString());
+    return;
+  } else if (_typeof(item) === "object") {
+    if (Array.isArray(item)) {
+      collector.push("[");
+      for (var i = 0; i < item.length; i++) {
+        collectObjectRecursive(item[i], collector);
+        if (i !== item.length - 1) collector.push(",");
+      }
+      collector.push("]");
+    } else {
+      collector.push("{");
+      var keys = Object.keys(item).sort();
+      keys.forEach(function (key, i) {
+        collector.push("\"".concat(key, "\":"));
+        collectObjectRecursive(item[key], collector);
+        if (i !== keys.length - 1) collector.push(",");
+      });
+      collector.push("}");
+    }
+    return;
+  } else {
+    console.warn("Unknown type encountered when hashing object", _typeof(item), item);
+  }
+}
+
+/**
+ * Extracts schemas and sources from a ValModules registry and computes the
+ * deterministic SHAs that the server and client both use to detect changes.
+ *
+ * Used by ValOps on the server and by ValSyncEngine on the client so the
+ * hash algorithm has a single source of truth.
+ */
+function extractValModules(_x) {
+  return _extractValModules.apply(this, arguments);
+}
+function _extractValModules() {
+  _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, configSha, sourcesSha, baseSha, schemaSha, _loop, _ret, moduleIdx;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          moduleErrors = [];
+          addModuleError = function addModuleError(message, index, path) {
+            moduleErrors[index] = {
+              message: message,
+              path: path
+            };
+          };
+          sources = {};
+          schemas = {};
+          serializedSchemas = {};
+          configSha = hash(JSON.stringify(valModules.config));
+          sourcesSha = "";
+          baseSha = configSha;
+          schemaSha = configSha;
+          _loop = /*#__PURE__*/_regenerator().m(function _loop(moduleIdx) {
+            var module;
+            return _regenerator().w(function (_context) {
+              while (1) switch (_context.n) {
+                case 0:
+                  module = valModules.modules[moduleIdx];
+                  if (module.def) {
+                    _context.n = 1;
+                    break;
+                  }
+                  addModuleError("val.modules is missing 'def' property", moduleIdx);
+                  return _context.a(2, 0);
+                case 1:
+                  if (!(typeof module.def !== "function")) {
+                    _context.n = 2;
+                    break;
+                  }
+                  addModuleError("val.modules 'def' property is not a function", moduleIdx);
+                  return _context.a(2, 0);
+                case 2:
+                  _context.n = 3;
+                  return module.def().then(function (value) {
+                    if (!value) {
+                      addModuleError("val.modules 'def' did not return a value", moduleIdx);
+                      return;
+                    }
+                    if (!value["default"]) {
+                      addModuleError("val.modules 'def' did not return a default export", moduleIdx);
+                      return;
+                    }
+                    var path = getValPath(value["default"]);
+                    if (path === undefined) {
+                      addModuleError("path is undefined", moduleIdx);
+                      return;
+                    }
+                    var schema = getSchema(value["default"]);
+                    if (schema === undefined) {
+                      addModuleError("schema in path '".concat(path, "' is undefined"), moduleIdx, path);
+                      return;
+                    }
+                    // Avoid `schema instanceof Schema` — the editor SPA and the host
+                    // Next.js bundle each ship their own copy of @valbuild/core, so the
+                    // `Schema` class identity differs between them and the instanceof
+                    // check would fail for cross-bundle modules. The executeSerialize
+                    // check below is the actual contract we depend on.
+                    if (typeof schema["executeSerialize"] !== "function") {
+                      addModuleError("schema.serialize in path '".concat(path, "' is not a function"), moduleIdx, path);
+                      return;
+                    }
+                    var source = getSource(value["default"]);
+                    if (source === undefined) {
+                      addModuleError("source in ".concat(path, " is undefined"), moduleIdx, path);
+                      return;
+                    }
+                    var serializedSchema;
+                    try {
+                      serializedSchema = schema["executeSerialize"]();
+                    } catch (e) {
+                      var message = e instanceof Error ? e.message : JSON.stringify(e);
+                      addModuleError("Could not serialize module: '".concat(path, "'. Error: ").concat(message), moduleIdx, path);
+                      return;
+                    }
+                    var pathM = path;
+                    sources[pathM] = source;
+                    schemas[pathM] = schema;
+                    serializedSchemas[pathM] = serializedSchema;
+                    sourcesSha = hash(sourcesSha + JSON.stringify({
+                      path: path,
+                      source: source
+                    }));
+                    baseSha = hash(baseSha + JSON.stringify({
+                      path: path,
+                      schema: serializedSchema,
+                      source: source,
+                      modulesErrors: moduleErrors
+                    }));
+                    schemaSha = hash(schemaSha + JSON.stringify(serializedSchema));
+                  });
+                case 3:
+                  return _context.a(2);
+              }
+            }, _loop);
+          });
+          moduleIdx = 0;
+        case 1:
+          if (!(moduleIdx < valModules.modules.length)) {
+            _context2.n = 4;
+            break;
+          }
+          return _context2.d(_regeneratorValues(_loop(moduleIdx)), 2);
+        case 2:
+          _ret = _context2.v;
+          if (!(_ret === 0)) {
+            _context2.n = 3;
+            break;
+          }
+          return _context2.a(3, 3);
+        case 3:
+          moduleIdx++;
+          _context2.n = 1;
+          break;
+        case 4:
+          return _context2.a(2, {
+            sources: sources,
+            schemas: schemas,
+            serializedSchemas: serializedSchemas,
+            baseSha: baseSha,
+            schemaSha: schemaSha,
+            sourcesSha: sourcesSha,
+            configSha: configSha,
+            moduleErrors: moduleErrors
+          });
+      }
+    }, _callee);
+  }));
+  return _extractValModules.apply(this, arguments);
+}
+
+var DEFAULT_VAL_REMOTE_HOST = "https://remote.val.build";
+function convertRemoteSource(src) {
+  if (src !== null && src !== void 0 && src.patch_id) {
+    var splitRemoteRefDataRes = splitRemoteRef(src[FILE_REF_PROP]);
+    if (splitRemoteRefDataRes.status === "success") {
+      return {
+        url: "/api/val/files/" + splitRemoteRefDataRes.filePath + "?patch_id=".concat(src["patch_id"], "&remote=true&ref=").concat(encodeURIComponent(src[FILE_REF_PROP])),
+        metadata: src.metadata
+      };
+    } else {
+      console.warn("Internal Val error: failed to split remote ref: ".concat(src[FILE_REF_PROP], ". The data format is different than what is expected. Check Val versions for mismatches."), splitRemoteRefDataRes.error);
+    }
+  }
+  return {
+    url: src[FILE_REF_PROP],
+    metadata: src.metadata
+  };
+}
+
+var PatchError = /*#__PURE__*/_createClass(function PatchError(message) {
+  _classCallCheck(this, PatchError);
+  this.message = message;
+});
+
+/**
+ * NOTE: MAY mutate the input document.
+ */
+
+function derefPath(path) {
+  var dereffedPath = [];
+  var referencedPath = null;
+  var _iterator = _createForOfIteratorHelper(path),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var segment = _step.value;
+      if (segment.startsWith("$")) {
+        var dereffedSegment = segment.slice(1);
+        dereffedPath.push(dereffedSegment);
+        referencedPath = [];
+        var _iterator2 = _createForOfIteratorHelper(path.slice(dereffedPath.length)),
+          _step2;
+        try {
+          for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+            var _segment = _step2.value;
+            if (_segment.startsWith("$")) {
+              return err(new PatchError("Cannot reference within reference: ".concat(_segment, ". Path: ").concat(path.join("/"))));
+            }
+            referencedPath.push(_segment);
+          }
+        } catch (err) {
+          _iterator2.e(err);
+        } finally {
+          _iterator2.f();
+        }
+        break;
+      } else {
+        dereffedPath.push(segment);
+      }
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return ok([dereffedPath, referencedPath]);
+}
+function derefPatch(patch, document, ops) {
+  var fileUpdates = {};
+  var dereferencedPatch = [];
+  var _iterator3 = _createForOfIteratorHelper(patch),
+    _step3;
+  try {
+    for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+      var op = _step3.value;
+      if (op.op === "replace") {
+        var maybeDerefRes = derefPath(op.path);
+        if (isErr(maybeDerefRes)) {
+          return maybeDerefRes;
+        }
+        var _maybeDerefRes$value = _slicedToArray(maybeDerefRes.value, 2),
+          dereffedPath = _maybeDerefRes$value[0],
+          referencedPath = _maybeDerefRes$value[1];
+        if (referencedPath) {
+          var maybeValue = ops.get(document, dereffedPath);
+          if (isOk(maybeValue)) {
+            var value = maybeValue.value;
+            if (isFile(value)) {
+              if (referencedPath.length > 0) {
+                return err(new PatchError("Cannot sub-reference file reference at path: ".concat(dereffedPath.join("/"))));
+              }
+              if (typeof op.value !== "string") {
+                return err(new PatchError("Expected base64 encoded string value for file reference, got ".concat(JSON.stringify(op.value))));
+              }
+              fileUpdates[value[FILE_REF_PROP]] = op.value;
+              // } else if (isRemote(value)) {
+              //   if (!remotePatches[value[REMOTE_REF_PROP]]) {
+              //     remotePatches[value[REMOTE_REF_PROP]] = [];
+              //   }
+              //   remotePatches[value[REMOTE_REF_PROP]].push({
+              //     op: "replace",
+              //     path: referencedPath,
+              //     value: op.value,
+              //   });
+            } else {
+              return err(new PatchError("Unknown reference: ".concat(JSON.stringify(op), " at path: ").concat(dereffedPath.join("/"))));
+            }
+          } else {
+            return maybeValue;
+          }
+        } else {
+          dereferencedPatch.push(op);
+        }
+      } else if (op.op === "file") {
+        if (!op.filePath.startsWith("/public")) {
+          return err(new PatchError("Path must start with /public"));
+        }
+        if (typeof op.value !== "string") {
+          return err(new PatchError("File operation must have a value that is typeof string. Found: ".concat(_typeof(op.value))));
+        }
+        fileUpdates[op.filePath] = op.value;
+      } else {
+        var _maybeDerefRes = derefPath(op.path);
+        if (isErr(_maybeDerefRes)) {
+          return _maybeDerefRes;
+        }
+        var _maybeDerefRes$value2 = _slicedToArray(_maybeDerefRes.value, 2),
+          _referencedPath = _maybeDerefRes$value2[1];
+        if (_referencedPath) {
+          throw new Error("Unimplemented operation: ".concat(JSON.stringify(op)));
+        }
+        dereferencedPatch.push(op);
+      }
+    }
+  } catch (err) {
+    _iterator3.e(err);
+  } finally {
+    _iterator3.f();
+  }
+  return ok({
+    fileUpdates: fileUpdates,
+    dereferencedPatch: dereferencedPatch
+  });
+}
+
 var EXT_TO_MIME_TYPES = {
   x3d: "application/vnd.hzn-3d-crossword",
   "3gp": "video/3gpp",
@@ -6783,4 +7175,4 @@ function tryJsonParse(str) {
   }
 }
 
-export { ArraySchema as A, BooleanSchema as B, DEFAULT_CONTENT_HOST as D, FATAL_ERROR_TYPES as F, GenericSelector as G, Internal as I, KeyOfSchema as K, LiteralSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, RecordSchema as R, Schema as S, UnionSchema as U, VAL_EXTENSION as V, _typeof as _, _slicedToArray as a, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_VAL_REMOTE_HOST as f, FILE_REF_PROP as g, FILE_REF_SUBTYPE_TAG as h, initVal as i, derefPatch as j, StringSchema as k, ImageSchema as l, modules as m, FileSchema as n, DateSchema as o, DateTimeSchema as p, RouteSchema as q, RichTextSchema as r, splitModuleFilePathAndModulePath as s, deserializeSchema as t, getSourcePathFromRoute as u };
+export { ArraySchema as A, BooleanSchema as B, DEFAULT_CONTENT_HOST as D, FATAL_ERROR_TYPES as F, GenericSelector as G, Internal as I, KeyOfSchema as K, LiteralSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, RecordSchema as R, Schema as S, UnionSchema as U, VAL_EXTENSION as V, _typeof as _, _slicedToArray as a, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, extractValModules as f, DEFAULT_VAL_REMOTE_HOST as g, FILE_REF_PROP as h, initVal as i, FILE_REF_SUBTYPE_TAG as j, derefPatch as k, StringSchema as l, modules as m, ImageSchema as n, FileSchema as o, DateSchema as p, DateTimeSchema as q, RouteSchema as r, splitModuleFilePathAndModulePath as s, RichTextSchema as t, deserializeSchema as u, getSourcePathFromRoute as v };