@valbuild/server 0.106.1 → 0.108.0

package/dist/declarations/src/getValidationErrorFileRef.d.ts

@@ -5,4 +5,4 @@ import { ValidationError } from "@valbuild/core";
  * There is no schema in hand here — a `ValidationError` carries only the value
  * it flagged — so the shape is all there is to go on.
  */
-export declare function getValidationErrorFileRef(validationError: ValidationError): string | null;
+export declare function getValidationErrorFileRef(validationError: ValidationError): any;

package/dist/declarations/src/patchStore.d.ts

@@ -1,4 +1,4 @@
-import { ModuleFilePath, PatchId } from "@valbuild/core";
+import { PatchId } from "@valbuild/core";
 import { z } from "zod";
 import type { AuthorId, BaseSha } from "./ValOps.js";
 import { PatchLogEntry, PatchLogProblem } from "./patchLog.js";

package/dist/valbuild-server.cjs.dev.js

@@ -3648,7 +3648,7 @@ class JsonEntryFilesFingerprint {
     if (cached && cached.moduleMtimeMs === moduleMtimeMs) {
       return cached.entryFilePaths;
     }
-    let entryFilePaths = [];
+    let entryFilePaths;
     try {
       const contents = fs__default["default"].readFileSync(absModulePath, "utf-8");
       entryFilePaths = findJsonEntryFilePathsInSource(moduleFilePath, ts__default["default"].createSourceFile(absModulePath, contents, ts__default["default"].ScriptTarget.ES2015));
@@ -3972,14 +3972,14 @@ const FSPatch = z.z.object({
   path: z.z.string().refine(p => p.startsWith("/") && p.includes(".val."), "Path is not valid. Must start with '/' and include '.val.'"),
   patch: internal.Patch,
   patchId: z.z.string(),
-  baseSha: z.z.string().refine(p => true),
-  authorId: z.z.string().refine(p => true).nullable(),
+  baseSha: z.z.string().refine(_p => true),
+  authorId: z.z.string().refine(_p => true).nullable(),
   createdAt: z.z.string().datetime(),
   coreVersion: z.z.string().nullable(),
   sessionId: z.z.string().nullable()
 });
 const FSPatchBase = z.z.object({
-  baseSha: z.z.string().refine(p => true),
+  baseSha: z.z.string().refine(_p => true),
   timestamp: z.z.string().datetime()
 });
 
@@ -4753,7 +4753,6 @@ async function acquirePatchLock(lockFilePath, options) {
       message: `Could not create the directory for ${lockFilePath}: ${err instanceof Error ? err.message : "unknown error"}`
     };
   }
-  let lastSeenHolder = null;
   for (;;) {
     const acquiredAt = now();
     const info = {
@@ -4785,7 +4784,7 @@ async function acquirePatchLock(lockFilePath, options) {
       // Released between the failed create and the read. Go straight round again.
       continue;
     }
-    lastSeenHolder = parsePatchLockInfo(rawBefore);
+    const lastSeenHolder = parsePatchLockInfo(rawBefore);
     if (isExpired(lastSeenHolder, now())) {
       // Read twice across a poll interval before removing it: an unchanged stale
       // file is one nobody is renewing, and requiring the second read is what
@@ -9782,15 +9781,12 @@ const ValServer = (valModules, options, callbacks) => {
         //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
         // Thus: attack surface + ease of attack + benefit = low probability of attack
         // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-        let cacheControl;
         let fileBuffer;
         let mimeType;
         const remote = query.remote === "true";
         if (query.patch_id) {
           fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id, remote);
           mimeType = core.Internal.filenameToMimeType(filePath);
-          // TODO: reenable this:
-          // cacheControl = "public, max-age=20000, immutable";
         } else {
           if (serverOps instanceof ValOpsHttp && remote) {
             console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
@@ -9803,7 +9799,12 @@ const ValServer = (valModules, options, callbacks) => {
             headers: {
               // TODO: we could use ETag and return 304 instead
               "Content-Type": mimeType || "application/octet-stream",
-              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+              // TODO: a file requested with a patch_id is immutable for that
+              // patch, so it could be served "public, max-age=20000, immutable"
+              // instead. There used to be a `cacheControl` variable here for
+              // that, but its only assignment was commented out, so every
+              // response has always taken the revalidate branch.
+              "Cache-Control": "public, max-age=0, must-revalidate"
             },
             body: bufferToReadableStream(fileBuffer)
           };
@@ -10705,9 +10706,7 @@ async function extractImageMetadata(filename, input) {
     mimeType
   };
 }
-async function extractFileMetadata(filename,
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-_input // TODO: use buffer to determine mimetype
+async function extractFileMetadata(filename, _input // TODO: use buffer to determine mimetype
 ) {
   let mimeType = core.Internal.filenameToMimeType(filename);
   if (!mimeType) {
@@ -11747,7 +11746,6 @@ async function handleRemoteFileUpload(ctx) {
   // schema above already established that this IS media.
   const actualRemoteFileSource = resolvedRemoteFileAtSourcePath.source;
   const fileSourceMetadata = actualRemoteFileSource && typeof actualRemoteFileSource === "object" && "path" in actualRemoteFileSource ? (() => {
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const {
       path: _path,
       ...metadata
@@ -12163,7 +12161,9 @@ async function evalValConfigFile(projectRoot, configFileName) {
     if (isFileNotFound(err)) {
       return null;
     }
-    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`);
+    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`, {
+      cause: err
+    });
   }
   if (!code.trim()) {
     return null;

package/dist/valbuild-server.cjs.prod.js

@@ -3648,7 +3648,7 @@ class JsonEntryFilesFingerprint {
     if (cached && cached.moduleMtimeMs === moduleMtimeMs) {
       return cached.entryFilePaths;
     }
-    let entryFilePaths = [];
+    let entryFilePaths;
     try {
       const contents = fs__default["default"].readFileSync(absModulePath, "utf-8");
       entryFilePaths = findJsonEntryFilePathsInSource(moduleFilePath, ts__default["default"].createSourceFile(absModulePath, contents, ts__default["default"].ScriptTarget.ES2015));
@@ -3972,14 +3972,14 @@ const FSPatch = z.z.object({
   path: z.z.string().refine(p => p.startsWith("/") && p.includes(".val."), "Path is not valid. Must start with '/' and include '.val.'"),
   patch: internal.Patch,
   patchId: z.z.string(),
-  baseSha: z.z.string().refine(p => true),
-  authorId: z.z.string().refine(p => true).nullable(),
+  baseSha: z.z.string().refine(_p => true),
+  authorId: z.z.string().refine(_p => true).nullable(),
   createdAt: z.z.string().datetime(),
   coreVersion: z.z.string().nullable(),
   sessionId: z.z.string().nullable()
 });
 const FSPatchBase = z.z.object({
-  baseSha: z.z.string().refine(p => true),
+  baseSha: z.z.string().refine(_p => true),
   timestamp: z.z.string().datetime()
 });
 
@@ -4753,7 +4753,6 @@ async function acquirePatchLock(lockFilePath, options) {
       message: `Could not create the directory for ${lockFilePath}: ${err instanceof Error ? err.message : "unknown error"}`
     };
   }
-  let lastSeenHolder = null;
   for (;;) {
     const acquiredAt = now();
     const info = {
@@ -4785,7 +4784,7 @@ async function acquirePatchLock(lockFilePath, options) {
       // Released between the failed create and the read. Go straight round again.
       continue;
     }
-    lastSeenHolder = parsePatchLockInfo(rawBefore);
+    const lastSeenHolder = parsePatchLockInfo(rawBefore);
     if (isExpired(lastSeenHolder, now())) {
       // Read twice across a poll interval before removing it: an unchanged stale
       // file is one nobody is renewing, and requiring the second read is what
@@ -9782,15 +9781,12 @@ const ValServer = (valModules, options, callbacks) => {
         //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
         // Thus: attack surface + ease of attack + benefit = low probability of attack
         // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-        let cacheControl;
         let fileBuffer;
         let mimeType;
         const remote = query.remote === "true";
         if (query.patch_id) {
           fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id, remote);
           mimeType = core.Internal.filenameToMimeType(filePath);
-          // TODO: reenable this:
-          // cacheControl = "public, max-age=20000, immutable";
         } else {
           if (serverOps instanceof ValOpsHttp && remote) {
             console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
@@ -9803,7 +9799,12 @@ const ValServer = (valModules, options, callbacks) => {
             headers: {
               // TODO: we could use ETag and return 304 instead
               "Content-Type": mimeType || "application/octet-stream",
-              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+              // TODO: a file requested with a patch_id is immutable for that
+              // patch, so it could be served "public, max-age=20000, immutable"
+              // instead. There used to be a `cacheControl` variable here for
+              // that, but its only assignment was commented out, so every
+              // response has always taken the revalidate branch.
+              "Cache-Control": "public, max-age=0, must-revalidate"
             },
             body: bufferToReadableStream(fileBuffer)
           };
@@ -10705,9 +10706,7 @@ async function extractImageMetadata(filename, input) {
     mimeType
   };
 }
-async function extractFileMetadata(filename,
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-_input // TODO: use buffer to determine mimetype
+async function extractFileMetadata(filename, _input // TODO: use buffer to determine mimetype
 ) {
   let mimeType = core.Internal.filenameToMimeType(filename);
   if (!mimeType) {
@@ -11747,7 +11746,6 @@ async function handleRemoteFileUpload(ctx) {
   // schema above already established that this IS media.
   const actualRemoteFileSource = resolvedRemoteFileAtSourcePath.source;
   const fileSourceMetadata = actualRemoteFileSource && typeof actualRemoteFileSource === "object" && "path" in actualRemoteFileSource ? (() => {
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const {
       path: _path,
       ...metadata
@@ -12163,7 +12161,9 @@ async function evalValConfigFile(projectRoot, configFileName) {
     if (isFileNotFound(err)) {
       return null;
     }
-    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`);
+    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`, {
+      cause: err
+    });
   }
   if (!code.trim()) {
     return null;

package/dist/valbuild-server.esm.js

@@ -3614,7 +3614,7 @@ class JsonEntryFilesFingerprint {
     if (cached && cached.moduleMtimeMs === moduleMtimeMs) {
       return cached.entryFilePaths;
     }
-    let entryFilePaths = [];
+    let entryFilePaths;
     try {
       const contents = fs.readFileSync(absModulePath, "utf-8");
       entryFilePaths = findJsonEntryFilePathsInSource(moduleFilePath, ts.createSourceFile(absModulePath, contents, ts.ScriptTarget.ES2015));
@@ -3938,14 +3938,14 @@ const FSPatch = z.object({
   path: z.string().refine(p => p.startsWith("/") && p.includes(".val."), "Path is not valid. Must start with '/' and include '.val.'"),
   patch: Patch,
   patchId: z.string(),
-  baseSha: z.string().refine(p => true),
-  authorId: z.string().refine(p => true).nullable(),
+  baseSha: z.string().refine(_p => true),
+  authorId: z.string().refine(_p => true).nullable(),
   createdAt: z.string().datetime(),
   coreVersion: z.string().nullable(),
   sessionId: z.string().nullable()
 });
 const FSPatchBase = z.object({
-  baseSha: z.string().refine(p => true),
+  baseSha: z.string().refine(_p => true),
   timestamp: z.string().datetime()
 });
 
@@ -4719,7 +4719,6 @@ async function acquirePatchLock(lockFilePath, options) {
       message: `Could not create the directory for ${lockFilePath}: ${err instanceof Error ? err.message : "unknown error"}`
     };
   }
-  let lastSeenHolder = null;
   for (;;) {
     const acquiredAt = now();
     const info = {
@@ -4751,7 +4750,7 @@ async function acquirePatchLock(lockFilePath, options) {
       // Released between the failed create and the read. Go straight round again.
       continue;
     }
-    lastSeenHolder = parsePatchLockInfo(rawBefore);
+    const lastSeenHolder = parsePatchLockInfo(rawBefore);
     if (isExpired(lastSeenHolder, now())) {
       // Read twice across a poll interval before removing it: an unchanged stale
       // file is one nobody is renewing, and requiring the second read is what
@@ -9748,15 +9747,12 @@ const ValServer = (valModules, options, callbacks) => {
         //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
         // Thus: attack surface + ease of attack + benefit = low probability of attack
         // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-        let cacheControl;
         let fileBuffer;
         let mimeType;
         const remote = query.remote === "true";
         if (query.patch_id) {
           fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id, remote);
           mimeType = Internal.filenameToMimeType(filePath);
-          // TODO: reenable this:
-          // cacheControl = "public, max-age=20000, immutable";
         } else {
           if (serverOps instanceof ValOpsHttp && remote) {
             console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
@@ -9769,7 +9765,12 @@ const ValServer = (valModules, options, callbacks) => {
             headers: {
               // TODO: we could use ETag and return 304 instead
               "Content-Type": mimeType || "application/octet-stream",
-              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+              // TODO: a file requested with a patch_id is immutable for that
+              // patch, so it could be served "public, max-age=20000, immutable"
+              // instead. There used to be a `cacheControl` variable here for
+              // that, but its only assignment was commented out, so every
+              // response has always taken the revalidate branch.
+              "Cache-Control": "public, max-age=0, must-revalidate"
             },
             body: bufferToReadableStream(fileBuffer)
           };
@@ -10671,9 +10672,7 @@ async function extractImageMetadata(filename, input) {
     mimeType
   };
 }
-async function extractFileMetadata(filename,
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-_input // TODO: use buffer to determine mimetype
+async function extractFileMetadata(filename, _input // TODO: use buffer to determine mimetype
 ) {
   let mimeType = Internal.filenameToMimeType(filename);
   if (!mimeType) {
@@ -11713,7 +11712,6 @@ async function handleRemoteFileUpload(ctx) {
   // schema above already established that this IS media.
   const actualRemoteFileSource = resolvedRemoteFileAtSourcePath.source;
   const fileSourceMetadata = actualRemoteFileSource && typeof actualRemoteFileSource === "object" && "path" in actualRemoteFileSource ? (() => {
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const {
       path: _path,
       ...metadata
@@ -12129,7 +12127,9 @@ async function evalValConfigFile(projectRoot, configFileName) {
     if (isFileNotFound(err)) {
       return null;
     }
-    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`);
+    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`, {
+      cause: err
+    });
   }
   if (!code.trim()) {
     return null;

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.106.1",
+  "version": "0.108.0",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0"
@@ -24,17 +24,17 @@
   "dependencies": {
     "chokidar": "^5.0.0",
     "image-size": "^2.0.2",
-    "minimatch": "^10.2.3",
+    "minimatch": "^10.2.6",
     "sucrase": "^3.35.1",
-    "typescript": "^5.9.3",
-    "zod": "^4.3.5",
+    "typescript": "^6.0.3",
+    "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "@valbuild/core": "0.106.0",
-    "@valbuild/shared": "0.106.0",
-    "@valbuild/ui": "0.106.1"
+    "@valbuild/shared": "0.108.0",
+    "@valbuild/ui": "0.108.0"
   },
   "engines": {
-    "node": ">=18.17.0"
+    "node": "^20.19.0 || >=22"
   },
   "files": [
     "dist"