@valbuild/server 0.114.0 → 0.115.0

package/dist/declarations/src/ValRouter.d.ts

@@ -114,6 +114,32 @@ type ValServerOverrides = Partial<{
     disableCache?: boolean;
 }>;
 export declare function createValServer(valModules: ValModules, route: string, opts: ValApiOptions, config: ValConfig, callbacks: ValServerCallbacks, formatter?: (code: string, filePath: string) => string | Promise<string>): Promise<ValServer>;
+/**
+ * Hosts we send credentials to, and what each one puts at risk. They differ:
+ * only `valBuildUrl` hands back the app token that becomes the session cookie,
+ * so a single shared sentence would overstate one and understate the other.
+ */
+type CredentialBearingUrl = "valBuildUrl" | "valContentUrl";
+/**
+ * Returns a warning if `url` would send credentials somewhere they can be read
+ * off the wire, or null if it is fine.
+ *
+ * Both URLs default to https, but each is overridable - `opts.valBuildUrl` /
+ * `VAL_BUILD_URL`, `opts.valContentUrl` / `VAL_CONTENT_URL` - and neither
+ * override has ever been scheme-checked. Point one at a plain http host and the
+ * api key goes out in clear text, and whatever comes back is whatever the
+ * network says: for `valBuildUrl` that includes the app token this server
+ * re-signs into the session cookie.
+ *
+ * Loopback over http is exempt: that is a val.build running on the developer's
+ * own machine, and there is no network to be on the wrong side of.
+ *
+ * This warns rather than throws. Both overrides are set by the operator, not by
+ * an attacker, so this is a misconfiguration to surface - not untrusted input to
+ * reject - and refusing to boot would break anyone deliberately pointing at an
+ * internal http host today.
+ */
+export declare function insecureUrlWarning(name: CredentialBearingUrl, url: string): string | null;
 export declare function safeReadGit(cwd: string): Promise<{
     commit?: string;
     branch?: string;

package/dist/declarations/src/index.d.ts

@@ -25,8 +25,8 @@ export { checkRemoteRef, downloadFileFromRemote, getCachedRemoteFileDir, getCach
 export { hasRemoteFileSchema } from "@valbuild/core";
 export { getFileExt } from "./getFileExt.js";
 export { evalValConfigFile, findAndEvalValConfigFile, } from "./evalValConfigFile.js";
-export { startValLogin, awaitValLoginConfirmation, persistPersonalAccessToken, ValLoginError, DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_MAX_DURATION, DEFAULT_LOGIN_POLL_INTERVAL, } from "./login.js";
-export type { ValLoginErrorCode, ValLoginResult, ValLoginSession, } from "./login.js";
+export { startValLogin, awaitValLoginConfirmation, persistPersonalAccessToken, ValLoginError, DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_EXPIRES_IN_SECONDS, DEFAULT_LOGIN_POLL_INTERVAL_SECONDS, } from "./login.js";
+export type { ValLoginErrorCode, ValLoginResult, ValDeviceAuthorization, } from "./login.js";
 export { createModulePathMap, createJsonEntryPathMap, getModulePathRange, } from "./modulePathMap.js";
 export { findJsonEntryFilePath } from "./jsonEntryLocation.js";
 export { classifyJsonValuesOp, rebaseContentOp } from "./patch/jsonValuesPatch.js";

package/dist/declarations/src/login.d.ts

@@ -1,5 +1,15 @@
 /**
- * The Val login device flow, as reusable primitives.
+ * The Val login flow, as reusable primitives.
+ *
+ * This is an RFC 8628 device authorization grant. The shape that matters:
+ * {@link ValDeviceAuthorization.deviceCode} is a secret this process holds and
+ * polls with, while {@link ValDeviceAuthorization.userCode} is the short string
+ * the human reads out of the terminal and types into a browser. Only the device
+ * code can collect a token.
+ *
+ * Keep them apart. Show the user code; never print, log or put the device code
+ * in a URL. An earlier version of this flow used one value for both jobs, which
+ * meant anyone who saw the verification link could collect the token it led to.
  *
  * The CLI wraps these with terminal output, and `@valbuild/language-server`
  * wraps them with LSP `window/showDocument` and progress reporting. Neither the
@@ -16,6 +26,10 @@ export type ValLoginErrorCode =
  | "unexpected-response"
 /** The server returned a 5xx. */
  | "server-error"
+/** The user declined the login in the browser. */
+ | "access-denied"
+/** The login was not approved before the code expired. */
+ | "expired"
 /** The user did not complete the login within the allotted time. */
  | "timeout"
 /** The caller aborted the flow. */
@@ -25,12 +39,23 @@ export declare class ValLoginError extends Error {
     readonly details?: string | undefined;
     constructor(code: ValLoginErrorCode, message: string, details?: string | undefined);
 }
-/** A login attempt that is waiting for the user to confirm in a browser. */
-export type ValLoginSession = {
-    /** Opaque token used to poll for confirmation. */
-    nonce: string;
-    /** URL the user must open to confirm the login. */
-    url: string;
+/** A login attempt that is waiting for the user to approve it in a browser. */
+export type ValDeviceAuthorization = {
+    /**
+     * Secret. Polls for the token. Do not display, log or transmit anywhere but
+     * the token endpoint.
+     */
+    deviceCode: string;
+    /** Short code for the user to compare and type. Safe to display. */
+    userCode: string;
+    /** Where the user goes to enter {@link userCode}. */
+    verificationUri: string;
+    /** {@link verificationUri} with the code prefilled, for convenience. */
+    verificationUriComplete: string;
+    /** Seconds until the code stops being approvable. */
+    expiresInSeconds: number;
+    /** Minimum seconds between polls, per the server. */
+    intervalSeconds: number;
 };
 export type ValLoginResult = {
     profile: {
@@ -39,24 +64,26 @@ export type ValLoginResult = {
     pat: string;
 };
 /**
- * Begin a login attempt. The caller is responsible for getting
- * {@link ValLoginSession.url} in front of the user.
+ * Begin a login attempt. The caller is responsible for getting the user code
+ * and verification URL in front of the user.
  */
 export declare function startValLogin(options?: {
     host?: string;
-}): Promise<ValLoginSession>;
-export declare const DEFAULT_LOGIN_MAX_DURATION: number;
-export declare const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+    deviceName?: string;
+}): Promise<ValDeviceAuthorization>;
+/** Fallbacks for a server that omits the optional RFC 8628 timing fields. */
+export declare const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 600;
+export declare const DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = 5;
 /**
- * Poll until the user confirms the login in their browser.
+ * Poll until the user approves the login in their browser.
  *
  * Accepts an `AbortSignal` so an editor can cancel the flow when the user
- * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ * dismisses the prompt, instead of leaving a poll loop running to expiry.
  */
-export declare function awaitValLoginConfirmation(nonce: string, options?: {
+export declare function awaitValLoginConfirmation(authorization: ValDeviceAuthorization, options?: {
     host?: string;
+    /** Defaults to the authorization's own `expiresInSeconds`. */
     maxDurationMs?: number;
-    pollIntervalMs?: number;
     signal?: AbortSignal;
     /** Wall clock, injectable for tests. */
     now?: () => number;

package/dist/valbuild-server.cjs.dev.js

@@ -10347,6 +10347,10 @@ async function initHandlerOptions(route, opts, config) {
   const maybeValProject = opts.project || process.env.VAL_PROJECT;
   const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
   const valContentUrl = opts.valContentUrl || process.env.VAL_CONTENT_URL || core.DEFAULT_CONTENT_HOST;
+  warnIfInsecureUrls({
+    valBuildUrl,
+    valContentUrl
+  });
   if (isProxyMode) {
     var _opts$versions, _opts$versions2;
     if (!maybeApiKey || !maybeValSecret) {
@@ -10388,7 +10392,6 @@ async function initHandlerOptions(route, opts, config) {
     };
   } else {
     const cwd = process.cwd();
-    const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
     return {
       mode: "fs",
       cwd,
@@ -10405,6 +10408,84 @@ async function initHandlerOptions(route, opts, config) {
   }
 }
 
+/**
+ * Hosts we send credentials to, and what each one puts at risk. They differ:
+ * only `valBuildUrl` hands back the app token that becomes the session cookie,
+ * so a single shared sentence would overstate one and understate the other.
+ */
+
+const CREDENTIAL_BEARING_URLS = ["valBuildUrl", "valContentUrl"];
+const WHAT_IS_AT_RISK = {
+  valBuildUrl: "Val's api key is sent to this host, and the token it returns is what this server signs into the session cookie, " + "so both can be read - and the token replaced - by anyone on the network path.",
+  valContentUrl: "Val's api key, or the caller's personal access token, is sent to this host, " + "so it can be read by anyone on the network path."
+};
+
+// NOTE: `URL.hostname` keeps the brackets on an IPv6 literal, so this is
+// "[::1]" and not "::1" - and `http://[0:0:0:0:0:0:0:1]` normalises to the
+// same short form before it gets here. Dropping the brackets looks like a
+// tidy-up and silently stops matching IPv6 loopback.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
+
+/**
+ * The URL as it is safe to print. `http://user:pass@host` is a legal override,
+ * and a warning about credential exposure that puts the password in the log
+ * would be the very thing it is warning about.
+ */
+function forLog(parsed) {
+  if (!parsed.username && !parsed.password) {
+    return parsed.href;
+  }
+  const redacted = new URL(parsed.href);
+  redacted.username = "";
+  redacted.password = "";
+  return `${redacted.href} (credentials redacted)`;
+}
+
+/**
+ * Returns a warning if `url` would send credentials somewhere they can be read
+ * off the wire, or null if it is fine.
+ *
+ * Both URLs default to https, but each is overridable - `opts.valBuildUrl` /
+ * `VAL_BUILD_URL`, `opts.valContentUrl` / `VAL_CONTENT_URL` - and neither
+ * override has ever been scheme-checked. Point one at a plain http host and the
+ * api key goes out in clear text, and whatever comes back is whatever the
+ * network says: for `valBuildUrl` that includes the app token this server
+ * re-signs into the session cookie.
+ *
+ * Loopback over http is exempt: that is a val.build running on the developer's
+ * own machine, and there is no network to be on the wrong side of.
+ *
+ * This warns rather than throws. Both overrides are set by the operator, not by
+ * an attacker, so this is a misconfiguration to surface - not untrusted input to
+ * reject - and refusing to boot would break anyone deliberately pointing at an
+ * internal http host today.
+ */
+function insecureUrlWarning(name, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // NOTE: the URL is not echoed here. It did not parse, so there is nothing
+    // to redact with, and an unparseable string can still hold a password.
+    return `Val: ${name} is not a valid URL.`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  if (parsed.protocol === "http:" && (LOOPBACK_HOSTNAMES.includes(parsed.hostname) || parsed.hostname.endsWith(".localhost"))) {
+    return null;
+  }
+  return `Val: ${name} is set to ${forLog(parsed)}, which is not https. ` + `${WHAT_IS_AT_RISK[name]} ` + `Use https, or a loopback address for local development.`;
+}
+function warnIfInsecureUrls(urls) {
+  for (const name of CREDENTIAL_BEARING_URLS) {
+    const warning = insecureUrlWarning(name, urls[name]);
+    if (warning) {
+      console.warn(warning);
+    }
+  }
+}
+
 // TODO: remove
 async function safeReadGit(cwd) {
   async function findGitHead(currentDir, depth) {
@@ -12408,7 +12489,17 @@ async function findAndEvalValConfigFile(projectRoot) {
 }
 
 /**
- * The Val login device flow, as reusable primitives.
+ * The Val login flow, as reusable primitives.
+ *
+ * This is an RFC 8628 device authorization grant. The shape that matters:
+ * {@link ValDeviceAuthorization.deviceCode} is a secret this process holds and
+ * polls with, while {@link ValDeviceAuthorization.userCode} is the short string
+ * the human reads out of the terminal and types into a browser. Only the device
+ * code can collect a token.
+ *
+ * Keep them apart. Show the user code; never print, log or put the device code
+ * in a URL. An earlier version of this flow used one value for both jobs, which
+ * meant anyone who saw the verification link could collect the token it led to.
  *
  * The CLI wraps these with terminal output, and `@valbuild/language-server`
  * wraps them with LSP `window/showDocument` and progress reporting. Neither the
@@ -12422,6 +12513,21 @@ const DEFAULT_LOGIN_HOST = "https://admin.val.build";
 function defaultHost() {
   return process.env.VAL_BUILD_URL || DEFAULT_LOGIN_HOST;
 }
+
+/**
+ * What gets shown on the approval screen so the person can tell which terminal
+ * is asking. Self-reported and therefore a hint, not proof — the server treats
+ * it as untrusted display text.
+ */
+function defaultDeviceName() {
+  try {
+    return `${os__default["default"].hostname()} (${os__default["default"].platform()})`;
+  } catch {
+    // hostname() can throw on locked-down containers. A missing device name is
+    // not worth failing a login over; the server renders "Unknown".
+    return "";
+  }
+}
 class ValLoginError extends Error {
   constructor(code, message, details) {
     super(message);
@@ -12431,20 +12537,24 @@ class ValLoginError extends Error {
   }
 }
 
-/** A login attempt that is waiting for the user to confirm in a browser. */
+/** A login attempt that is waiting for the user to approve it in a browser. */
 
 /**
- * Begin a login attempt. The caller is responsible for getting
- * {@link ValLoginSession.url} in front of the user.
+ * Begin a login attempt. The caller is responsible for getting the user code
+ * and verification URL in front of the user.
  */
 async function startValLogin(options = {}) {
   var _response$headers$get;
   const host = options.host ?? defaultHost();
+  const deviceName = options.deviceName ?? defaultDeviceName();
   const response = await fetch(`${host}/api/login`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
-    }
+    },
+    body: JSON.stringify(deviceName ? {
+      device_name: deviceName
+    } : {})
   });
   if (response.status >= 500) {
     const text = await response.text().catch(() => "");
@@ -12455,42 +12565,63 @@ async function startValLogin(options = {}) {
     throw new ValLoginError("unexpected-content-type", "Unexpected failure while trying to login (content type was not JSON).", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
   }
   const json = await response.json();
-  const nonce = json === null || json === void 0 ? void 0 : json.nonce;
-  const url = json === null || json === void 0 ? void 0 : json.url;
-  if (typeof nonce !== "string" || typeof url !== "string") {
-    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+  const deviceCode = json === null || json === void 0 ? void 0 : json.device_code;
+  const userCode = json === null || json === void 0 ? void 0 : json.user_code;
+  const verificationUri = json === null || json === void 0 ? void 0 : json.verification_uri;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server. This version of Val may be too old for the login flow on this host — try updating @valbuild/cli.", JSON.stringify(json));
   }
   return {
-    nonce,
-    url
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: typeof (json === null || json === void 0 ? void 0 : json.verification_uri_complete) === "string" ? json.verification_uri_complete : verificationUri,
+    expiresInSeconds: typeof (json === null || json === void 0 ? void 0 : json.expires_in) === "number" ? json.expires_in : DEFAULT_LOGIN_EXPIRES_IN_SECONDS,
+    intervalSeconds: typeof (json === null || json === void 0 ? void 0 : json.interval) === "number" ? json.interval : DEFAULT_LOGIN_POLL_INTERVAL_SECONDS
   };
 }
-const DEFAULT_LOGIN_MAX_DURATION = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+
+/** Fallbacks for a server that omits the optional RFC 8628 timing fields. */
+const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = 5;
 
 /**
- * Poll until the user confirms the login in their browser.
+ * How much to add to the poll interval when the server answers `slow_down`.
+ * RFC 8628 section 3.5 specifies 5 seconds.
+ */
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+
+/**
+ * Poll until the user approves the login in their browser.
  *
  * Accepts an `AbortSignal` so an editor can cancel the flow when the user
- * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ * dismisses the prompt, instead of leaving a poll loop running to expiry.
  */
-async function awaitValLoginConfirmation(nonce, options = {}) {
+async function awaitValLoginConfirmation(authorization, options = {}) {
   const host = options.host ?? defaultHost();
-  const maxDuration = options.maxDurationMs ?? DEFAULT_LOGIN_MAX_DURATION;
-  const pollInterval = options.pollIntervalMs ?? DEFAULT_LOGIN_POLL_INTERVAL;
+  const maxDuration = options.maxDurationMs ?? authorization.expiresInSeconds * 1000;
   const now = options.now ?? (() => Date.now());
+  // Mutable: `slow_down` widens it as we go, and never narrows it again.
+  let intervalMs = authorization.intervalSeconds * 1000;
   const start = now();
   while (now() - start < maxDuration) {
     var _options$signal, _options$signal2;
     if ((_options$signal = options.signal) !== null && _options$signal !== void 0 && _options$signal.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    await new Promise(resolve => setTimeout(resolve, pollInterval));
+    // Wait first: the user has not had time to approve anything yet.
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
     if ((_options$signal2 = options.signal) !== null && _options$signal2 !== void 0 && _options$signal2.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    const response = await fetch(`${host}/api/login?token=${nonce}&consume=true`, {
-      method: "POST"
+    const response = await fetch(`${host}/api/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        device_code: authorization.deviceCode
+      })
     });
     if (response.status >= 500) {
       throw new ValLoginError("server-error", "An error occurred on the server.", `Status: ${response.status}`);
@@ -12508,6 +12639,23 @@ async function awaitValLoginConfirmation(nonce, options = {}) {
       }
       throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
     }
+    const json = await response.json().catch(() => null);
+    const error = typeof (json === null || json === void 0 ? void 0 : json.error) === "string" ? json.error : null;
+    const description = typeof (json === null || json === void 0 ? void 0 : json.error_description) === "string" ? json.error_description : undefined;
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down" || response.status === 429) {
+      intervalMs += SLOW_DOWN_INCREMENT_SECONDS * 1000;
+      continue;
+    }
+    if (error === "access_denied") {
+      throw new ValLoginError("access-denied", "The login was declined in the browser.", description);
+    }
+    if (error === "expired_token") {
+      throw new ValLoginError("expired", "The login code expired before it was approved.", description);
+    }
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
   }
   throw new ValLoginError("timeout", "Login confirmation timed out.");
 }
@@ -12813,9 +12961,9 @@ Object.defineProperty(exports, 'hasRemoteFileSchema', {
   enumerable: true,
   get: function () { return core.hasRemoteFileSchema; }
 });
+exports.DEFAULT_LOGIN_EXPIRES_IN_SECONDS = DEFAULT_LOGIN_EXPIRES_IN_SECONDS;
 exports.DEFAULT_LOGIN_HOST = DEFAULT_LOGIN_HOST;
-exports.DEFAULT_LOGIN_MAX_DURATION = DEFAULT_LOGIN_MAX_DURATION;
-exports.DEFAULT_LOGIN_POLL_INTERVAL = DEFAULT_LOGIN_POLL_INTERVAL;
+exports.DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = DEFAULT_LOGIN_POLL_INTERVAL_SECONDS;
 exports.Service = Service;
 exports.ValFSHost = ValFSHost;
 exports.ValLoginError = ValLoginError;

package/dist/valbuild-server.cjs.prod.js

@@ -10347,6 +10347,10 @@ async function initHandlerOptions(route, opts, config) {
   const maybeValProject = opts.project || process.env.VAL_PROJECT;
   const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
   const valContentUrl = opts.valContentUrl || process.env.VAL_CONTENT_URL || core.DEFAULT_CONTENT_HOST;
+  warnIfInsecureUrls({
+    valBuildUrl,
+    valContentUrl
+  });
   if (isProxyMode) {
     var _opts$versions, _opts$versions2;
     if (!maybeApiKey || !maybeValSecret) {
@@ -10388,7 +10392,6 @@ async function initHandlerOptions(route, opts, config) {
     };
   } else {
     const cwd = process.cwd();
-    const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
     return {
       mode: "fs",
       cwd,
@@ -10405,6 +10408,84 @@ async function initHandlerOptions(route, opts, config) {
   }
 }
 
+/**
+ * Hosts we send credentials to, and what each one puts at risk. They differ:
+ * only `valBuildUrl` hands back the app token that becomes the session cookie,
+ * so a single shared sentence would overstate one and understate the other.
+ */
+
+const CREDENTIAL_BEARING_URLS = ["valBuildUrl", "valContentUrl"];
+const WHAT_IS_AT_RISK = {
+  valBuildUrl: "Val's api key is sent to this host, and the token it returns is what this server signs into the session cookie, " + "so both can be read - and the token replaced - by anyone on the network path.",
+  valContentUrl: "Val's api key, or the caller's personal access token, is sent to this host, " + "so it can be read by anyone on the network path."
+};
+
+// NOTE: `URL.hostname` keeps the brackets on an IPv6 literal, so this is
+// "[::1]" and not "::1" - and `http://[0:0:0:0:0:0:0:1]` normalises to the
+// same short form before it gets here. Dropping the brackets looks like a
+// tidy-up and silently stops matching IPv6 loopback.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
+
+/**
+ * The URL as it is safe to print. `http://user:pass@host` is a legal override,
+ * and a warning about credential exposure that puts the password in the log
+ * would be the very thing it is warning about.
+ */
+function forLog(parsed) {
+  if (!parsed.username && !parsed.password) {
+    return parsed.href;
+  }
+  const redacted = new URL(parsed.href);
+  redacted.username = "";
+  redacted.password = "";
+  return `${redacted.href} (credentials redacted)`;
+}
+
+/**
+ * Returns a warning if `url` would send credentials somewhere they can be read
+ * off the wire, or null if it is fine.
+ *
+ * Both URLs default to https, but each is overridable - `opts.valBuildUrl` /
+ * `VAL_BUILD_URL`, `opts.valContentUrl` / `VAL_CONTENT_URL` - and neither
+ * override has ever been scheme-checked. Point one at a plain http host and the
+ * api key goes out in clear text, and whatever comes back is whatever the
+ * network says: for `valBuildUrl` that includes the app token this server
+ * re-signs into the session cookie.
+ *
+ * Loopback over http is exempt: that is a val.build running on the developer's
+ * own machine, and there is no network to be on the wrong side of.
+ *
+ * This warns rather than throws. Both overrides are set by the operator, not by
+ * an attacker, so this is a misconfiguration to surface - not untrusted input to
+ * reject - and refusing to boot would break anyone deliberately pointing at an
+ * internal http host today.
+ */
+function insecureUrlWarning(name, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // NOTE: the URL is not echoed here. It did not parse, so there is nothing
+    // to redact with, and an unparseable string can still hold a password.
+    return `Val: ${name} is not a valid URL.`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  if (parsed.protocol === "http:" && (LOOPBACK_HOSTNAMES.includes(parsed.hostname) || parsed.hostname.endsWith(".localhost"))) {
+    return null;
+  }
+  return `Val: ${name} is set to ${forLog(parsed)}, which is not https. ` + `${WHAT_IS_AT_RISK[name]} ` + `Use https, or a loopback address for local development.`;
+}
+function warnIfInsecureUrls(urls) {
+  for (const name of CREDENTIAL_BEARING_URLS) {
+    const warning = insecureUrlWarning(name, urls[name]);
+    if (warning) {
+      console.warn(warning);
+    }
+  }
+}
+
 // TODO: remove
 async function safeReadGit(cwd) {
   async function findGitHead(currentDir, depth) {
@@ -12408,7 +12489,17 @@ async function findAndEvalValConfigFile(projectRoot) {
 }
 
 /**
- * The Val login device flow, as reusable primitives.
+ * The Val login flow, as reusable primitives.
+ *
+ * This is an RFC 8628 device authorization grant. The shape that matters:
+ * {@link ValDeviceAuthorization.deviceCode} is a secret this process holds and
+ * polls with, while {@link ValDeviceAuthorization.userCode} is the short string
+ * the human reads out of the terminal and types into a browser. Only the device
+ * code can collect a token.
+ *
+ * Keep them apart. Show the user code; never print, log or put the device code
+ * in a URL. An earlier version of this flow used one value for both jobs, which
+ * meant anyone who saw the verification link could collect the token it led to.
  *
  * The CLI wraps these with terminal output, and `@valbuild/language-server`
  * wraps them with LSP `window/showDocument` and progress reporting. Neither the
@@ -12422,6 +12513,21 @@ const DEFAULT_LOGIN_HOST = "https://admin.val.build";
 function defaultHost() {
   return process.env.VAL_BUILD_URL || DEFAULT_LOGIN_HOST;
 }
+
+/**
+ * What gets shown on the approval screen so the person can tell which terminal
+ * is asking. Self-reported and therefore a hint, not proof — the server treats
+ * it as untrusted display text.
+ */
+function defaultDeviceName() {
+  try {
+    return `${os__default["default"].hostname()} (${os__default["default"].platform()})`;
+  } catch {
+    // hostname() can throw on locked-down containers. A missing device name is
+    // not worth failing a login over; the server renders "Unknown".
+    return "";
+  }
+}
 class ValLoginError extends Error {
   constructor(code, message, details) {
     super(message);
@@ -12431,20 +12537,24 @@ class ValLoginError extends Error {
   }
 }
 
-/** A login attempt that is waiting for the user to confirm in a browser. */
+/** A login attempt that is waiting for the user to approve it in a browser. */
 
 /**
- * Begin a login attempt. The caller is responsible for getting
- * {@link ValLoginSession.url} in front of the user.
+ * Begin a login attempt. The caller is responsible for getting the user code
+ * and verification URL in front of the user.
  */
 async function startValLogin(options = {}) {
   var _response$headers$get;
   const host = options.host ?? defaultHost();
+  const deviceName = options.deviceName ?? defaultDeviceName();
   const response = await fetch(`${host}/api/login`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
-    }
+    },
+    body: JSON.stringify(deviceName ? {
+      device_name: deviceName
+    } : {})
   });
   if (response.status >= 500) {
     const text = await response.text().catch(() => "");
@@ -12455,42 +12565,63 @@ async function startValLogin(options = {}) {
     throw new ValLoginError("unexpected-content-type", "Unexpected failure while trying to login (content type was not JSON).", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
   }
   const json = await response.json();
-  const nonce = json === null || json === void 0 ? void 0 : json.nonce;
-  const url = json === null || json === void 0 ? void 0 : json.url;
-  if (typeof nonce !== "string" || typeof url !== "string") {
-    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+  const deviceCode = json === null || json === void 0 ? void 0 : json.device_code;
+  const userCode = json === null || json === void 0 ? void 0 : json.user_code;
+  const verificationUri = json === null || json === void 0 ? void 0 : json.verification_uri;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server. This version of Val may be too old for the login flow on this host — try updating @valbuild/cli.", JSON.stringify(json));
   }
   return {
-    nonce,
-    url
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: typeof (json === null || json === void 0 ? void 0 : json.verification_uri_complete) === "string" ? json.verification_uri_complete : verificationUri,
+    expiresInSeconds: typeof (json === null || json === void 0 ? void 0 : json.expires_in) === "number" ? json.expires_in : DEFAULT_LOGIN_EXPIRES_IN_SECONDS,
+    intervalSeconds: typeof (json === null || json === void 0 ? void 0 : json.interval) === "number" ? json.interval : DEFAULT_LOGIN_POLL_INTERVAL_SECONDS
   };
 }
-const DEFAULT_LOGIN_MAX_DURATION = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+
+/** Fallbacks for a server that omits the optional RFC 8628 timing fields. */
+const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = 5;
 
 /**
- * Poll until the user confirms the login in their browser.
+ * How much to add to the poll interval when the server answers `slow_down`.
+ * RFC 8628 section 3.5 specifies 5 seconds.
+ */
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+
+/**
+ * Poll until the user approves the login in their browser.
  *
  * Accepts an `AbortSignal` so an editor can cancel the flow when the user
- * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ * dismisses the prompt, instead of leaving a poll loop running to expiry.
  */
-async function awaitValLoginConfirmation(nonce, options = {}) {
+async function awaitValLoginConfirmation(authorization, options = {}) {
   const host = options.host ?? defaultHost();
-  const maxDuration = options.maxDurationMs ?? DEFAULT_LOGIN_MAX_DURATION;
-  const pollInterval = options.pollIntervalMs ?? DEFAULT_LOGIN_POLL_INTERVAL;
+  const maxDuration = options.maxDurationMs ?? authorization.expiresInSeconds * 1000;
   const now = options.now ?? (() => Date.now());
+  // Mutable: `slow_down` widens it as we go, and never narrows it again.
+  let intervalMs = authorization.intervalSeconds * 1000;
   const start = now();
   while (now() - start < maxDuration) {
     var _options$signal, _options$signal2;
     if ((_options$signal = options.signal) !== null && _options$signal !== void 0 && _options$signal.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    await new Promise(resolve => setTimeout(resolve, pollInterval));
+    // Wait first: the user has not had time to approve anything yet.
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
     if ((_options$signal2 = options.signal) !== null && _options$signal2 !== void 0 && _options$signal2.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    const response = await fetch(`${host}/api/login?token=${nonce}&consume=true`, {
-      method: "POST"
+    const response = await fetch(`${host}/api/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        device_code: authorization.deviceCode
+      })
     });
     if (response.status >= 500) {
       throw new ValLoginError("server-error", "An error occurred on the server.", `Status: ${response.status}`);
@@ -12508,6 +12639,23 @@ async function awaitValLoginConfirmation(nonce, options = {}) {
       }
       throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
     }
+    const json = await response.json().catch(() => null);
+    const error = typeof (json === null || json === void 0 ? void 0 : json.error) === "string" ? json.error : null;
+    const description = typeof (json === null || json === void 0 ? void 0 : json.error_description) === "string" ? json.error_description : undefined;
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down" || response.status === 429) {
+      intervalMs += SLOW_DOWN_INCREMENT_SECONDS * 1000;
+      continue;
+    }
+    if (error === "access_denied") {
+      throw new ValLoginError("access-denied", "The login was declined in the browser.", description);
+    }
+    if (error === "expired_token") {
+      throw new ValLoginError("expired", "The login code expired before it was approved.", description);
+    }
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
   }
   throw new ValLoginError("timeout", "Login confirmation timed out.");
 }
@@ -12813,9 +12961,9 @@ Object.defineProperty(exports, 'hasRemoteFileSchema', {
   enumerable: true,
   get: function () { return core.hasRemoteFileSchema; }
 });
+exports.DEFAULT_LOGIN_EXPIRES_IN_SECONDS = DEFAULT_LOGIN_EXPIRES_IN_SECONDS;
 exports.DEFAULT_LOGIN_HOST = DEFAULT_LOGIN_HOST;
-exports.DEFAULT_LOGIN_MAX_DURATION = DEFAULT_LOGIN_MAX_DURATION;
-exports.DEFAULT_LOGIN_POLL_INTERVAL = DEFAULT_LOGIN_POLL_INTERVAL;
+exports.DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = DEFAULT_LOGIN_POLL_INTERVAL_SECONDS;
 exports.Service = Service;
 exports.ValFSHost = ValFSHost;
 exports.ValLoginError = ValLoginError;

package/dist/valbuild-server.esm.js

@@ -10313,6 +10313,10 @@ async function initHandlerOptions(route, opts, config) {
   const maybeValProject = opts.project || process.env.VAL_PROJECT;
   const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
   const valContentUrl = opts.valContentUrl || process.env.VAL_CONTENT_URL || DEFAULT_CONTENT_HOST;
+  warnIfInsecureUrls({
+    valBuildUrl,
+    valContentUrl
+  });
   if (isProxyMode) {
     var _opts$versions, _opts$versions2;
     if (!maybeApiKey || !maybeValSecret) {
@@ -10354,7 +10358,6 @@ async function initHandlerOptions(route, opts, config) {
     };
   } else {
     const cwd = process.cwd();
-    const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
     return {
       mode: "fs",
       cwd,
@@ -10371,6 +10374,84 @@ async function initHandlerOptions(route, opts, config) {
   }
 }
 
+/**
+ * Hosts we send credentials to, and what each one puts at risk. They differ:
+ * only `valBuildUrl` hands back the app token that becomes the session cookie,
+ * so a single shared sentence would overstate one and understate the other.
+ */
+
+const CREDENTIAL_BEARING_URLS = ["valBuildUrl", "valContentUrl"];
+const WHAT_IS_AT_RISK = {
+  valBuildUrl: "Val's api key is sent to this host, and the token it returns is what this server signs into the session cookie, " + "so both can be read - and the token replaced - by anyone on the network path.",
+  valContentUrl: "Val's api key, or the caller's personal access token, is sent to this host, " + "so it can be read by anyone on the network path."
+};
+
+// NOTE: `URL.hostname` keeps the brackets on an IPv6 literal, so this is
+// "[::1]" and not "::1" - and `http://[0:0:0:0:0:0:0:1]` normalises to the
+// same short form before it gets here. Dropping the brackets looks like a
+// tidy-up and silently stops matching IPv6 loopback.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
+
+/**
+ * The URL as it is safe to print. `http://user:pass@host` is a legal override,
+ * and a warning about credential exposure that puts the password in the log
+ * would be the very thing it is warning about.
+ */
+function forLog(parsed) {
+  if (!parsed.username && !parsed.password) {
+    return parsed.href;
+  }
+  const redacted = new URL(parsed.href);
+  redacted.username = "";
+  redacted.password = "";
+  return `${redacted.href} (credentials redacted)`;
+}
+
+/**
+ * Returns a warning if `url` would send credentials somewhere they can be read
+ * off the wire, or null if it is fine.
+ *
+ * Both URLs default to https, but each is overridable - `opts.valBuildUrl` /
+ * `VAL_BUILD_URL`, `opts.valContentUrl` / `VAL_CONTENT_URL` - and neither
+ * override has ever been scheme-checked. Point one at a plain http host and the
+ * api key goes out in clear text, and whatever comes back is whatever the
+ * network says: for `valBuildUrl` that includes the app token this server
+ * re-signs into the session cookie.
+ *
+ * Loopback over http is exempt: that is a val.build running on the developer's
+ * own machine, and there is no network to be on the wrong side of.
+ *
+ * This warns rather than throws. Both overrides are set by the operator, not by
+ * an attacker, so this is a misconfiguration to surface - not untrusted input to
+ * reject - and refusing to boot would break anyone deliberately pointing at an
+ * internal http host today.
+ */
+function insecureUrlWarning(name, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // NOTE: the URL is not echoed here. It did not parse, so there is nothing
+    // to redact with, and an unparseable string can still hold a password.
+    return `Val: ${name} is not a valid URL.`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  if (parsed.protocol === "http:" && (LOOPBACK_HOSTNAMES.includes(parsed.hostname) || parsed.hostname.endsWith(".localhost"))) {
+    return null;
+  }
+  return `Val: ${name} is set to ${forLog(parsed)}, which is not https. ` + `${WHAT_IS_AT_RISK[name]} ` + `Use https, or a loopback address for local development.`;
+}
+function warnIfInsecureUrls(urls) {
+  for (const name of CREDENTIAL_BEARING_URLS) {
+    const warning = insecureUrlWarning(name, urls[name]);
+    if (warning) {
+      console.warn(warning);
+    }
+  }
+}
+
 // TODO: remove
 async function safeReadGit(cwd) {
   async function findGitHead(currentDir, depth) {
@@ -12374,7 +12455,17 @@ async function findAndEvalValConfigFile(projectRoot) {
 }
 
 /**
- * The Val login device flow, as reusable primitives.
+ * The Val login flow, as reusable primitives.
+ *
+ * This is an RFC 8628 device authorization grant. The shape that matters:
+ * {@link ValDeviceAuthorization.deviceCode} is a secret this process holds and
+ * polls with, while {@link ValDeviceAuthorization.userCode} is the short string
+ * the human reads out of the terminal and types into a browser. Only the device
+ * code can collect a token.
+ *
+ * Keep them apart. Show the user code; never print, log or put the device code
+ * in a URL. An earlier version of this flow used one value for both jobs, which
+ * meant anyone who saw the verification link could collect the token it led to.
  *
  * The CLI wraps these with terminal output, and `@valbuild/language-server`
  * wraps them with LSP `window/showDocument` and progress reporting. Neither the
@@ -12388,6 +12479,21 @@ const DEFAULT_LOGIN_HOST = "https://admin.val.build";
 function defaultHost() {
   return process.env.VAL_BUILD_URL || DEFAULT_LOGIN_HOST;
 }
+
+/**
+ * What gets shown on the approval screen so the person can tell which terminal
+ * is asking. Self-reported and therefore a hint, not proof — the server treats
+ * it as untrusted display text.
+ */
+function defaultDeviceName() {
+  try {
+    return `${os.hostname()} (${os.platform()})`;
+  } catch {
+    // hostname() can throw on locked-down containers. A missing device name is
+    // not worth failing a login over; the server renders "Unknown".
+    return "";
+  }
+}
 class ValLoginError extends Error {
   constructor(code, message, details) {
     super(message);
@@ -12397,20 +12503,24 @@ class ValLoginError extends Error {
   }
 }
 
-/** A login attempt that is waiting for the user to confirm in a browser. */
+/** A login attempt that is waiting for the user to approve it in a browser. */
 
 /**
- * Begin a login attempt. The caller is responsible for getting
- * {@link ValLoginSession.url} in front of the user.
+ * Begin a login attempt. The caller is responsible for getting the user code
+ * and verification URL in front of the user.
  */
 async function startValLogin(options = {}) {
   var _response$headers$get;
   const host = options.host ?? defaultHost();
+  const deviceName = options.deviceName ?? defaultDeviceName();
   const response = await fetch(`${host}/api/login`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
-    }
+    },
+    body: JSON.stringify(deviceName ? {
+      device_name: deviceName
+    } : {})
   });
   if (response.status >= 500) {
     const text = await response.text().catch(() => "");
@@ -12421,42 +12531,63 @@ async function startValLogin(options = {}) {
     throw new ValLoginError("unexpected-content-type", "Unexpected failure while trying to login (content type was not JSON).", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
   }
   const json = await response.json();
-  const nonce = json === null || json === void 0 ? void 0 : json.nonce;
-  const url = json === null || json === void 0 ? void 0 : json.url;
-  if (typeof nonce !== "string" || typeof url !== "string") {
-    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+  const deviceCode = json === null || json === void 0 ? void 0 : json.device_code;
+  const userCode = json === null || json === void 0 ? void 0 : json.user_code;
+  const verificationUri = json === null || json === void 0 ? void 0 : json.verification_uri;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server. This version of Val may be too old for the login flow on this host — try updating @valbuild/cli.", JSON.stringify(json));
   }
   return {
-    nonce,
-    url
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: typeof (json === null || json === void 0 ? void 0 : json.verification_uri_complete) === "string" ? json.verification_uri_complete : verificationUri,
+    expiresInSeconds: typeof (json === null || json === void 0 ? void 0 : json.expires_in) === "number" ? json.expires_in : DEFAULT_LOGIN_EXPIRES_IN_SECONDS,
+    intervalSeconds: typeof (json === null || json === void 0 ? void 0 : json.interval) === "number" ? json.interval : DEFAULT_LOGIN_POLL_INTERVAL_SECONDS
   };
 }
-const DEFAULT_LOGIN_MAX_DURATION = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+
+/** Fallbacks for a server that omits the optional RFC 8628 timing fields. */
+const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = 5;
 
 /**
- * Poll until the user confirms the login in their browser.
+ * How much to add to the poll interval when the server answers `slow_down`.
+ * RFC 8628 section 3.5 specifies 5 seconds.
+ */
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+
+/**
+ * Poll until the user approves the login in their browser.
  *
  * Accepts an `AbortSignal` so an editor can cancel the flow when the user
- * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ * dismisses the prompt, instead of leaving a poll loop running to expiry.
  */
-async function awaitValLoginConfirmation(nonce, options = {}) {
+async function awaitValLoginConfirmation(authorization, options = {}) {
   const host = options.host ?? defaultHost();
-  const maxDuration = options.maxDurationMs ?? DEFAULT_LOGIN_MAX_DURATION;
-  const pollInterval = options.pollIntervalMs ?? DEFAULT_LOGIN_POLL_INTERVAL;
+  const maxDuration = options.maxDurationMs ?? authorization.expiresInSeconds * 1000;
   const now = options.now ?? (() => Date.now());
+  // Mutable: `slow_down` widens it as we go, and never narrows it again.
+  let intervalMs = authorization.intervalSeconds * 1000;
   const start = now();
   while (now() - start < maxDuration) {
     var _options$signal, _options$signal2;
     if ((_options$signal = options.signal) !== null && _options$signal !== void 0 && _options$signal.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    await new Promise(resolve => setTimeout(resolve, pollInterval));
+    // Wait first: the user has not had time to approve anything yet.
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
     if ((_options$signal2 = options.signal) !== null && _options$signal2 !== void 0 && _options$signal2.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    const response = await fetch(`${host}/api/login?token=${nonce}&consume=true`, {
-      method: "POST"
+    const response = await fetch(`${host}/api/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        device_code: authorization.deviceCode
+      })
     });
     if (response.status >= 500) {
       throw new ValLoginError("server-error", "An error occurred on the server.", `Status: ${response.status}`);
@@ -12474,6 +12605,23 @@ async function awaitValLoginConfirmation(nonce, options = {}) {
       }
       throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
     }
+    const json = await response.json().catch(() => null);
+    const error = typeof (json === null || json === void 0 ? void 0 : json.error) === "string" ? json.error : null;
+    const description = typeof (json === null || json === void 0 ? void 0 : json.error_description) === "string" ? json.error_description : undefined;
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down" || response.status === 429) {
+      intervalMs += SLOW_DOWN_INCREMENT_SECONDS * 1000;
+      continue;
+    }
+    if (error === "access_denied") {
+      throw new ValLoginError("access-denied", "The login was declined in the browser.", description);
+    }
+    if (error === "expired_token") {
+      throw new ValLoginError("expired", "The login code expired before it was approved.", description);
+    }
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
   }
   throw new ValLoginError("timeout", "Login confirmation timed out.");
 }
@@ -12775,4 +12923,4 @@ function readCapturedReport(snapshotDir) {
   return JSON.parse(fs.readFileSync(reportPath, "utf-8"));
 }
 
-export { DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_MAX_DURATION, DEFAULT_LOGIN_POLL_INTERVAL, Service, ValFSHost, ValLoginError, ValModuleLoader, ValOpsFS, ValOpsHttp, ValSourceFileHandler, analyzeValModule, awaitValLoginConfirmation, checkRemoteRef, classifyJsonValuesOp, compareWithCapturedReport, createDefaultValFSHost, createFixPatch, createJsonEntryPathMap, createModulePathMap, createService, createValApiRouter, createValModuleFileInspector, createValServer, currentFixHandlers, decodeJwtWithoutVerifying, describePatchStoreProblems, downloadFileFromRemote, encodeJwt, evalValConfigFile, extractFileMetadata, extractImageMetadata, extractJsonValuesEntry, findAndEvalValConfigFile, findJsonEntryFilePath, fixHandlers, formatPatchSourceError, formatSyntaxErrorTree, getCachedRemoteFileDir, getCachedRemoteFilePath, getCompilerOptions, getExpire, getFileExt, getModulePathRange, getPersonalAccessTokenPath, getSettings, getValidationErrorFileRef, handleCheckAllFiles, handleFileMetadata, handleJsonValuesExtractEntry, handleRemoteFileCheck, handleRemoteFileDownload, handleRemoteFileUpload, handleRemoteGalleryFileUpload, handleUniqueFolderCheck, loadValModules, parsePersonalAccessTokenFile, patchSourceFile, persistPersonalAccessToken, readCapturedReport, readPatchStore, rebaseContentOp, replaySnapshot, safeReadGit, startValLogin, uploadRemoteFile, validateMetadata, verifyJwt };
+export { DEFAULT_LOGIN_EXPIRES_IN_SECONDS, DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_POLL_INTERVAL_SECONDS, Service, ValFSHost, ValLoginError, ValModuleLoader, ValOpsFS, ValOpsHttp, ValSourceFileHandler, analyzeValModule, awaitValLoginConfirmation, checkRemoteRef, classifyJsonValuesOp, compareWithCapturedReport, createDefaultValFSHost, createFixPatch, createJsonEntryPathMap, createModulePathMap, createService, createValApiRouter, createValModuleFileInspector, createValServer, currentFixHandlers, decodeJwtWithoutVerifying, describePatchStoreProblems, downloadFileFromRemote, encodeJwt, evalValConfigFile, extractFileMetadata, extractImageMetadata, extractJsonValuesEntry, findAndEvalValConfigFile, findJsonEntryFilePath, fixHandlers, formatPatchSourceError, formatSyntaxErrorTree, getCachedRemoteFileDir, getCachedRemoteFilePath, getCompilerOptions, getExpire, getFileExt, getModulePathRange, getPersonalAccessTokenPath, getSettings, getValidationErrorFileRef, handleCheckAllFiles, handleFileMetadata, handleJsonValuesExtractEntry, handleRemoteFileCheck, handleRemoteFileDownload, handleRemoteFileUpload, handleRemoteGalleryFileUpload, handleUniqueFolderCheck, loadValModules, parsePersonalAccessTokenFile, patchSourceFile, persistPersonalAccessToken, readCapturedReport, readPatchStore, rebaseContentOp, replaySnapshot, safeReadGit, startValLogin, uploadRemoteFile, validateMetadata, verifyJwt };

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.114.0",
+  "version": "0.115.0",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0"
@@ -29,8 +29,8 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.111.0",
     "@valbuild/shared": "0.114.0",
+    "@valbuild/core": "0.111.0",
     "@valbuild/ui": "0.114.0"
   },
   "engines": {