@valbuild/server 0.125.0 → 0.127.0

package/CHANGELOG.md

@@ -1,5 +1,215 @@
 # @valbuild/server
 
+## 0.127.0
+
+### Minor Changes
+
+- [#608](https://github.com/valbuild/val/pull/608) [`7fa8699`](https://github.com/valbuild/val/commit/7fa869974bc895af992a7d5c18b76253636d7d65) Thanks [@freekh](https://github.com/freekh)! - A record whose schema declares its keys now holds every one of them.
+
+  Two key schemas enumerate their keys: `s.locale()`, whose set is the project's
+  `locales.available`, and a union of literals. For those, the keys are part of the
+  schema, so a missing one is a hole in the content rather than content nobody has
+  written yet — and validation now says so, naming what is missing.
+
+  ```typescript
+  s.record(s.locale(), s.object({ title: s.string() }));
+  // Missing key: 'nb-NO'. This record's keys are declared by its schema, so
+  // every one of them is an entry — an entry nobody has written yet is null,
+  // not absent.
+  ```
+
+  **An entry nobody has written yet is `null`.** Not an absent key: a null entry is
+  data you can count, filter and see in a diff, and it means half-translated
+  content stays _valid_ rather than blocking a publish. The value type of such a
+  record widens by `null` to match, so writing one in a `.val.ts` type-checks:
+
+  ```typescript
+  c.define(
+    "/content/jacket.val.ts",
+    s.record(s.locale(), s.object({ title: s.string() })),
+    {
+      "en-US": { title: "Winter jacket" },
+      "nb-NO": null, // nobody has translated this yet
+    },
+  );
+  ```
+
+  **This changes `s.record(s.union(...), item)`**, and closes a gap that was
+  already there: `s.record(s.union(s.literal("a"), s.literal("b")), item)` types as
+  `Record<"a" | "b", T>`, so TypeScript demanded both keys while the validator only
+  checked the ones present. It now checks them too, and — as above — accepts `null`
+  for an entry that has not been filled in. If you have such a record with keys
+  missing, validation will report them; adding the keys with `null` values is the
+  fix, and creating one from the Studio does it for you.
+
+  `emptyOf` creates these records with every key already in them rather than
+  empty, since an empty one is already missing keys. In the Studio use the
+  `useEmptyOf()` hook rather than importing `emptyOf` directly: a locale record's
+  keys are in the settings module, and the hook is what has read it.
+
+- [#608](https://github.com/valbuild/val/pull/608) [`5b7fe05`](https://github.com/valbuild/val/commit/5b7fe05cec6365f9cd1de9ba31e65ed4a87edb63) Thanks [@freekh](https://github.com/freekh)! - `s.locale()`: one of the project's languages.
+
+  The languages themselves are declared in the settings module (`locales.available`);
+  this says that a value is one of them.
+
+  ```typescript
+  // a field: everything in this entry is in this language
+  s.record(s.string(), s.object({ locale: s.locale(), title: s.string() }));
+
+  // a key: one entry per language
+  s.record(s.locale(), s.object({ title: s.string() }));
+  ```
+
+  Every locale in content is checked against the project's list, the way `keyOf`
+  and `route` are checked against what they point at. An undeclared language names
+  the ones the project has; a project that has declared none is told to declare
+  them rather than told the value is wrong.
+
+  A locale is stored as the tag itself — the value in content is `nb-NO`, and a
+  record keyed by `s.locale()` has `nb-NO` as its key. Spelling one differently
+  where it is stored (`/no/…` as a URL segment) is a real need and is deliberately
+  not in this release: it changes what is accepted as well as what is shown, so it
+  is being designed on its own rather than folded in here.
+
+  A locale is **never stega encoded**: it ends up in `<html lang>`, in `hreflang`
+  and in `Intl` constructors, none of which survive invisible characters.
+
+  `assistant.translation` joins the settings module alongside `context` and `tone`
+  — a note per language, keyed by language, so only the target language's rules are
+  sent when translating into it.
+
+### Patch Changes
+
+- Updated dependencies [[`7fa8699`](https://github.com/valbuild/val/commit/7fa869974bc895af992a7d5c18b76253636d7d65), [`600308d`](https://github.com/valbuild/val/commit/600308d0174990ad9f5c417147d160273489c65a), [`5b7fe05`](https://github.com/valbuild/val/commit/5b7fe05cec6365f9cd1de9ba31e65ed4a87edb63), [`88262ac`](https://github.com/valbuild/val/commit/88262ac8db068650a664981ef73556457d87741a), [`7072e07`](https://github.com/valbuild/val/commit/7072e07623c953a09ac14388ae22dada0b431ce3), [`29811c3`](https://github.com/valbuild/val/commit/29811c3f8c7e001a950e6f4833af6888e6a4efea), [`9983116`](https://github.com/valbuild/val/commit/99831164c5151aad7ca69de79e1d0d59878be251)]:
+  - @valbuild/core@0.127.0
+  - @valbuild/shared@0.127.0
+  - @valbuild/ui@0.127.0
+
+## 0.126.0
+
+### Patch Changes
+
+- [#664](https://github.com/valbuild/val/pull/664) [`5bfd630`](https://github.com/valbuild/val/commit/5bfd630b63dee2189e238f20fe72ecc5537160f7) Thanks [@freekh](https://github.com/freekh)! - Show the git message on deployments Val did not publish
+
+  The deploy feed could only name a publish when Val itself had made the commit:
+  the message came off Val's own `ValCommit`, and every other deployment — a
+  developer's push, a merged pull request, a revert — showed a seven-character
+  sha. On most projects those are the majority, so "what went out at 14:02?" had
+  no answer in the Studio.
+
+  A deployment can now carry its own `commitMessage`, which the Studio uses
+  wherever there is no Val commit to prefer. It is optional and nullable, so a
+  content service that does not report messages is unaffected — those publishes
+  keep showing the short sha, exactly as before.
+
+  Deployment rows also show only the subject line of a message now. A git message
+  is a subject, a blank line and a body, and the rows are one truncated line — so
+  a real push arrived as "Subject The body went on like this…". The classic
+  Draft changes view still has the whole message in its tooltip.
+
+- [#652](https://github.com/valbuild/val/pull/652) [`f2fe70d`](https://github.com/valbuild/val/commit/f2fe70dab2b65000dfaf289f09c70b4a8291467a) Thanks [@freekh](https://github.com/freekh)! - `s.union` is now `s.discriminatedUnion` and `s.enum`.
+
+  `s.union` did two unrelated jobs and worked out which one you meant from its
+  first argument: a string key meant a tagged union of objects, literal schemas
+  meant a set of allowed strings. Those are now two schemas with two names.
+
+  ```ts
+  // A fixed set of strings — presents as a dropdown
+  s.enum("primary", "secondary", "ghost"); // Schema<"primary" | "secondary" | "ghost">
+
+  // One of several object shapes, told apart by a tag field
+  s.discriminatedUnion(
+    "type",
+    s.object({ type: s.literal("hero"), heading: s.string() }),
+    s.object({ type: s.literal("quote"), text: s.string() }),
+  );
+  ```
+
+  `s.enum` takes the strings directly, so the `s.literal(...)` wrapper is gone.
+
+  **`s.union` still works** — it is deprecated, and it builds exactly the schema
+  above, so nothing has to change today:
+
+  ```ts
+  s.union(s.literal("one"), s.literal("two")); // → s.enum("one", "two")
+  s.union("type", pageA, pageB); // → s.discriminatedUnion("type", pageA, pageB)
+  ```
+
+  The two are different kinds of node, and that is the reason for the split. A
+  discriminated union is a container: the selected variant's fields are the fields
+  being edited, and everything that walks a schema descends through it. An enum is
+  a leaf — a string with a closed domain — so nothing recurses into it. Told apart
+  only by the shape of `key`, every consumer had to re-derive which one it was
+  holding; each now has its own serialized type (`"discriminated-union"` and
+  `"enum"`) and Val Studio has a field per kind rather than one field that
+  branches.
+
+  Two behaviour changes fall out of the split, both of them fixes:
+
+  - A value that is not a string at all now fails an enum's validation with a
+    type error. `s.union` of literals only ever checked the value against its
+    literals when the value WAS a string, so a number or an object where an enum
+    was declared validated clean.
+  - An enum field now shows its validation errors in Val Studio where the field
+    is opened on its own — the module editor and the canvas's fields column — and
+    gets the compact error layout inside an inline list row. It is a leaf now, so
+    it goes through the same error rendering as every other leaf field; the string
+    union bypassed it and showed nothing in those places.
+
+  Several latent crashes in the old `s.union` are fixed on the way past, all of
+  them cases where it threw a `TypeError` instead of reporting:
+
+  - A required discriminated union holding `null` now reports a type error rather
+    than throwing, and resolving a path underneath a nullable one that is `null`
+    gives the error the API promises instead of a crash.
+  - `s.literal("")` is a legal discriminator tag, and `s.enum("")` a legal value.
+    Both used to be treated as absent by a truthiness check — in path resolution,
+    in stega encoding, and in the message that lists a union's valid tags. The
+    editor's dropdowns handle them too: an empty value is reserved by the select
+    component and had to be mapped around.
+  - A variant that omits the discriminator entirely is now reported as the schema
+    error it is, instead of throwing while the check looked for it.
+  - An enum's value is now indexed for search, like every other string leaf. The
+    old string union was never indexed at all, so searching for one of its values
+    could not find the field.
+  - A nullable discriminated union set to `null` no longer renders a spinner that
+    never resolves.
+
+  `s.discriminatedUnion` also requires at least one variant, as `s.enum` requires
+  at least one value: a union with nothing to select is not a thing to write, and
+  everything downstream reads the first variant where it needs any.
+
+  If you read serialized schemas yourself, that is the breaking part: `type` is no
+  longer `"union"`, an enum carries `values: string[]` instead of a `key` plus
+  `items` of literal schemas, and `UnionSchema` is no longer a class.
+  `SerializedUnionSchema`, `SerializedStringUnionSchema`,
+  `SerializedObjectUnionSchema` and `UnionSchema` remain as deprecated type
+  aliases.
+
+- [#666](https://github.com/valbuild/val/pull/666) [`5c18c99`](https://github.com/valbuild/val/commit/5c18c99ecc84651f82123481fc042063db953833) Thanks [@freekh](https://github.com/freekh)! - `next build` no longer warns `module.createRequire failed parsing argument.`
+
+  Every Next app that bundles `@valbuild/server` into its Val API route got this
+  on every build, twice, with an import trace that led from `route.ts` down into
+  `valbuild-server.esm.js` and stopped there:
+
+  ```
+  ⚠ ./node_modules/.../@valbuild/server/dist/valbuild-server.esm.js
+  module.createRequire failed parsing argument.
+  ```
+
+  Nothing was wrong. webpack special-cases a `createRequire` binding imported from
+  `node:module` and tries to resolve the call's argument at build time; the two
+  calls in this package take a path inside the user's project, known only at
+  runtime, so there was nothing to resolve and nothing the warning could tell
+  anyone. Both now go through a helper that reaches the same function through the
+  `Module` class, which that analysis does not tag. Runtime behaviour is
+  unchanged, and a lint rule keeps the direct import from coming back.
+
+- Updated dependencies [[`719ad6b`](https://github.com/valbuild/val/commit/719ad6b607bcf136d0dbde9e90bf4b8a843561a4), [`9830277`](https://github.com/valbuild/val/commit/9830277e9aaca8da3030f629c2656ec58da47e45), [`64bfd0a`](https://github.com/valbuild/val/commit/64bfd0a6c85832ea5169b53e47087f22e193df36), [`7782979`](https://github.com/valbuild/val/commit/7782979e9b52f2015a6e72dc981e630d4f8c78e2), [`5bfd630`](https://github.com/valbuild/val/commit/5bfd630b63dee2189e238f20fe72ecc5537160f7), [`ccbcda6`](https://github.com/valbuild/val/commit/ccbcda60b3e3c465071229ae1ba28ac735483e63), [`f2fe70d`](https://github.com/valbuild/val/commit/f2fe70dab2b65000dfaf289f09c70b4a8291467a), [`755e1a3`](https://github.com/valbuild/val/commit/755e1a3953775cb8d2c2dce87d6810d3dc329640), [`c6b1ec8`](https://github.com/valbuild/val/commit/c6b1ec84f1883750a4cfe5f70470b177621e971f), [`656f680`](https://github.com/valbuild/val/commit/656f680043c640f678625a64e690389ab23a0a69), [`610a041`](https://github.com/valbuild/val/commit/610a0414b120b521f38a2eb1182b3778bf778b2b), [`171208a`](https://github.com/valbuild/val/commit/171208a20177e68ed5a8b1a6fdaabfe893a6aa5f)]:
+  - @valbuild/ui@0.126.0
+  - @valbuild/shared@0.126.0
+  - @valbuild/core@0.126.0
+
 ## 0.125.0
 
 ### Patch Changes

package/dist/declarations/src/fixHandlers.d.ts

@@ -206,6 +206,6 @@ export declare function handleJsonValuesExtractEntry(ctx: FixHandlerContext): Pr
  * — just not by this command.
  */
 export declare function handleExternalUpload(): Promise<FixHandlerResult>;
-export declare const currentFixHandlers: Record<Exclude<ValidationFix, "keyof:check-keys" | "router:check-route">, FixHandler>;
+export declare const currentFixHandlers: Record<Exclude<ValidationFix, "keyof:check-keys" | "router:check-route" | "locale:check-locale" | "record:fill-keys">, FixHandler>;
 export declare const fixHandlers: Record<string, FixHandler>;
 export declare function createDefaultValFSHost(): IValFSHost;

package/dist/valbuild-server.cjs.dev.js

@@ -696,6 +696,32 @@ const getCompilerOptions = (rootDir, parseConfigHost) => {
   return parsedConfigFile.options;
 };
 
+/**
+ * Node's `require`, resolving as if from `filename`.
+ *
+ * Use this instead of importing `createRequire` from `node:module` directly.
+ * webpack special-cases a `createRequire` binding imported from `module` /
+ * `node:module`: it tries to resolve the call's argument at build time, and
+ * when the argument is not a literal it gives up with
+ *
+ *     module.createRequire failed parsing argument.
+ *
+ * Our argument is never a literal — it is a path inside the user's project,
+ * known only at runtime — so there is nothing for that analysis to find, and
+ * nothing the warning can tell anyone. It is emitted on every build of every
+ * Next app that bundles `@valbuild/server` into its Val API route, which is
+ * all of them. Reaching `createRequire` through the `Module` class is the same
+ * function and is not what webpack tags, so the call is invisible to it.
+ *
+ * It has to stay a real `node:module` import: jest's module registry hands out
+ * its own `node:module`, and a `require` obtained around it (via
+ * `process.getBuiltinModule`, say) would resolve against the real filesystem
+ * rather than the registry the tests run in.
+ */
+function createNodeRequire(filename) {
+  return node_module.Module.createRequire(filename);
+}
+
 /**
  * The filesystem seam `loadValModules` reads through.
  *
@@ -829,7 +855,7 @@ function loadModule(absPath, cache, compilerOptions, host) {
   // Insert into the cache before evaluating so cyclic imports resolve.
   cache[absPath] = moduleObj;
   const dirName = path__namespace["default"].dirname(absPath);
-  const realRequire = node_module.Module.createRequire(absPath);
+  const realRequire = createNodeRequire(absPath);
   const customRequire = spec => {
     var _ts$resolveModuleName;
     if (isStubbedSpecifier(spec)) {
@@ -1136,7 +1162,7 @@ function findNestedJsonValuesRecords(schema, path = []) {
       case "array":
         rec(current.item, currentPath.concat("*"));
         return;
-      case "union":
+      case "discriminated-union":
         for (let i = 0; i < current.items.length; i++) {
           rec(current.items[i], currentPath.concat(`union[${i}]`));
         }
@@ -1722,6 +1748,7 @@ async function createService(projectRoot, host = {
   return new Service(projectRoot, sourceFileHandler, extracted);
 }
 class Service {
+  projectRoot;
   constructor(projectRoot, sourceFileHandler, extracted) {
     this.sourceFileHandler = sourceFileHandler;
     this.extracted = extracted;
@@ -2361,17 +2388,18 @@ function findNestedJsonValuesModuleErrors(schemas) {
 // #region ValOps
 class ValOps {
   /** Sources from val modules, immutable (without patches or anything)  */
-
+  sources;
   /** The sha256 / hash of all sources + all schemas + config */
-
+  baseSha;
   /** The sha256 / hash of all sources */
-
+  sourcesSha;
   /** The sha256 / hash of config */
-
+  configSha;
   /** Schema from val modules, immutable  */
-
+  schemas;
   /** The sha256 / hash of schema + config - if this changes users needs to reload */
-
+  schemaSha;
+  modulesErrors;
   /**
    * What the SHAs above are a fold over, so they can be recomputed.
    *
@@ -2379,7 +2407,7 @@ class ValOps {
    * without re-evaluating the modules is a save, and it has to be able to move
    * the SHAs with them.
    */
-
+  shaEntries;
   /**
    * The extraction's OWN module errors, which are what the fold was given.
    *
@@ -2387,7 +2415,7 @@ class ValOps {
    * `.jsonValues()` errors concatenated on, and those were never part of the
    * hash. Re-folding with the wrong list changes the base SHA for no reason.
    */
-
+  shaModuleErrors;
   /**
    * What a save has told us each `.jsonValues()` entry now holds.
    *
@@ -3147,7 +3175,8 @@ class ValOps {
     // (must include all modules, not just those being validated, since conflicts can come from any module)
     const galleryDirectoryToModules = new Map();
     // Build a schema/source snapshot so the shared resolver can cross-reference
-    // keyof:check-keys and router:check-route against every module's data.
+    // the marker fixes — a keyOf's key, a route, a locale tag, a record's
+    // declared keys — against every module's data. See `SCHEMA_SOURCE_FIXES`.
     const snapshot = {
       schemas: {},
       sources: {}
@@ -3227,7 +3256,7 @@ class ValOps {
         };
         if (validationErrors) {
           for (const validationError of validationErrors) {
-            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6, _validationError$fixe7, _validationError$fixe8;
+            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6;
             if (isOnlyFileCheckValidationError(validationError)) {
               if (files[sourcePath]) {
                 addError({
@@ -3241,13 +3270,13 @@ class ValOps {
               }
             } else if ((_validationError$fixe = validationError.fixes) !== null && _validationError$fixe !== void 0 && _validationError$fixe.includes("image:check-remote") || (_validationError$fixe2 = validationError.fixes) !== null && _validationError$fixe2 !== void 0 && _validationError$fixe2.includes("file:check-remote")) {
               remoteFiles[sourcePath] = validationError.value;
-            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("keyof:check-keys") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("router:check-route")) {
+            } else if (internal.isSchemaSourceFixError(validationError)) {
               const resolved = internal.resolveSchemaSourceFixForError(validationError, snapshot);
               if (resolved && resolved.status === "remaining") {
                 addError(resolved.error);
               }
               // resolved.status === "resolved" → drop silently
-            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-unique-folder") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-unique-folder")) {
+            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("images:check-unique-folder") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("files:check-unique-folder")) {
               const TYPE_ERROR_MESSAGE = `This is most likely a Val version mismatch or Val bug.`;
               if (!validationError.value || typeof validationError.value !== "object") {
                 addError({
@@ -3272,7 +3301,7 @@ class ValOps {
                   // If conflictingModules is empty, directory is unique — silently drop the error.
                 }
               }
-            } else if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.includes("images:check-all-files") || (_validationError$fixe8 = validationError.fixes) !== null && _validationError$fixe8 !== void 0 && _validationError$fixe8.includes("files:check-all-files")) ; else {
+            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-all-files") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-all-files")) ; else {
               addError(validationError);
             }
           }
@@ -4132,8 +4161,8 @@ class ValOps {
   // #endregion history
 }
 function isOnlyFileCheckValidationError(validationError) {
-  var _validationError$fixe9;
-  if ((_validationError$fixe9 = validationError.fixes) !== null && _validationError$fixe9 !== void 0 && _validationError$fixe9.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
+  var _validationError$fixe7;
+  if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
     return true;
   }
   return false;
@@ -5654,6 +5683,7 @@ function serializeSchemaSafely(schema) {
 }
 class ValOpsFS extends ValOps {
   static VAL_DIR = ".val";
+  host;
   constructor(contentUrl, rootDir, valModules, options) {
     super(valModules, options);
     this.contentUrl = contentUrl;
@@ -5666,6 +5696,7 @@ class ValOpsFS extends ValOps {
    * Change detection for `.jsonValues()` entry files, which no sha can see (their
    * content lives behind a thunk that `JSON.stringify` drops).
    */
+  jsonEntryFilesFingerprint;
 
   /**
    * Unpublished changes repair threw away, waiting to be told to somebody.
@@ -7015,7 +7046,11 @@ const GetApplicablePatches = z.z.object({
     commitSha: z.z.string(),
     deploymentState: z.z.string(),
     createdAt: z.z.string(),
-    updatedAt: z.z.string()
+    updatedAt: z.z.string(),
+    // The git message, where the content service knows it. See
+    // `ValDeployment`: this is the only source for a deployment that Val
+    // did not publish, and zod would otherwise strip it here.
+    commitMessage: z.z.string().nullable().optional()
   })).optional()
 });
 const FilesResponse = z.z.object({
@@ -7191,6 +7226,8 @@ const NonceResponse = z.z.object({
  */
 const PATCH_GROUPS_CACHE_MS = 1000;
 class ValOpsHttp extends ValOps {
+  authHeaders;
+  root;
   constructor(contentUrl, project, commitSha,
   // TODO: CommitSha
   branch,
@@ -7616,7 +7653,8 @@ class ValOpsHttp extends ValOps {
                 deploymentId: deployment.deploymentId,
                 deploymentState: deployment.deploymentState,
                 createdAt: deployment.createdAt,
-                updatedAt: deployment.updatedAt
+                updatedAt: deployment.updatedAt,
+                commitMessage: deployment.commitMessage
               });
             }
           }
@@ -13545,6 +13583,8 @@ const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
 const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
 
 class ValModuleLoader {
+  cache;
+  cacheSize;
   constructor(projectRoot, compilerOptions,
   // TODO: remove this?
   sourceFileHandler, host = {
@@ -15224,9 +15264,10 @@ async function handleExternalUpload() {
   };
 }
 
-// Fix handler registry. `keyof:check-keys` and `router:check-route` are
-// resolved upfront by the shared resolveSchemaSourceFixes — they never reach
-// this registry, so they're excluded from the key set.
+// Fix handler registry. `keyof:check-keys`, `router:check-route`,
+// `locale:check-locale` and `record:fill-keys` are resolved upfront by the
+// shared resolveSchemaSourceFixes — they never reach this registry, so they're
+// excluded from the key set.
 const currentFixHandlers = {
   "image:check-metadata": handleFileMetadata,
   "image:add-metadata": handleFileMetadata,
@@ -15386,7 +15427,7 @@ async function evalValConfigFile(projectRoot, configFileName) {
     },
     fileName: valConfigPath
   });
-  const projectRootRequire = node_module.createRequire(valConfigPath);
+  const projectRootRequire = createNodeRequire(valConfigPath);
   const exportsObj = {};
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const sandbox = {

package/dist/valbuild-server.cjs.prod.js

@@ -696,6 +696,32 @@ const getCompilerOptions = (rootDir, parseConfigHost) => {
   return parsedConfigFile.options;
 };
 
+/**
+ * Node's `require`, resolving as if from `filename`.
+ *
+ * Use this instead of importing `createRequire` from `node:module` directly.
+ * webpack special-cases a `createRequire` binding imported from `module` /
+ * `node:module`: it tries to resolve the call's argument at build time, and
+ * when the argument is not a literal it gives up with
+ *
+ *     module.createRequire failed parsing argument.
+ *
+ * Our argument is never a literal — it is a path inside the user's project,
+ * known only at runtime — so there is nothing for that analysis to find, and
+ * nothing the warning can tell anyone. It is emitted on every build of every
+ * Next app that bundles `@valbuild/server` into its Val API route, which is
+ * all of them. Reaching `createRequire` through the `Module` class is the same
+ * function and is not what webpack tags, so the call is invisible to it.
+ *
+ * It has to stay a real `node:module` import: jest's module registry hands out
+ * its own `node:module`, and a `require` obtained around it (via
+ * `process.getBuiltinModule`, say) would resolve against the real filesystem
+ * rather than the registry the tests run in.
+ */
+function createNodeRequire(filename) {
+  return node_module.Module.createRequire(filename);
+}
+
 /**
  * The filesystem seam `loadValModules` reads through.
  *
@@ -829,7 +855,7 @@ function loadModule(absPath, cache, compilerOptions, host) {
   // Insert into the cache before evaluating so cyclic imports resolve.
   cache[absPath] = moduleObj;
   const dirName = path__namespace["default"].dirname(absPath);
-  const realRequire = node_module.Module.createRequire(absPath);
+  const realRequire = createNodeRequire(absPath);
   const customRequire = spec => {
     var _ts$resolveModuleName;
     if (isStubbedSpecifier(spec)) {
@@ -1136,7 +1162,7 @@ function findNestedJsonValuesRecords(schema, path = []) {
       case "array":
         rec(current.item, currentPath.concat("*"));
         return;
-      case "union":
+      case "discriminated-union":
         for (let i = 0; i < current.items.length; i++) {
           rec(current.items[i], currentPath.concat(`union[${i}]`));
         }
@@ -1722,6 +1748,7 @@ async function createService(projectRoot, host = {
   return new Service(projectRoot, sourceFileHandler, extracted);
 }
 class Service {
+  projectRoot;
   constructor(projectRoot, sourceFileHandler, extracted) {
     this.sourceFileHandler = sourceFileHandler;
     this.extracted = extracted;
@@ -2361,17 +2388,18 @@ function findNestedJsonValuesModuleErrors(schemas) {
 // #region ValOps
 class ValOps {
   /** Sources from val modules, immutable (without patches or anything)  */
-
+  sources;
   /** The sha256 / hash of all sources + all schemas + config */
-
+  baseSha;
   /** The sha256 / hash of all sources */
-
+  sourcesSha;
   /** The sha256 / hash of config */
-
+  configSha;
   /** Schema from val modules, immutable  */
-
+  schemas;
   /** The sha256 / hash of schema + config - if this changes users needs to reload */
-
+  schemaSha;
+  modulesErrors;
   /**
    * What the SHAs above are a fold over, so they can be recomputed.
    *
@@ -2379,7 +2407,7 @@ class ValOps {
    * without re-evaluating the modules is a save, and it has to be able to move
    * the SHAs with them.
    */
-
+  shaEntries;
   /**
    * The extraction's OWN module errors, which are what the fold was given.
    *
@@ -2387,7 +2415,7 @@ class ValOps {
    * `.jsonValues()` errors concatenated on, and those were never part of the
    * hash. Re-folding with the wrong list changes the base SHA for no reason.
    */
-
+  shaModuleErrors;
   /**
    * What a save has told us each `.jsonValues()` entry now holds.
    *
@@ -3147,7 +3175,8 @@ class ValOps {
     // (must include all modules, not just those being validated, since conflicts can come from any module)
     const galleryDirectoryToModules = new Map();
     // Build a schema/source snapshot so the shared resolver can cross-reference
-    // keyof:check-keys and router:check-route against every module's data.
+    // the marker fixes — a keyOf's key, a route, a locale tag, a record's
+    // declared keys — against every module's data. See `SCHEMA_SOURCE_FIXES`.
     const snapshot = {
       schemas: {},
       sources: {}
@@ -3227,7 +3256,7 @@ class ValOps {
         };
         if (validationErrors) {
           for (const validationError of validationErrors) {
-            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6, _validationError$fixe7, _validationError$fixe8;
+            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6;
             if (isOnlyFileCheckValidationError(validationError)) {
               if (files[sourcePath]) {
                 addError({
@@ -3241,13 +3270,13 @@ class ValOps {
               }
             } else if ((_validationError$fixe = validationError.fixes) !== null && _validationError$fixe !== void 0 && _validationError$fixe.includes("image:check-remote") || (_validationError$fixe2 = validationError.fixes) !== null && _validationError$fixe2 !== void 0 && _validationError$fixe2.includes("file:check-remote")) {
               remoteFiles[sourcePath] = validationError.value;
-            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("keyof:check-keys") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("router:check-route")) {
+            } else if (internal.isSchemaSourceFixError(validationError)) {
               const resolved = internal.resolveSchemaSourceFixForError(validationError, snapshot);
               if (resolved && resolved.status === "remaining") {
                 addError(resolved.error);
               }
               // resolved.status === "resolved" → drop silently
-            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-unique-folder") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-unique-folder")) {
+            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("images:check-unique-folder") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("files:check-unique-folder")) {
               const TYPE_ERROR_MESSAGE = `This is most likely a Val version mismatch or Val bug.`;
               if (!validationError.value || typeof validationError.value !== "object") {
                 addError({
@@ -3272,7 +3301,7 @@ class ValOps {
                   // If conflictingModules is empty, directory is unique — silently drop the error.
                 }
               }
-            } else if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.includes("images:check-all-files") || (_validationError$fixe8 = validationError.fixes) !== null && _validationError$fixe8 !== void 0 && _validationError$fixe8.includes("files:check-all-files")) ; else {
+            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-all-files") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-all-files")) ; else {
               addError(validationError);
             }
           }
@@ -4132,8 +4161,8 @@ class ValOps {
   // #endregion history
 }
 function isOnlyFileCheckValidationError(validationError) {
-  var _validationError$fixe9;
-  if ((_validationError$fixe9 = validationError.fixes) !== null && _validationError$fixe9 !== void 0 && _validationError$fixe9.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
+  var _validationError$fixe7;
+  if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
     return true;
   }
   return false;
@@ -5654,6 +5683,7 @@ function serializeSchemaSafely(schema) {
 }
 class ValOpsFS extends ValOps {
   static VAL_DIR = ".val";
+  host;
   constructor(contentUrl, rootDir, valModules, options) {
     super(valModules, options);
     this.contentUrl = contentUrl;
@@ -5666,6 +5696,7 @@ class ValOpsFS extends ValOps {
    * Change detection for `.jsonValues()` entry files, which no sha can see (their
    * content lives behind a thunk that `JSON.stringify` drops).
    */
+  jsonEntryFilesFingerprint;
 
   /**
    * Unpublished changes repair threw away, waiting to be told to somebody.
@@ -7015,7 +7046,11 @@ const GetApplicablePatches = z.z.object({
     commitSha: z.z.string(),
     deploymentState: z.z.string(),
     createdAt: z.z.string(),
-    updatedAt: z.z.string()
+    updatedAt: z.z.string(),
+    // The git message, where the content service knows it. See
+    // `ValDeployment`: this is the only source for a deployment that Val
+    // did not publish, and zod would otherwise strip it here.
+    commitMessage: z.z.string().nullable().optional()
   })).optional()
 });
 const FilesResponse = z.z.object({
@@ -7191,6 +7226,8 @@ const NonceResponse = z.z.object({
  */
 const PATCH_GROUPS_CACHE_MS = 1000;
 class ValOpsHttp extends ValOps {
+  authHeaders;
+  root;
   constructor(contentUrl, project, commitSha,
   // TODO: CommitSha
   branch,
@@ -7616,7 +7653,8 @@ class ValOpsHttp extends ValOps {
                 deploymentId: deployment.deploymentId,
                 deploymentState: deployment.deploymentState,
                 createdAt: deployment.createdAt,
-                updatedAt: deployment.updatedAt
+                updatedAt: deployment.updatedAt,
+                commitMessage: deployment.commitMessage
               });
             }
           }
@@ -13545,6 +13583,8 @@ const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
 const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
 
 class ValModuleLoader {
+  cache;
+  cacheSize;
   constructor(projectRoot, compilerOptions,
   // TODO: remove this?
   sourceFileHandler, host = {
@@ -15224,9 +15264,10 @@ async function handleExternalUpload() {
   };
 }
 
-// Fix handler registry. `keyof:check-keys` and `router:check-route` are
-// resolved upfront by the shared resolveSchemaSourceFixes — they never reach
-// this registry, so they're excluded from the key set.
+// Fix handler registry. `keyof:check-keys`, `router:check-route`,
+// `locale:check-locale` and `record:fill-keys` are resolved upfront by the
+// shared resolveSchemaSourceFixes — they never reach this registry, so they're
+// excluded from the key set.
 const currentFixHandlers = {
   "image:check-metadata": handleFileMetadata,
   "image:add-metadata": handleFileMetadata,
@@ -15386,7 +15427,7 @@ async function evalValConfigFile(projectRoot, configFileName) {
     },
     fileName: valConfigPath
   });
-  const projectRootRequire = node_module.createRequire(valConfigPath);
+  const projectRootRequire = createNodeRequire(valConfigPath);
   const exportsObj = {};
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const sandbox = {

package/dist/valbuild-server.esm.js

@@ -7,8 +7,8 @@ import * as path from 'path';
 import path__default from 'path';
 import fs, { promises } from 'fs';
 import vm from 'node:vm';
-import { Module, createRequire } from 'node:module';
-import { resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, JSONValue, PatchGroup, newestCommitSha, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, Api } from '@valbuild/shared/internal';
+import { Module } from 'node:module';
+import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, JSONValue, PatchGroup, newestCommitSha, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, Api } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
 import crypto$1 from 'crypto';
 import z$1, { z } from 'zod';
@@ -662,6 +662,32 @@ const getCompilerOptions = (rootDir, parseConfigHost) => {
   return parsedConfigFile.options;
 };
 
+/**
+ * Node's `require`, resolving as if from `filename`.
+ *
+ * Use this instead of importing `createRequire` from `node:module` directly.
+ * webpack special-cases a `createRequire` binding imported from `module` /
+ * `node:module`: it tries to resolve the call's argument at build time, and
+ * when the argument is not a literal it gives up with
+ *
+ *     module.createRequire failed parsing argument.
+ *
+ * Our argument is never a literal — it is a path inside the user's project,
+ * known only at runtime — so there is nothing for that analysis to find, and
+ * nothing the warning can tell anyone. It is emitted on every build of every
+ * Next app that bundles `@valbuild/server` into its Val API route, which is
+ * all of them. Reaching `createRequire` through the `Module` class is the same
+ * function and is not what webpack tags, so the call is invisible to it.
+ *
+ * It has to stay a real `node:module` import: jest's module registry hands out
+ * its own `node:module`, and a `require` obtained around it (via
+ * `process.getBuiltinModule`, say) would resolve against the real filesystem
+ * rather than the registry the tests run in.
+ */
+function createNodeRequire(filename) {
+  return Module.createRequire(filename);
+}
+
 /**
  * The filesystem seam `loadValModules` reads through.
  *
@@ -795,7 +821,7 @@ function loadModule(absPath, cache, compilerOptions, host) {
   // Insert into the cache before evaluating so cyclic imports resolve.
   cache[absPath] = moduleObj;
   const dirName = path__default.dirname(absPath);
-  const realRequire = Module.createRequire(absPath);
+  const realRequire = createNodeRequire(absPath);
   const customRequire = spec => {
     var _ts$resolveModuleName;
     if (isStubbedSpecifier(spec)) {
@@ -1102,7 +1128,7 @@ function findNestedJsonValuesRecords(schema, path = []) {
       case "array":
         rec(current.item, currentPath.concat("*"));
         return;
-      case "union":
+      case "discriminated-union":
         for (let i = 0; i < current.items.length; i++) {
           rec(current.items[i], currentPath.concat(`union[${i}]`));
         }
@@ -1688,6 +1714,7 @@ async function createService(projectRoot, host = {
   return new Service(projectRoot, sourceFileHandler, extracted);
 }
 class Service {
+  projectRoot;
   constructor(projectRoot, sourceFileHandler, extracted) {
     this.sourceFileHandler = sourceFileHandler;
     this.extracted = extracted;
@@ -2327,17 +2354,18 @@ function findNestedJsonValuesModuleErrors(schemas) {
 // #region ValOps
 class ValOps {
   /** Sources from val modules, immutable (without patches or anything)  */
-
+  sources;
   /** The sha256 / hash of all sources + all schemas + config */
-
+  baseSha;
   /** The sha256 / hash of all sources */
-
+  sourcesSha;
   /** The sha256 / hash of config */
-
+  configSha;
   /** Schema from val modules, immutable  */
-
+  schemas;
   /** The sha256 / hash of schema + config - if this changes users needs to reload */
-
+  schemaSha;
+  modulesErrors;
   /**
    * What the SHAs above are a fold over, so they can be recomputed.
    *
@@ -2345,7 +2373,7 @@ class ValOps {
    * without re-evaluating the modules is a save, and it has to be able to move
    * the SHAs with them.
    */
-
+  shaEntries;
   /**
    * The extraction's OWN module errors, which are what the fold was given.
    *
@@ -2353,7 +2381,7 @@ class ValOps {
    * `.jsonValues()` errors concatenated on, and those were never part of the
    * hash. Re-folding with the wrong list changes the base SHA for no reason.
    */
-
+  shaModuleErrors;
   /**
    * What a save has told us each `.jsonValues()` entry now holds.
    *
@@ -3113,7 +3141,8 @@ class ValOps {
     // (must include all modules, not just those being validated, since conflicts can come from any module)
     const galleryDirectoryToModules = new Map();
     // Build a schema/source snapshot so the shared resolver can cross-reference
-    // keyof:check-keys and router:check-route against every module's data.
+    // the marker fixes — a keyOf's key, a route, a locale tag, a record's
+    // declared keys — against every module's data. See `SCHEMA_SOURCE_FIXES`.
     const snapshot = {
       schemas: {},
       sources: {}
@@ -3193,7 +3222,7 @@ class ValOps {
         };
         if (validationErrors) {
           for (const validationError of validationErrors) {
-            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6, _validationError$fixe7, _validationError$fixe8;
+            var _validationError$fixe, _validationError$fixe2, _validationError$fixe3, _validationError$fixe4, _validationError$fixe5, _validationError$fixe6;
             if (isOnlyFileCheckValidationError(validationError)) {
               if (files[sourcePath]) {
                 addError({
@@ -3207,13 +3236,13 @@ class ValOps {
               }
             } else if ((_validationError$fixe = validationError.fixes) !== null && _validationError$fixe !== void 0 && _validationError$fixe.includes("image:check-remote") || (_validationError$fixe2 = validationError.fixes) !== null && _validationError$fixe2 !== void 0 && _validationError$fixe2.includes("file:check-remote")) {
               remoteFiles[sourcePath] = validationError.value;
-            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("keyof:check-keys") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("router:check-route")) {
+            } else if (isSchemaSourceFixError(validationError)) {
               const resolved = resolveSchemaSourceFixForError(validationError, snapshot);
               if (resolved && resolved.status === "remaining") {
                 addError(resolved.error);
               }
               // resolved.status === "resolved" → drop silently
-            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-unique-folder") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-unique-folder")) {
+            } else if ((_validationError$fixe3 = validationError.fixes) !== null && _validationError$fixe3 !== void 0 && _validationError$fixe3.includes("images:check-unique-folder") || (_validationError$fixe4 = validationError.fixes) !== null && _validationError$fixe4 !== void 0 && _validationError$fixe4.includes("files:check-unique-folder")) {
               const TYPE_ERROR_MESSAGE = `This is most likely a Val version mismatch or Val bug.`;
               if (!validationError.value || typeof validationError.value !== "object") {
                 addError({
@@ -3238,7 +3267,7 @@ class ValOps {
                   // If conflictingModules is empty, directory is unique — silently drop the error.
                 }
               }
-            } else if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.includes("images:check-all-files") || (_validationError$fixe8 = validationError.fixes) !== null && _validationError$fixe8 !== void 0 && _validationError$fixe8.includes("files:check-all-files")) ; else {
+            } else if ((_validationError$fixe5 = validationError.fixes) !== null && _validationError$fixe5 !== void 0 && _validationError$fixe5.includes("images:check-all-files") || (_validationError$fixe6 = validationError.fixes) !== null && _validationError$fixe6 !== void 0 && _validationError$fixe6.includes("files:check-all-files")) ; else {
               addError(validationError);
             }
           }
@@ -4098,8 +4127,8 @@ class ValOps {
   // #endregion history
 }
 function isOnlyFileCheckValidationError(validationError) {
-  var _validationError$fixe9;
-  if ((_validationError$fixe9 = validationError.fixes) !== null && _validationError$fixe9 !== void 0 && _validationError$fixe9.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
+  var _validationError$fixe7;
+  if ((_validationError$fixe7 = validationError.fixes) !== null && _validationError$fixe7 !== void 0 && _validationError$fixe7.every(f => f === "file:check-metadata" || f === "image:check-metadata")) {
     return true;
   }
   return false;
@@ -5620,6 +5649,7 @@ function serializeSchemaSafely(schema) {
 }
 class ValOpsFS extends ValOps {
   static VAL_DIR = ".val";
+  host;
   constructor(contentUrl, rootDir, valModules, options) {
     super(valModules, options);
     this.contentUrl = contentUrl;
@@ -5632,6 +5662,7 @@ class ValOpsFS extends ValOps {
    * Change detection for `.jsonValues()` entry files, which no sha can see (their
    * content lives behind a thunk that `JSON.stringify` drops).
    */
+  jsonEntryFilesFingerprint;
 
   /**
    * Unpublished changes repair threw away, waiting to be told to somebody.
@@ -6981,7 +7012,11 @@ const GetApplicablePatches = z.object({
     commitSha: z.string(),
     deploymentState: z.string(),
     createdAt: z.string(),
-    updatedAt: z.string()
+    updatedAt: z.string(),
+    // The git message, where the content service knows it. See
+    // `ValDeployment`: this is the only source for a deployment that Val
+    // did not publish, and zod would otherwise strip it here.
+    commitMessage: z.string().nullable().optional()
   })).optional()
 });
 const FilesResponse = z.object({
@@ -7157,6 +7192,8 @@ const NonceResponse = z.object({
  */
 const PATCH_GROUPS_CACHE_MS = 1000;
 class ValOpsHttp extends ValOps {
+  authHeaders;
+  root;
   constructor(contentUrl, project, commitSha,
   // TODO: CommitSha
   branch,
@@ -7582,7 +7619,8 @@ class ValOpsHttp extends ValOps {
                 deploymentId: deployment.deploymentId,
                 deploymentState: deployment.deploymentState,
                 createdAt: deployment.createdAt,
-                updatedAt: deployment.updatedAt
+                updatedAt: deployment.updatedAt,
+                commitMessage: deployment.commitMessage
               });
             }
           }
@@ -13511,6 +13549,8 @@ const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
 const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
 
 class ValModuleLoader {
+  cache;
+  cacheSize;
   constructor(projectRoot, compilerOptions,
   // TODO: remove this?
   sourceFileHandler, host = {
@@ -15190,9 +15230,10 @@ async function handleExternalUpload() {
   };
 }
 
-// Fix handler registry. `keyof:check-keys` and `router:check-route` are
-// resolved upfront by the shared resolveSchemaSourceFixes — they never reach
-// this registry, so they're excluded from the key set.
+// Fix handler registry. `keyof:check-keys`, `router:check-route`,
+// `locale:check-locale` and `record:fill-keys` are resolved upfront by the
+// shared resolveSchemaSourceFixes — they never reach this registry, so they're
+// excluded from the key set.
 const currentFixHandlers = {
   "image:check-metadata": handleFileMetadata,
   "image:add-metadata": handleFileMetadata,
@@ -15352,7 +15393,7 @@ async function evalValConfigFile(projectRoot, configFileName) {
     },
     fileName: valConfigPath
   });
-  const projectRootRequire = createRequire(valConfigPath);
+  const projectRootRequire = createNodeRequire(valConfigPath);
   const exportsObj = {};
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const sandbox = {

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.125.0",
+  "version": "0.127.0",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0"
@@ -29,9 +29,9 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.125.0",
-    "@valbuild/shared": "0.125.0",
-    "@valbuild/ui": "0.125.0"
+    "@valbuild/shared": "0.127.0",
+    "@valbuild/ui": "0.127.0",
+    "@valbuild/core": "0.127.0"
   },
   "engines": {
     "node": "^20.19.0 || >=22"