@valbuild/server 0.135.0 → 0.136.1

package/dist/valbuild-server.esm.js

@@ -973,18 +973,29 @@ function createValModuleFileInspector(projectRoot, host = ts.sys) {
 }
 
 /**
- * Whether the file exports a RUNTIME value as `default`, without evaluating it.
+ * The statement that exports a RUNTIME value as `default`, without evaluating
+ * it — or `undefined` when the file has no such export.
+ *
+ * This is the one rule that separates a Val module from a `*.val.ts` that
+ * merely wears the naming convention: a shared schema or helper is exported by
+ * name, a module is exported by default. Every caller that needs to tell those
+ * apart goes through this — `val validate` to decide whether an unregistered
+ * file is worth reporting, and the language server to decide the same thing and
+ * to put its diagnostic on the export rather than on line 1.
  *
  * Two things deliberately do not count, because neither exists once the file is
  * transpiled — and treating either as a default export would send a pure helper
  * off to be evaluated and reported:
  *
  *  - `export * from "./x"`, since a star re-export never carries the default;
- *  - a type-only export, in either of its spellings
- *    (`export type { T as default }` and `export { type T as default }`).
+ *  - a type-only export, in any of its three spellings
+ *    (`export type { T as default }`, `export { type T as default }` and
+ *    `export default interface T {}` — the last one parses as a declaration
+ *    carrying a `default` modifier, exactly like `export default class`, and is
+ *    the one that looks like a runtime export and is not).
  */
-function hasDefaultExport(sourceFile) {
-  return sourceFile.statements.some(statement => {
+function findDefaultExport(sourceFile) {
+  return sourceFile.statements.find(statement => {
     // `export default <expr>` — but not `export = x`, which shares this node.
     if (ts.isExportAssignment(statement)) {
       return !statement.isExportEquals;
@@ -995,10 +1006,17 @@ function hasDefaultExport(sourceFile) {
     }
     // `export default function f() {}` / `export default class C {}`, which are
     // declarations carrying a `default` modifier rather than export assignments.
-    return ts.canHaveModifiers(statement) && (ts.getModifiers(statement) ?? []).some(modifier => modifier.kind === ts.SyntaxKind.DefaultKeyword);
+    // `export default interface T {}` is spelled the same way and is a type, so
+    // it is excluded here rather than by the `isTypeOnly` checks above.
+    return !ts.isInterfaceDeclaration(statement) && ts.canHaveModifiers(statement) && (ts.getModifiers(statement) ?? []).some(modifier => modifier.kind === ts.SyntaxKind.DefaultKeyword);
   });
 }
 
+/** Whether the file exports a runtime value as `default`. */
+function hasDefaultExport(sourceFile) {
+  return findDefaultExport(sourceFile) !== undefined;
+}
+
 /** A short, human-readable "what you exported instead" for the error message. */
 function describeDefaultExport(value) {
   if (value === null) {
@@ -4524,6 +4542,52 @@ class ValOps {
     return null;
   }
 
+  /**
+   * How this project's SOURCE is kept, or `null` when it is nobody's question.
+   *
+   * `"managed"` -- the content service is the store of record, there is no
+   * repository, and nothing outside the browser will ever pick a commit up.
+   * `"connected"` -- commits are mirrored into a repository a host watches.
+   *
+   * `null` is the honest answer for `fs` and memory mode, where publishing is
+   * writing to disk and there is no project to have a mode, and for an `http`
+   * project whose content service predates the field. The Studio treats it as
+   * "the story I have always told", which is the connected one -- the feed, and
+   * a `building` state that something outside resolves. Guessing `managed`
+   * instead would take the deploy feed away from every project running against
+   * an older service.
+   */
+  sourceMode() {
+    return null;
+  }
+
+  /**
+   * Forward one call to the content service's publish API, as this project.
+   *
+   * The Studio builds a managed project in the tab and then has to publish what
+   * it built -- but a browser cannot talk to content directly. It holds a
+   * session cookie for THIS origin and no credential content would accept, so
+   * the conversation goes through here, exactly as patches already do.
+   *
+   * Refused by default, and that is the honest answer rather than a gap: `fs`
+   * and memory mode have no content service to forward to, and publishing there
+   * is writing to disk.
+   *
+   * The path is content's, minus the `/v1` prefix -- `/publish`,
+   * `/publish/{id}/artifacts`, `/build-target`. The ALLOW LIST lives in the
+   * implementation rather than here, because it is what keeps this from being
+   * a way to reach the rest of content with the project's credential.
+   */
+  async publishApi(_path, _init) {
+    return {
+      status: 501,
+      contentType: "application/json",
+      body: JSON.stringify({
+        message: "This Val server has no content service to publish through. " + "Publishing from the browser is for a project whose content is " + "served over HTTP."
+      })
+    };
+  }
+
   /**
    * Whether a commit here produces `.val.ts` TEXT as well as data.
    *
@@ -7883,6 +7947,202 @@ class ValOpsHttp extends ValOps {
       message: `This project mirrors its content into a git repository (branch ` + `'${this.projectExpectation.branch}'), but this deployment was not ` + "built from one, so it does not know which commit to write that " + "mirror against. Publishing would save the content and silently " + "leave the repository behind. Deploy this project again from its " + "repository, and publishing will work from that build on."
     };
   }
+
+  /**
+   * What the content service last said this project's source mode is.
+   *
+   * Read off the same remembered expectation {@link publishRefusal} uses. It is
+   * CURRENT wherever it matters rather than a poll behind, and by construction
+   * rather than by luck: the only caller is `/stat`, which awaits `getStat`
+   * first, and that fetches the patches -- which is the response the expectation
+   * is recorded from.
+   *
+   * `null` before anything has fetched patches, which is the same "not
+   * reported" the wire field means, and reads as connected. The alternative
+   * would be to ask for it separately, which is a round trip for a field that
+   * has just arrived.
+   */
+  sourceMode() {
+    var _this$projectExpectat2;
+    return ((_this$projectExpectat2 = this.projectExpectation) === null || _this$projectExpectat2 === void 0 ? void 0 : _this$projectExpectat2.sourceMode) ?? null;
+  }
+
+  /**
+   * The short-lived publish token, and when it stops being usable.
+   *
+   * `null` until something publishes, which for most deployments is never.
+   */
+  publishToken = null;
+
+  /**
+   * Trade this deployment's credential for one that can do one thing.
+   *
+   * Content's publish API takes a PROJECT TOKEN and nothing else --
+   * `authenticateProjectToken` refuses anything that is not one, deliberately,
+   * because a personal access token is a person's credential and does not name
+   * a project. What this deployment holds is the project's api key, which is
+   * neither.
+   *
+   * `POST /v1/{org}/{project}/publish-token` is the exchange, and it was built
+   * for exactly this: its own docblock names the case where "the caller was the
+   * project's api key ... a machine exchanging one machine credential for a
+   * narrower one". What comes back can publish one project for ten minutes.
+   *
+   * So the api key never leaves this process and the browser never sees any
+   * credential at all. That is the point of routing the publish through here
+   * rather than letting the tab talk to content.
+   */
+  async mintPublishToken() {
+    const res = await fetch(`${this.contentUrl}/v1/${this.project}/publish-token`, {
+      method: "POST",
+      headers: this.authHeaders
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      return {
+        status: res.status,
+        error: `Could not get a publish token for '${this.project}': ` + `${res.status} ${text.slice(0, 300)}`
+      };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return {
+        status: 502,
+        error: "The publish token exchange did not answer with JSON."
+      };
+    }
+    const token = typeof parsed === "object" && parsed !== null && "token" in parsed && typeof parsed.token === "string" ? parsed.token : null;
+    if (token === null) {
+      return {
+        status: 502,
+        error: "The publish token exchange sent no token."
+      };
+    }
+    const expiresAtRaw = typeof parsed === "object" && parsed !== null && "expiresAt" in parsed ? parsed.expiresAt : null;
+    const expiresAt = typeof expiresAtRaw === "string" ? Date.parse(expiresAtRaw) : NaN;
+    return {
+      token,
+      /*
+       * A token with no expiry, or one we cannot read, is treated as expiring
+       * NOW -- so it is used for this call and minted again for the next.
+       * Caching one we cannot reason about is how a publish starts failing
+       * halfway through, days later, for no reason anyone can see.
+       */
+      expiresAt: Number.isFinite(expiresAt) ? expiresAt : 0
+    };
+  }
+
+  /**
+   * A usable publish token, minting one when what we have will not last.
+   *
+   * The margin is what stops a token that is valid when the publish starts from
+   * expiring in the middle of it: a publish is five calls and an upload of
+   * every artifact, and the upload is the slow one.
+   */
+  async currentPublishToken() {
+    const margin = 60_000;
+    if (this.publishToken !== null && this.publishToken.expiresAt - margin > Date.now()) {
+      return {
+        token: this.publishToken.token
+      };
+    }
+    const minted = await this.mintPublishToken();
+    if ("error" in minted) {
+      this.publishToken = null;
+      return minted;
+    }
+    this.publishToken = minted;
+    return {
+      token: minted.token
+    };
+  }
+
+  /**
+   * The content paths this may reach, and nothing else.
+   *
+   * An allow list rather than a prefix check, because this method holds a
+   * credential and the browser chooses the path. `/publish/{id}` and its three
+   * steps are the publish conversation; `/build-target` is what a build needs
+   * to know before it starts; `/project-source` is what it builds.
+   *
+   * `/project-source` is here rather than on a route of its own because it is
+   * one of the three things a publish asks for and none of them are useful
+   * apart -- and because the credential is the same one. The Studio cannot get
+   * the project's files any other way: it runs inside the deployment, which
+   * holds a session for its own origin and an api key for content, and content
+   * is the only thing it is allowed to talk to at all.
+   *
+   * A publish id is opaque and content-generated, so it is matched rather than
+   * parsed -- what matters is that nothing with a `..`, a query or another
+   * segment gets through.
+   */
+  static publishApiPathAllowed(path) {
+    if (path === "/build-target" || path === "/project-source" || path === "/publish") {
+      return true;
+    }
+    return /^\/publish\/[A-Za-z0-9_-]+(\/(artifacts|verify|promote))?$/.test(path);
+  }
+  async publishApi(path, init) {
+    const json = "application/json";
+    if (!ValOpsHttp.publishApiPathAllowed(path)) {
+      return {
+        status: 403,
+        contentType: json,
+        body: JSON.stringify({
+          message: `'${path}' is not part of the publish API.`
+        })
+      };
+    }
+    const send = async token => fetch(`${this.contentUrl}/v1${path}`, {
+      method: init.method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        ...(init.body === undefined ? {} : {
+          "Content-Type": json
+        })
+      },
+      ...(init.body === undefined ? {} : {
+        body: init.body
+      })
+    });
+    const credential = await this.currentPublishToken();
+    if ("error" in credential) {
+      return {
+        status: credential.status,
+        contentType: json,
+        body: JSON.stringify({
+          message: credential.error
+        })
+      };
+    }
+    let res = await send(credential.token);
+    if (res.status === 401) {
+      /*
+       * Revoked, or expired sooner than it said. One retry with a fresh token,
+       * because the alternative is a publish that fails for a reason the editor
+       * cannot act on and a retry that fails the same way.
+       */
+      this.publishToken = null;
+      const second = await this.currentPublishToken();
+      if ("error" in second) {
+        return {
+          status: second.status,
+          contentType: json,
+          body: JSON.stringify({
+            message: second.error
+          })
+        };
+      }
+      res = await send(second.token);
+    }
+    return {
+      status: res.status,
+      contentType: res.headers.get("content-type") ?? json,
+      body: await res.text()
+    };
+  }
   async onInit() {
     // TODO: unused for now. Implement or remove
   }
@@ -11441,6 +11701,38 @@ const ValServer = (valModules, options, callbacks) => {
       }
     };
   };
+
+  /**
+   * Hand one publish-API call to content and carry the answer back.
+   *
+   * `JSON.parse` and nothing more. That is not validation -- there is no schema
+   * here and no knowledge of content's shapes -- it is the round trip a JSON
+   * body has to make to travel as `json` rather than as a string. A body that
+   * does not parse is a gateway's error page rather than content answering, so
+   * it comes back as a message with the original status instead of throwing:
+   * a publish that failed is something the editor has to be told in words.
+   */
+  const proxyPublishApi = async (path, method, body) => {
+    const answer = await serverOps.publishApi(path ?? "", {
+      method,
+      ...(body === undefined ? {} : {
+        body
+      })
+    });
+    try {
+      return {
+        status: answer.status,
+        json: JSON.parse(answer.body)
+      };
+    } catch {
+      return {
+        status: answer.status,
+        json: {
+          message: answer.body.trim() === "" ? `The publish API answered ${answer.status} with no body.` : `The publish API answered ${answer.status}: ${answer.body.slice(0, 300)}`
+        }
+      };
+    }
+  };
   return {
     "/draft/enable": {
       GET: async req => {
@@ -11864,6 +12156,16 @@ const ValServer = (valModules, options, callbacks) => {
          * it failed to compute.
          */
         const publishRefusal = serverOps.publishRefusal();
+        /*
+         * How this project's source is kept, when the store knows.
+         *
+         * Spread for the same reason `publishRefusal` is: absent has to keep
+         * meaning "not reported" rather than becoming a mode. The Studio
+         * narrates a publish differently for a managed project -- there is
+         * nothing outside the browser to finish it -- so a wrong default here
+         * shows one story to a project that lives by the other.
+         */
+        const sourceMode = serverOps.sourceMode();
         return {
           status: 200,
           json: {
@@ -11873,11 +12175,55 @@ const ValServer = (valModules, options, callbacks) => {
             ...(publishRefusal ? {
               publishRefusal
             } : {}),
+            ...(sourceMode ? {
+              sourceMode
+            } : {}),
             config: options.config
           }
         };
       }
     },
+    /**
+     * The content service's publish API, reached through this deployment.
+     *
+     * The Studio builds a managed project in its own tab and then publishes
+     * what it built. It cannot talk to content directly -- it holds a session
+     * cookie for this origin and no credential content would accept -- so the
+     * whole conversation comes through here.
+     *
+     * Three things happen, and nothing else: the session is checked, the
+     * credential is swapped for a publish-scoped one (see
+     * `ValOpsHttp.publishApi`), and content's answer is carried back with its
+     * status intact. The Studio parses that answer with the same module
+     * `val publish` uses, so there is no copy of content's shapes here to
+     * fall out of step.
+     */
+    "/publish-api": {
+      GET: async req => {
+        const auth = getAuth(req.cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        return proxyPublishApi(req.path, "GET");
+      },
+      POST: async req => {
+        const auth = getAuth(req.cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        return proxyPublishApi(req.path, "POST", req.body === undefined ? undefined : JSON.stringify(req.body));
+      }
+    },
     "/upload/patches": {
       POST: async req => {
         if (serverOps instanceof ValOpsHttp) {
@@ -13435,7 +13781,15 @@ const ValServer = (valModules, options, callbacks) => {
             return {
               status: 200,
               json: {
-                commitSha: commitRes.commit
+                commitSha: commitRes.commit,
+                /*
+                 * For the Studio to BUILD, when it is the deployer. See
+                 * `sourceFiles` on the route: the build must contain the text
+                 * this commit wrote, and only this handler has it.
+                 */
+                ...(serverOps.sourceMode() === "managed" ? {
+                  sourceFiles: preparedCommit.patchedSourceFiles
+                } : {})
               }
             };
           }
@@ -17961,4 +18315,4 @@ function readCapturedReport(snapshotDir) {
   return JSON.parse(fs.readFileSync(reportPath, "utf-8"));
 }
 
-export { DEFAULT_LOGIN_EXPIRES_IN_SECONDS, DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_POLL_INTERVAL_SECONDS, EXTERNAL_RESULT, InMemoryPatchStore, Service, ValFSHost, ValLoginError, ValModuleLoader, ValOpsFS, ValOpsHttp, ValOpsMemory, ValSourceFileHandler, analyzeValModule, awaitValLoginConfirmation, checkRemoteRef, classifyJsonValuesOp, compareWithCapturedReport, createDefaultValFSHost, createFixPatch, createJsonEntryPathMap, createModulePathMap, createPrettierFormatter, createService, createValApiRouter, createValModuleFileInspector, createValOps, createValServer, currentFixHandlers, decodeJwtWithoutVerifying, defineExternal, describePatchStoreProblems, downloadFileFromRemote, encodeJwt, err, evalValConfigFile, extractFileMetadata, extractImageMetadata, extractJsonValuesEntry, findAndEvalValConfigFile, findJsonEntryFilePath, fixHandlers, formatPatchSourceError, formatSyntaxErrorTree, getCachedRemoteFileDir, getCachedRemoteFilePath, getCompilerOptions, getExpire, getFileExt, getModulePathRange, getPersonalAccessTokenPath, getSettings, getValidationErrorFileRef, handleCheckAllFiles, handleExternalUpload, handleFileMetadata, handleJsonValuesExtractEntry, handleRemoteFileCheck, handleRemoteFileDownload, handleRemoteFileUpload, handleRemoteGalleryFileUpload, handleUniqueFolderCheck, initHandlerOptions, isExternalResult, loadValModules, ok, parsePersonalAccessTokenFile, patchSourceFile, persistPersonalAccessToken, planJsonValuesEntryExtraction, readCapturedReport, readPatchStore, rebaseContentOp, replaySnapshot, resolveRemoteFileAuth, safeReadGit, startValLogin, uploadRemoteFile, validateMetadata, verifyJwt };
+export { DEFAULT_LOGIN_EXPIRES_IN_SECONDS, DEFAULT_LOGIN_HOST, DEFAULT_LOGIN_POLL_INTERVAL_SECONDS, EXTERNAL_RESULT, InMemoryPatchStore, Service, ValFSHost, ValLoginError, ValModuleLoader, ValOpsFS, ValOpsHttp, ValOpsMemory, ValSourceFileHandler, analyzeValModule, awaitValLoginConfirmation, checkRemoteRef, classifyJsonValuesOp, compareWithCapturedReport, createDefaultValFSHost, createFixPatch, createJsonEntryPathMap, createModulePathMap, createPrettierFormatter, createService, createValApiRouter, createValModuleFileInspector, createValOps, createValServer, currentFixHandlers, decodeJwtWithoutVerifying, defineExternal, describePatchStoreProblems, downloadFileFromRemote, encodeJwt, err, evalValConfigFile, extractFileMetadata, extractImageMetadata, extractJsonValuesEntry, findAndEvalValConfigFile, findDefaultExport, findJsonEntryFilePath, fixHandlers, formatPatchSourceError, formatSyntaxErrorTree, getCachedRemoteFileDir, getCachedRemoteFilePath, getCompilerOptions, getExpire, getFileExt, getModulePathRange, getPersonalAccessTokenPath, getSettings, getValidationErrorFileRef, handleCheckAllFiles, handleExternalUpload, handleFileMetadata, handleJsonValuesExtractEntry, handleRemoteFileCheck, handleRemoteFileDownload, handleRemoteFileUpload, handleRemoteGalleryFileUpload, handleUniqueFolderCheck, initHandlerOptions, isExternalResult, loadValModules, ok, parsePersonalAccessTokenFile, patchSourceFile, persistPersonalAccessToken, planJsonValuesEntryExtraction, readCapturedReport, readPatchStore, rebaseContentOp, replaySnapshot, resolveRemoteFileAuth, safeReadGit, startValLogin, uploadRemoteFile, validateMetadata, verifyJwt };

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.135.0",
+  "version": "0.136.1",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -30,9 +30,9 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.134.0",
-    "@valbuild/shared": "0.134.1",
-    "@valbuild/ui": "0.134.0"
+    "@valbuild/core": "0.136.1",
+    "@valbuild/shared": "0.136.1",
+    "@valbuild/ui": "0.136.1"
   },
   "engines": {
     "node": "^20.19.0 || >=22"