@valbuild/server 0.139.1 → 0.140.0

package/dist/valbuild-server.cjs.dev.js

@@ -1488,17 +1488,22 @@ function applyJsonValuesEntryPatches(args) {
     serializedSchema,
     entryKey,
     baseContent,
-    patches
+    patches,
+    baseContentOf,
+    stopBefore
   } = args;
   let content = baseContent;
   let deleted = false;
   const appliedPatchIds = [];
-  for (const {
+  replay: for (const [patchIndex, {
     patchId,
     patch: patch$1
-  } of patches) {
+  }] of patches.entries()) {
     let touched = false;
-    for (const rawOp of patch$1) {
+    for (const [opIndex, rawOp] of patch$1.entries()) {
+      if (stopBefore && (patchIndex > stopBefore.patch || patchIndex === stopBefore.patch && opIndex >= stopBefore.op)) {
+        break replay;
+      }
       /**
        * A write of the WHOLE record becomes what it says about THIS entry.
        *
@@ -1523,6 +1528,13 @@ function applyJsonValuesEntryPatches(args) {
         const cls = serializedSchema ? classifyJsonValuesOp(serializedSchema, op.path) : {
           kind: "normal"
         };
+        if (op.op === "move" && wholeEntryKey(serializedSchema, op.from) === entryKey && wholeEntryKey(serializedSchema, op.path) !== entryKey) {
+          // Moved AWAY: under its old key, the entry is gone.
+          touched = true;
+          content = undefined;
+          deleted = true;
+          continue;
+        }
         if (cls.kind !== "entry" || cls.recordPath.length > 0 || cls.entryKey !== entryKey) {
           continue;
         }
@@ -1568,7 +1580,30 @@ function applyJsonValuesEntryPatches(args) {
             continue;
           } else {
             // move/copy INTO this key: the content comes from the source entry,
-            // which the caller must resolve (it is a different `*.val.json`).
+            // as it stood at this op (it is a different `*.val.json`).
+            const fromKey = wholeEntryKey(serializedSchema, op.from);
+            const fromBase = fromKey === undefined ? undefined : baseContentOf === null || baseContentOf === void 0 ? void 0 : baseContentOf(fromKey);
+            if (fromKey !== undefined && fromBase !== undefined) {
+              const source = applyJsonValuesEntryPatches({
+                serializedSchema,
+                entryKey: fromKey,
+                baseContent: fromBase.content,
+                patches,
+                baseContentOf,
+                stopBefore: {
+                  patch: patchIndex,
+                  op: opIndex
+                }
+              });
+              if (source.kind === "error") {
+                return source;
+              }
+              if (source.kind === "content") {
+                content = patch.deepClone(source.content);
+                deleted = false;
+                continue;
+              }
+            }
             return {
               kind: "error",
               message: `Cannot resolve '${op.op}' of jsonValues entry '${entryKey}' from its own content`,
@@ -1620,6 +1655,18 @@ function applyJsonValuesEntryPatches(args) {
   };
 }
 
+/**
+ * The entry a path names when it names a WHOLE entry of the root
+ * `.jsonValues()` record, and `undefined` for anything else.
+ */
+function wholeEntryKey(serializedSchema, path) {
+  if (!serializedSchema) {
+    return undefined;
+  }
+  const cls = classifyJsonValuesOp(serializedSchema, path);
+  return cls.kind === "entry" && cls.recordPath.length === 0 && cls.subPath.length === 0 ? cls.entryKey : undefined;
+}
+
 /**
  * Resolves an EXISTING entry's `*.val.json` path (relative to rootDir) from the
  * `import(...)` path recorded in the `.val.ts` thunk (from
@@ -2845,7 +2892,7 @@ function v4Of(high, low) {
  * each other by the API route's zod schema, which is the only place they meet.
  */
 
-const DEFAULT_TIMEOUT_MS$1 = 5000;
+const DEFAULT_TIMEOUT_MS$2 = 5000;
 const DEFAULT_MAX_REDIRECTS = 5;
 
 /**
@@ -2943,7 +2990,7 @@ function needsGetFallback(code) {
   return code === 405 || code === 501;
 }
 async function probeUrl(rawUrl, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$2;
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   const now = options.now ?? (() => Date.now());
   const started = now();
@@ -3591,7 +3638,7 @@ class ValOps {
           message: `Could not fetch patches: ${JSON.stringify(patchOps.errors)}`
         };
       }
-      modulePatches = scopedModulePatches(patchOps.patches, moduleFilePath, opts === null || opts === void 0 ? void 0 : opts.patchIds).map(p => ({
+      modulePatches = scopedModulePatches(patchOps.patches, moduleFilePath, opts === null || opts === void 0 ? void 0 : opts.patchIds, patchOps.commits).map(p => ({
         patchId: p.patchId,
         patch: p.patch
       }));
@@ -3605,7 +3652,25 @@ class ValOps {
     const entries = [];
     const missing = [];
     const errors = [];
-    const resolved = await Promise.all(requestedKeys.map(async entryKey => {
+    /*
+     * The entries a whole-entry `move` or `copy` reads from. A renamed or
+     * duplicated entry's content is theirs, so they are loaded beside the
+     * ones asked for, and not reported.
+     */
+    const sourceKeys = new Set();
+    for (const {
+      patch
+    } of modulePatches) {
+      for (const op of patch) {
+        if (op.op === "move" || op.op === "copy") {
+          const fromKey = wholeEntryKey(serializedSchema, op.from);
+          if (fromKey !== undefined && !requestedKeys.includes(fromKey)) {
+            sourceKeys.add(fromKey);
+          }
+        }
+      }
+    }
+    const loaded = await Promise.all([...requestedKeys, ...sourceKeys].map(async entryKey => {
       const marker = record[entryKey];
       if (marker !== undefined && !core.Internal.isJson(marker)) {
         // Not a jsonValues entry — return the inlined value as-is (defensive).
@@ -3667,6 +3732,15 @@ class ValOps {
         };
       }
     }));
+    const resolved = loaded.slice(0, requestedKeys.length);
+    const bases = new Map();
+    for (const entry of loaded) {
+      if (!("message" in entry) && !("inline" in entry)) {
+        bases.set(entry.entryKey, {
+          content: entry.baseContent
+        });
+      }
+    }
     for (const result of resolved) {
       const {
         entryKey
@@ -3696,7 +3770,8 @@ class ValOps {
         serializedSchema,
         entryKey,
         baseContent,
-        patches: modulePatches
+        patches: modulePatches,
+        baseContentOf: key => bases.get(key)
       });
       if (res.kind === "error") {
         errors.push({
@@ -5429,8 +5504,10 @@ function formatPatchSourceError(error) {
  * 1. this module's, since the chain is branch-wide;
  * 2. this caller's, when they asked to be scoped. `undefined` is "everything",
  *    which is what every unscoped caller gets and must keep getting;
- * 3. not already applied — a fact about this path rather than about scoping,
- *    and true with or without a scope.
+ * 3. a patch published after this build is kept whatever the scope: it is
+ *    nobody's to hold back, and this build does not have it. One already in
+ *    the build is dropped. `draftOverlay` decides which is which, from
+ *    `commits`.
  *
  * Filtered here rather than by asking `fetchPatches` for a list, and that is
  * load-bearing: both implementations read an empty `patchIds` as "no filter"
@@ -5440,9 +5517,52 @@ function formatPatchSourceError(error) {
  * instead of base. It costs no round trip either: the whole chain is what the
  * unscoped path fetches anyway.
  */
-function scopedModulePatches(patches, moduleFilePath, patchIds) {
+function scopedModulePatches(patches, moduleFilePath, patchIds, /** The commits content says came after this build: see `draftOverlay`. */
+commits) {
   const scope = patchIds && new Set(patchIds);
-  return patches.filter(patch => patch.path === moduleFilePath && !patch.appliedAt && (scope === undefined || scope.has(patch.patchId)));
+  return draftOverlay(patches.filter(patch => patch.path === moduleFilePath && (patch.appliedAt !== null || scope === undefined || scope.has(patch.patchId))), commits);
+}
+
+/**
+ * The patches a DRAFT applies on top of this build's own source: the pending
+ * ones, and the ones published AFTER this build, in chain order -- with
+ * `appliedAt` cleared on the latter, because this build has none of them.
+ *
+ * Content places every caller at its own build (`getApplicablePatchesAndCommits`
+ * in valbuild/home: "the earliest the caller has not seen") and returns the
+ * commits after it as `commits`. A patch applied at one of those was
+ * published after this build and is not in it, so a draft has to apply it --
+ * skipping it showed the build's old value from the publish until the next
+ * build went live. `/sources/~` already applies them (`getSources` walks every
+ * patch it is given); the `.jsonValues()` entry path skipped them.
+ *
+ * A patch applied at a commit NOT in that list is already in this build --
+ * content returns one only because it was asked for by id -- and is dropped:
+ * applying it again would apply it twice. Without `commits` (a store that
+ * does not report them) every applied patch is dropped, as before. Only
+ * `ValOpsHttp` ever reports `appliedAt`; `fs` and memory stores report `null`.
+ *
+ * Chain order, not published-first, because that is the order the Studio
+ * applies them in, and a draft page starts from the server's answer and is
+ * then kept up to date by the Studio's: the two must agree.
+ *
+ * For the reads that render a draft only. What to COMMIT still keys on
+ * `appliedAt`: a published patch must never be published again.
+ */
+function draftOverlay(patches, commits) {
+  const afterThisBuild = new Set((commits ?? []).map(commit => commit.commitSha));
+  const overlay = [];
+  for (const patch of patches) {
+    if (patch.appliedAt === null) {
+      overlay.push(patch);
+    } else if (afterThisBuild.has(patch.appliedAt.commitSha)) {
+      overlay.push({
+        ...patch,
+        appliedAt: null
+      });
+    }
+  }
+  return overlay;
 }
 function getFieldsForType(type) {
   if (type === "file") {
@@ -6579,7 +6699,7 @@ function describeLogProblem(problem) {
  */
 
 const PATCH_LOCK_FILE_NAME = "patches.lock";
-const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_TIMEOUT_MS$1 = 10_000;
 const DEFAULT_POLL_MS = 25;
 
 /**
@@ -6698,7 +6818,7 @@ function tryCreate(lockFilePath, info) {
 }
 async function acquirePatchLock(lockFilePath, options) {
   const now = options.now ?? Date.now;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1;
   const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
   const deadline = now() + timeoutMs;
   try {
@@ -11969,6 +12089,135 @@ contentUrl) {
   }
 }
 
+/**
+ * Forwarding for `/admin/proxy/*`: Val Build's Studio API, `/v1/studio/*` on
+ * the content server, called on the editor's behalf with the token from their
+ * session.
+ *
+ * The web components the Studio mounts from content.val.build cannot call Val
+ * Build themselves. The editor's credential is in this app's httpOnly
+ * `val_session` cookie, and a cookie of admin.val.build's own would be
+ * third-party on this page, which Safari and Firefox block. So they call this
+ * app, and this is where the token is attached.
+ *
+ * It is a pipe for the path, the query and a JSON body, so a new component or
+ * endpoint needs no Val release. It is NOT a pipe for where the request goes:
+ * the URL is built from `contentUrl` (the server's `valContentUrl`) and must
+ * still be under `/v1/studio/` after the URL parser has resolved `..`,
+ * `%2e%2e` and backslashes. The editor's token can reach the endpoints written
+ * for the Studio and nothing else on Val Build.
+ */
+
+const STUDIO_API_PREFIX = "/v1/studio/";
+const DEFAULT_TIMEOUT_MS = 10_000;
+async function forwardToStudioApi({
+  method,
+  path,
+  rawQuery,
+  body,
+  credential,
+  contentUrl,
+  fetchImpl = fetch,
+  timeoutMs = DEFAULT_TIMEOUT_MS
+}) {
+  const url = studioApiUrl(contentUrl, path, rawQuery);
+  if (url === null) {
+    return {
+      status: 404,
+      json: {
+        code: "not-found",
+        message: "No such Val Build endpoint."
+      }
+    };
+  }
+  // Every method the route accepts may carry a JSON body: a DELETE that
+  // names what it removes in its body is as valid as a PUT.
+  const sendsBody = method !== "GET" && body !== undefined;
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method,
+      headers: {
+        // `x-val-pat` is the header the rest of Val Build reads a PAT from.
+        ...("pat" in credential ? {
+          "x-val-pat": credential.pat
+        } : {
+          authorization: `Bearer ${credential.bearer}`
+        }),
+        accept: "application/json",
+        ...(sendsBody ? {
+          "content-type": "application/json"
+        } : {})
+      },
+      body: sendsBody ? JSON.stringify(body) : undefined,
+      // Never follow a redirect with the token attached.
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch {
+    return {
+      status: 500,
+      json: {
+        code: "unreachable",
+        message: "Could not reach Val Build."
+      }
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    json = {
+      code: "bad-gateway",
+      message: `Val Build answered ${response.status} without JSON.`
+    };
+  }
+  return {
+    status: mapStatus(response.status),
+    json
+  };
+}
+
+/**
+ * `{contentUrl}/v1/studio{path}{rawQuery}`, or null when the result is not
+ * under that prefix on that origin — the check that keeps the proxy from being
+ * pointed anywhere else with the editor's token.
+ */
+function studioApiUrl(contentUrl, path, rawQuery) {
+  if (!path.startsWith("/") || rawQuery !== "" && !rawQuery.startsWith("?")) {
+    return null;
+  }
+  let base;
+  let url;
+  try {
+    base = new URL(contentUrl);
+    url = new URL(`${STUDIO_API_PREFIX}${path.slice(1)}${rawQuery}`, base);
+  } catch {
+    return null;
+  }
+  if (url.origin !== base.origin || !url.pathname.startsWith(STUDIO_API_PREFIX)) {
+    return null;
+  }
+  return url.toString();
+}
+
+/**
+ * Onto the statuses this server speaks. The JSON is passed through untouched,
+ * so a `code` from Val Build still says what happened.
+ */
+function mapStatus(status) {
+  if (status >= 200 && status < 300) {
+    return 200;
+  }
+  if (status === 400 || status === 401 || status === 403 || status === 404) {
+    return status;
+  }
+  if (status >= 400 && status < 500) {
+    return 400;
+  }
+  return 500;
+}
+
 function getPersonalAccessTokenPath(root) {
   return path__namespace["default"].join(path__namespace["default"].resolve(root), ".val", "pat.json");
 }
@@ -12512,6 +12761,27 @@ function warnIfInsecureUrls(urls) {
  * genuinely confusing afternoon.
  */
 
+/**
+ * The personal access token `val login` wrote for this project, or null when
+ * there is none (or it does not parse). Only `fs` mode has a working directory
+ * to read it from, so every other mode answers null.
+ *
+ * Unlike `resolveRemoteFileAuth` this never answers with the api key: the
+ * caller wants to act as the DEVELOPER, and an api key is the project.
+ */
+async function readValLoginToken(options) {
+  if (options.mode !== "fs") {
+    return null;
+  }
+  const fs = await Promise.resolve().then(function () { return /*#__PURE__*/_interopNamespace(require('fs')); });
+  try {
+    const file = await fs.promises.readFile(getPersonalAccessTokenPath(options.cwd), "utf-8");
+    const parsed = parsePersonalAccessTokenFile(file);
+    return parsed.success ? parsed.data.pat : null;
+  } catch {
+    return null;
+  }
+}
 async function resolveRemoteFileAuth(options) {
   if (options.apiKey) {
     return {
@@ -12671,6 +12941,129 @@ const ValServer = (valModules, options, callbacks) => {
       return null;
     });
   };
+
+  /**
+   * `/admin/proxy/*`, for Val Build's web components in the Studio: forwarded
+   * to the Studio API on the content server. See `adminProxy.ts` for what is
+   * forwarded and why.
+   *
+   * Three refusals before anything leaves this server, and the `code`s are
+   * the ones the components act on:
+   * - no `x-val-studio` header: 403, since a cross-site request cannot set it;
+   * - no Val Build behind this Studio (no `valBuildUrl`, or fs mode without
+   *   a `val login`): 404 `not-connected`, which the component shows as such
+   *   rather than as an outage — though `/admin/status` keeps the Studio from
+   *   mounting it at all in that case;
+   * - a deployed Studio without a valid session: 401 `unauthenticated`, which
+   *   the component answers by asking the Studio to sign in.
+   */
+  const adminProxy = async (method, req) => {
+    if (req.headers[internal.VAL_STUDIO_HEADER] !== "1") {
+      return {
+        status: 403,
+        json: {
+          code: "forbidden",
+          message: `Requests to the Val Build proxy need the ${internal.VAL_STUDIO_HEADER} header.`
+        }
+      };
+    }
+    const credential = await getValBuildCredential(req.cookies);
+    if (credential.status !== "ok" || !options.valBuildUrl) {
+      if (!serverOps.requiresAuth || !options.valBuildUrl) {
+        return {
+          status: 404,
+          json: {
+            code: "not-connected",
+            message: "This Studio is not connected to Val Build."
+          }
+        };
+      }
+      return {
+        status: 401,
+        json: {
+          code: "unauthenticated",
+          message: credential.status === "invalid" ? credential.message : "Sign in to Val Build."
+        }
+      };
+    }
+    // To the content server, which serves the Studio API: Val Build's sign-in
+    // (`valBuildUrl`) is what makes the credential, the content server is
+    // what the components' data comes from.
+    return forwardToStudioApi({
+      method,
+      path: req.path,
+      rawQuery: req.rawQuery,
+      body: req.body,
+      credential: credential.credential,
+      contentUrl: options.valContentUrl
+    });
+  };
+
+  /**
+   * What this Studio can act on Val Build with, for the editor in front of it:
+   *
+   * - the session's token, in a deployed Studio (and in a local one where
+   *   someone signed in through the Studio anyway);
+   * - otherwise, in fs mode, the developer's own `val login` token from
+   *   `.val/pat.json` — the same file `val validate --fix` reads.
+   *
+   * An api key is never one of them: it is the project, not a person, and
+   * these requests are answered with a person's projects.
+   */
+  const getValBuildCredential = async cookies => {
+    const session = getSessionToken(cookies);
+    if (session.status === "ok") {
+      return {
+        status: "ok",
+        credential: {
+          bearer: session.token
+        }
+      };
+    }
+    if (options.mode === "fs") {
+      const pat = await readValLoginToken(options);
+      if (pat !== null) {
+        return {
+          status: "ok",
+          credential: {
+            pat
+          }
+        };
+      }
+      return {
+        status: "none"
+      };
+    }
+    return session;
+  };
+
+  /** The editor's Val Build token, from inside their session cookie. */
+  const getSessionToken = cookies => {
+    const cookie = cookies[internal.VAL_SESSION_COOKIE];
+    if (typeof cookie !== "string" || !options.valSecret) {
+      return {
+        status: "none"
+      };
+    }
+    const verified = verifyJwt(cookie, options.valSecret);
+    if (!verified.success) {
+      return {
+        status: "invalid",
+        message: sessionErrorMessage(verified.reason)
+      };
+    }
+    const payload = IntegratedServerJwtPayload.safeParse(verified.data);
+    if (!payload.success) {
+      return {
+        status: "invalid",
+        message: "Session invalid. You will need to login again."
+      };
+    }
+    return {
+      status: "ok",
+      token: payload.data.token
+    };
+  };
   const getAuth = cookies => {
     const cookie = cookies[internal.VAL_SESSION_COOKIE];
     /*
@@ -14350,6 +14743,20 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
+        /*
+         * What this build's draft applies: the pending patches and the ones
+         * published AFTER this build, which it does not have -- see
+         * `draftOverlay`. `getSources` already applied both, but
+         * `analyzePatches` skips every patch with `appliedAt`, so a module
+         * changed only by a post-build publish was reported with no
+         * `patches`, and a reader that sends only changed modules (TanStack's
+         * `fetchValDraft`) left it out: the page was rendered with this
+         * build's older value. Chain order, which is what the Studio applies.
+         */
+        patchOps = {
+          ...patchOps,
+          patches: draftOverlay(patchOps.patches, patchOps.commits)
+        };
         const patchAnalysis = serverOps.analyzePatches(patchOps.patches);
         const schemasRes = await serverOps.getSchemas();
         let sourcesRes = await serverOps.getSources();
@@ -14598,6 +15005,31 @@ const ValServer = (valModules, options, callbacks) => {
         });
       }
     },
+    "/admin/status": {
+      GET: async req => {
+        const credential = await getValBuildCredential(req.cookies);
+        return {
+          status: 200,
+          json: {
+            connected: Boolean(options.valBuildUrl) && credential.status === "ok",
+            /*
+             * How an editor signs in to Val Build here, which only the server
+             * knows. NOT the stat `mode`: that says whether patches are local,
+             * and a deployed memory-mode host reports `fs` while having no
+             * working directory to run `val login` in. Only a developer's own
+             * checkout (fs mode) signs in with `val login`.
+             */
+            signIn: options.mode === "fs" ? "val-login" : "studio"
+          }
+        };
+      }
+    },
+    "/admin/proxy": {
+      GET: req => adminProxy("GET", req),
+      POST: req => adminProxy("POST", req),
+      PUT: req => adminProxy("PUT", req),
+      DELETE: req => adminProxy("DELETE", req)
+    },
     "/profiles": {
       GET: async req => {
         const cookies = req.cookies;
@@ -17078,6 +17510,13 @@ function createValApiRouter(route, valServerPromise, convert) {
       if (!cookiesRes.success) {
         return zodErrorResult(cookiesRes.error, "invalid cookies");
       }
+      const headersRes = reqDefinition.headers ? getHeaders(req, reqDefinition.headers) : {
+        success: true,
+        data: {}
+      };
+      if (!headersRes.success) {
+        return zodErrorResult(headersRes.error, "invalid headers");
+      }
       const actualQueryParams = groupQueryParams(Array.from(url.searchParams.entries()));
       let query = {};
       if (reqDefinition.query) {
@@ -17126,6 +17565,8 @@ function createValApiRouter(route, valServerPromise, convert) {
         res = await endpointImpl({
           body: bodyRes.data,
           cookies: cookiesRes.data,
+          headers: headersRes.data,
+          rawQuery: reqDefinition.rawQuery ? url.search : undefined,
           query,
           path
         });
@@ -17222,10 +17663,22 @@ function zodErrorResult(error, message) {
 }
 
 // TODO: is this naive implementation is too naive?
+/** The declared headers, by name; `Headers.get` is case-insensitive. */
+function getHeaders(req, headersDef) {
+  const input = {};
+  for (const name of Object.keys(headersDef)) {
+    var _req$headers;
+    const value = (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.get(name);
+    if (value !== null && value !== undefined) {
+      input[name] = value;
+    }
+  }
+  return z.z.object(headersDef).safeParse(input);
+}
 function getCookies(req, cookiesDef) {
-  var _req$headers;
+  var _req$headers2;
   const input = {};
-  const cookieParts = (_req$headers = req.headers) === null || _req$headers === void 0 || (_req$headers = _req$headers.get("Cookie")) === null || _req$headers === void 0 ? void 0 : _req$headers.split("; ");
+  const cookieParts = (_req$headers2 = req.headers) === null || _req$headers2 === void 0 || (_req$headers2 = _req$headers2.get("Cookie")) === null || _req$headers2 === void 0 ? void 0 : _req$headers2.split("; ");
   for (const name of Object.keys(cookiesDef)) {
     const cookie = cookieParts === null || cookieParts === void 0 ? void 0 : cookieParts.find(cookie => cookie.startsWith(`${name}=`));
     const value = cookie ? decodeURIComponent(cookie === null || cookie === void 0 ? void 0 : cookie.split("=")[1]) : undefined;