@valbuild/server 0.146.2 → 0.147.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @valbuild/server
 
+## 0.147.0
+
+### Minor Changes
+
+- [#876](https://github.com/valbuild/val/pull/876) [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd) Thanks [@freekh](https://github.com/freekh)! - Demo mode: run the Val Studio with no account and no backend (TanStack Start).
+
+  `<ValApp demo>` starts Val's own server in the visitor's browser tab, and the Studio talks to it there instead of to `/api/val`. Edits show up in the page as they are typed and are held in the tab's memory: nothing is sent anywhere, and a reload starts over. Images and videos can be uploaded too: a small service worker, served by `initValDemoServer()`, hands the upload and the unpublished files to the server in the tab, so an uploaded photo or video shows in the page with nothing leaving the browser. Uploads are capped by their size after encoding. Pair `<ValApp demo>` with `<ValProvider demo>` on the site and `initValDemoServer()` from the new `@valbuild/tanstack/demo` entry on the API route. In a demo the Studio opens with a guided tour, Publish explains what it would do instead of publishing, and Preview in a new tab is shown but disabled.
+
+  Also:
+
+  - `@valbuild/server/browser` is a new entry: Val's request handling, bundleable for a browser. The TypeScript compiler, which only publishing and history need, is loaded when they ask for it, so a browser bundle of the server is about 140 KB rather than 3.6 MB.
+  - `s.image({ encode })` now scales an image down in browsers that cannot write WebP (Safari), as a JPEG or PNG in the image's own format, instead of uploading it at full size.
+  - `GET /profiles` answers with no profiles, rather than an error, when edits are stored locally and no project is configured.
+
+### Patch Changes
+
+- Updated dependencies [[`2f09cd5`](https://github.com/valbuild/val/commit/2f09cd5e2f4fc37f06917899f24f9ad2ee8d3a8b), [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd), [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd)]:
+  - @valbuild/core@0.147.0
+  - @valbuild/shared@0.147.0
+  - @valbuild/ui@0.147.0
+
+## 0.146.4
+
+### Patch Changes
+
+- [#877](https://github.com/valbuild/val/pull/877) [`c31f609`](https://github.com/valbuild/val/commit/c31f609fdeed79aa0e139fa4f652ba0684e96ea3) Thanks [@freekh](https://github.com/freekh)! - The Studio has an unlinked page, `/val/adept`, for trying out dependency
+  upgrades on a hosted project: it computes a lockfile for the live site's
+  `package.json`, previews each kind of upgrade from it, and fetches the type
+  declarations and TypeScript compiler a typecheck would load. It only shows
+  results; nothing on it is staged or published. Nothing links to it yet.
+
+  For it, the server now forwards Val Build's `/adept/*` routes for a signed-in
+  Studio session: lockfiles, upgrades, their jobs, type bundles and the
+  compiler. Like everything else the Studio asks Val Build for, they go with the
+  project's own credential, and they are open at a proposal's address too,
+  since they publish nothing.
+
+- Updated dependencies [[`81f2e80`](https://github.com/valbuild/val/commit/81f2e803c4cefdf58bbe6856c06e98ace95a8e0b), [`59ff6c3`](https://github.com/valbuild/val/commit/59ff6c367bc313b2bb7718b00c1641aaccab949d), [`c31f609`](https://github.com/valbuild/val/commit/c31f609fdeed79aa0e139fa4f652ba0684e96ea3)]:
+  - @valbuild/shared@0.146.4
+  - @valbuild/ui@0.146.4
+
 ## 0.146.2
 
 ### Patch Changes

package/browser/dist/valbuild-server-browser.cjs.d.ts

@@ -0,0 +1,2 @@
+export * from "../../dist/declarations/src/browser/index.js";
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsYnVpbGQtc2VydmVyLWJyb3dzZXIuY2pzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9kaXN0L2RlY2xhcmF0aW9ucy9zcmMvYnJvd3Nlci9pbmRleC5kLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBIn0=

package/browser/dist/valbuild-server-browser.cjs.dev.js

@@ -0,0 +1,146 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var core = require('@valbuild/core');
+var ValRouterCore = require('../../dist/ValRouterCore-3fd3d444.cjs.dev.js');
+require('buffer');
+require('@valbuild/shared/internal');
+require('zod');
+require('zod-validation-error');
+require('@valbuild/core/fp');
+require('@valbuild/core/patch');
+require('image-size');
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValRouterCore.ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: core.DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValRouterCore.ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = ValRouterCore.createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+exports.createInTabValFetch = createInTabValFetch;

package/browser/dist/valbuild-server-browser.cjs.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === "production") {
+  module.exports = require("./valbuild-server-browser.cjs.prod.js");
+} else {
+  module.exports = require("./valbuild-server-browser.cjs.dev.js");
+}

package/browser/dist/valbuild-server-browser.cjs.prod.js

@@ -0,0 +1,146 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var core = require('@valbuild/core');
+var ValRouterCore = require('../../dist/ValRouterCore-7ffcc08c.cjs.prod.js');
+require('buffer');
+require('@valbuild/shared/internal');
+require('zod');
+require('zod-validation-error');
+require('@valbuild/core/fp');
+require('@valbuild/core/patch');
+require('image-size');
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValRouterCore.ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: core.DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValRouterCore.ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = ValRouterCore.createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+exports.createInTabValFetch = createInTabValFetch;

package/browser/dist/valbuild-server-browser.esm.js

@@ -0,0 +1,142 @@
+import { DEFAULT_CONTENT_HOST } from '@valbuild/core';
+import { j as ValOpsMemory, k as ValServer, l as createValRequestHandler } from '../../dist/ValRouterCore-f5004f8f.esm.js';
+import 'buffer';
+import '@valbuild/shared/internal';
+import 'zod';
+import 'zod-validation-error';
+import '@valbuild/core/fp';
+import '@valbuild/core/patch';
+import 'image-size';
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+export { createInTabValFetch };

package/browser/package.json

@@ -0,0 +1,4 @@
+{
+  "main": "dist/valbuild-server-browser.cjs.js",
+  "module": "dist/valbuild-server-browser.esm.js"
+}