@valbuild/server 0.146.4 → 0.148.0

package/CHANGELOG.md

@@ -1,5 +1,134 @@
 # @valbuild/server
 
+## 0.148.0
+
+### Patch Changes
+
+- [#885](https://github.com/valbuild/val/pull/885) [`df5544c`](https://github.com/valbuild/val/commit/df5544c6e92a4c3a52765630c9de191e854ee723) Thanks [@freekh](https://github.com/freekh)! - Demo mode (`<ValApp demo>`) now starts under `vite dev`. It used to stop at
+  "The demo could not start: part of it did not load", with
+  `does not provide an export named 'Buffer'` in the console, because the server
+  that runs in the tab imported the CommonJS `buffer` package, and Vite's dev
+  server does not convert a dependency it only meets in a chunk loaded on demand.
+  That server now handles bytes without `buffer`, so an app needs no Vite
+  configuration for it, and `@valbuild/server` no longer depends on the package.
+  If you added `buffer` to `optimizeDeps.include` to work around this, you can
+  remove it.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - `createFixPatch` reads a file's bytes, and saves a downloaded remote file,
+  through an optional `files` reader instead of directly from disk. The default
+  reads the disk under `projectRoot` exactly as before, so `val validate --fix`
+  and the VS Code extension behave the same.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - Remote files are now addressed on the host the project's settings name. For a
+  project hosted by Val, that is the project's own address, and its remote images
+  and files are served from there rather than from `remote.val.build`. Every other
+  project is unchanged.
+
+  - The Studio, `val validate --fix` and the MCP image tool all take the host from
+    the project's settings, falling back to `remote.val.build` as before.
+  - Re-reading a remote file whose recorded size or type is out of date keeps it
+    on the host it was on.
+  - When a remote file's host cannot be reached, tooling downloads it from the
+    project's permanent `<id>.valstart.dev` address instead, and keeps it only if
+    its bytes match the file the address names.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - Remote files served from a project's own site (addresses like
+  `https://www.acme.no/_val/file/…`) are now checked for whether that address
+  still serves the project. When a custom domain has been removed or moved to
+  another project, the image or file is reported, and **Fix** on the Studio's
+  Validate page — or `val validate --fix` — points it at the project's permanent
+  `<id>.valstart.dev` address. Nothing is uploaded or downloaded: only the address
+  changes.
+
+  Remote file addresses with a `/_val` prefix after the host are now recognised.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - **Check everything** on the Studio's Validate page now checks media directories
+  (`s.imagedir()`, `s.filedir()`, `s.fontdir()` and `s.videodir()`) by the files
+  they list:
+
+  - An entry whose file is gone has a **Fix** that removes it from the directory.
+  - An image or file entry whose recorded size or type does not match its file has
+    a **Fix** that corrects it from the file, keeping its alt text.
+  - A video entry whose file is gone is reported, and is removed by hand: its
+    posters and captions may still be in use.
+  - A remote entry is checked with its host, like any remote file.
+
+  `val validate --fix` fixes media directories exactly as before.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - The Studio has a **Validate** page, at `/val/validate`, and a button for it in
+  the top bar with the number of errors left.
+
+  It lists the errors the Studio already shows, as the errors page did, and adds
+  **Check everything**: a check of every module on the server, including whether
+  each image's and file's recorded size and type match the file itself. It runs
+  only when you press it, can be stopped, and its results stay for the session.
+
+  Where the Studio can make the fix itself — a missing or wrong width, height or
+  mime type on an image, file or video — the row has a **Fix** button. A fix is an
+  ordinary change: it shows up in Review, is published with everything else, and
+  can be undone from the row. Fixes that need a terminal show the
+  `val validate --fix` command to copy.
+
+  `/val/errors` still works and opens the same page.
+
+  Also fixed: `.jsonValues()` entries no longer report every image in them as
+  "not checked against the file" when validated on the server.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - **Check everything** on the Studio's Validate page now checks remote images and
+  files too.
+
+  - A remote image or file whose address no longer matches what is recorded about
+    it (its size, type or the schema's options changed since it was uploaded) has
+    a **Fix**, which re-reads the file and corrects it, as `val validate --fix`
+    does.
+  - A remote host that does not answer is shown once, at the top of the page, with
+    how many files it holds and a **Try again**, rather than as an error on every
+    image.
+  - A file its host no longer has is shown at the image or file that uses it.
+
+  Images and files in your unpublished changes are not asked about until they are
+  published; the check makes sure the change still has them.
+
+- [#818](https://github.com/valbuild/val/pull/818) [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1) Thanks [@freekh](https://github.com/freekh)! - Two new Studio API routes for the full content check, not yet used by the
+  Studio's UI:
+
+  - `POST /api/val/validate` checks one module — its content against its schema,
+    and its local images and files against their bytes — on the content the
+    Studio is showing.
+  - `POST /api/val/validate/fix` returns the patch that fixes one of those errors,
+    for the Studio to add as a pending change. It builds only the fixes that need
+    no disk or remote host: image, file and video metadata, and a view pointing at
+    the wrong module.
+
+  Also fixed: an API route whose name started with another route's name could be
+  answered by the other route.
+
+- Updated dependencies [[`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`4176757`](https://github.com/valbuild/val/commit/41767579b01849473a94779122fd39c07dd99234), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1), [`562d032`](https://github.com/valbuild/val/commit/562d03280c3fcf97a80562e8b017dd2125ac4ad1)]:
+  - @valbuild/shared@0.148.0
+  - @valbuild/ui@0.148.0
+  - @valbuild/core@0.148.0
+
+## 0.147.0
+
+### Minor Changes
+
+- [#876](https://github.com/valbuild/val/pull/876) [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd) Thanks [@freekh](https://github.com/freekh)! - Demo mode: run the Val Studio with no account and no backend (TanStack Start).
+
+  `<ValApp demo>` starts Val's own server in the visitor's browser tab, and the Studio talks to it there instead of to `/api/val`. Edits show up in the page as they are typed and are held in the tab's memory: nothing is sent anywhere, and a reload starts over. Images and videos can be uploaded too: a small service worker, served by `initValDemoServer()`, hands the upload and the unpublished files to the server in the tab, so an uploaded photo or video shows in the page with nothing leaving the browser. Uploads are capped by their size after encoding. Pair `<ValApp demo>` with `<ValProvider demo>` on the site and `initValDemoServer()` from the new `@valbuild/tanstack/demo` entry on the API route. In a demo the Studio opens with a guided tour, Publish explains what it would do instead of publishing, and Preview in a new tab is shown but disabled.
+
+  Also:
+
+  - `@valbuild/server/browser` is a new entry: Val's request handling, bundleable for a browser. The TypeScript compiler, which only publishing and history need, is loaded when they ask for it, so a browser bundle of the server is about 140 KB rather than 3.6 MB.
+  - `s.image({ encode })` now scales an image down in browsers that cannot write WebP (Safari), as a JPEG or PNG in the image's own format, instead of uploading it at full size.
+  - `GET /profiles` answers with no profiles, rather than an error, when edits are stored locally and no project is configured.
+
+### Patch Changes
+
+- Updated dependencies [[`2f09cd5`](https://github.com/valbuild/val/commit/2f09cd5e2f4fc37f06917899f24f9ad2ee8d3a8b), [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd), [`cb04e58`](https://github.com/valbuild/val/commit/cb04e586db1e3ffd20ec1fee744561b1c8f8cffd)]:
+  - @valbuild/core@0.147.0
+  - @valbuild/shared@0.147.0
+  - @valbuild/ui@0.147.0
+
 ## 0.146.4
 
 ### Patch Changes

package/browser/dist/valbuild-server-browser.cjs.d.ts

@@ -0,0 +1,2 @@
+export * from "../../dist/declarations/src/browser/index.js";
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsYnVpbGQtc2VydmVyLWJyb3dzZXIuY2pzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9kaXN0L2RlY2xhcmF0aW9ucy9zcmMvYnJvd3Nlci9pbmRleC5kLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBIn0=

package/browser/dist/valbuild-server-browser.cjs.dev.js

@@ -0,0 +1,146 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var core = require('@valbuild/core');
+var ValRouterCore = require('../../dist/ValRouterCore-9bdaaf89.cjs.dev.js');
+require('@valbuild/shared/internal');
+require('zod');
+require('zod-validation-error');
+require('@valbuild/core/fp');
+require('@valbuild/core/patch');
+require('image-size');
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValRouterCore.ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  bytesToBase64: ValRouterCore.bytesToBase64,
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: core.DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValRouterCore.ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = ValRouterCore.createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+exports.createInTabValFetch = createInTabValFetch;

package/browser/dist/valbuild-server-browser.cjs.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === "production") {
+  module.exports = require("./valbuild-server-browser.cjs.prod.js");
+} else {
+  module.exports = require("./valbuild-server-browser.cjs.dev.js");
+}

package/browser/dist/valbuild-server-browser.cjs.prod.js

@@ -0,0 +1,146 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var core = require('@valbuild/core');
+var ValRouterCore = require('../../dist/ValRouterCore-42772c21.cjs.prod.js');
+require('@valbuild/shared/internal');
+require('zod');
+require('zod-validation-error');
+require('@valbuild/core/fp');
+require('@valbuild/core/patch');
+require('image-size');
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValRouterCore.ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  bytesToBase64: ValRouterCore.bytesToBase64,
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: core.DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValRouterCore.ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = ValRouterCore.createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+exports.createInTabValFetch = createInTabValFetch;

package/browser/dist/valbuild-server-browser.esm.js

@@ -0,0 +1,142 @@
+import { DEFAULT_CONTENT_HOST } from '@valbuild/core';
+import { j as ValOpsMemory, E as bytesToBase64, y as ValServer, z as createValRequestHandler } from '../../dist/ValRouterCore-7ca3dc68.esm.js';
+import '@valbuild/shared/internal';
+import 'zod';
+import 'zod-validation-error';
+import '@valbuild/core/fp';
+import '@valbuild/core/patch';
+import 'image-size';
+
+const NO_SESSIONS = "Val: sessions are not available here -- this server runs in the browser, " + "has no secret to sign them with, and serves without authenticating.";
+
+/**
+ * The platform for a server running in a browser tab.
+ *
+ * Memory mode only: there is no filesystem for `fs` mode and no credential for
+ * `http` mode. Everything else answers as a server without those things does
+ * -- no `val login` token, no credential for remote files, no link checks --
+ * and the session functions refuse, because a tab has no secret to sign with
+ * and the server is constructed with `unsafelyAllowUnauthenticated`, so
+ * nothing asks for one.
+ */
+const browserPlatform = {
+  createOps: (valModules, options) => {
+    if (options.mode !== "memory") {
+      throw new Error(`Val: a server in the browser runs in memory mode, not '${options.mode}'.`);
+    }
+    return new ValOpsMemory(valModules, {
+      formatter: options.formatter,
+      config: options.config,
+      sourceFiles: options.sourceFiles,
+      patchStore: options.patchStore,
+      unsafelyAllowUnauthenticated: options.unsafelyAllowUnauthenticated,
+      // Nothing can reach a server in a tab but the page it runs in.
+      warnUnauthenticated: false,
+      contentUrl: options.valContentUrl
+    });
+  },
+  probeUrl: async () => ({
+    kind: "skipped",
+    message: "Links are not checked in the browser."
+  }),
+  jwt: {
+    verifyJwt: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    decodeJwtWithoutVerifying: () => ({
+      success: false,
+      reason: "missing-secret",
+      message: NO_SESSIONS
+    }),
+    encodeJwt: () => {
+      throw new Error(NO_SESSIONS);
+    },
+    getExpire: () => Math.floor(Date.now() / 1000) + 60 * 60
+  },
+  bytesToBase64,
+  readValLoginToken: async () => null,
+  resolveRemoteFileAuth: async () => ({
+    status: "error",
+    errorCode: "api-key-missing",
+    message: "Remote files are not available in the browser."
+  })
+};
+
+/** A `fetch`, as far as the Studio's client calls one. */
+
+/**
+ * Val's API, served in this tab: a `fetch` that never touches the network.
+ *
+ * The whole server -- the router's request parsing, `ValServer`'s routes,
+ * memory mode's patch chain -- runs here, exactly as it runs on a server.
+ * What is removed is the hop between them, and nothing else, which is why the
+ * demo built on it cannot drift from the product: there is no second
+ * implementation to drift. See `docs/plans/demo-mode.md`.
+ *
+ * Memory mode with no source files, because nothing here publishes (only a
+ * publish reads `.val.ts` text), and without authentication, because the only
+ * caller is the page this runs in.
+ */
+function createInTabValFetch(valModules, options) {
+  const route = options.route ?? "/api/val";
+  const serverConfig = {
+    mode: "memory",
+    route,
+    sourceFiles: {},
+    patchStore: options.patchStore,
+    unsafelyAllowUnauthenticated: true,
+    valContentUrl: DEFAULT_CONTENT_HOST,
+    config: options.config
+  };
+  const server = ValServer(valModules, serverConfig, {
+    // Draft content is the only content a demo has.
+    isEnabled: async () => true,
+    onEnable: async () => {},
+    onDisable: async () => {}
+  }, browserPlatform);
+  const handle = createValRequestHandler(route, Promise.resolve(server), toResponse);
+  return (input, init) => {
+    const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
+    // A `Request` already has an absolute URL, and `init` overrides what it
+    // carries, as it does for `fetch`. Only a string or URL is resolved.
+    return handle(input instanceof Request ? new Request(input, init) : new Request(new URL(String(input), base).href, init));
+  };
+}
+
+/**
+ * The server's answer as a `Response`. The same conversion a host makes,
+ * less the cookies: a `Response` made in the page cannot set one, and a server
+ * that never authenticates has none to set.
+ */
+function toResponse(valRes) {
+  const headers = new Headers();
+  const valResHeaders = "headers" in valRes && valRes.headers || {};
+  for (const key in valResHeaders) {
+    const value = valResHeaders[key];
+    if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+  if ("json" in valRes) {
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(valRes.json), {
+      headers,
+      status: valRes.status
+    });
+  }
+  if (valRes.status === 302) {
+    headers.set("Location", valRes.redirectTo);
+    return new Response(null, {
+      status: valRes.status,
+      headers
+    });
+  }
+  return new Response("body" in valRes ? valRes.body : null, {
+    headers,
+    status: valRes.status
+  });
+}
+
+export { createInTabValFetch };

package/browser/package.json

@@ -0,0 +1,4 @@
+{
+  "main": "dist/valbuild-server-browser.cjs.js",
+  "module": "dist/valbuild-server-browser.esm.js"
+}