@valbuild/server 0.147.0 → 0.148.1

package/dist/valbuild-server.esm.js

@@ -3,29 +3,29 @@ export { a as analyzeValModule, d as formatSyntaxErrorTree } from './jsonValuesM
 import { applyPatch, PatchError, JSONOps, deepClone, deepEqual, sourceToPatchPath, isNotRoot } from '@valbuild/core/patch';
 import { T as TSOps, r as removeValJsonEntry, i as insertValJsonEntry } from './ops-0d05feaf.esm.js';
 import { pipe, result } from '@valbuild/core/fp';
-import { derefPatch, Internal, extractValModules, deserializeSchema, DEFAULT_CONTENT_HOST } from '@valbuild/core';
+import { derefPatch, Internal, extractValModules, deserializeSchema, DEFAULT_CONTENT_HOST, DEFAULT_VAL_REMOTE_HOST } from '@valbuild/core';
 export { hasRemoteFileSchema } from '@valbuild/core';
 import ts from 'typescript';
 import path from 'path';
 import fs from 'fs';
 import vm from 'node:vm';
 import { Module } from 'node:module';
-import { r as resolveExistingJsonPath, f as findNestedJsonValuesRecords, v as validateJsonValuesEntries, i as isJsonValuesRootOp, a as rebaseContentOp, c as classifyJsonValuesOp, V as ValOps, b as bufferFromDataUrl, g as getFieldsForType, u as uploadRemoteFile, d as getFileExt, e as guessMimeTypeFromPath, h as createMetadataFromBuffer, j as ValOpsMemory, k as ValServer, l as createValRequestHandler, m as isHlsMasterPlaylist, s as sumHlsSegmentDurations, p as parseHlsMasterVariants, n as largestHlsVariant, o as mapHlsUris, q as getNewJsonEntryPaths, t as formatPatchSourceError } from './ValRouterCore-f5004f8f.esm.js';
-export { I as InMemoryPatchStore, j as ValOpsMemory, c as classifyJsonValuesOp, t as formatPatchSourceError, d as getFileExt, w as getSettings, a as rebaseContentOp, u as uploadRemoteFile } from './ValRouterCore-f5004f8f.esm.js';
+import { r as resolveExistingJsonPath, f as findNestedJsonValuesRecords, v as validateJsonValuesEntries, i as isJsonValuesRootOp, a as rebaseContentOp, c as classifyJsonValuesOp, V as ValOps, b as bufferFromDataUrl, g as getFieldsForType, u as uploadRemoteFile, d as getFileExt, e as guessMimeTypeFromPath, h as createMetadataFromBuffer, j as ValOpsMemory, k as isHlsMasterPlaylist, s as sumHlsSegmentDurations, p as parseHlsMasterVariants, l as largestHlsVariant, m as fallbackRefOf, n as mapHlsUris, o as movedRemoteHost, q as needsHostCheck, t as rewriteRefHost, w as fallbackRemoteHost, x as checkRemoteFiles, y as ValServer, z as createValRequestHandler, A as getNewJsonEntryPaths, B as formatPatchSourceError } from './ValRouterCore-7ca3dc68.esm.js';
+export { I as InMemoryPatchStore, j as ValOpsMemory, C as askOncePerHost, c as classifyJsonValuesOp, B as formatPatchSourceError, d as getFileExt, D as getSettings, a as rebaseContentOp, u as uploadRemoteFile } from './ValRouterCore-7ca3dc68.esm.js';
 import { createUIRequestHandler } from '@valbuild/ui/server';
 import z$1, { z } from 'zod';
 import { fromError } from 'zod-validation-error';
-import { Patch, schemaErrorsOf, PatchSets, joinSharedChanges, schemaTypesOfPath, sideFiles, sideSource, JSONValue, PlanRefusalError, PatchId as PatchId$1, SerializedSchema, getErrorMessageFromUnknownJson, newestCommitSha, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
+import { Patch, schemaErrorsOf, PatchSets, joinSharedChanges, schemaTypesOfPath, sideFiles, sideSource, JSONValue, PlanRefusalError, PatchId as PatchId$1, SerializedSchema, getErrorMessageFromUnknownJson, newestCommitSha, traverseSchemaSource, richTextImageSchema, forEachRichTextImage, isStudioFix } from '@valbuild/shared/internal';
 import os from 'os';
 import crypto$1, { createHash } from 'crypto';
 import { Buffer as Buffer$1 } from 'buffer';
 import http from 'node:http';
 import https from 'node:https';
 import net from 'node:net';
-import { transform } from 'sucrase';
 import sizeOf from 'image-size';
 import http$1 from 'http';
 import https$1 from 'https';
+import { transform } from 'sucrase';
 import fs$1 from 'fs/promises';
 
 function getSyntheticContainingPath(rootDir) {
@@ -3153,7 +3153,7 @@ class ValOpsFS extends ValOps {
       // Cheap, and this is the one path that creates staging directories, so it
       // is where the ones nobody claimed get noticed.
       sweepStaleUploads(patchesDir);
-      const buffer = bufferFromDataUrl(data);
+      const buffer = bufferFromDataUrl(data, base64 => Buffer$1.from(base64, "base64"));
       if (!buffer) {
         return {
           error: {
@@ -9222,568 +9222,279 @@ function readableError(error) {
   }
 }
 
-/** The platform every server on Node runs with. See {@link ValServerPlatform}. */
-const nodePlatform = {
-  createOps: createValOps,
-  probeUrl: url => probeUrl(url),
-  jwt: {
-    verifyJwt,
-    decodeJwtWithoutVerifying,
-    encodeJwt,
-    getExpire
-  },
-  readValLoginToken,
-  resolveRemoteFileAuth
-};
-
-async function createValServer(valModules, route, opts, config, callbacks, formatter,
 /**
- * Called after a save has applied its patches. EXPERIMENTAL — see
- * `ValServerOptions.commitPrepared`.
- */
-commitPrepared,
-/**
- * What a publish does in http mode. EXPERIMENTAL — see
- * `ValServerOptions.publishOverride`.
+ * The size and length of an ISO base media file (`.mp4`, `.m4v`, `.mov`),
+ * read from its headers. Nothing is decoded.
+ *
+ * Hand-written rather than a media library, deliberately: `@valbuild/server`
+ * is loaded by every app that runs Val, and the four numbers wanted here are
+ * three small boxes away from the start of the `moov` box:
+ *
+ *   moov > mvhd                  timescale and duration (version 0 and 1)
+ *   moov > mvex > mehd           duration of a FRAGMENTED file, whose mvhd says 0
+ *   moov > trak > tkhd           width and height (16.16 fixed point) and the
+ *                                display matrix, for a rotated phone video
+ *   moov > trak > mdia > hdlr    `vide`: which trak is the picture
+ *
+ * Only the box headers are read on the way to `moov`, and then `moov` itself,
+ * so a multi-GB file costs a few small reads: `mdat` is seeked past, never
+ * loaded. That is what {@link ByteSource} is for.
  */
-publishOverride) {
-  const valServerConfig = await initHandlerOptions(route, opts, config);
-  return ValServer(valModules, {
-    formatter,
-    commitPrepared,
-    publishOverride,
-    ...valServerConfig
-  }, callbacks, nodePlatform);
+
+/** Random access to a file's bytes, so a large `mdat` can be skipped. */
+
+function bufferByteSource(buffer) {
+  return {
+    size: buffer.length,
+    read: (offset, length) => buffer.subarray(offset, offset + length)
+  };
 }
 
-// TODO: remove
 /**
- * `fs` and `path` are imported INSIDE this function, not at the top of the file.
- *
- * This is the only thing in this module that touches either, and it is a local
- * development convenience: scanning upwards for a `.git` to guess the commit and
- * branch. A static import put `fs` in the module graph of everything reaching
- * `createValApiRouter` -- which is every server integration, including ones that
- * run where there is no filesystem. Workerd provides no `fs`, so such a build
- * could not be bundled at all without stubbing it.
- *
- * The `await import` costs nothing here: the only caller is the CLI, on a
- * machine that has both.
+ * Run `read` against a file on disk, reading only what it asks for. The file
+ * is closed afterwards whatever happens.
  */
-async function safeReadGit(cwd) {
-  const {
-    promises: fs
-  } = await import('fs');
-  const path = await import('path');
-  async function findGitHead(currentDir, depth) {
-    const gitHeadPath = path.join(currentDir, ".git", "HEAD");
-    if (depth > 1000) {
-      console.error(`Reached max depth while scanning for .git folder. Current working dir: ${cwd}.`);
-      return {
-        commit: undefined,
-        branch: undefined
-      };
-    }
-    try {
-      const headContents = await fs.readFile(gitHeadPath, "utf-8");
-      const match = headContents.match(/^ref: refs\/heads\/(.+)/);
-      if (match) {
-        const branchName = match[1];
-        return {
-          branch: branchName,
-          commit: await readCommit(currentDir, branchName)
-        };
-      } else {
-        return {
-          commit: undefined,
-          branch: undefined
-        };
+function withFileByteSource(absolutePath, read) {
+  const fd = fs.openSync(absolutePath, "r");
+  try {
+    const size = fs.fstatSync(fd).size;
+    return read({
+      size,
+      read: (offset, length) => {
+        const wanted = Math.max(0, Math.min(length, size - offset));
+        const buffer = Buffer.alloc(wanted);
+        let filled = 0;
+        while (filled < wanted) {
+          const n = fs.readSync(fd, buffer, filled, wanted - filled, offset + filled);
+          if (n === 0) {
+            break;
+          }
+          filled += n;
+        }
+        return buffer.subarray(0, filled);
       }
-    } catch {
-      const parentDir = path.dirname(currentDir);
+    });
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+/**
+ * A `moov` larger than this is not a header worth reading into memory. A
+ * two-hour film's is a few MB; this is far past any real one.
+ */
+const MAX_MOOV_SIZE = 64 * 1024 * 1024;
 
-      // We've reached the root directory
-      if (parentDir === currentDir) {
-        return {
-          commit: undefined,
-          branch: undefined
-        };
+/**
+ * Whatever of {@link IsoBmffMetadata} the file declares. A field that cannot be
+ * read is absent; nothing here throws on a file that is not ISO BMFF.
+ */
+function readIsoBmffMetadata(source) {
+  const moov = findTopLevelBox(source, "moov");
+  if (!moov) {
+    return {};
+  }
+  const metadata = {};
+  const mvhd = childBox(moov, "mvhd");
+  const timescaleAndDuration = mvhd ? readMvhd(mvhd) : undefined;
+  if (timescaleAndDuration) {
+    const {
+      timescale,
+      duration
+    } = timescaleAndDuration;
+    if (duration > 0) {
+      metadata.duration = duration / timescale;
+    } else {
+      // A fragmented file (CMAF) says 0 in mvhd and puts the length in mehd,
+      // in the same timescale.
+      const mehd = childBox(childBox(moov, "mvex"), "mehd");
+      const fragmentDuration = mehd ? readMehd(mehd) : undefined;
+      if (fragmentDuration !== undefined && fragmentDuration > 0) {
+        metadata.duration = fragmentDuration / timescale;
       }
-      return findGitHead(parentDir, depth + 1);
     }
   }
-  try {
-    return findGitHead(cwd, 0);
-  } catch (err) {
-    console.error("Error while reading .git", err);
-    return {
-      commit: undefined,
-      branch: undefined
-    };
-  }
-}
-
-/** Only reached from {@link safeReadGit}; same reason for the local imports. */
-async function readCommit(gitDir, branchName) {
-  const {
-    promises: fs
-  } = await import('fs');
-  const path = await import('path');
-  try {
-    return (await fs.readFile(path.join(gitDir, ".git", "refs", "heads", branchName), "utf-8")).trim();
-  } catch {
-    return undefined;
+  for (const trak of childBoxes(moov, "trak")) {
+    const hdlr = childBox(childBox(trak, "mdia"), "hdlr");
+    if (!hdlr || hdlr.length < 12 || hdlr.toString("latin1", 8, 12) !== "vide") {
+      continue;
+    }
+    const tkhd = childBox(trak, "tkhd");
+    const size = tkhd ? readTkhd(tkhd) : undefined;
+    if (size && size.width > 0 && size.height > 0) {
+      metadata.width = size.width;
+      metadata.height = size.height;
+      break;
+    }
   }
+  return metadata;
 }
-function createValApiRouter(route, valServerPromise, convert) {
-  const uiRequestHandler = createUIRequestHandler();
-  return createValRequestHandler(route, valServerPromise, convert, uiRequestHandler);
-}
-
-const JsFileLookupMapping = [
-// NOTE: first one matching will be used
-[".cjs.d.ts", [".esm.js", ".mjs.js"]], [".cjs.js", [".esm.js", ".mjs.js"]], [".cjs", [".mjs"]], [".d.ts", [".js", ".esm.js", ".mjs.js"]]];
-const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
-const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
 
-class ValModuleLoader {
-  cache;
-  cacheSize;
-  constructor(projectRoot, compilerOptions,
-  // TODO: remove this?
-  sourceFileHandler, host = {
-    ...ts.sys,
-    writeFile: (fileName, data, encoding) => {
-      fs.mkdirSync(path.dirname(fileName), {
-        recursive: true
-      });
-      fs.writeFileSync(fileName, typeof data === "string" ? data : new Uint8Array(data), encoding);
-    },
-    rmFile: fs.rmSync,
-    readBuffer: fileName => {
-      try {
-        return fs.readFileSync(fileName);
-      } catch {
+/** The payload (after the header) of the first top-level box of a type. */
+function findTopLevelBox(source, type) {
+  let offset = 0;
+  while (offset + 8 <= source.size) {
+    const header = source.read(offset, 16);
+    if (header.length < 8) {
+      return undefined;
+    }
+    let size = header.readUInt32BE(0);
+    const boxType = header.toString("latin1", 4, 8);
+    let headerSize = 8;
+    if (size === 1) {
+      if (header.length < 16) {
         return undefined;
       }
+      size = Number(header.readBigUInt64BE(8));
+      headerSize = 16;
+    } else if (size === 0) {
+      size = source.size - offset;
     }
-  }, disableCache = false) {
-    this.projectRoot = projectRoot;
-    this.compilerOptions = compilerOptions;
-    this.sourceFileHandler = sourceFileHandler;
-    this.host = host;
-    this.disableCache = disableCache;
-    this.cache = {};
-    this.cacheSize = 0;
-  }
-  getModule(modulePath) {
-    if (!modulePath) {
-      throw Error(`Illegal module path: "${modulePath}"`);
+    if (size < headerSize) {
+      return undefined;
     }
-    const code = this.host.readFile(modulePath);
-    if (!code) {
-      throw Error(`Could not read file "${modulePath}"`);
-    }
-    let compiledCode;
-    if (this.cache[code] && !this.disableCache) {
-      // TODO: use hash instead of code as key
-      compiledCode = this.cache[code];
-    } else {
-      compiledCode = transform(code, {
-        filePath: modulePath,
-        disableESTransforms: true,
-        transforms: ["typescript"]
-      }).code;
-      if (!this.disableCache) {
-        if (this.cacheSize > MAX_CACHE_SIZE) {
-          console.warn("Cache size exceeded, clearing cache");
-          this.cache = {};
-          this.cacheSize = 0;
-        }
-        if (code.length < MAX_OBJECT_KEY_SIZE) {
-          this.cache[code] = compiledCode;
-          this.cacheSize += code.length + compiledCode.length; // code is mostly ASCII so 1 byte per char
-        }
+    if (boxType === type) {
+      if (size - headerSize > MAX_MOOV_SIZE) {
+        return undefined;
       }
+      const payload = source.read(offset + headerSize, size - headerSize);
+      return payload.length === size - headerSize ? payload : undefined;
     }
-    return compiledCode;
+    offset += size;
   }
-  resolveModulePath(containingFilePath, requestedModuleName) {
-    var _this$host$realpath, _this$host;
-    let sourceFileName = this.sourceFileHandler.resolveSourceModulePath(containingFilePath, requestedModuleName);
-    if (requestedModuleName === "@vercel/stega") {
-      sourceFileName = this.sourceFileHandler.resolveSourceModulePath(containingFilePath, "@vercel/stega").replace("stega/dist", "stega/dist/esm");
-    }
-    const matches = this.findMatchingJsFile(sourceFileName);
-    if (matches.match === false) {
-      let debugInfo = "";
-      if (sourceFileName.includes("val.config")) {
-        debugInfo = `\n@valbuild directory scan:\n${this.host.readDirectory("/", ["js", "ts", "json"], [], ["**/@valbuild/*"]).join("\n")}`;
+  return undefined;
+}
+
+/** Each child box of a container payload, as `[type, payload]`. */
+function* boxesIn(payload) {
+  let offset = 0;
+  while (offset + 8 <= payload.length) {
+    let size = payload.readUInt32BE(offset);
+    const type = payload.toString("latin1", offset + 4, offset + 8);
+    let headerSize = 8;
+    if (size === 1) {
+      if (offset + 16 > payload.length) {
+        return;
       }
-      throw Error(`Could not find matching js file for module "${requestedModuleName}" requested by: "${containingFilePath}". Tried:\n${matches.tried.join("\n")}${debugInfo}`);
+      size = Number(payload.readBigUInt64BE(offset + 8));
+      headerSize = 16;
+    } else if (size === 0) {
+      size = payload.length - offset;
     }
-    const filePath = matches.match;
-    // resolve all symlinks (preconstruct for example symlinks the dist folder)
-    const followedPath = ((_this$host$realpath = (_this$host = this.host).realpath) === null || _this$host$realpath === void 0 ? void 0 : _this$host$realpath.call(_this$host, filePath)) ?? filePath;
-    if (!followedPath) {
-      throw Error(`File path was empty: "${filePath}", containing file: "${containingFilePath}", requested module: "${requestedModuleName}"`);
+    if (size < headerSize || offset + size > payload.length) {
+      return;
     }
-    return followedPath;
+    yield [type, payload.subarray(offset + headerSize, offset + size)];
+    offset += size;
   }
-  findMatchingJsFile(filePath) {
-    let requiresReplacements = false;
-    for (const [currentEnding] of JsFileLookupMapping) {
-      if (filePath.endsWith(currentEnding)) {
-        requiresReplacements = true;
-        break;
-      }
-    }
-    // avoid unnecessary calls to fileExists if we don't need to replace anything
-    if (!requiresReplacements) {
-      if (this.host.fileExists(filePath)) {
-        return {
-          match: filePath
-        };
-      }
+}
+function childBoxes(payload, type) {
+  if (!payload) {
+    return [];
+  }
+  const found = [];
+  for (const [boxType, child] of boxesIn(payload)) {
+    if (boxType === type) {
+      found.push(child);
     }
-    const tried = [];
-    for (const [currentEnding, replacements] of JsFileLookupMapping) {
-      if (filePath.endsWith(currentEnding)) {
-        for (const replacement of replacements) {
-          const newFilePath = filePath.slice(0, -currentEnding.length) + replacement;
-          if (this.host.fileExists(newFilePath)) {
-            return {
-              match: newFilePath
-            };
-          } else {
-            tried.push(newFilePath);
-          }
-        }
-      }
+  }
+  return found;
+}
+function childBox(payload, type) {
+  return childBoxes(payload, type)[0];
+}
+
+/** "Unknown" in a version 1 box. Not a literal: `0x…n` needs an ES2020 target. */
+const ALL_ONES_64 = BigInt("0xffffffffffffffff");
+function readMvhd(mvhd) {
+  const version = mvhd[0];
+  if (version === 1) {
+    if (mvhd.length < 32) return undefined;
+    const timescale = mvhd.readUInt32BE(20);
+    const duration = mvhd.readBigUInt64BE(24);
+    if (timescale === 0 || duration === ALL_ONES_64) {
+      return undefined;
     }
     return {
-      match: false,
-      tried: tried.concat(filePath)
+      timescale,
+      duration: Number(duration)
     };
   }
+  if (mvhd.length < 20) return undefined;
+  const timescale = mvhd.readUInt32BE(12);
+  const duration = mvhd.readUInt32BE(16);
+  // All ones means "unknown" in a version 0 box.
+  if (timescale === 0 || duration === 0xffffffff) {
+    return undefined;
+  }
+  return {
+    timescale,
+    duration
+  };
+}
+function readMehd(mehd) {
+  if (mehd[0] === 1) {
+    return mehd.length >= 12 ? Number(mehd.readBigUInt64BE(4)) : undefined;
+  }
+  return mehd.length >= 8 ? mehd.readUInt32BE(4) : undefined;
 }
 
 /**
- * An implementation of methods in the various ts.*Host interfaces
- * that uses ValFS to resolve modules and read/write files.
+ * The size a track is SHOWN at: tkhd's width and height, swapped when the
+ * display matrix turns the picture a quarter turn — a phone records upright
+ * video sideways and says so here, and a page lays it out as it is shown.
  */
-
-class ValFSHost {
-  constructor(valFS, currentDirectory) {
-    this.valFS = valFS;
-    this.currentDirectory = currentDirectory;
-  }
-  useCaseSensitiveFileNames = true;
-  readDirectory(rootDir, extensions, excludes, includes, depth) {
-    return this.valFS.readDirectory(rootDir, extensions, excludes, includes, depth);
-  }
-  rmFile(fileName) {
-    this.valFS.rmFile(fileName);
-  }
-  writeFile(fileName, text, encoding) {
-    this.valFS.writeFile(fileName, text, encoding);
-  }
-  getCurrentDirectory() {
-    return this.currentDirectory;
-  }
-  getCanonicalFileName(fileName) {
-    if (path.isAbsolute(fileName)) {
-      return path.normalize(fileName);
-    }
-    return path.resolve(this.getCurrentDirectory(), fileName);
-  }
-  fileExists(fileName) {
-    return this.valFS.fileExists(fileName);
-  }
-  readFile(fileName) {
-    return this.valFS.readFile(fileName);
-  }
-  readBuffer(fileName) {
-    return this.valFS.readBuffer(fileName);
-  }
-  realpath(path) {
-    return this.valFS.realpath(path);
+function readTkhd(tkhd) {
+  // Past the version-specific times and ids, then 16 bytes of reserved,
+  // layer, alternate group, volume and reserved, then the 36-byte matrix.
+  const matrixAt = tkhd[0] === 1 ? 4 + 32 + 16 : 4 + 20 + 16;
+  const widthAt = matrixAt + 36;
+  if (tkhd.length < widthAt + 8) {
+    return undefined;
   }
+  const a = tkhd.readInt32BE(matrixAt);
+  const b = tkhd.readInt32BE(matrixAt + 4);
+  const c = tkhd.readInt32BE(matrixAt + 12);
+  const d = tkhd.readInt32BE(matrixAt + 16);
+  const width = Math.round(tkhd.readUInt32BE(widthAt) / 0x10000);
+  const height = Math.round(tkhd.readUInt32BE(widthAt + 4) / 0x10000);
+  const quarterTurn = a === 0 && d === 0 && b !== 0 && c !== 0;
+  return quarterTurn ? {
+    width: height,
+    height: width
+  } : {
+    width,
+    height
+  };
 }
 
 /**
- * The size and length of an ISO base media file (`.mp4`, `.m4v`, `.mov`),
- * read from its headers. Nothing is decoded.
+ * The size and length of a Matroska file (`.webm`, and `.mkv`, which is the
+ * same container), read from its headers. Nothing is decoded.
  *
- * Hand-written rather than a media library, deliberately: `@valbuild/server`
- * is loaded by every app that runs Val, and the four numbers wanted here are
- * three small boxes away from the start of the `moov` box:
+ * Hand-written for the same reason `isoBmff.ts` is: `@valbuild/server` is
+ * loaded by every app that runs Val, and what is wanted here is a handful of
+ * integers two levels into the file:
  *
- *   moov > mvhd                  timescale and duration (version 0 and 1)
- *   moov > mvex > mehd           duration of a FRAGMENTED file, whose mvhd says 0
- *   moov > trak > tkhd           width and height (16.16 fixed point) and the
- *                                display matrix, for a rotated phone video
- *   moov > trak > mdia > hdlr    `vide`: which trak is the picture
+ *   EBML                          the header; a file without one is not Matroska
+ *   Segment > Info                TimecodeScale and Duration
+ *   Segment > Tracks > TrackEntry TrackType 1 (video) >
+ *     Video                       PixelWidth / PixelHeight, and DisplayWidth /
+ *                                 DisplayHeight when they are in pixels
  *
- * Only the box headers are read on the way to `moov`, and then `moov` itself,
- * so a multi-GB file costs a few small reads: `mdat` is seeked past, never
- * loaded. That is what {@link ByteSource} is for.
- */
-
-/** Random access to a file's bytes, so a large `mdat` can be skipped. */
-
-function bufferByteSource(buffer) {
-  return {
-    size: buffer.length,
-    read: (offset, length) => buffer.subarray(offset, offset + length)
-  };
-}
-
-/**
- * Run `read` against a file on disk, reading only what it asks for. The file
- * is closed afterwards whatever happens.
- */
-function withFileByteSource(absolutePath, read) {
-  const fd = fs.openSync(absolutePath, "r");
-  try {
-    const size = fs.fstatSync(fd).size;
-    return read({
-      size,
-      read: (offset, length) => {
-        const wanted = Math.max(0, Math.min(length, size - offset));
-        const buffer = Buffer.alloc(wanted);
-        let filled = 0;
-        while (filled < wanted) {
-          const n = fs.readSync(fd, buffer, filled, wanted - filled, offset + filled);
-          if (n === 0) {
-            break;
-          }
-          filled += n;
-        }
-        return buffer.subarray(0, filled);
-      }
-    });
-  } finally {
-    fs.closeSync(fd);
-  }
-}
-/**
- * A `moov` larger than this is not a header worth reading into memory. A
- * two-hour film's is a few MB; this is far past any real one.
- */
-const MAX_MOOV_SIZE = 64 * 1024 * 1024;
-
-/**
- * Whatever of {@link IsoBmffMetadata} the file declares. A field that cannot be
- * read is absent; nothing here throws on a file that is not ISO BMFF.
- */
-function readIsoBmffMetadata(source) {
-  const moov = findTopLevelBox(source, "moov");
-  if (!moov) {
-    return {};
-  }
-  const metadata = {};
-  const mvhd = childBox(moov, "mvhd");
-  const timescaleAndDuration = mvhd ? readMvhd(mvhd) : undefined;
-  if (timescaleAndDuration) {
-    const {
-      timescale,
-      duration
-    } = timescaleAndDuration;
-    if (duration > 0) {
-      metadata.duration = duration / timescale;
-    } else {
-      // A fragmented file (CMAF) says 0 in mvhd and puts the length in mehd,
-      // in the same timescale.
-      const mehd = childBox(childBox(moov, "mvex"), "mehd");
-      const fragmentDuration = mehd ? readMehd(mehd) : undefined;
-      if (fragmentDuration !== undefined && fragmentDuration > 0) {
-        metadata.duration = fragmentDuration / timescale;
-      }
-    }
-  }
-  for (const trak of childBoxes(moov, "trak")) {
-    const hdlr = childBox(childBox(trak, "mdia"), "hdlr");
-    if (!hdlr || hdlr.length < 12 || hdlr.toString("latin1", 8, 12) !== "vide") {
-      continue;
-    }
-    const tkhd = childBox(trak, "tkhd");
-    const size = tkhd ? readTkhd(tkhd) : undefined;
-    if (size && size.width > 0 && size.height > 0) {
-      metadata.width = size.width;
-      metadata.height = size.height;
-      break;
-    }
-  }
-  return metadata;
-}
-
-/** The payload (after the header) of the first top-level box of a type. */
-function findTopLevelBox(source, type) {
-  let offset = 0;
-  while (offset + 8 <= source.size) {
-    const header = source.read(offset, 16);
-    if (header.length < 8) {
-      return undefined;
-    }
-    let size = header.readUInt32BE(0);
-    const boxType = header.toString("latin1", 4, 8);
-    let headerSize = 8;
-    if (size === 1) {
-      if (header.length < 16) {
-        return undefined;
-      }
-      size = Number(header.readBigUInt64BE(8));
-      headerSize = 16;
-    } else if (size === 0) {
-      size = source.size - offset;
-    }
-    if (size < headerSize) {
-      return undefined;
-    }
-    if (boxType === type) {
-      if (size - headerSize > MAX_MOOV_SIZE) {
-        return undefined;
-      }
-      const payload = source.read(offset + headerSize, size - headerSize);
-      return payload.length === size - headerSize ? payload : undefined;
-    }
-    offset += size;
-  }
-  return undefined;
-}
-
-/** Each child box of a container payload, as `[type, payload]`. */
-function* boxesIn(payload) {
-  let offset = 0;
-  while (offset + 8 <= payload.length) {
-    let size = payload.readUInt32BE(offset);
-    const type = payload.toString("latin1", offset + 4, offset + 8);
-    let headerSize = 8;
-    if (size === 1) {
-      if (offset + 16 > payload.length) {
-        return;
-      }
-      size = Number(payload.readBigUInt64BE(offset + 8));
-      headerSize = 16;
-    } else if (size === 0) {
-      size = payload.length - offset;
-    }
-    if (size < headerSize || offset + size > payload.length) {
-      return;
-    }
-    yield [type, payload.subarray(offset + headerSize, offset + size)];
-    offset += size;
-  }
-}
-function childBoxes(payload, type) {
-  if (!payload) {
-    return [];
-  }
-  const found = [];
-  for (const [boxType, child] of boxesIn(payload)) {
-    if (boxType === type) {
-      found.push(child);
-    }
-  }
-  return found;
-}
-function childBox(payload, type) {
-  return childBoxes(payload, type)[0];
-}
-
-/** "Unknown" in a version 1 box. Not a literal: `0x…n` needs an ES2020 target. */
-const ALL_ONES_64 = BigInt("0xffffffffffffffff");
-function readMvhd(mvhd) {
-  const version = mvhd[0];
-  if (version === 1) {
-    if (mvhd.length < 32) return undefined;
-    const timescale = mvhd.readUInt32BE(20);
-    const duration = mvhd.readBigUInt64BE(24);
-    if (timescale === 0 || duration === ALL_ONES_64) {
-      return undefined;
-    }
-    return {
-      timescale,
-      duration: Number(duration)
-    };
-  }
-  if (mvhd.length < 20) return undefined;
-  const timescale = mvhd.readUInt32BE(12);
-  const duration = mvhd.readUInt32BE(16);
-  // All ones means "unknown" in a version 0 box.
-  if (timescale === 0 || duration === 0xffffffff) {
-    return undefined;
-  }
-  return {
-    timescale,
-    duration
-  };
-}
-function readMehd(mehd) {
-  if (mehd[0] === 1) {
-    return mehd.length >= 12 ? Number(mehd.readBigUInt64BE(4)) : undefined;
-  }
-  return mehd.length >= 8 ? mehd.readUInt32BE(4) : undefined;
-}
-
-/**
- * The size a track is SHOWN at: tkhd's width and height, swapped when the
- * display matrix turns the picture a quarter turn — a phone records upright
- * video sideways and says so here, and a page lays it out as it is shown.
- */
-function readTkhd(tkhd) {
-  // Past the version-specific times and ids, then 16 bytes of reserved,
-  // layer, alternate group, volume and reserved, then the 36-byte matrix.
-  const matrixAt = tkhd[0] === 1 ? 4 + 32 + 16 : 4 + 20 + 16;
-  const widthAt = matrixAt + 36;
-  if (tkhd.length < widthAt + 8) {
-    return undefined;
-  }
-  const a = tkhd.readInt32BE(matrixAt);
-  const b = tkhd.readInt32BE(matrixAt + 4);
-  const c = tkhd.readInt32BE(matrixAt + 12);
-  const d = tkhd.readInt32BE(matrixAt + 16);
-  const width = Math.round(tkhd.readUInt32BE(widthAt) / 0x10000);
-  const height = Math.round(tkhd.readUInt32BE(widthAt + 4) / 0x10000);
-  const quarterTurn = a === 0 && d === 0 && b !== 0 && c !== 0;
-  return quarterTurn ? {
-    width: height,
-    height: width
-  } : {
-    width,
-    height
-  };
-}
-
-/**
- * The size and length of a Matroska file (`.webm`, and `.mkv`, which is the
- * same container), read from its headers. Nothing is decoded.
- *
- * Hand-written for the same reason `isoBmff.ts` is: `@valbuild/server` is
- * loaded by every app that runs Val, and what is wanted here is a handful of
- * integers two levels into the file:
- *
- *   EBML                          the header; a file without one is not Matroska
- *   Segment > Info                TimecodeScale and Duration
- *   Segment > Tracks > TrackEntry TrackType 1 (video) >
- *     Video                       PixelWidth / PixelHeight, and DisplayWidth /
- *                                 DisplayHeight when they are in pixels
- *
- * Matroska is EBML: every element is a variable-length ID, a variable-length
- * size and a payload. Only element HEADERS are read on the way through the
- * Segment, and then the payloads of Info and Tracks, which are a few hundred
- * bytes. The Clusters — the frames, which are the file — are never read: the
- * walk stops at the first one.
- *
- * That is allowed because the spec (RFC 9559, section 6.3) requires the first
- * Info and Tracks to come before the first Cluster, or to be named by a
- * SeekHead that does. A file written by a browser's MediaRecorder, or by
- * anything else that streams, does not know its own length when it starts:
- * its Segment and Clusters have the "unknown" size, and its Info has no
- * Duration. The Segment is then read as running to the end of the file, and
- * the duration is left out rather than counted from the Clusters — a caller
- * reports it, as it does for a fragmented mp4.
+ * Matroska is EBML: every element is a variable-length ID, a variable-length
+ * size and a payload. Only element HEADERS are read on the way through the
+ * Segment, and then the payloads of Info and Tracks, which are a few hundred
+ * bytes. The Clusters — the frames, which are the file — are never read: the
+ * walk stops at the first one.
+ *
+ * That is allowed because the spec (RFC 9559, section 6.3) requires the first
+ * Info and Tracks to come before the first Cluster, or to be named by a
+ * SeekHead that does. A file written by a browser's MediaRecorder, or by
+ * anything else that streams, does not know its own length when it starts:
+ * its Segment and Clusters have the "unknown" size, and its Info has no
+ * Duration. The Segment is then read as running to the end of the file, and
+ * the duration is left out rather than counted from the Clusters — a caller
+ * reports it, as it does for a fragmented mp4.
  */
 
 const EBML_HEADER = 0x1a45dfa3;
@@ -10508,7 +10219,18 @@ function getValidationErrorFileRef(validationError) {
 }
 
 const textEncoder$1 = new TextEncoder();
-async function checkRemoteRef(remoteHost, ref, projectRoot, schema, metadata) {
+async function checkRemoteRef(
+/**
+ * Unused: a re-derived ref keeps the host it already names (see below).
+ * Kept so the exported signature does not change.
+ */
+_remoteHost, ref, projectRoot, schema, metadata,
+/**
+ * Where the bytes come from when the ref has to be re-derived. Defaults to
+ * a download cached under `projectRoot`; the Studio passes one that keeps
+ * nothing on disk (`FixFiles.readRemoteFile`).
+ */
+readRemote = (ref, fileExt, fileHash) => getFileBufferFromRemote(ref, fileExt, fileHash, projectRoot)) {
   const remoteRefDataRes = Internal.remote.splitRemoteRef(ref);
   if (remoteRefDataRes.status === "error") {
     return remoteRefDataRes;
@@ -10553,7 +10275,7 @@ async function checkRemoteRef(remoteHost, ref, projectRoot, schema, metadata) {
     };
   }
   // Validation hash does not match, so we need to re-validate the remote content
-  const fileBufferRes = await getFileBufferFromRemote(ref, fileExt, remoteRefDataRes.fileHash, projectRoot);
+  const fileBufferRes = await readRemote(ref, fileExt, remoteRefDataRes.fileHash);
 
   // We could not download the remote file for some reason (for example, the file hash is wrong)
   if (fileBufferRes.status === "error") {
@@ -10579,7 +10301,7 @@ async function checkRemoteRef(remoteHost, ref, projectRoot, schema, metadata) {
   } catch (err) {
     return {
       status: "error",
-      error: `Failed to extract metadata from remote file: ${err instanceof Error ? err.message : "Unknown error"}. Cached file: ${fileBufferRes.cachedFilePath}`
+      error: `Failed to extract metadata from remote file: ${err instanceof Error ? err.message : "Unknown error"}${fileBufferRes.cachedFilePath ? `. Cached file: ${fileBufferRes.cachedFilePath}` : ""}`
     };
   }
   const updatedMetadata = {
@@ -10598,7 +10320,11 @@ async function checkRemoteRef(remoteHost, ref, projectRoot, schema, metadata) {
   return {
     status: "fix-required",
     metadata: updatedMetadata,
-    ref: Internal.remote.createRemoteRef(remoteHost, {
+    // On the host the ref was already on. Re-deriving a ref changes what it
+    // says about the file, never where it is served from: a Hosted project's
+    // file is in R2 and served only at its own address, and moving a ref to
+    // another host is a fix of its own (`remote:rewrite-host`).
+    ref: Internal.remote.createRemoteRef(remoteRefDataRes.remoteHost, {
       publicProjectId: remoteRefDataRes.projectId,
       coreVersion,
       bucket: remoteRefDataRes.bucket,
@@ -10617,6 +10343,12 @@ function getCachedRemoteFilePath(fileExt, currentFileHash, remoteFileCacheDir) {
   const remoteFilePath = path.join(remoteFileCacheDir, currentFileHash + "." + fileExt);
   return remoteFilePath;
 }
+
+/**
+ * A remote file's bytes, and the hash they actually have — which is the one a
+ * re-derived ref is made from, whatever hash the old ref claimed.
+ */
+
 async function getFileBufferFromRemote(ref, fileExt, currentFileHash, projectRoot) {
   const remoteFileCacheDir = getCachedRemoteFileDir(projectRoot);
   const remoteFilePath = getCachedRemoteFilePath(fileExt, currentFileHash, remoteFileCacheDir);
@@ -10655,14 +10387,55 @@ async function getFileBufferFromRemote(ref, fileExt, currentFileHash, projectRoo
     cachedFilePath: remoteFilePath
   };
 }
+
+/**
+ * Download a remote file to `filePath`, from where its ref says -- and, for a
+ * platform ref whose host fails, from the same file on the project's own
+ * `valstart.dev` address, which always serves it (`fallbackRefOf`). The bytes
+ * from the fallback are checked against the ref's file hash before they are
+ * kept: a different host answering is only safe because of that check.
+ *
+ * Rejects with the FIRST host's error when both fail: that is the one the ref
+ * names, and the one a person can recognise.
+ */
 async function downloadFileFromRemote(ref, filePath) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(ref);
+  try {
+    return await downloadFromUrl(ref, filePath);
+  } catch (err) {
+    const fallback = fallbackRefOf(ref);
+    const parsed = Internal.remote.splitRemoteRef(ref);
+    if (fallback === null || parsed.status === "error") {
+      throw err;
+    }
+    try {
+      const res = await downloadFromUrl(fallback, filePath);
+      if (res.status === "error") {
+        throw err;
+      }
+    } catch {
+      throw err;
+    }
+    const bytes = await fs.promises.readFile(filePath);
+    if (Internal.remote.getFileHash(bytes) !== parsed.fileHash) {
+      await fs.promises.unlink(filePath).catch(() => undefined);
+      throw new Error(`${ref}. Its host failed, and the file at ${fallback} is not the one the ref names.`, {
+        cause: err
+      });
+    }
+    return {
+      status: "success",
+      filePath
+    };
+  }
+}
+async function downloadFromUrl(ref, filePath) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(ref);
     const client = url.protocol === "https:" ? https$1 : http$1;
     const request = client.get(url, response => {
       if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
         // Handle redirects
-        return downloadFileFromRemote(response.headers.location, filePath).then(resolve).catch(reject);
+        return downloadFromUrl(response.headers.location, filePath).then(resolve).catch(reject);
       }
       if (response.statusCode == 404) {
         return reject(new Error(`${ref}. File not found. The URL is most likely incorrect.`));
@@ -10683,6 +10456,45 @@ async function downloadFileFromRemote(ref, filePath) {
   });
 }
 
+/**
+ * Where `createFixPatch` reads a project file's bytes, and where it puts a
+ * remote file it was asked to download.
+ *
+ * Every path is the file's path from the project root, the way a source names
+ * it: `/public/val/logo.png`, never an absolute path on some disk. That is the
+ * point: a project in http mode, or one the platform serves from a Worker, has
+ * no disk to join a path onto, and a fix that reads a file has to work there
+ * too. `diskFixFiles` is the one the CLI and the language server use, and does
+ * exactly what `createFixPatch` did with `fs` before this existed.
+ *
+ * Not yet covered, and still read from `projectRoot` directly: the CLI's
+ * listing of a media directory for files it does not track, and
+ * `videos:check-all-files` (`videosetCheckAllFilesPatch`), which lists one.
+ * See `docs/plans/studio-validate.md`.
+ */
+
+/** {@link FixFiles} over a project on disk. */
+function diskFixFiles(projectRoot) {
+  const absolute = filePath => path.join(projectRoot, filePath);
+  return {
+    readFile: filePath => fs.promises.readFile(absolute(filePath)),
+    readVideoMetadata: filePath => extractVideoMetadataFromFile(absolute(filePath)),
+    // Kept under `.val/remote-file-cache`, so the next run does not download
+    // it again.
+    readRemoteFile: (ref, fileExt, fileHash) => getFileBufferFromRemote(ref, fileExt, fileHash, projectRoot),
+    saveRemoteFile: async (url, filePath) => {
+      const target = absolute(filePath);
+      await fs.promises.mkdir(path.dirname(target), {
+        recursive: true
+      });
+      const res = await downloadFileFromRemote(url, target);
+      return res.status === "error" ? res : {
+        status: "success"
+      };
+    }
+  };
+}
+
 const textEncoder = new TextEncoder();
 
 /**
@@ -10719,6 +10531,7 @@ async function openRemoteUploadSession(ctx) {
   let publicProjectId = ctx.publicProjectId;
   let remoteFileBuckets = ctx.remoteFileBuckets;
   let remoteFilesCounter = ctx.remoteFilesCounter;
+  let remoteHost = ctx.remote.remoteHost;
   if (!publicProjectId || !remoteFileBuckets) {
     if (!projectName) {
       return fail("Project name not found. Add project name to val.config or set the VAL_PROJECT environment variable");
@@ -10731,6 +10544,7 @@ async function openRemoteUploadSession(ctx) {
     }
     publicProjectId = settingsRes.data.publicProjectId;
     remoteFileBuckets = settingsRes.data.remoteFileBuckets.map(b => b.bucket);
+    remoteHost = settingsRes.data.remoteHost ?? remoteHost;
   }
   if (!publicProjectId) {
     return fail("Could not get public project id");
@@ -10751,7 +10565,8 @@ async function openRemoteUploadSession(ctx) {
       publicProjectId,
       bucket,
       remoteFileBuckets,
-      remoteFilesCounter
+      remoteFilesCounter,
+      remoteHost
     }
   };
 }
@@ -10773,7 +10588,7 @@ async function uploadBytesToRemote(ctx, session, relativeFilePath, fileBuffer, m
   const fileHash = Internal.remote.getFileHash(fileBuffer);
   const coreVersion = Internal.VERSION.core || "unknown";
   const fileExt = getFileExt(relativeFilePath);
-  const ref = Internal.remote.createRemoteRef(ctx.remote.remoteHost, {
+  const ref = Internal.remote.createRemoteRef(session.remoteHost, {
     publicProjectId: session.publicProjectId,
     coreVersion,
     bucket: session.bucket,
@@ -12291,7 +12106,7 @@ async function videosetCheckAllFilesPatch({
  * `alt` and anything already there are someone's, and stay.
  */
 async function videosetAddMetadataPatch({
-  projectRoot,
+  files,
   sourcePath,
   validationError,
   moduleSource,
@@ -12325,7 +12140,7 @@ async function videosetAddMetadataPatch({
   }
   let metadata;
   try {
-    metadata = galleryEntryOf(key).remote ? await extractVideoMetadataFromUrl(key, nameForTypeOf(key)) : await extractVideoMetadataFromFile(path.join(projectRoot, key));
+    metadata = galleryEntryOf(key).remote ? await extractVideoMetadataFromUrl(key, nameForTypeOf(key)) : await files.readVideoMetadata(key);
   } catch (err) {
     return fail(`Failed to read video metadata from ${key}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -12423,9 +12238,10 @@ function mediaValueOf(value) {
 async function createFixPatch(config, apply, sourcePath, validationError, remoteFiles, moduleSource, moduleSchema) {
   const remainingErrors = [];
   const patch = [];
+  const files = config.files ?? diskFixFiles(config.projectRoot);
   for (const fix of validationError.fixes || []) {
     if (fix === "image:check-metadata" || fix === "image:add-metadata") {
-      const imageMetadata = await getImageMetadata(config.projectRoot, validationError);
+      const imageMetadata = await getImageMetadata(files, validationError);
       if (imageMetadata.width === undefined || imageMetadata.height === undefined) {
         remainingErrors.push({
           ...validationError,
@@ -12492,7 +12308,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
         }
       }
     } else if (fix === "file:add-metadata" || fix === "file:check-metadata") {
-      const fileMetadata = await getFileMetadata(config.projectRoot, validationError);
+      const fileMetadata = await getFileMetadata(files, validationError);
       if (fileMetadata === undefined) {
         remainingErrors.push({
           ...validationError,
@@ -12553,7 +12369,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       }
       let metadata;
       try {
-        metadata = await getVideoMetadata(config.projectRoot, fileRef);
+        metadata = await getVideoMetadata(files, fileRef);
       } catch (err) {
         remainingErrors.push({
           ...validationError,
@@ -12589,7 +12405,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       // A set entry's twin of `video:add-metadata`: the file is the entry's
       // KEY, and only what is missing is written.
       const fixed = await videosetAddMetadataPatch({
-        projectRoot: config.projectRoot,
+        files,
         sourcePath,
         validationError,
         moduleSource,
@@ -12613,9 +12429,9 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       let metadata = remoteFile.metadata;
       if (!metadata) {
         if (fix === "image:upload-remote") {
-          metadata = await getImageMetadata(config.projectRoot, validationError);
+          metadata = await getImageMetadata(files, validationError);
         } else if (fix === "file:upload-remote") {
-          metadata = await getFileMetadata(config.projectRoot, validationError);
+          metadata = await getFileMetadata(files, validationError);
         }
       }
       if (!metadata) {
@@ -12749,11 +12565,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
         });
         continue;
       }
-      const absoluteFilePath = path.join(config.projectRoot, splitRemoteRefDataRes.filePath);
-      await fs.promises.mkdir(path.dirname(absoluteFilePath), {
-        recursive: true
-      });
-      const res = await downloadFileFromRemote(url, absoluteFilePath);
+      const res = await files.saveRemoteFile(url, filePath);
       if (res.status === "error") {
         remainingErrors.push({
           ...validationError,
@@ -12789,10 +12601,9 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           // image as unreadable, and with `--fix` REMOVED it from the gallery.
           continue;
         }
-        const filename = path.join(config.projectRoot, entry.localPath);
         let buffer;
         try {
-          buffer = fs.readFileSync(filename);
+          buffer = await files.readFile(entry.localPath);
         } catch {
           if (apply) {
             const removePath = sourceToPatchPath(sourcePath).concat([entryKey]);
@@ -12805,16 +12616,16 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           } else {
             remainingErrors.push({
               ...validationError,
-              message: `Could not read file: ${filename} - file might not exist or can not be accessed`,
+              message: `Could not read file: ${path.join(config.projectRoot, entry.localPath)} - file might not exist or can not be accessed`,
               fixes: undefined
             });
           }
           continue;
         }
         if (fix === "images:check-all-files") {
-          const actualMetadata = await extractImageMetadata(filename, buffer);
+          const actualMetadata = await extractImageMetadata(entry.localPath, buffer);
           const stored = storedEntry;
-          const metadataIsCorrect = stored.width === actualMetadata.width && stored.height === actualMetadata.height && stored.mimeType === actualMetadata.mimeType;
+          const metadataIsCorrect = mediaDirEntryMismatches("images", stored, actualMetadata).length === 0;
           if (!metadataIsCorrect) {
             if (apply) {
               patch.push({
@@ -12839,9 +12650,9 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
             }
           }
         } else if (fix === "files:check-all-files") {
-          const actualMetadata = await extractFileMetadata(filename);
+          const actualMetadata = await extractFileMetadata(entry.localPath);
           const stored = storedEntry;
-          const metadataIsCorrect = stored.mimeType === actualMetadata.mimeType;
+          const metadataIsCorrect = mediaDirEntryMismatches("files", stored, actualMetadata).length === 0;
           if (!metadataIsCorrect) {
             if (apply) {
               patch.push({
@@ -12899,7 +12710,27 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
         schema: schemaAtPath
       } = Internal.resolvePath(modulePath, moduleSource, moduleSchema);
       if (schemaAtPath.type === "image" || schemaAtPath.type === "file") {
-        const res = await checkRemoteRef(config.remoteHost, v.path, config.projectRoot, schemaAtPath, v.metadata);
+        // First, whether the ref's host still serves its project at all: a
+        // ref on a domain the project dropped is pointed at the project's own
+        // address, not re-derived from bytes nobody can download from there.
+        const moved = await movedRemoteHost(v.path, config.askHostProject);
+        if (moved) {
+          if (apply) {
+            patch.push({
+              op: "replace",
+              path: sourceToPatchPath(sourcePath).concat(["path"]),
+              value: moved.ref
+            });
+          } else {
+            remainingErrors.push({
+              ...validationError,
+              message: `${moved.why}. Run 'val validate --fix' to point it at ${moved.to}, which always serves it.`,
+              fixes: ["remote:rewrite-host"]
+            });
+          }
+          continue;
+        }
+        const res = await checkRemoteRef(config.remoteHost, v.path, config.projectRoot, schemaAtPath, v.metadata, files.readRemoteFile);
         if (res.status === "success") ; else if (res.status === "error") {
           remainingErrors.push({
             ...validationError,
@@ -12928,162 +12759,966 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
             fixes: undefined
           });
         }
-      } else {
-        remainingErrors.push({
-          ...validationError,
-          message: "Could not check remote ref: schema type is not image or file: " + (schemaAtPath === null || schemaAtPath === void 0 ? void 0 : schemaAtPath.type),
-          fixes: undefined
-        });
+      } else {
+        remainingErrors.push({
+          ...validationError,
+          message: "Could not check remote ref: schema type is not image or file: " + (schemaAtPath === null || schemaAtPath === void 0 ? void 0 : schemaAtPath.type),
+          fixes: undefined
+        });
+      }
+    } else if (fix === "remote:rewrite-host") {
+      // The new ref is derived from the old one alone, so nothing the error
+      // carries is trusted: the value is read from the module, and only a
+      // platform ref that is not already on the project's own address moves.
+      const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
+      const current = moduleSource !== undefined && moduleSchema !== undefined ? Internal.resolvePath(modulePath, moduleSource, moduleSchema).source : undefined;
+      const ref = typeof current === "object" && current !== null && "path" in current && typeof current.path === "string" ? current.path : undefined;
+      const parsed = ref === undefined ? undefined : Internal.remote.splitRemoteRef(ref);
+      const rewritten = ref !== undefined && (parsed === null || parsed === void 0 ? void 0 : parsed.status) === "success" && needsHostCheck(parsed.remoteHost, parsed.projectId) ? rewriteRefHost(ref, fallbackRemoteHost(parsed.projectId)) : null;
+      if (rewritten === null) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot point this at the project's own address: it is not a platform ref on another host",
+          fixes: undefined
+        });
+        continue;
+      }
+      patch.push({
+        op: "replace",
+        path: sourceToPatchPath(sourcePath).concat(["path"]),
+        value: rewritten
+      });
+    } else if (fix === "view:check-module") {
+      // The schema is the authority: it names the module, and there is exactly
+      // one valid pointer. So this is written rather than reported — nobody has
+      // a decision to make here.
+      const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
+      if (moduleSource === undefined || moduleSchema === undefined) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Unexpected error while checking a view (no module source or schema)",
+          fixes: undefined
+        });
+        continue;
+      }
+      const {
+        schema: schemaAtPath
+      } = Internal.resolvePath(modulePath, moduleSource, moduleSchema);
+      if (schemaAtPath.type !== "view") {
+        remainingErrors.push({
+          ...validationError,
+          message: `Could not fix view: schema at ${sourcePath} is '${schemaAtPath.type}', not a view`,
+          fixes: undefined
+        });
+        continue;
+      }
+      if (apply) {
+        patch.push({
+          op: "replace",
+          path: Internal.createPatchPath(modulePath),
+          value: {
+            view: schemaAtPath.moduleFilePath
+          }
+        });
+      } else {
+        remainingErrors.push({
+          ...validationError,
+          message: `This view points at the wrong module. Expected '${schemaAtPath.moduleFilePath}'.`
+        });
+      }
+    }
+  }
+  if (!validationError.fixes || validationError.fixes.length === 0) {
+    remainingErrors.push(validationError);
+  }
+  return {
+    patch,
+    remainingErrors
+  };
+}
+function getRemoteValueFromValidationError(v) {
+  if (v.value && typeof v.value !== "object") {
+    return {
+      success: false,
+      message: "Unexpected error while checking remote (not an object)"
+    };
+  }
+  if (!v.value) {
+    return {
+      success: false,
+      message: "Unexpected error while checking remote (no value)"
+    };
+  }
+  if (typeof v.value !== "object" || v.value === null || !("path" in v.value)) {
+    return {
+      success: false,
+      message: "Unexpected error while checking remote (no path in value)"
+    };
+  }
+  if (typeof v.value.path !== "string") {
+    return {
+      success: false,
+      message: "Unexpected error while checking remote (path is not a string)"
+    };
+  }
+  // Everything but the path is what Val read from the bytes.
+  const {
+    path,
+    ...metadata
+  } = v.value;
+  return {
+    success: true,
+    path,
+    metadata
+  };
+}
+
+/** The fields of a video that are read from its bytes, in the order written. */
+const VIDEO_METADATA_FIELDS = ["mimeType", "width", "height", "duration"];
+
+/**
+ * The video a `video:add-metadata` error is about, read from the module at its
+ * path when the module is at hand — the schema there decides that it IS a
+ * video — and from the error's own value otherwise.
+ */
+function currentVideoValue(sourcePath, validationError, moduleSource, moduleSchema) {
+  if (moduleSource !== undefined && moduleSchema !== undefined) {
+    const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
+    const resolved = Internal.resolvePath(modulePath, moduleSource, moduleSchema);
+    if (resolved.schema.type !== "video") {
+      return {
+        status: "error",
+        message: `Could not add video metadata: schema at ${sourcePath} is '${resolved.schema.type}', not a video`
+      };
+    }
+    const value = mediaValueOf(resolved.source);
+    return value ? {
+      status: "ok",
+      value
+    } : {
+      status: "error",
+      message: "Video is not an object!"
+    };
+  }
+  const value = mediaValueOf(validationError.value);
+  return value ? {
+    status: "ok",
+    value
+  } : {
+    status: "error",
+    message: "Video is not an object!"
+  };
+}
+async function getVideoMetadata(files, fileRef) {
+  // Not read into memory: only the headers are, and a video is mostly not
+  // headers. A remote video's headers are read over HTTP, with Range
+  // requests, so it is not downloaded either.
+  if (Internal.isRemoteMediaPath(fileRef)) {
+    return extractVideoMetadataFromUrl(fileRef, nameForTypeOf(fileRef));
+  }
+  return files.readVideoMetadata(fileRef);
+}
+async function getImageMetadata(files, validationError) {
+  const fileRef = getValidationErrorFileRef(validationError);
+  if (!fileRef) {
+    // TODO:
+    throw Error("Cannot fix image without a file reference");
+  }
+  return extractImageMetadata(fileRef, await files.readFile(fileRef));
+}
+async function getFileMetadata(files, validationError) {
+  const fileRef = getValidationErrorFileRef(validationError);
+  if (!fileRef) {
+    // TODO:
+    throw Error("Cannot fix file without a file reference");
+  }
+  return extractFileMetadata(fileRef, await files.readFile(fileRef));
+}
+
+/**
+ * What an image or file directory's entry records that its bytes disagree
+ * with, as `[field, recorded, actual]`. The one comparison: the CLI's
+ * `*:check-all-files` fix and the Studio's full check both ask it.
+ */
+function mediaDirEntryMismatches(type, stored, actual) {
+  const fields = type === "images" ? ["width", "height", "mimeType"] : ["mimeType"];
+  return fields.filter(field => stored[field] !== actual[field]).map(field => [field, stored[field], actual[field]]);
+}
+
+/**
+ * The Studio's full check, one module at a time: what `/validate` and
+ * `/validate/fix` answer with. See `docs/plans/studio-validate.md`.
+ *
+ * Both take the sources the caller is looking at — base plus the patches it
+ * names — so an error is about the content on the editor's screen, and a fix
+ * is a patch on top of it.
+ */
+
+/**
+ * Every error in one module: its sources against its schema, and its local
+ * files against their bytes.
+ *
+ * Not filtered the way the publish gate filters (`partitionValidationErrors`):
+ * the errors the gate hides because "the server repairs them on save" are the
+ * ones this check exists to show, since nothing repairs them in http mode.
+ *
+ * Remote files are checked too: a stale ref is an error with a fix, and a
+ * host that does not serve them is reported once, as a host, rather than as
+ * an error on every image it holds (`checkRemoteFiles`).
+ *
+ * Not yet here: the media directories' own entries, step 5 of the plan.
+ */
+async function checkModuleForStudio(ops, input) {
+  const {
+    moduleFilePath,
+    schemas,
+    sources
+  } = input;
+  if (!schemas[moduleFilePath]) {
+    return {
+      status: "unknown-module"
+    };
+  }
+  const validation = await ops.validateSources(schemas, sources, undefined, [moduleFilePath]);
+  const moduleErrors = validation.errors[moduleFilePath];
+  if (moduleErrors !== null && moduleErrors !== void 0 && moduleErrors.invalidSource) {
+    return {
+      status: "invalid-source",
+      message: moduleErrors.invalidSource.message
+    };
+  }
+  const errors = {};
+  const add = (sourcePath, found) => {
+    errors[sourcePath] = (errors[sourcePath] ?? []).concat(found);
+  };
+  for (const [sourcePath, found] of Object.entries((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.validations) ?? {})) {
+    add(sourcePath, found);
+  }
+  // `validateSources` hands back every local file whose metadata it could
+  // not judge without the bytes — which is every image that has metadata at
+  // all. Reading them is what turns "has metadata" into "has the RIGHT
+  // metadata".
+  const fileErrors = await ops.validateFiles(schemas, sources, validation.files, input.fileLastUpdatedByPatchId);
+  for (const [sourcePath, found] of Object.entries(fileErrors)) {
+    add(sourcePath, found);
+  }
+  const remote = await ops.validateRemoteFiles(schemas, sources, validation.remoteFiles, input.fileLastUpdatedByPatchId, input.network);
+  for (const [sourcePath, found] of Object.entries(remote.errors)) {
+    add(sourcePath, found);
+  }
+  const mediaDir = await checkMediaDirEntries(ops, input);
+  for (const [sourcePath, found] of Object.entries(mediaDir.errors)) {
+    add(sourcePath, found);
+  }
+  return {
+    status: "ok",
+    errors,
+    remoteHosts: [...remote.hosts, ...mediaDir.hosts]
+  };
+}
+
+/** A module that is an `s.imagedir()`, `s.filedir()` or `s.videodir()`. */
+
+function mediaDirOf(input) {
+  var _input$schemas$input$;
+  const schema = (_input$schemas$input$ = input.schemas[input.moduleFilePath]) === null || _input$schemas$input$ === void 0 ? void 0 : _input$schemas$input$["executeSerialize"]();
+  const source = input.sources[input.moduleFilePath];
+  if ((schema === null || schema === void 0 ? void 0 : schema.type) !== "record" || !schema.mediaType || typeof schema.dir !== "string" || !isEntries(source)) {
+    return undefined;
+  }
+  return {
+    type: schema.mediaType,
+    dir: schema.dir,
+    entries: source
+  };
+}
+function isEntries(source) {
+  return typeof source === "object" && source !== null && !Array.isArray(source);
+}
+
+/**
+ * A media directory's own entries against their files: what
+ * `*:check-all-files` asks, minus the listing of the directory on disk.
+ *
+ * Only what the directory TRACKS is checked. Listing the directory for files
+ * it does not track stays the CLI's: in a managed project nothing puts a file
+ * there but the directory itself, and in a connected one the files are in the
+ * repository, where `val validate` sees them. See
+ * `docs/plans/studio-validate.md`, "Media directories are checked by what
+ * they track".
+ *
+ * - **A local entry** is read through the ops, from the pending patch that
+ *   wrote it if there is one. Gone: the row's **Fix** removes the entry. Wrong
+ *   size or type: the row's **Fix** writes what the bytes say. Both are
+ *   `*:check-all-files`, built for that one entry (see `fixForStudio`).
+ * - **A video entry** is only asked whether its file is there, and gets no
+ *   fix: what a videodir records is read in the browser from the upload, and
+ *   is never compared with the file (`videosetCheckAllFilesPatch` says why).
+ * - **A remote entry** is asked of its host, as any remote file is, but only
+ *   whether the host has it (`existenceOnly`).
+ */
+async function checkMediaDirEntries(ops, input, onlyKey) {
+  const errors = {};
+  const mediaDir = mediaDirOf(input);
+  if (!mediaDir) {
+    return {
+      errors,
+      hosts: []
+    };
+  }
+  const files = opsFixFiles(ops, input.fileLastUpdatedByPatchId);
+  const remoteEntries = {};
+  const type = mediaDir.type;
+  const keys = Object.keys(mediaDir.entries).filter(key => onlyKey === undefined || key === onlyKey).sort();
+  for (const key of keys) {
+    const entryPath = Internal.createValPathOfItem(input.moduleFilePath, key);
+    if (!entryPath) {
+      continue;
+    }
+    const entry = galleryEntryOf(key);
+    if (entry.remote) {
+      remoteEntries[entryPath] = {
+        path: key
+      };
+      continue;
+    }
+    if (type === "videos") {
+      // A video: there or not, and nothing else. See above.
+      const fromPatch = input.fileLastUpdatedByPatchId[entry.localPath] ?? null;
+      const reader = await ops.openBinaryFile(entry.localPath, fromPatch);
+      if (reader === null) {
+        errors[entryPath] = [{
+          message: "The file is gone, but the directory still lists it. Remove it from the directory, or put the file back.",
+          keyError: true
+        }];
+      }
+      continue;
+    }
+    const checkFix = type === "images" ? "images:check-all-files" : "files:check-all-files";
+    let buffer;
+    try {
+      buffer = await files.readFile(entry.localPath);
+    } catch {
+      errors[entryPath] = [{
+        message: "The file is gone, but the directory still lists it. Fix removes it from the directory.",
+        keyError: true,
+        fixes: [checkFix]
+      }];
+      continue;
+    }
+    const stored = mediaDir.entries[key];
+    if (typeof stored !== "object" || stored === null) {
+      // The record schema already reports an entry that is not an object.
+      continue;
+    }
+    const actual = type === "images" ? await extractImageMetadata(entry.localPath, buffer) : await extractFileMetadata(entry.localPath);
+    const mismatches = mediaDirEntryMismatches(type, {
+      ...stored
+    }, actual);
+    if (mismatches.length > 0) {
+      errors[entryPath] = [{
+        message: `Does not match the file: ${mismatches.map(([field, recorded, read]) => `${field} ${String(recorded ?? "missing")} → ${String(read)}`).join(", ")}.`,
+        keyError: true,
+        fixes: [checkFix]
+      }];
+    }
+  }
+  if (Object.keys(remoteEntries).length === 0) {
+    return {
+      errors,
+      hosts: []
+    };
+  }
+  const sampleByHost = ops.sourceMode() === "managed";
+  const published = sampleByHost ? (await ops.getSources()).sources[input.moduleFilePath] : undefined;
+  const remote = await checkRemoteFiles({
+    remoteFiles: remoteEntries,
+    existenceOnly: true,
+    schemaAt: () => undefined,
+    // A directory's entry IS its key: published when the published directory
+    // has the same key.
+    isPublished: (_, ref) => typeof published === "object" && published !== null && !Array.isArray(published) && ref in published,
+    pendingBytes: ops.pendingBytesOf(input.fileLastUpdatedByPatchId),
+    sampleByHost,
+    ...input.network
+  });
+  for (const [path, found] of Object.entries(remote.errors)) {
+    errors[path] = (errors[path] ?? []).concat(found.map(error => ({
+      ...error,
+      keyError: true
+    })));
+  }
+  return {
+    errors,
+    hosts: remote.hosts
+  };
+}
+/**
+ * The patch that fixes one error, built from the server's own reading of the
+ * module rather than from the error the caller saw.
+ *
+ * The caller names the error by where it is and which fix it wants; the error
+ * itself is found again here. That is what keeps a stale or hand-written
+ * request from steering `createFixPatch` (CLAUDE.md, "Adding a ValidationFix
+ * code"), and it is what lets an error reported at a FIELD be fixed at the
+ * media value it belongs to: `validateFiles` reports a wrong width at
+ * `…"hero"."width"`, while the fix rewrites `…"hero"`.
+ *
+ * Only {@link isStudioFix} codes are built. The others need a disk or a
+ * remote host this server may not have, and are the CLI's for now.
+ */
+async function fixForStudio(ops, input) {
+  var _validation$errors$mo, _input$network;
+  const {
+    moduleFilePath,
+    schemas,
+    sources,
+    fix
+  } = input;
+  if (!isStudioFix(fix)) {
+    return {
+      status: "not-in-studio"
+    };
+  }
+  const schema = schemas[moduleFilePath];
+  if (!schema) {
+    return {
+      status: "unknown-module"
+    };
+  }
+  const validation = await ops.validateSources(schemas, sources, undefined, [moduleFilePath]);
+  const found = await findError(ops, ((_validation$errors$mo = validation.errors[moduleFilePath]) === null || _validation$errors$mo === void 0 ? void 0 : _validation$errors$mo.validations) ?? {}, validation.files, validation.remoteFiles, input);
+  if (!found) {
+    return {
+      status: "not-found"
+    };
+  }
+  const res = await createFixPatch({
+    // Nothing a Studio fix runs reads `projectRoot`: every byte goes through
+    // `files`. An empty root means a fix that slipped past that fails to
+    // find its file rather than reading one off this server's disk.
+    projectRoot: "",
+    // A re-derived ref stays on the host it was on. Moving refs to another
+    // host is its own fix (step 6 of the plan), not a side effect of this.
+    remoteHost: found.remoteHost ?? DEFAULT_VAL_REMOTE_HOST,
+    files: opsFixFiles(ops, input.fileLastUpdatedByPatchId),
+    askHostProject: (_input$network = input.network) === null || _input$network === void 0 ? void 0 : _input$network.askHostProject
+  }, true, found.sourcePath, found.error, {}, found.moduleSource ?? sources[moduleFilePath], schema["executeSerialize"]());
+  if (!res) {
+    return {
+      status: "not-found"
+    };
+  }
+  return {
+    status: "ok",
+    patch: res.patch,
+    remainingErrors: res.remainingErrors
+  };
+}
+async function findError(ops, validations, files, remoteFiles, input) {
+  var _validations$sourcePa;
+  const {
+    sourcePath,
+    fix
+  } = input;
+  const reported = (_validations$sourcePa = validations[sourcePath]) === null || _validations$sourcePa === void 0 ? void 0 : _validations$sourcePa.find(error => {
+    var _error$fixes;
+    return (_error$fixes = error.fixes) === null || _error$fixes === void 0 ? void 0 : _error$fixes.includes(fix);
+  });
+  if (reported) {
+    return {
+      sourcePath,
+      error: reported
+    };
+  }
+  if (fix === "images:check-all-files" || fix === "files:check-all-files") {
+    var _checked$errors$sourc;
+    // One entry, checked again on its own: a row whose file someone has since
+    // put back, or whose entry someone already fixed, is "not found".
+    const mediaDir = mediaDirOf(input);
+    const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
+    const [key, ...rest] = modulePath ? Internal.splitModulePath(modulePath) : [];
+    if (!mediaDir || key === undefined || rest.length > 0) {
+      return undefined;
+    }
+    const checked = await checkMediaDirEntries(ops, input, key);
+    const error = (_checked$errors$sourc = checked.errors[sourcePath]) === null || _checked$errors$sourc === void 0 ? void 0 : _checked$errors$sourc.find(candidate => {
+      var _candidate$fixes;
+      return (_candidate$fixes = candidate.fixes) === null || _candidate$fixes === void 0 ? void 0 : _candidate$fixes.includes(fix);
+    });
+    if (!error) {
+      return undefined;
+    }
+    return {
+      // `createFixPatch` fixes a directory at its root, every entry it is
+      // handed: so it is handed this one.
+      sourcePath: Internal.parentOfSourcePath(sourcePath),
+      error: {
+        message: error.message,
+        value: {
+          dir: mediaDir.dir,
+          type: mediaDir.type
+        },
+        fixes: [fix]
+      },
+      moduleSource: {
+        [key]: mediaDir.entries[key]
+      }
+    };
+  }
+  if (fix === "image:check-remote" || fix === "file:check-remote" || fix === "remote:rewrite-host") {
+    var _checked$errors$sourc2;
+    // Every remote value is in `remoteFiles`, sound or not, so check it again
+    // before rewriting it: a ref someone already fixed, or whose host serves
+    // the project again, is "not found", not a download and an identical ref.
+    const value = remoteFiles[sourcePath];
+    if (!value) {
+      return undefined;
+    }
+    const checked = await ops.validateRemoteFiles(input.schemas, input.sources, {
+      [sourcePath]: value
+    }, input.fileLastUpdatedByPatchId, input.network);
+    const found = (_checked$errors$sourc2 = checked.errors[sourcePath]) === null || _checked$errors$sourc2 === void 0 ? void 0 : _checked$errors$sourc2.find(error => {
+      var _error$fixes2;
+      return (_error$fixes2 = error.fixes) === null || _error$fixes2 === void 0 ? void 0 : _error$fixes2.includes(fix);
+    });
+    const parsed = Internal.remote.splitRemoteRef(value.path);
+    if (!found || parsed.status === "error") {
+      return undefined;
+    }
+    return {
+      sourcePath,
+      error: found,
+      remoteHost: parsed.remoteHost
+    };
+  }
+  if (fix !== "image:check-metadata" && fix !== "file:check-metadata") {
+    return undefined;
+  }
+  // A metadata mismatch is reported by `validateFiles`, at the field that is
+  // wrong, and always as `image:check-metadata` — even for a file, which has
+  // no width to read. So the media value is found from the field, and the fix
+  // is chosen by what its schema says it is.
+  for (const [mediaPathS, value] of Object.entries(files)) {
+    const mediaPath = mediaPathS;
+    const type = mediaTypeAt(mediaPath, input);
+    if (!type) {
+      continue;
+    }
+    const fieldPaths = getFieldsForType(type).map(field => Internal.createValPathOfItem(mediaPath, field));
+    if (mediaPath === sourcePath || fieldPaths.includes(sourcePath)) {
+      // Every image with metadata is in `files`, right or wrong — being there
+      // only means "not yet compared with its bytes". So compare it, and fix
+      // only one that is actually wrong: a stale request for an image someone
+      // has since fixed is "not found", not an empty patch.
+      const mismatches = await ops.validateFiles(input.schemas, input.sources, {
+        [mediaPath]: value
+      }, input.fileLastUpdatedByPatchId);
+      if (Object.keys(mismatches).length === 0) {
+        return undefined;
+      }
+      return {
+        sourcePath: mediaPath,
+        error: {
+          message: "Metadata does not match the file",
+          value,
+          fixes: [type === "image" ? "image:check-metadata" : "file:check-metadata"]
+        }
+      };
+    }
+  }
+  return undefined;
+}
+function mediaTypeAt(sourcePath, {
+  moduleFilePath,
+  schemas,
+  sources
+}) {
+  const schema = schemas[moduleFilePath];
+  if (!schema) {
+    return undefined;
+  }
+  const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
+  try {
+    const {
+      schema: atPath
+    } = Internal.resolvePath(modulePath, sources[moduleFilePath], schema["executeSerialize"]());
+    return atPath.type === "image" || atPath.type === "file" ? atPath.type : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * {@link FixFiles} over whatever store this server has: the disk in fs mode,
+ * the content service in http mode. A file a pending patch wrote is read from
+ * that patch, as `validateFiles` reads it, so a fix is made from the bytes
+ * the check was made from.
+ */
+function opsFixFiles(ops, fileLastUpdatedByPatchId) {
+  const readFile = async filePath => {
+    const fromPatch = fileLastUpdatedByPatchId[filePath];
+    const buffer = fromPatch ? await ops.getBase64EncodedBinaryFileFromPatch(filePath, fromPatch.patchId, fromPatch.remote) : await ops.getBinaryFile(filePath);
+    if (buffer === null) {
+      throw new Error(`Could not read ${filePath}`);
+    }
+    // A view of the same bytes, not a copy: the readers below take a Buffer,
+    // and ops answer with a Uint8Array because they run in a browser too.
+    return Buffer.from(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+  };
+  return {
+    readFile,
+    readVideoMetadata: async filePath => extractVideoMetadata(filePath, await readFile(filePath)),
+    readRemoteFile: readRemoteFileOverHttp,
+    saveRemoteFile: async () => ({
+      status: "error",
+      error: "Downloading a remote file is not available in the Studio yet. Run `val validate --fix` in the project."
+    })
+  };
+}
+
+/**
+ * A remote file's bytes, downloaded and kept nowhere: this server may have no
+ * disk to keep them on (http mode, a Worker on the platform).
+ *
+ * A platform ref whose host fails is read from the project's own
+ * `valstart.dev` address instead (`fallbackRefOf`), and those bytes are kept
+ * only if they hash to what the ref names: a different host answering is safe
+ * because of that check, and only because of it.
+ */
+const readRemoteFileOverHttp = async ref => {
+  const first = await fetchBytes(ref);
+  if (first.status === "success") {
+    return first;
+  }
+  const fallback = fallbackRefOf(ref);
+  const parsed = Internal.remote.splitRemoteRef(ref);
+  if (fallback === null || parsed.status === "error") {
+    return first;
+  }
+  const second = await fetchBytes(fallback);
+  if (second.status === "success" && second.fileHash === parsed.fileHash) {
+    return second;
+  }
+  return first;
+};
+async function fetchBytes(url) {
+  try {
+    const res = await fetch(url, {
+      signal: AbortSignal.timeout(30_000)
+    });
+    if (!res.ok) {
+      return {
+        status: "error",
+        error: `The file could not be downloaded from its address: HTTP ${res.status}.`
+      };
+    }
+    const fileBuffer = Buffer.from(await res.arrayBuffer());
+    return {
+      status: "success",
+      fileBuffer,
+      fileHash: Internal.remote.getFileHash(fileBuffer)
+    };
+  } catch (err) {
+    return {
+      status: "error",
+      error: `The file could not be downloaded from its address: ${err instanceof Error ? err.message : "unknown error"}.`
+    };
+  }
+}
+
+/** The platform every server on Node runs with. See {@link ValServerPlatform}. */
+const nodePlatform = {
+  createOps: createValOps,
+  probeUrl: url => probeUrl(url),
+  jwt: {
+    verifyJwt,
+    decodeJwtWithoutVerifying,
+    encodeJwt,
+    getExpire
+  },
+  bytesToBase64: bytes => Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64"),
+  readValLoginToken,
+  resolveRemoteFileAuth,
+  studioValidation: {
+    checkModuleForStudio,
+    fixForStudio
+  }
+};
+
+async function createValServer(valModules, route, opts, config, callbacks, formatter,
+/**
+ * Called after a save has applied its patches. EXPERIMENTAL — see
+ * `ValServerOptions.commitPrepared`.
+ */
+commitPrepared,
+/**
+ * What a publish does in http mode. EXPERIMENTAL — see
+ * `ValServerOptions.publishOverride`.
+ */
+publishOverride) {
+  const valServerConfig = await initHandlerOptions(route, opts, config);
+  return ValServer(valModules, {
+    formatter,
+    commitPrepared,
+    publishOverride,
+    ...valServerConfig
+  }, callbacks, nodePlatform);
+}
+
+// TODO: remove
+/**
+ * `fs` and `path` are imported INSIDE this function, not at the top of the file.
+ *
+ * This is the only thing in this module that touches either, and it is a local
+ * development convenience: scanning upwards for a `.git` to guess the commit and
+ * branch. A static import put `fs` in the module graph of everything reaching
+ * `createValApiRouter` -- which is every server integration, including ones that
+ * run where there is no filesystem. Workerd provides no `fs`, so such a build
+ * could not be bundled at all without stubbing it.
+ *
+ * The `await import` costs nothing here: the only caller is the CLI, on a
+ * machine that has both.
+ */
+async function safeReadGit(cwd) {
+  const {
+    promises: fs
+  } = await import('fs');
+  const path = await import('path');
+  async function findGitHead(currentDir, depth) {
+    const gitHeadPath = path.join(currentDir, ".git", "HEAD");
+    if (depth > 1000) {
+      console.error(`Reached max depth while scanning for .git folder. Current working dir: ${cwd}.`);
+      return {
+        commit: undefined,
+        branch: undefined
+      };
+    }
+    try {
+      const headContents = await fs.readFile(gitHeadPath, "utf-8");
+      const match = headContents.match(/^ref: refs\/heads\/(.+)/);
+      if (match) {
+        const branchName = match[1];
+        return {
+          branch: branchName,
+          commit: await readCommit(currentDir, branchName)
+        };
+      } else {
+        return {
+          commit: undefined,
+          branch: undefined
+        };
+      }
+    } catch {
+      const parentDir = path.dirname(currentDir);
+
+      // We've reached the root directory
+      if (parentDir === currentDir) {
+        return {
+          commit: undefined,
+          branch: undefined
+        };
+      }
+      return findGitHead(parentDir, depth + 1);
+    }
+  }
+  try {
+    return findGitHead(cwd, 0);
+  } catch (err) {
+    console.error("Error while reading .git", err);
+    return {
+      commit: undefined,
+      branch: undefined
+    };
+  }
+}
+
+/** Only reached from {@link safeReadGit}; same reason for the local imports. */
+async function readCommit(gitDir, branchName) {
+  const {
+    promises: fs
+  } = await import('fs');
+  const path = await import('path');
+  try {
+    return (await fs.readFile(path.join(gitDir, ".git", "refs", "heads", branchName), "utf-8")).trim();
+  } catch {
+    return undefined;
+  }
+}
+function createValApiRouter(route, valServerPromise, convert) {
+  const uiRequestHandler = createUIRequestHandler();
+  return createValRequestHandler(route, valServerPromise, convert, uiRequestHandler);
+}
+
+const JsFileLookupMapping = [
+// NOTE: first one matching will be used
+[".cjs.d.ts", [".esm.js", ".mjs.js"]], [".cjs.js", [".esm.js", ".mjs.js"]], [".cjs", [".mjs"]], [".d.ts", [".js", ".esm.js", ".mjs.js"]]];
+const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
+const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
+
+class ValModuleLoader {
+  cache;
+  cacheSize;
+  constructor(projectRoot, compilerOptions,
+  // TODO: remove this?
+  sourceFileHandler, host = {
+    ...ts.sys,
+    writeFile: (fileName, data, encoding) => {
+      fs.mkdirSync(path.dirname(fileName), {
+        recursive: true
+      });
+      fs.writeFileSync(fileName, typeof data === "string" ? data : new Uint8Array(data), encoding);
+    },
+    rmFile: fs.rmSync,
+    readBuffer: fileName => {
+      try {
+        return fs.readFileSync(fileName);
+      } catch {
+        return undefined;
+      }
+    }
+  }, disableCache = false) {
+    this.projectRoot = projectRoot;
+    this.compilerOptions = compilerOptions;
+    this.sourceFileHandler = sourceFileHandler;
+    this.host = host;
+    this.disableCache = disableCache;
+    this.cache = {};
+    this.cacheSize = 0;
+  }
+  getModule(modulePath) {
+    if (!modulePath) {
+      throw Error(`Illegal module path: "${modulePath}"`);
+    }
+    const code = this.host.readFile(modulePath);
+    if (!code) {
+      throw Error(`Could not read file "${modulePath}"`);
+    }
+    let compiledCode;
+    if (this.cache[code] && !this.disableCache) {
+      // TODO: use hash instead of code as key
+      compiledCode = this.cache[code];
+    } else {
+      compiledCode = transform(code, {
+        filePath: modulePath,
+        disableESTransforms: true,
+        transforms: ["typescript"]
+      }).code;
+      if (!this.disableCache) {
+        if (this.cacheSize > MAX_CACHE_SIZE) {
+          console.warn("Cache size exceeded, clearing cache");
+          this.cache = {};
+          this.cacheSize = 0;
+        }
+        if (code.length < MAX_OBJECT_KEY_SIZE) {
+          this.cache[code] = compiledCode;
+          this.cacheSize += code.length + compiledCode.length; // code is mostly ASCII so 1 byte per char
+        }
       }
-    } else if (fix === "view:check-module") {
-      // The schema is the authority: it names the module, and there is exactly
-      // one valid pointer. So this is written rather than reported — nobody has
-      // a decision to make here.
-      const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
-      if (moduleSource === undefined || moduleSchema === undefined) {
-        remainingErrors.push({
-          ...validationError,
-          message: "Unexpected error while checking a view (no module source or schema)",
-          fixes: undefined
-        });
-        continue;
+    }
+    return compiledCode;
+  }
+  resolveModulePath(containingFilePath, requestedModuleName) {
+    var _this$host$realpath, _this$host;
+    let sourceFileName = this.sourceFileHandler.resolveSourceModulePath(containingFilePath, requestedModuleName);
+    if (requestedModuleName === "@vercel/stega") {
+      sourceFileName = this.sourceFileHandler.resolveSourceModulePath(containingFilePath, "@vercel/stega").replace("stega/dist", "stega/dist/esm");
+    }
+    const matches = this.findMatchingJsFile(sourceFileName);
+    if (matches.match === false) {
+      let debugInfo = "";
+      if (sourceFileName.includes("val.config")) {
+        debugInfo = `\n@valbuild directory scan:\n${this.host.readDirectory("/", ["js", "ts", "json"], [], ["**/@valbuild/*"]).join("\n")}`;
       }
-      const {
-        schema: schemaAtPath
-      } = Internal.resolvePath(modulePath, moduleSource, moduleSchema);
-      if (schemaAtPath.type !== "view") {
-        remainingErrors.push({
-          ...validationError,
-          message: `Could not fix view: schema at ${sourcePath} is '${schemaAtPath.type}', not a view`,
-          fixes: undefined
-        });
-        continue;
+      throw Error(`Could not find matching js file for module "${requestedModuleName}" requested by: "${containingFilePath}". Tried:\n${matches.tried.join("\n")}${debugInfo}`);
+    }
+    const filePath = matches.match;
+    // resolve all symlinks (preconstruct for example symlinks the dist folder)
+    const followedPath = ((_this$host$realpath = (_this$host = this.host).realpath) === null || _this$host$realpath === void 0 ? void 0 : _this$host$realpath.call(_this$host, filePath)) ?? filePath;
+    if (!followedPath) {
+      throw Error(`File path was empty: "${filePath}", containing file: "${containingFilePath}", requested module: "${requestedModuleName}"`);
+    }
+    return followedPath;
+  }
+  findMatchingJsFile(filePath) {
+    let requiresReplacements = false;
+    for (const [currentEnding] of JsFileLookupMapping) {
+      if (filePath.endsWith(currentEnding)) {
+        requiresReplacements = true;
+        break;
       }
-      if (apply) {
-        patch.push({
-          op: "replace",
-          path: Internal.createPatchPath(modulePath),
-          value: {
-            view: schemaAtPath.moduleFilePath
+    }
+    // avoid unnecessary calls to fileExists if we don't need to replace anything
+    if (!requiresReplacements) {
+      if (this.host.fileExists(filePath)) {
+        return {
+          match: filePath
+        };
+      }
+    }
+    const tried = [];
+    for (const [currentEnding, replacements] of JsFileLookupMapping) {
+      if (filePath.endsWith(currentEnding)) {
+        for (const replacement of replacements) {
+          const newFilePath = filePath.slice(0, -currentEnding.length) + replacement;
+          if (this.host.fileExists(newFilePath)) {
+            return {
+              match: newFilePath
+            };
+          } else {
+            tried.push(newFilePath);
           }
-        });
-      } else {
-        remainingErrors.push({
-          ...validationError,
-          message: `This view points at the wrong module. Expected '${schemaAtPath.moduleFilePath}'.`
-        });
+        }
       }
     }
-  }
-  if (!validationError.fixes || validationError.fixes.length === 0) {
-    remainingErrors.push(validationError);
-  }
-  return {
-    patch,
-    remainingErrors
-  };
-}
-function getRemoteValueFromValidationError(v) {
-  if (v.value && typeof v.value !== "object") {
-    return {
-      success: false,
-      message: "Unexpected error while checking remote (not an object)"
-    };
-  }
-  if (!v.value) {
-    return {
-      success: false,
-      message: "Unexpected error while checking remote (no value)"
-    };
-  }
-  if (typeof v.value !== "object" || v.value === null || !("path" in v.value)) {
-    return {
-      success: false,
-      message: "Unexpected error while checking remote (no path in value)"
-    };
-  }
-  if (typeof v.value.path !== "string") {
     return {
-      success: false,
-      message: "Unexpected error while checking remote (path is not a string)"
+      match: false,
+      tried: tried.concat(filePath)
     };
   }
-  // Everything but the path is what Val read from the bytes.
-  const {
-    path,
-    ...metadata
-  } = v.value;
-  return {
-    success: true,
-    path,
-    metadata
-  };
 }
 
-/** The fields of a video that are read from its bytes, in the order written. */
-const VIDEO_METADATA_FIELDS = ["mimeType", "width", "height", "duration"];
-
 /**
- * The video a `video:add-metadata` error is about, read from the module at its
- * path when the module is at hand — the schema there decides that it IS a
- * video — and from the error's own value otherwise.
+ * An implementation of methods in the various ts.*Host interfaces
+ * that uses ValFS to resolve modules and read/write files.
  */
-function currentVideoValue(sourcePath, validationError, moduleSource, moduleSchema) {
-  if (moduleSource !== undefined && moduleSchema !== undefined) {
-    const [, modulePath] = Internal.splitModuleFilePathAndModulePath(sourcePath);
-    const resolved = Internal.resolvePath(modulePath, moduleSource, moduleSchema);
-    if (resolved.schema.type !== "video") {
-      return {
-        status: "error",
-        message: `Could not add video metadata: schema at ${sourcePath} is '${resolved.schema.type}', not a video`
-      };
+
+class ValFSHost {
+  constructor(valFS, currentDirectory) {
+    this.valFS = valFS;
+    this.currentDirectory = currentDirectory;
+  }
+  useCaseSensitiveFileNames = true;
+  readDirectory(rootDir, extensions, excludes, includes, depth) {
+    return this.valFS.readDirectory(rootDir, extensions, excludes, includes, depth);
+  }
+  rmFile(fileName) {
+    this.valFS.rmFile(fileName);
+  }
+  writeFile(fileName, text, encoding) {
+    this.valFS.writeFile(fileName, text, encoding);
+  }
+  getCurrentDirectory() {
+    return this.currentDirectory;
+  }
+  getCanonicalFileName(fileName) {
+    if (path.isAbsolute(fileName)) {
+      return path.normalize(fileName);
     }
-    const value = mediaValueOf(resolved.source);
-    return value ? {
-      status: "ok",
-      value
-    } : {
-      status: "error",
-      message: "Video is not an object!"
-    };
+    return path.resolve(this.getCurrentDirectory(), fileName);
   }
-  const value = mediaValueOf(validationError.value);
-  return value ? {
-    status: "ok",
-    value
-  } : {
-    status: "error",
-    message: "Video is not an object!"
-  };
-}
-async function getVideoMetadata(projectRoot, fileRef) {
-  // Not read into memory: only the headers are, and a video is mostly not
-  // headers. A remote video's headers are read over HTTP, with Range
-  // requests, so it is not downloaded either.
-  if (Internal.isRemoteMediaPath(fileRef)) {
-    return extractVideoMetadataFromUrl(fileRef, nameForTypeOf(fileRef));
+  fileExists(fileName) {
+    return this.valFS.fileExists(fileName);
   }
-  return extractVideoMetadataFromFile(path.join(projectRoot, fileRef));
-}
-async function getImageMetadata(projectRoot, validationError) {
-  const fileRef = getValidationErrorFileRef(validationError);
-  if (!fileRef) {
-    // TODO:
-    throw Error("Cannot fix image without a file reference");
+  readFile(fileName) {
+    return this.valFS.readFile(fileName);
   }
-  const filename = path.join(projectRoot, fileRef);
-  const buffer = fs.readFileSync(filename);
-  return extractImageMetadata(filename, buffer);
-}
-async function getFileMetadata(projectRoot, validationError) {
-  const fileRef = getValidationErrorFileRef(validationError);
-  if (!fileRef) {
-    // TODO:
-    throw Error("Cannot fix file without a file reference");
+  readBuffer(fileName) {
+    return this.valFS.readBuffer(fileName);
+  }
+  realpath(path) {
+    return this.valFS.realpath(path);
   }
-  const filename = path.join(projectRoot, fileRef);
-  fs.readFileSync(filename);
-  return extractFileMetadata(fileRef);
 }
 
 /**
@@ -13766,6 +14401,26 @@ async function handleViewCheckModule(ctx) {
     shouldApplyPatch: true
   };
 }
+
+/**
+ * `remote:rewrite-host`: a platform ref whose host no longer serves its
+ * project. The server's full check reports it, and so does `createFixPatch`'s
+ * `image:check-remote` branch, which is how `val validate` finds it: that
+ * branch asks the host first. Either way the patch is `createFixPatch`'s, and
+ * needs nothing but the ref -- the new host is derived from it.
+ */
+async function handleRemoteRewriteHost(ctx) {
+  if (!ctx.fix) {
+    return {
+      success: true,
+      fixableErrorMessage: `${ctx.validationError.message} ` + "Run 'val validate --fix' to point it at the project's own address."
+    };
+  }
+  return {
+    success: true,
+    shouldApplyPatch: true
+  };
+}
 async function handleExternalUpload() {
   return {
     success: true,
@@ -13807,7 +14462,8 @@ const currentFixHandlers = {
   "files:check-all-files": handleCheckAllFiles,
   "jsonValues:extract-entry": handleJsonValuesExtractEntry,
   "external:upload": handleExternalUpload,
-  "view:check-module": handleViewCheckModule
+  "view:check-module": handleViewCheckModule,
+  "remote:rewrite-host": handleRemoteRewriteHost
 };
 const deprecatedFixHandlers = {
   "image:replace-metadata": handleFileMetadata