@valbuild/server 0.148.1 → 0.148.3

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @valbuild/server
 
+## 0.148.3
+
+### Patch Changes
+
+- [#881](https://github.com/valbuild/val/pull/881) [`0139436`](https://github.com/valbuild/val/commit/0139436426142d91cbb29ec6c696dfb86f34ab9d) Thanks [@freekh](https://github.com/freekh)! - The content analytics script. With analytics on (it is off by default, and turned on in a hosted project's settings), a TanStack site counts which content each visitor's page **rendered** and which they actually **viewed** (at least half on screen for a second), and sends it to `/api/val/analytics`.
+
+  - No cookies, no storage, no visitor IDs. Each page view also says where it came from (the referring site's host and any `utm_source` / `utm_medium` / `utm_campaign`) and whether it was a phone, tablet or desktop.
+  - A page is sent as its route's pattern (`/posts/$postId`), never its address, so a path that holds something about one visitor (an order number, a token) is never stored. `startValAnalytics` takes this as `routeFor`; `ValProvider` passes TanStack's matched route.
+  - Editors are never counted: nothing is sent in draft mode, in the Studio, with Val enabled, or at a proposal's address, and nothing from automated browsers. A page the browser prerenders counts nothing until it is shown.
+  - The script is the new `@valbuild/react/analytics` entry, loaded only for visitors of a site with analytics on, after the page has hydrated. It imports nothing else from Val.
+  - Storing the counts and showing them is part of Val's hosting, which takes these beacons before they reach the site. Anywhere else, `/api/val/analytics` checks each beacon and stores nothing; in local development, with `VAL_DEBUG=1`, it logs a line per beacon, so you can see it working.
+  - `ValProvider`'s Studio check now matches `/val` and what is below it only, not every route starting with those letters (`/values`). The same fix is in `@valbuild/next`.
+
+- Updated dependencies [[`0139436`](https://github.com/valbuild/val/commit/0139436426142d91cbb29ec6c696dfb86f34ab9d), [`5eff8a0`](https://github.com/valbuild/val/commit/5eff8a055a4ef50d476797c28f9c3e50deb73c89)]:
+  - @valbuild/shared@0.148.3
+  - @valbuild/ui@0.148.3
+
+## 0.148.2
+
+### Patch Changes
+
+- [#889](https://github.com/valbuild/val/pull/889) [`dc7c8cc`](https://github.com/valbuild/val/commit/dc7c8ccd82f643e662d00225fabec411b5d39e3a) Thanks [@freekh](https://github.com/freekh)! - Val is quieter in your app's console. Errors and warnings you can act on still
+  print, now prefixed with `[val]` so you can filter them. Val's own debug
+  output, which used to reach your terminal and browser console, is now off by
+  default. That includes the `Invalid JWT` line that printed on every request
+  with an expired session cookie, the "verifying draft mode" and polling notices,
+  and the Studio's sync and WebSocket chatter.
+
+  To turn the debug output back on, for example when reporting a bug:
+
+  - on the server, set `VAL_DEBUG=1`
+  - in the browser, run `localStorage.setItem("val:debug", "1")` in the console.
+    It takes effect immediately, with no reload. Remove the key to turn it off
+    again.
+
+- Updated dependencies [[`dc7c8cc`](https://github.com/valbuild/val/commit/dc7c8ccd82f643e662d00225fabec411b5d39e3a)]:
+  - @valbuild/core@0.148.2
+  - @valbuild/shared@0.148.2
+  - @valbuild/ui@0.148.2
+
 ## 0.148.1
 
 ### Patch Changes

package/browser/dist/valbuild-server-browser.cjs.dev.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var core = require('@valbuild/core');
-var ValRouterCore = require('../../dist/ValRouterCore-9bdaaf89.cjs.dev.js');
+var ValRouterCore = require('../../dist/ValRouterCore-fec2cbca.cjs.dev.js');
 require('@valbuild/shared/internal');
 require('zod');
 require('zod-validation-error');

package/browser/dist/valbuild-server-browser.cjs.prod.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var core = require('@valbuild/core');
-var ValRouterCore = require('../../dist/ValRouterCore-42772c21.cjs.prod.js');
+var ValRouterCore = require('../../dist/ValRouterCore-dfb7b578.cjs.prod.js');
 require('@valbuild/shared/internal');
 require('zod');
 require('zod-validation-error');

package/browser/dist/valbuild-server-browser.esm.js

@@ -1,5 +1,5 @@
 import { DEFAULT_CONTENT_HOST } from '@valbuild/core';
-import { j as ValOpsMemory, E as bytesToBase64, y as ValServer, z as createValRequestHandler } from '../../dist/ValRouterCore-7ca3dc68.esm.js';
+import { j as ValOpsMemory, E as bytesToBase64, y as ValServer, z as createValRequestHandler } from '../../dist/ValRouterCore-2579e663.esm.js';
 import '@valbuild/shared/internal';
 import 'zod';
 import 'zod-validation-error';

package/dist/{ValRouterCore-7ca3dc68.esm.js → ValRouterCore-2579e663.esm.js}

@@ -1,5 +1,5 @@
 import { Internal, VAL_EXTENSION, extractValModules, computeValModuleShas, ImageSchema, DEFAULT_CONTENT_HOST, hasRemoteFileSchema } from '@valbuild/core';
-import { isSchemaSourceFixError, resolveSchemaSourceFixForError, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, newestCommitSha, parseJob, VAL_STUDIO_HEADER, getErrorMessageFromUnknownJson, Api } from '@valbuild/shared/internal';
+import { isSchemaSourceFixError, resolveSchemaSourceFixForError, SerializedSchema, AnalyticsBeacon, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, newestCommitSha, parseJob, VAL_STUDIO_HEADER, getErrorMessageFromUnknownJson, Api } from '@valbuild/shared/internal';
 import { z } from 'zod';
 import { fromError } from 'zod-validation-error';
 import { result, array } from '@valbuild/core/fp';
@@ -1457,7 +1457,7 @@ encode = bytesToBase64) {
   }]) => {
     if (remote) return;
     const bytes = await ops.getBase64EncodedBinaryFileFromPatch(filePath, patchId, remote).catch(error => {
-      console.error("Could not read a committed file", filePath, error);
+      Internal.log.error("Could not read a committed file", filePath, error);
       return null;
     });
     if (bytes === null) unread.push(filePath);else files[filePath] = encode(bytes);
@@ -2425,7 +2425,7 @@ class ValOps {
     for (const [moduleFilePathS, source] of Object.entries(sources)) {
       const moduleFilePath = moduleFilePathS;
       if (errors[moduleFilePath] !== undefined) {
-        console.error("Val: not adopting the committed source of a module whose patches " + "did not apply cleanly. Its content here stays as it was until the " + "modules are re-evaluated.", {
+        Internal.log.error("not adopting the committed source of a module whose patches " + "did not apply cleanly. Its content here stays as it was until the " + "modules are re-evaluated.", {
           moduleFilePath,
           errors: errors[moduleFilePath]
         });
@@ -2975,7 +2975,7 @@ class ValOps {
         if (!errors[path]) {
           errors[path] = [];
         }
-        console.error("Val: Module not found", path);
+        Internal.log.error("Module not found", path);
         errors[path].push({
           patchId: patchData.patchId,
           skipped: true,
@@ -2988,7 +2988,7 @@ class ValOps {
       }
       const patchId = patchData.patchId;
       if (errors[path]) {
-        console.error("Cannot apply patch: previous errors exists", path, errors[path]);
+        Internal.log.error("Cannot apply patch: previous errors exists", path, errors[path]);
         errors[path].push({
           patchId: patchId,
           skipped: true,
@@ -3152,7 +3152,7 @@ class ValOps {
         // applyPatch mutates the source. On add operations it adds more than once? There is something strange going on... deepClone seems to fix, but is that the right solution?
         jsonOps, applicableOps.concat(...Object.values(fileFixOps)));
         if (result.isErr(patchRes)) {
-          console.error("Could not apply patch", JSON.stringify({
+          Internal.log.error("Could not apply patch", JSON.stringify({
             path,
             patchId,
             error: patchRes.error,
@@ -3799,7 +3799,7 @@ class ValOps {
         return result.ok(entries);
       };
       const collectPatchError = (err, patchId, op) => {
-        console.error("Could not patch", JSON.stringify({
+        Internal.log.error("Could not patch", JSON.stringify({
           path,
           patchId,
           error: err,
@@ -4328,7 +4328,7 @@ class ValOps {
         // sends it again later, so an error line here would be one a minute.
         return result.err(saveRes.error);
       }
-      console.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
+      Internal.log.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
       if (saveRes.error.errorType === "patch-head-conflict") {
         return result.err({
           errorType: "patch-head-conflict"
@@ -5568,11 +5568,11 @@ const ValServer = (valModules, options, callbacks, platform) => {
           token
         };
       } else {
-        console.debug("Failed to get data from code: ", res.status);
+        Internal.log.debug("Failed to get data from code: ", res.status);
         return null;
       }
     }).catch(err => {
-      console.debug("Failed to get user from code: ", err);
+      Internal.log.debug("Failed to get user from code: ", err);
       return null;
     });
   };
@@ -6005,6 +6005,50 @@ const ValServer = (valModules, options, callbacks, platform) => {
         };
       }
     },
+    /**
+     * Content analytics beacons, outside the hosted platform.
+     *
+     * On a site Val hosts, the platform's loader answers this route before a
+     * request reaches the app, and counts. Everywhere else nothing counts yet:
+     * this checks the beacon and answers, so a site with analytics on does not
+     * fill its visitors' consoles with 404s. In local dev it also logs a line
+     * per beacon, which is how the showcase shows analytics working.
+     */
+    "/analytics": {
+      POST: async req => {
+        const parsed = AnalyticsBeacon.safeParse(req.body);
+        if (!parsed.success) {
+          const body = req.body;
+          const version = typeof body === "object" && body !== null && "v" in body ? body.v : undefined;
+          if (typeof version === "number" && version !== 1) {
+            // A newer format than this server knows: not an error.
+            return {
+              status: 200,
+              json: {
+                counted: false
+              }
+            };
+          }
+          return {
+            status: 400,
+            json: {
+              message: "Not a valid Val analytics beacon"
+            }
+          };
+        }
+        if (options.mode === "fs") {
+          const beacon = parsed.data;
+          const count = paths => Object.values(paths).reduce((n, list) => n + list.length, 0);
+          Internal.log.debug(`analytics: ${beacon.route}${beacon.view ? " (page view)" : ""}: ${count(beacon.rendered)} rendered, ${count(beacon.viewed)} viewed`);
+        }
+        return {
+          status: 200,
+          json: {
+            counted: false
+          }
+        };
+      }
+    },
     "/draft/stat": {
       GET: async req => {
         const cookies = req.cookies;
@@ -6292,7 +6336,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         // the environment when @valbuild/server was built. See getSettings.
         const settingsRes = await getSettings(options.project, remoteFileAuth, options.valContentUrl);
         if (!settingsRes.success) {
-          console.warn("Could not get remote files settings: " + settingsRes.message);
+          Internal.log.warn("Could not get remote files settings: " + settingsRes.message);
           return {
             status: 400,
             json: {
@@ -6737,7 +6781,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
           let contentBaseUrl = null;
           let contentAuthNonce = null;
           if (!options.project) {
-            console.warn("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
+            Internal.log.debug("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
           } else if (!isFsOps(serverOps)) {
             /*
              * Presigning needs a content host to presign AGAINST, and a local
@@ -6750,11 +6794,11 @@ const ValServer = (valModules, options, callbacks, platform) => {
              * the patch upload base url -- still works, and the only thing lost
              * is the browser posting AI images straight to the content host.
              */
-            console.warn("Direct content-host uploads (AI images) disabled: this store has no content host to presign against.");
+            Internal.log.debug("Direct content-host uploads (AI images) disabled: this store has no content host to presign against.");
           } else {
             const authDataRes = await getRemoteFileAuth();
             if (authDataRes.status !== 200) {
-              console.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
+              Internal.log.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
             } else {
               const corsOrigin = "*"; // TODO: add cors origin
               const presignedAuthNonce = await serverOps.getPresignedAuthNonce(options.project, corsOrigin, authDataRes.json.remoteFileAuth);
@@ -6762,7 +6806,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
                 contentBaseUrl = presignedAuthNonce.data.baseUrl;
                 contentAuthNonce = presignedAuthNonce.data.nonce;
               } else {
-                console.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
+                Internal.log.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
               }
             }
           }
@@ -6937,7 +6981,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         });
         if (fetchedPatchesRes.error) {
           // Error is singular
-          console.error("Val: Failed to get patches", fetchedPatchesRes.error);
+          Internal.log.error("Failed to get patches", fetchedPatchesRes.error);
           return {
             status: 500,
             json: {
@@ -6948,7 +6992,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         }
         if (fetchedPatchesRes.errors && Object.keys(fetchedPatchesRes.errors).length > 0) {
           // Errors is plural. Different property than above.
-          console.error("Val: Failed to get patches", fetchedPatchesRes.errors);
+          Internal.log.error("Failed to get patches", fetchedPatchesRes.errors);
           return {
             status: 500,
             json: {
@@ -6999,7 +7043,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         const ids = query.id;
         const deleteRes = await serverOps.deletePatches(ids);
         if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
-          console.error("Val: Failed to delete patches", deleteRes.errors);
+          Internal.log.error("Failed to delete patches", deleteRes.errors);
           return {
             status: 500,
             json: {
@@ -7058,7 +7102,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         }
         const moduleErrors = await serverOps.getModuleErrors();
         if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-          console.error("Val: Module errors", moduleErrors);
+          Internal.log.error("Module errors", moduleErrors);
           return {
             status: 500,
             json: {
@@ -7076,7 +7120,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
             serializedSchemas[moduleFilePath] = schema["executeSerialize"]();
           }
         } catch (e) {
-          console.error("Val: Failed to serialize schemas", e);
+          Internal.log.error("Failed to serialize schemas", e);
           return {
             status: 500,
             json: {
@@ -7262,7 +7306,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         const sourcesSha = await serverOps.getSourcesSha();
         const moduleErrors = await serverOps.getModuleErrors();
         if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-          console.error("Val: Module errors", moduleErrors);
+          Internal.log.error("Module errors", moduleErrors);
           return {
             status: 500,
             json: {
@@ -7971,11 +8015,11 @@ const ValServer = (valModules, options, callbacks, platform) => {
               ...serverOps.analyzePatches(survivors, patches.commits, commit),
               ...survivingPatches
             });
-            console.error("Val: removed unpublished changes that could not be applied", removed);
+            Internal.log.error("removed unpublished changes that could not be applied", removed);
           }
         }
         if (preparedCommit.hasErrors) {
-          console.error("Failed to create commit", JSON.stringify({
+          Internal.log.error("Failed to create commit", JSON.stringify({
             sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
             binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
           }, null, 2));
@@ -8033,7 +8077,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
               }
               const uploadRes = await serverOps.uploadRemoteFiles(preparedCommit, authRes.json.remoteFileAuth);
               if (Object.keys(uploadRes.errors).length > 0) {
-                console.error("Val: Failed to upload remote files", uploadRes.errors);
+                Internal.log.error("Failed to upload remote files", uploadRes.errors);
                 return {
                   status: 400,
                   json: {
@@ -8065,7 +8109,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
             const remoteFileAuth = (_remoteFileAuthRes = remoteFileAuthRes) === null || _remoteFileAuthRes === void 0 || (_remoteFileAuthRes = _remoteFileAuthRes.json) === null || _remoteFileAuthRes === void 0 ? void 0 : _remoteFileAuthRes.remoteFileAuth;
             const saveRes = await serverOps.saveOrUploadFiles(preparedCommit, mode, remoteFileAuth);
             if (Object.keys(saveRes.errors).length > 0) {
-              console.error("Val: Failed to save files", saveRes.errors);
+              Internal.log.error("Failed to save files", saveRes.errors);
               return {
                 status: 400,
                 json: {
@@ -8124,13 +8168,13 @@ const ValServer = (valModules, options, callbacks, platform) => {
            */
           const deleteRes = await serverOps.deletePatches(consumed);
           if ("error" in deleteRes && deleteRes.error !== undefined) {
-            console.error(`Val got an error while cleaning up patches after publish: ${deleteRes.error.message}`);
+            Internal.log.error(`got an error while cleaning up patches after publish: ${deleteRes.error.message}`);
           } else if ("errors" in deleteRes && deleteRes.errors !== undefined) {
             // Per patch, and not fatal: the files are written, so the save
             // succeeded. A patch left behind is announced again on the next
             // stat, applies to a base that already contains it, and is removed
             // then.
-            console.error("Val: could not clean up some patches after publish", deleteRes.errors);
+            Internal.log.error("could not clean up some patches after publish", deleteRes.errors);
           }
           return {
             status: 200,
@@ -8163,7 +8207,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
               commitToGit
             }) : await commitToGit();
             if (commitRes.error) {
-              console.error("Failed to commit", commitRes.error);
+              Internal.log.error("Failed to commit", commitRes.error);
               if ("isNotFastForward" in commitRes && commitRes.isNotFastForward) {
                 return {
                   status: 409,
@@ -9052,7 +9096,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         // TypeScript compiler. See `patch/ts/publishKit.ts`.
         const {
           getJsonEntryAtCommit
-        } = await import('./getJsonEntryAtCommit-40b6d9c1.esm.js');
+        } = await import('./getJsonEntryAtCommit-66544899.esm.js');
         const res = await getJsonEntryAtCommit(serverOps, req.query.commit_sha, req.query.path, req.query.key);
         if (result.isErr(res)) {
           return historyErrorResponse(res.error);
@@ -9141,7 +9185,7 @@ const ValServer = (valModules, options, callbacks, platform) => {
         const remote = query.remote === "true";
         const patchId = query.patch_id;
         if (!patchId && isHttpOps(serverOps) && remote) {
-          console.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
+          Internal.log.error(`Remote file: ${filePath} requested without patch id. This is most likely a bug in Val.`);
         }
         // Opened, not read: a video is seeked in by many small ranges, and
         // only the asked-for bytes are read where the mode can (fs).
@@ -9373,7 +9417,7 @@ async function withAuth(verifyJwt, secret, cookies, errorMessageType, handler) {
       };
     }
     return handler(verification.data).catch(err => {
-      console.error(`Failed while processing: ${errorMessageType}`, err);
+      Internal.log.error(`Failed while processing: ${errorMessageType}`, err);
       return {
         status: 500,
         json: {
@@ -9942,7 +9986,7 @@ class ValOpsMemory extends ValOps {
     this.contentUrl = options.contentUrl;
     this.requiresAuth = !options.unsafelyAllowUnauthenticated;
     if (options.unsafelyAllowUnauthenticated && options.warnUnauthenticated !== false) {
-      console.warn("Val: serving memory mode WITHOUT authentication. Every request that " + "reaches this server may read content, create patches and trigger a " + "publish. Only correct if the host authorises requests before they " + "get here.");
+      Internal.log.warn("serving memory mode WITHOUT authentication. Every request that " + "reaches this server may read content, create patches and trigger a " + "publish. Only correct if the host authorises requests before they " + "get here.");
     }
     this.sourceFiles = Object.fromEntries(Object.entries(options.sourceFiles).map(([path, text]) => [ValOpsMemory.key(path), text]));
   }
@@ -10444,7 +10488,7 @@ function createValRequestHandler(route, valServerPromise, convert, serveStatic)
         message: "Val: could not start the Val server",
         details: err instanceof Error ? err.message : String(err)
       };
-      console.error(error.message + ": " + error.details);
+      Internal.log.error(error.message + ": " + error.details);
       return convert({
         status: 500,
         json: error
@@ -10456,7 +10500,7 @@ function createValRequestHandler(route, valServerPromise, convert, serveStatic)
         message: "Val: routes are not configured correctly",
         details: `Check you api routes. Expected pathname to start with "${route}", but it was: "${url.pathname}"`
       };
-      console.error(error);
+      Internal.log.error(error);
       return convert({
         status: 500,
         json: error
@@ -10647,7 +10691,7 @@ function createValRequestHandler(route, valServerPromise, convert, serveStatic)
         });
       } catch (err) {
         const error = err instanceof Error ? err : new Error(String(err));
-        console.error(`Val: ${method} ${route} threw: ${error.message}`, error.stack);
+        Internal.log.error(`${method} ${route} threw: ${error.message}`, error.stack);
         return {
           status: 500,
           json: {