@valbuild/server 0.33.0 → 0.35.0

package/dist/valbuild-server.cjs.dev.js

@@ -7,14 +7,13 @@ var ts = require('typescript');
 var fp = require('@valbuild/core/fp');
 var core = require('@valbuild/core');
 var patch = require('@valbuild/core/patch');
+var crypto = require('crypto');
 var path = require('path');
 var fs = require('fs');
 var sucrase = require('sucrase');
-var express = require('express');
-var server = require('@valbuild/ui/server');
 var z = require('zod');
-var crypto = require('crypto');
-var stream = require('stream');
+var internal = require('@valbuild/shared/internal');
+var server = require('@valbuild/ui/server');
 var sizeOf = require('image-size');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -38,11 +37,10 @@ function _interopNamespace(e) {
 }
 
 var ts__default = /*#__PURE__*/_interopDefault(ts);
+var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var path__namespace = /*#__PURE__*/_interopNamespace(path);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
-var express__default = /*#__PURE__*/_interopDefault(express);
 var z__default = /*#__PURE__*/_interopDefault(z);
-var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var sizeOf__default = /*#__PURE__*/_interopDefault(sizeOf);
 
 class ValSyntaxError {
@@ -496,7 +494,7 @@ function getPointerFromPath(node, path) {
       return childNode;
     }
     if (childNode.value === undefined) {
-      return fp.result.err(new patch.PatchError("Path refers to non-existing object/array"));
+      return fp.result.err(new patch.PatchError(`Path refers to non-existing object/array: ${path.join("/")}`));
     }
     targetNode = childNode.value;
   }
@@ -618,6 +616,64 @@ class TSOps {
   }
 }
 
+const ops = new TSOps(document => {
+  return fp.pipe(analyzeValModule(document), fp.result.map(({
+    source
+  }) => source));
+});
+
+// TODO: rename to patchValFiles since we may write multiple files
+const patchValFile = async (id, valConfigPath, patch$1, sourceFileHandler, runtime) => {
+  const timeId = crypto.randomUUID();
+  console.time("patchValFile" + timeId);
+  const filePath = sourceFileHandler.resolveSourceModulePath(valConfigPath, `.${id}.val`);
+  const sourceFile = sourceFileHandler.getSourceFile(filePath);
+  if (!sourceFile) {
+    throw Error(`Source file ${filePath} not found`);
+  }
+  const derefRes = core.derefPatch(patch$1, sourceFile, ops);
+  if (fp.result.isErr(derefRes)) {
+    throw derefRes.error;
+  }
+  const dereferencedPatch = derefRes.value.dereferencedPatch; // TODO: add ref changes to remote replace/add, ...
+  const newSourceFile = patchSourceFile(sourceFile, dereferencedPatch);
+  if (fp.result.isErr(newSourceFile)) {
+    if (newSourceFile.error instanceof patch.PatchError) {
+      throw newSourceFile.error;
+    } else {
+      throw new Error(`${filePath}\n${flatMapErrors(newSourceFile.error, error => formatSyntaxError(error, sourceFile)).join("\n")}`);
+    }
+  }
+  for (const [filePath, content] of Object.entries(derefRes.value.fileUpdates)) {
+    // Evaluate if we want to make these writes (more) atomic with a temp file and a move.
+    // This can potentially fill mid-way if there is not enough space on disk for example...
+    // However, that might be add add bit more complexity in our host and virtual file systems?
+    // Example:
+    // const tempFilePath = sourceFileHandler.writeTempFile(
+    //   Buffer.from(content, "base64").toString("binary")
+    // );
+    // sourceFileHandler.moveFile(tempFilePath, "." + filePath);
+    // TODO: ensure that directory exists
+    if (content.startsWith("data:/image/svg+xml")) {
+      sourceFileHandler.writeFile("." + filePath, convertDataUrlToBase64(content).toString("utf8"), "utf8");
+    } else {
+      sourceFileHandler.writeFile("." + filePath, convertDataUrlToBase64(content).toString("binary"), "binary");
+    }
+  }
+  sourceFileHandler.writeSourceFile(newSourceFile.value);
+  console.timeEnd("patchValFile" + timeId);
+};
+function convertDataUrlToBase64(dataUrl) {
+  const base64 = dataUrl.slice(dataUrl.indexOf(",") + 1);
+  return Buffer.from(base64, "base64");
+}
+const patchSourceFile = (sourceFile, patch$1) => {
+  if (typeof sourceFile === "string") {
+    return patch.applyPatch(ts__default["default"].createSourceFile("<val>", sourceFile, ts__default["default"].ScriptTarget.ES2015), ops, patch$1);
+  }
+  return patch.applyPatch(sourceFile, ops, patch$1);
+};
+
 const readValFile = async (id, valConfigPath, runtime) => {
   const context = runtime.newContext();
   try {
@@ -695,62 +751,6 @@ globalThis.valModule = {
   }
 };
 
-const ops = new TSOps(document => {
-  return fp.pipe(analyzeValModule(document), fp.result.map(({
-    source
-  }) => source));
-});
-
-// TODO: rename to patchValFiles since we may write multiple files
-const patchValFile = async (id, valConfigPath, patch$1, sourceFileHandler, runtime) => {
-  const filePath = sourceFileHandler.resolveSourceModulePath(valConfigPath, `.${id}.val`);
-  const sourceFile = sourceFileHandler.getSourceFile(filePath);
-  if (!sourceFile) {
-    throw Error(`Source file ${filePath} not found`);
-  }
-  const derefRes = core.derefPatch(patch$1, sourceFile, ops);
-  if (fp.result.isErr(derefRes)) {
-    throw derefRes.error;
-  }
-  const dereferencedPatch = derefRes.value.dereferencedPatch; // TODO: add ref changes to remote replace/add, ...
-  const newSourceFile = patchSourceFile(sourceFile, dereferencedPatch);
-  if (fp.result.isErr(newSourceFile)) {
-    if (newSourceFile.error instanceof patch.PatchError) {
-      throw newSourceFile.error;
-    } else {
-      throw new Error(`${filePath}\n${flatMapErrors(newSourceFile.error, error => formatSyntaxError(error, sourceFile)).join("\n")}`);
-    }
-  }
-  for (const [filePath, content] of Object.entries(derefRes.value.fileUpdates)) {
-    // Evaluate if we want to make these writes (more) atomic with a temp file and a move.
-    // This can potentially fill mid-way if there is not enough space on disk for example...
-    // However, that might be add add bit more complexity in our host and virtual file systems?
-    // Example:
-    // const tempFilePath = sourceFileHandler.writeTempFile(
-    //   Buffer.from(content, "base64").toString("binary")
-    // );
-    // sourceFileHandler.moveFile(tempFilePath, "." + filePath);
-    // TODO: ensure that directory exists
-    if (content.startsWith("data:/image/svg+xml")) {
-      sourceFileHandler.writeFile("." + filePath, convertDataUrlToBase64(content).toString("utf8"), "utf8");
-    } else {
-      sourceFileHandler.writeFile("." + filePath, convertDataUrlToBase64(content).toString("binary"), "binary");
-    }
-  }
-  sourceFileHandler.writeSourceFile(newSourceFile.value);
-  return readValFile(id, valConfigPath, runtime);
-};
-function convertDataUrlToBase64(dataUrl) {
-  const base64 = dataUrl.slice(dataUrl.indexOf(",") + 1);
-  return Buffer.from(base64, "base64");
-}
-const patchSourceFile = (sourceFile, patch$1) => {
-  if (typeof sourceFile === "string") {
-    return patch.applyPatch(ts__default["default"].createSourceFile("<val>", sourceFile, ts__default["default"].ScriptTarget.ES2015), ops, patch$1);
-  }
-  return patch.applyPatch(sourceFile, ops, patch$1);
-};
-
 const getCompilerOptions = (rootDir, parseConfigHost) => {
   const tsConfigPath = path__namespace["default"].resolve(rootDir, "tsconfig.json");
   const jsConfigPath = path__namespace["default"].resolve(rootDir, "jsconfig.json");
@@ -797,7 +797,9 @@ class ValSourceFileHandler {
     }
   }
   writeSourceFile(sourceFile) {
-    return this.writeFile(sourceFile.fileName, sourceFile.text, "utf8");
+    return this.writeFile(sourceFile.fileName,
+    // https://github.com/microsoft/TypeScript/issues/36174
+    unescape(sourceFile.text.replace(/\\u/g, "%u")), "utf8");
   }
   writeFile(filePath, content, encoding) {
     this.host.writeFile(filePath, content, encoding);
@@ -815,7 +817,7 @@ class ValSourceFileHandler {
 const JsFileLookupMapping = [
 // NOTE: first one matching will be used
 [".cjs.d.ts", [".esm.js", ".mjs.js"]], [".cjs.js", [".esm.js", ".mjs.js"]], [".cjs", [".mjs"]], [".d.ts", [".js", ".esm.js", ".mjs.js"]]];
-const MAX_CACHE_SIZE = 100 * 1024 * 1024; // 100 mb
+const MAX_CACHE_SIZE = 10 * 1024 * 1024; // 10 mb
 const MAX_OBJECT_KEY_SIZE = 2 ** 27; // https://stackoverflow.com/questions/13367391/is-there-a-limit-on-length-of-the-key-string-in-js-object
 
 class ValModuleLoader {
@@ -959,6 +961,11 @@ async function newValQuickJSRuntime(quickJSModule, moduleLoader, {
           value: "export default new Proxy({}, { get() { return () => { throw new Error(`Cannot import 'react' in this file`) } } } )"
         };
       }
+      if (modulePath === "./ValNextProvider") {
+        return {
+          value: "export const ValNextProvider = new Proxy({}, { get() { return () => { throw new Error(`Cannot import 'ValProvider' in this file`) } } } )"
+        };
+      }
       return {
         value: moduleLoader.getModule(modulePath)
       };
@@ -994,6 +1001,11 @@ async function newValQuickJSRuntime(quickJSModule, moduleLoader, {
           value: requestedName
         };
       }
+      if (requestedName === "./ValNextProvider") {
+        return {
+          value: requestedName
+        };
+      }
       const modulePath = moduleLoader.resolveModulePath(baseModuleName, requestedName);
       return {
         value: modulePath
@@ -1052,25 +1064,6 @@ class Service {
   }
 }
 
-function createRequestHandler(valServer) {
-  const router = express.Router();
-  router.use("/static", server.createRequestHandler());
-  router.get("/session", valServer.session.bind(valServer));
-  router.get("/authorize", valServer.authorize.bind(valServer));
-  router.get("/callback", valServer.callback.bind(valServer));
-  router.get("/logout", valServer.logout.bind(valServer));
-  router.post("/patches/*", express__default["default"].json({
-    type: "application/json",
-    limit: "10mb"
-  }), valServer.postPatches.bind(valServer)).get("/patches/*", valServer.getPatches.bind(valServer));
-  router.post("/commit", valServer.commit.bind(valServer));
-  router.get("/enable", valServer.enable.bind(valServer));
-  router.get("/disable", valServer.disable.bind(valServer));
-  router.get("/tree/*", valServer.getTree.bind(valServer));
-  router.get("/files/*", valServer.getFiles.bind(valServer));
-  return router;
-}
-
 const JSONValueT = z__default["default"].lazy(() => z__default["default"].union([z__default["default"].string(), z__default["default"].number(), z__default["default"].boolean(), z__default["default"].null(), z__default["default"].array(JSONValueT), z__default["default"].record(JSONValueT)]));
 
 /**
@@ -1113,6 +1106,182 @@ const OperationJSONT = z__default["default"].discriminatedUnion("op", [z__defaul
 }).strict()]);
 const PatchJSON = z__default["default"].array(OperationJSONT);
 
+const ENABLE_COOKIE_VALUE = {
+  value: "true",
+  options: {
+    httpOnly: false,
+    sameSite: "lax"
+  }
+};
+function getRedirectUrl(query, overrideHost) {
+  if (typeof query.redirect_to !== "string") {
+    return {
+      status: 400,
+      json: {
+        message: "Missing redirect_to query param"
+      }
+    };
+  }
+  if (overrideHost) {
+    return overrideHost + "?redirect_to=" + encodeURIComponent(query.redirect_to);
+  }
+  return query.redirect_to;
+}
+
+class LocalValServer {
+  constructor(options, callbacks) {
+    this.options = options;
+    this.callbacks = callbacks;
+  }
+  async session() {
+    return {
+      status: 200,
+      json: {
+        mode: "local",
+        enabled: await this.callbacks.isEnabled()
+      }
+    };
+  }
+  async getTree(treePath,
+  // TODO: use the params: patch, schema, source
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  query) {
+    const rootDir = process.cwd();
+    const moduleIds = [];
+    // iterate over all .val files in the root directory
+    const walk = async dir => {
+      const files = await fs.promises.readdir(dir);
+      for (const file of files) {
+        if ((await fs.promises.stat(path__namespace["default"].join(dir, file))).isDirectory()) {
+          if (file === "node_modules") continue;
+          await walk(path__namespace["default"].join(dir, file));
+        } else {
+          const isValFile = file.endsWith(".val.js") || file.endsWith(".val.ts");
+          if (!isValFile) {
+            continue;
+          }
+          if (treePath && !path__namespace["default"].join(dir, file).replace(rootDir, "").startsWith(treePath)) {
+            continue;
+          }
+          moduleIds.push(path__namespace["default"].join(dir, file).replace(rootDir, "").replace(".val.js", "").replace(".val.ts", ""));
+        }
+      }
+    };
+    const serializedModuleContent = await walk(rootDir).then(async () => {
+      return Promise.all(moduleIds.map(async moduleId => {
+        return await this.options.service.get(moduleId, "");
+      }));
+    });
+
+    //
+    const modules = Object.fromEntries(serializedModuleContent.map(serializedModuleContent => {
+      const module = {
+        schema: serializedModuleContent.schema,
+        source: serializedModuleContent.source,
+        errors: serializedModuleContent.errors
+      };
+      return [serializedModuleContent.path, module];
+    }));
+    const apiTreeResponse = {
+      modules,
+      git: this.options.git
+    };
+    return {
+      status: 200,
+      json: apiTreeResponse
+    };
+  }
+  async enable(query) {
+    const redirectToRes = getRedirectUrl(query, this.options.valEnableRedirectUrl);
+    if (typeof redirectToRes !== "string") {
+      return redirectToRes;
+    }
+    await this.callbacks.onEnable(true);
+    return {
+      cookies: {
+        [internal.VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
+      },
+      status: 302,
+      redirectTo: redirectToRes
+    };
+  }
+  async disable(query) {
+    const redirectToRes = getRedirectUrl(query, this.options.valDisableRedirectUrl);
+    if (typeof redirectToRes !== "string") {
+      return redirectToRes;
+    }
+    await this.callbacks.onDisable(true);
+    return {
+      cookies: {
+        [internal.VAL_ENABLE_COOKIE_NAME]: {
+          value: null
+        }
+      },
+      status: 302,
+      redirectTo: redirectToRes
+    };
+  }
+  async postPatches(body) {
+    // First validate that the body has the right structure
+    const patchJSON = z.z.record(PatchJSON).safeParse(body);
+    if (!patchJSON.success) {
+      return {
+        status: 404,
+        json: {
+          message: `Invalid patch: ${patchJSON.error.message}`,
+          details: patchJSON.error.issues
+        }
+      };
+    }
+    const id = crypto.randomUUID();
+    console.time("patching:" + id);
+    for (const moduleId in patchJSON.data) {
+      // Then parse/validate
+      // TODO: validate all and then fail instead:
+      const patch$1 = patch.parsePatch(patchJSON.data[moduleId]);
+      if (fp.result.isErr(patch$1)) {
+        console.error("Unexpected error parsing patch", patch$1.error);
+        throw new Error("Unexpected error parsing patch");
+      }
+      await this.options.service.patch(moduleId, patch$1.value);
+    }
+    console.timeEnd("patching:" + id);
+    return {
+      status: 200,
+      json: {} // no patch ids created
+    };
+  }
+
+  badRequest() {
+    return {
+      status: 400,
+      json: {
+        message: "Local server does not handle this request"
+      }
+    };
+  }
+
+  // eslint-disable-next-line @typescript-eslint/ban-types
+  async postCommit() {
+    return this.badRequest();
+  }
+  async authorize() {
+    return this.badRequest();
+  }
+  async callback() {
+    return this.badRequest();
+  }
+  async logout() {
+    return this.badRequest();
+  }
+  async getFiles() {
+    return this.badRequest();
+  }
+  async getPatches() {
+    return this.badRequest();
+  }
+}
+
 function decodeJwt(token, secretKey) {
   const [headerBase64, payloadBase64, signatureBase64, ...rest] = token.split(".");
   if (!headerBase64 || !payloadBase64 || !signatureBase64 || rest.length > 0) {
@@ -1172,167 +1341,258 @@ function encodeJwt(payload, sessionKey) {
   return `${jwtHeaderBase64}.${payloadBase64}.${crypto__default["default"].createHmac("sha256", sessionKey).update(`${jwtHeaderBase64}.${payloadBase64}`).digest("base64")}`;
 }
 
-const VAL_SESSION_COOKIE = core.Internal.VAL_SESSION_COOKIE;
-const VAL_STATE_COOKIE = core.Internal.VAL_STATE_COOKIE;
-const VAL_ENABLED_COOKIE = core.Internal.VAL_ENABLE_COOKIE_NAME;
-class BrowserReadableStreamWrapper extends stream.Readable {
-  constructor(readableStream) {
-    super();
-    this.reader = readableStream.getReader();
-  }
-  _read() {
-    this.reader.read().then(({
-      done,
-      value
-    }) => {
-      if (done) {
-        this.push(null); // No more data to read
-      } else {
-        this.push(Buffer.from(value));
-      }
-    }).catch(error => {
-      this.emit("error", error);
-    });
-  }
-}
 class ProxyValServer {
-  constructor(options) {
+  constructor(options, callbacks) {
     this.options = options;
+    this.callbacks = callbacks;
   }
-  async getFiles(req, res) {
-    return this.withAuth(req, res, async data => {
-      const url = new URL(`/v1/files/${this.options.valName}/${req.params["0"]}`, this.options.valContentUrl);
-      if (typeof req.query.sha256 === "string") {
-        url.searchParams.append("sha256", req.query.sha256);
+  async getFiles(treePath, query, cookies) {
+    return this.withAuth(cookies, "getFiles", async data => {
+      const url = new URL(`/v1/files/${this.options.valName}/${treePath}`, this.options.valContentUrl);
+      if (typeof query.sha256 === "string") {
+        url.searchParams.append("sha256", query.sha256);
       } else {
         console.warn("Missing sha256 query param");
       }
       const fetchRes = await fetch(url, {
         headers: this.getAuthHeaders(data.token)
       });
-      const contentType = fetchRes.headers.get("content-type");
-      if (contentType !== null) {
-        res.setHeader("Content-Type", contentType);
-      }
-      const contentLength = fetchRes.headers.get("content-length");
-      if (contentLength !== null) {
-        res.setHeader("Content-Length", contentLength);
-      }
-      if (fetchRes.ok) {
+      if (fetchRes.status === 200) {
         if (fetchRes.body) {
-          new BrowserReadableStreamWrapper(fetchRes.body).pipe(res);
+          return {
+            status: fetchRes.status,
+            headers: {
+              "Content-Type": fetchRes.headers.get("Content-Type") || "",
+              "Content-Length": fetchRes.headers.get("Content-Length") || "0"
+            },
+            body: fetchRes.body
+          };
         } else {
-          console.warn("No body in response");
-          res.sendStatus(500);
+          return {
+            status: 500,
+            body: {
+              message: "No body in response"
+            }
+          };
         }
       } else {
-        res.sendStatus(fetchRes.status);
+        return {
+          status: fetchRes.status,
+          body: {
+            message: "Failed to get files"
+          }
+        };
       }
     });
   }
-  async authorize(req, res) {
-    const {
-      redirect_to
-    } = req.query;
-    if (typeof redirect_to !== "string") {
-      res.redirect(this.getAppErrorUrl("Login failed: missing redirect_to param"));
-      return;
+  async authorize(query) {
+    if (typeof query.redirect_to !== "string") {
+      return {
+        status: 400,
+        json: {
+          message: "Missing redirect_to query param"
+        }
+      };
     }
     const token = crypto__default["default"].randomUUID();
-    const redirectUrl = new URL(redirect_to);
+    const redirectUrl = new URL(query.redirect_to);
     const appAuthorizeUrl = this.getAuthorizeUrl(`${redirectUrl.origin}/${this.options.route}`, token);
-    res.cookie(VAL_STATE_COOKIE, createStateCookie({
-      redirect_to,
-      token
-    }), {
-      httpOnly: true,
-      sameSite: "lax",
-      expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
-    }).redirect(appAuthorizeUrl);
+    return {
+      cookies: {
+        [internal.VAL_STATE_COOKIE]: {
+          value: createStateCookie({
+            redirect_to: query.redirect_to,
+            token
+          }),
+          options: {
+            httpOnly: true,
+            sameSite: "lax",
+            expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
+          }
+        }
+      },
+
+      status: 302,
+      redirectTo: appAuthorizeUrl
+    };
   }
-  async enable(req, res) {
-    return enable(req, res, this.options.valEnableRedirectUrl);
+  async enable(query) {
+    const redirectToRes = getRedirectUrl(query, this.options.valEnableRedirectUrl);
+    if (typeof redirectToRes !== "string") {
+      return redirectToRes;
+    }
+    await this.callbacks.onEnable(true);
+    return {
+      cookies: {
+        [internal.VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
+      },
+      status: 302,
+      redirectTo: redirectToRes
+    };
   }
-  async disable(req, res) {
-    return disable(req, res, this.options.valEnableRedirectUrl);
+  async disable(query) {
+    const redirectToRes = getRedirectUrl(query, this.options.valDisableRedirectUrl);
+    if (typeof redirectToRes !== "string") {
+      return redirectToRes;
+    }
+    await this.callbacks.onDisable(true);
+    return {
+      cookies: {
+        [internal.VAL_ENABLE_COOKIE_NAME]: {
+          value: null
+        }
+      },
+      status: 302,
+      redirectTo: redirectToRes
+    };
   }
-  async callback(req, res) {
+  async callback(query, cookies) {
     const {
       success: callbackReqSuccess,
       error: callbackReqError
-    } = verifyCallbackReq(req.cookies[VAL_STATE_COOKIE], req.query);
-    res.clearCookie(VAL_STATE_COOKIE); // we don't need this anymore
-
+    } = verifyCallbackReq(cookies[internal.VAL_STATE_COOKIE], query);
     if (callbackReqError !== null) {
-      res.redirect(this.getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`));
-      return;
+      return {
+        status: 302,
+        cookies: {
+          [internal.VAL_STATE_COOKIE]: {
+            value: null
+          }
+        },
+        redirectTo: this.getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`)
+      };
     }
     const data = await this.consumeCode(callbackReqSuccess.code);
     if (data === null) {
-      res.redirect(this.getAppErrorUrl("Failed to exchange code for user"));
-      return;
+      return {
+        status: 302,
+        cookies: {
+          [internal.VAL_STATE_COOKIE]: {
+            value: null
+          }
+        },
+        redirectTo: this.getAppErrorUrl("Failed to exchange code for user")
+      };
     }
     const exp = getExpire();
     const cookie = encodeJwt({
       ...data,
       exp // this is the client side exp
     }, this.options.valSecret);
-    res.cookie(VAL_SESSION_COOKIE, cookie, {
-      httpOnly: true,
-      sameSite: "strict",
-      secure: true,
-      expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
-    }).redirect(callbackReqSuccess.redirect_uri || "/");
-  }
-  async logout(_req, res) {
-    res.clearCookie(VAL_SESSION_COOKIE).clearCookie(VAL_STATE_COOKIE).sendStatus(200);
-  }
-  async withAuth(req, res, handler) {
-    const cookie = req.cookies[VAL_SESSION_COOKIE];
+    return {
+      status: 302,
+      cookies: {
+        [internal.VAL_STATE_COOKIE]: {
+          value: null
+        },
+        [internal.VAL_SESSION_COOKIE]: {
+          value: cookie,
+          options: {
+            httpOnly: true,
+            sameSite: "strict",
+            path: "/",
+            secure: true,
+            expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
+          }
+        }
+      },
+
+      redirectTo: callbackReqSuccess.redirect_uri || "/"
+    };
+  }
+  async logout() {
+    return {
+      status: 200,
+      cookies: {
+        [internal.VAL_SESSION_COOKIE]: {
+          value: null
+        },
+        [internal.VAL_STATE_COOKIE]: {
+          value: null
+        }
+      }
+    };
+  }
+  async withAuth(cookies, errorMessageType, handler) {
+    const cookie = cookies[internal.VAL_SESSION_COOKIE];
     if (typeof cookie === "string") {
-      const verification = IntegratedServerJwtPayload.safeParse(decodeJwt(cookie, this.options.valSecret));
+      const decodedToken = decodeJwt(cookie, this.options.valSecret);
+      if (!decodedToken) {
+        return {
+          status: 401,
+          json: {
+            message: "Invalid JWT token"
+          }
+        };
+      }
+      const verification = IntegratedServerJwtPayload.safeParse(decodedToken);
       if (!verification.success) {
-        res.sendStatus(401);
-        return;
+        return {
+          status: 401,
+          json: {
+            message: "Could not parse JWT",
+            details: verification.error
+          }
+        };
       }
       return handler(verification.data).catch(err => {
-        console.error(`Failed while processing: ${req.url}`, err);
-        res.sendStatus(500);
-        return undefined;
+        console.error(`Failed while processing: ${errorMessageType}`, err);
+        return {
+          status: 500,
+          body: {
+            message: err.message
+          }
+        };
       });
     } else {
-      res.sendStatus(401);
+      return {
+        status: 401,
+        json: {
+          message: "No token"
+        }
+      };
     }
   }
-  async session(req, res) {
-    return this.withAuth(req, res, async data => {
+  async session(cookies) {
+    return this.withAuth(cookies, "session", async data => {
       const url = new URL(`/api/val/${this.options.valName}/auth/session`, this.options.valBuildUrl);
       const fetchRes = await fetch(url, {
         headers: this.getAuthHeaders(data.token, "application/json")
       });
-      if (fetchRes.ok) {
-        res.status(fetchRes.status).json({
-          mode: "proxy",
-          ...(await fetchRes.json())
-        });
+      if (fetchRes.status === 200) {
+        return {
+          status: fetchRes.status,
+          json: {
+            mode: "proxy",
+            enabled: await this.callbacks.isEnabled(),
+            ...(await fetchRes.json())
+          }
+        };
       } else {
-        res.sendStatus(fetchRes.status);
+        return {
+          status: fetchRes.status,
+          body: {
+            message: "Failed to get session"
+          }
+        };
       }
     });
   }
-  async getTree(req, res) {
-    return this.withAuth(req, res, async data => {
+  async getTree(treePath, query, cookies) {
+    return this.withAuth(cookies, "getTree", async data => {
       const {
         patch,
         schema,
         source
-      } = req.query;
+      } = query;
       const commit = this.options.gitCommit;
       if (!commit) {
-        res.status(401).json({
-          error: "Could not detect the git commit. Check if env is missing VAL_GIT_COMMIT."
-        });
-        return;
+        return {
+          status: 400,
+          body: {
+            message: "Could not detect the git commit. Check if env is missing VAL_GIT_COMMIT."
+          }
+        };
       }
       const params = new URLSearchParams({
         patch: (patch === "true").toString(),
@@ -1340,63 +1600,99 @@ class ProxyValServer {
         source: (source === "true").toString(),
         commit
       });
-      const url = new URL(`/v1/tree/${this.options.valName}/heads/${this.options.gitBranch}/${req.params["0"]}/?${params}`, this.options.valContentUrl);
-      const json = await fetch(url, {
-        headers: this.getAuthHeaders(data.token, "application/json")
-      }).then(res => res.json()).catch(err => {
-        console.error(err);
-        throw err;
-      });
-      res.send(json);
+      const url = new URL(`/v1/tree/${this.options.valName}/heads/${this.options.gitBranch}/${treePath}/?${params}`, this.options.valContentUrl);
+      try {
+        const fetchRes = await fetch(url, {
+          headers: this.getAuthHeaders(data.token, "application/json")
+        });
+        if (fetchRes.status === 200) {
+          return {
+            status: fetchRes.status,
+            json: await fetchRes.json()
+          };
+        } else {
+          try {
+            var _fetchRes$headers$get;
+            if ((_fetchRes$headers$get = fetchRes.headers.get("Content-Type")) !== null && _fetchRes$headers$get !== void 0 && _fetchRes$headers$get.includes("application/json")) {
+              const json = await fetchRes.json();
+              return {
+                status: fetchRes.status,
+                json
+              };
+            }
+          } catch (err) {
+            console.error(err);
+          }
+          return {
+            status: fetchRes.status,
+            json: {
+              message: "Unknown failure while accessing Val"
+            }
+          };
+        }
+      } catch (err) {
+        return {
+          status: 500,
+          body: {
+            message: "Failed to fetch: check network connection"
+          }
+        };
+      }
     });
   }
-  async getPatches(req, res) {
-    const patchIds = typeof req.params["id"] === "string" ? [req.params["id"]] : Array.isArray(req.params["id"]) ? req.params["id"] : [];
+  async getPatches(query, cookies) {
+    const patchIds = query.id || [];
     const params = patchIds.length > 0 ? `?${patchIds.map(id => `id=${encodeURIComponent(id)}`).join("&")}` : "";
-    await this.withAuth(req, res, async ({
+    return this.withAuth(cookies, "getPatches", async ({
       token
     }) => {
-      const url = new URL(`/v1/patches/${this.options.valName}/heads/${this.options.gitBranch}/${req.params["0"]}${params}`, this.options.valContentUrl);
-      console.log(url);
+      const url = new URL(`/v1/patches/${this.options.valName}/heads/${this.options.gitBranch}/~${params}`, this.options.valContentUrl);
       // Proxy patch to val.build
       const fetchRes = await fetch(url, {
         method: "GET",
         headers: this.getAuthHeaders(token, "application/json")
       });
-      if (fetchRes.ok) {
-        const json = await fetchRes.json();
-        res.status(fetchRes.status).json(json);
+      if (fetchRes.status === 200) {
+        return {
+          status: fetchRes.status,
+          json: await fetchRes.json()
+        };
       } else {
-        res.sendStatus(fetchRes.status);
+        return {
+          status: fetchRes.status,
+          body: {
+            message: "Failed to get patches"
+          }
+        };
       }
-    }).catch(e => {
-      res.status(500).send({
-        error: {
-          message: e === null || e === void 0 ? void 0 : e.message,
-          status: 500
-        }
-      });
     });
   }
-  async postPatches(req, res) {
+  async postPatches(body, cookies) {
     const commit = this.options.gitCommit;
     if (!commit) {
-      res.status(401).json({
-        error: "Could not detect the git commit. Check if env is missing VAL_GIT_COMMIT."
-      });
-      return;
+      return {
+        status: 401,
+        json: {
+          message: "Could not detect the git commit. Check if env is missing VAL_GIT_COMMIT."
+        }
+      };
     }
     const params = new URLSearchParams({
       commit
     });
-    await this.withAuth(req, res, async ({
+    return this.withAuth(cookies, "postPatches", async ({
       token
     }) => {
       // First validate that the body has the right structure
-      const patchJSON = z.z.record(PatchJSON).safeParse(req.body);
+      const patchJSON = z.z.record(PatchJSON).safeParse(body);
       if (!patchJSON.success) {
-        res.status(401).json(patchJSON.error.issues);
-        return;
+        return {
+          status: 400,
+          body: {
+            message: "Invalid patch",
+            details: patchJSON.error.issues
+          }
+        };
       }
       // Then parse/validate
       // TODO:
@@ -1406,29 +1702,27 @@ class ProxyValServer {
       //   res.status(401).json(patch.error);
       //   return;
       // }
-      const url = new URL(`/v1/patches/${this.options.valName}/heads/${this.options.gitBranch}/${req.params["0"]}/?${params}`, this.options.valContentUrl);
+      const url = new URL(`/v1/patches/${this.options.valName}/heads/${this.options.gitBranch}/~?${params}`, this.options.valContentUrl);
       // Proxy patch to val.build
       const fetchRes = await fetch(url, {
         method: "POST",
         headers: this.getAuthHeaders(token, "application/json"),
         body: JSON.stringify(patch)
       });
-      if (fetchRes.ok) {
-        res.status(fetchRes.status).json(await fetchRes.json());
+      if (fetchRes.status === 200) {
+        return {
+          status: fetchRes.status,
+          json: await fetchRes.json()
+        };
       } else {
-        res.sendStatus(fetchRes.status);
+        return {
+          status: fetchRes.status
+        };
       }
-    }).catch(e => {
-      res.status(500).send({
-        error: {
-          message: e === null || e === void 0 ? void 0 : e.message,
-          status: 500
-        }
-      });
     });
   }
-  async commit(req, res) {
-    await this.withAuth(req, res, async ({
+  async postCommit(cookies) {
+    return this.withAuth(cookies, "postCommit", async ({
       token
     }) => {
       const url = new URL(`/api/val/commit/${encodeURIComponent(this.options.gitBranch)}`, this.options.valBuildUrl);
@@ -1436,10 +1730,15 @@ class ProxyValServer {
         method: "POST",
         headers: this.getAuthHeaders(token)
       });
-      if (fetchRes.ok) {
-        res.status(fetchRes.status).json(await fetchRes.json());
+      if (fetchRes.status === 200) {
+        return {
+          status: fetchRes.status,
+          json: await fetchRes.json()
+        };
       } else {
-        res.sendStatus(fetchRes.status);
+        return {
+          status: fetchRes.status
+        };
       }
     });
   }
@@ -1592,40 +1891,6 @@ function getStateFromCookie(stateCookie) {
     };
   }
 }
-async function enable(req, res, redirectUrl) {
-  const {
-    redirect_to
-  } = req.query;
-  if (typeof redirect_to === "string" || typeof redirect_to === "undefined") {
-    let redirectUrlToUse = redirect_to || "/";
-    if (redirectUrl) {
-      redirectUrlToUse = redirectUrl + "?redirect_to=" + encodeURIComponent(redirectUrlToUse);
-    }
-    res.cookie(VAL_ENABLED_COOKIE, "true", {
-      httpOnly: false,
-      sameSite: "lax"
-    }).redirect(redirectUrlToUse);
-  } else {
-    res.sendStatus(400);
-  }
-}
-async function disable(req, res, redirectUrl) {
-  const {
-    redirect_to
-  } = req.query;
-  if (typeof redirect_to === "string" || typeof redirect_to === "undefined") {
-    let redirectUrlToUse = redirect_to || "/";
-    if (redirectUrl) {
-      redirectUrlToUse = redirectUrl + "?redirect_to=" + encodeURIComponent(redirectUrlToUse);
-    }
-    res.cookie(VAL_ENABLED_COOKIE, "false", {
-      httpOnly: false,
-      sameSite: "lax"
-    }).redirect(redirectUrlToUse);
-  } else {
-    res.sendStatus(400);
-  }
-}
 function createStateCookie(state) {
   return Buffer.from(JSON.stringify(state), "utf8").toString("base64");
 }
@@ -1643,137 +1908,13 @@ const IntegratedServerJwtPayload = z.z.object({
   project: z.z.string()
 });
 
-class LocalValServer {
-  constructor(options) {
-    this.options = options;
-  }
-  async session(_req, res) {
-    res.json({
-      mode: "local"
-    });
-  }
-  async getTree(req, res) {
-    try {
-      // TODO: use the params: patch, schema, source
-      const treePath = req.params["0"].replace("~", "");
-      const rootDir = process.cwd();
-      const moduleIds = [];
-      // iterate over all .val files in the root directory
-      const walk = async dir => {
-        const files = await fs.promises.readdir(dir);
-        for (const file of files) {
-          if ((await fs.promises.stat(path__namespace["default"].join(dir, file))).isDirectory()) {
-            if (file === "node_modules") continue;
-            await walk(path__namespace["default"].join(dir, file));
-          } else {
-            const isValFile = file.endsWith(".val.js") || file.endsWith(".val.ts");
-            if (!isValFile) {
-              continue;
-            }
-            if (treePath && !path__namespace["default"].join(dir, file).replace(rootDir, "").startsWith(treePath)) {
-              continue;
-            }
-            moduleIds.push(path__namespace["default"].join(dir, file).replace(rootDir, "").replace(".val.js", "").replace(".val.ts", ""));
-          }
-        }
-      };
-      const serializedModuleContent = await walk(rootDir).then(async () => {
-        return Promise.all(moduleIds.map(async moduleId => {
-          return await this.options.service.get(moduleId, "");
-        }));
-      });
-
-      //
-      const modules = Object.fromEntries(serializedModuleContent.map(serializedModuleContent => {
-        const module = {
-          schema: serializedModuleContent.schema,
-          source: serializedModuleContent.source,
-          errors: serializedModuleContent.errors
-        };
-        return [serializedModuleContent.path, module];
-      }));
-      const apiTreeResponse = {
-        modules,
-        git: this.options.git
-      };
-      res.send(JSON.stringify(apiTreeResponse));
-    } catch (err) {
-      console.error(err);
-      res.sendStatus(500);
-    }
-  }
-  async enable(req, res) {
-    return enable(req, res);
-  }
-  async disable(req, res) {
-    return disable(req, res);
-  }
-  async postPatches(req, res) {
-    // First validate that the body has the right structure
-    const patchJSON = z.z.record(PatchJSON).safeParse(req.body);
-    if (!patchJSON.success) {
-      res.status(401).json(patchJSON.error.issues);
-      return;
-    }
-    try {
-      for (const moduleId in patchJSON.data) {
-        // Then parse/validate
-        // TODO: validate all and then fail instead:
-        const patch$1 = patch.parsePatch(patchJSON.data[moduleId]);
-        if (fp.result.isErr(patch$1)) {
-          res.status(401).json(patch$1.error);
-          return;
-        }
-        await this.options.service.patch(moduleId, patch$1.value);
-      }
-      res.json({});
-    } catch (err) {
-      if (err instanceof patch.PatchError) {
-        res.status(400).send({
-          message: err.message
-        });
-      } else {
-        console.error(err);
-        res.status(500).send({
-          message: err instanceof Error ? err.message : "Unknown error"
-        });
-      }
-    }
-  }
-  async badRequest(req, res) {
-    console.debug("Local server does handle this request", req.url);
-    res.sendStatus(400);
-  }
-  commit(req, res) {
-    return this.badRequest(req, res);
-  }
-  authorize(req, res) {
-    return this.badRequest(req, res);
-  }
-  callback(req, res) {
-    return this.badRequest(req, res);
-  }
-  logout(req, res) {
-    return this.badRequest(req, res);
-  }
-  getFiles(req, res) {
-    return this.badRequest(req, res);
-  }
-  getPatches(req, res) {
-    return this.badRequest(req, res);
-  }
-}
-
-async function _createRequestListener(route, opts) {
+async function createValServer(route, opts, callbacks) {
   const serverOpts = await initHandlerOptions(route, opts);
-  let valServer;
   if (serverOpts.mode === "proxy") {
-    valServer = new ProxyValServer(serverOpts);
+    return new ProxyValServer(serverOpts, callbacks);
   } else {
-    valServer = new LocalValServer(serverOpts);
+    return new LocalValServer(serverOpts, callbacks);
   }
-  const reqHandler = createRequestHandler(valServer);
-  return express__default["default"]().use(route, reqHandler);
 }
 async function initHandlerOptions(route, opts) {
   const maybeApiKey = opts.apiKey || process.env.VAL_API_KEY;
@@ -1817,6 +1958,8 @@ async function initHandlerOptions(route, opts) {
     return {
       mode: "local",
       service,
+      valEnableRedirectUrl: opts.valEnableRedirectUrl || process.env.VAL_ENABLE_REDIRECT_URL,
+      valDisableRedirectUrl: opts.valDisableRedirectUrl || process.env.VAL_DISABLE_REDIRECT_URL,
       git: {
         commit: process.env.VAL_GIT_COMMIT || git.commit,
         branch: process.env.VAL_GIT_BRANCH || git.branch
@@ -1879,22 +2022,127 @@ async function readCommit(gitDir, branchName) {
     return undefined;
   }
 }
-
-// TODO: rename to createValApiHandlers?
-function createRequestListener(route, opts) {
-  const handler = _createRequestListener(route, opts);
-  return async (req, res) => {
-    try {
-      return (await handler)(req, res);
-    } catch (e) {
-      res.statusCode = 500;
-      res.write(e instanceof Error ? e.message : "Unknown error");
-      res.end();
-      return;
+const {
+  VAL_SESSION_COOKIE,
+  VAL_STATE_COOKIE
+} = core.Internal;
+const TREE_PATH_PREFIX = "/tree/~";
+const PATCHES_PATH_PREFIX = "/patches/~";
+const FILES_PATH_PREFIX = "/files";
+function createValApiRouter(route, valServerPromise, convert) {
+  const uiRequestHandler = server.createUIRequestHandler();
+  return async req => {
+    var _req$method;
+    const valServer = await valServerPromise;
+    req.headers.get("content-type");
+    req.headers.get("Cookie");
+    const url = new URL(req.url);
+    if (!url.pathname.startsWith(route)) {
+      const error = {
+        message: "Val: routes are not configured correctly",
+        details: `Check you api routes. Expected pathname to start with "${route}", but it was: "${url.pathname}"`
+      };
+      console.error(error);
+      return convert({
+        status: 500,
+        json: error
+      });
+    }
+    const method = (_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase();
+    function withTreePath(path, prefix) {
+      return async useTreePath => {
+        const pathIndex = path.indexOf("~");
+        if (path.startsWith(prefix) && pathIndex !== -1) {
+          return useTreePath(path.slice(pathIndex + 1));
+        } else {
+          if (prefix.indexOf("/~") === -1) {
+            return convert({
+              status: 500,
+              json: {
+                message: `Route is incorrectly formed: ${prefix}!`
+              }
+            });
+          }
+          return convert({
+            status: 404,
+            json: {
+              message: `Malformed ${prefix} path! Expected: '${prefix}'`
+            }
+          });
+        }
+      };
+    }
+    const path = url.pathname.slice(route.length);
+    if (path.startsWith("/static")) {
+      return convert(await uiRequestHandler(path.slice("/static".length)));
+    } else if (path === "/session") {
+      return convert(await valServer.session(getCookies(req, [VAL_SESSION_COOKIE])));
+    } else if (path === "/authorize") {
+      return convert(await valServer.authorize({
+        redirect_to: url.searchParams.get("redirect_to") || undefined
+      }));
+    } else if (path === "/callback") {
+      return convert(await valServer.callback({
+        code: url.searchParams.get("code") || undefined,
+        state: url.searchParams.get("state") || undefined
+      }, getCookies(req, [VAL_STATE_COOKIE])));
+    } else if (path === "/logout") {
+      return convert(await valServer.logout());
+    } else if (path === "/enable") {
+      return convert(await valServer.enable({
+        redirect_to: url.searchParams.get("redirect_to") || undefined
+      }));
+    } else if (path === "/disable") {
+      return convert(await valServer.disable({
+        redirect_to: url.searchParams.get("redirect_to") || undefined
+      }));
+    } else if (method === "POST" && path === "/commit") {
+      return convert(await valServer.postCommit(getCookies(req, [VAL_SESSION_COOKIE])));
+    } else if (method === "GET" && path.startsWith(TREE_PATH_PREFIX)) {
+      return withTreePath(path, TREE_PATH_PREFIX)(async treePath => convert(await valServer.getTree(treePath, {
+        patch: url.searchParams.get("patch") || undefined,
+        schema: url.searchParams.get("schema") || undefined,
+        source: url.searchParams.get("source") || undefined
+      }, getCookies(req, [VAL_SESSION_COOKIE]))));
+    } else if (method === "GET" && path.startsWith(PATCHES_PATH_PREFIX)) {
+      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.getPatches({
+        id: url.searchParams.getAll("id")
+      }, getCookies(req, [VAL_SESSION_COOKIE]))));
+    } else if (method === "POST" && path.startsWith(PATCHES_PATH_PREFIX)) {
+      const body = await req.json();
+      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.postPatches(body, getCookies(req, [VAL_SESSION_COOKIE]))));
+    } else if (path.startsWith(FILES_PATH_PREFIX)) {
+      const treePath = path.slice(FILES_PATH_PREFIX.length);
+      return convert(await valServer.getFiles(treePath, {
+        sha256: url.searchParams.get("sha256") || undefined
+      }, getCookies(req, [VAL_SESSION_COOKIE])));
+    } else {
+      return convert({
+        status: 404,
+        json: {
+          message: "Not Found",
+          details: {
+            method,
+            path
+          }
+        }
+      });
     }
   };
 }
 
+// TODO: is this naive implementation is too naive?
+function getCookies(req, names) {
+  var _req$headers$get;
+  return ((_req$headers$get = req.headers.get("Cookie")) === null || _req$headers$get === void 0 ? void 0 : _req$headers$get.split("; ").reduce((acc, cookie) => {
+    const [name, value] = cookie.split("=");
+    if (names.includes(name.trim())) {
+      acc[name.trim()] = decodeURIComponent(value.trim());
+    }
+    return acc;
+  }, {})) || {};
+}
+
 /**
  * An implementation of methods in the various ts.*Host interfaces
  * that uses ValFS to resolve modules and read/write files.
@@ -2042,9 +2290,9 @@ exports.ValFSHost = ValFSHost;
 exports.ValModuleLoader = ValModuleLoader;
 exports.ValSourceFileHandler = ValSourceFileHandler;
 exports.createFixPatch = createFixPatch;
-exports.createRequestHandler = createRequestHandler;
-exports.createRequestListener = createRequestListener;
 exports.createService = createService;
+exports.createValApiRouter = createValApiRouter;
+exports.createValServer = createValServer;
 exports.decodeJwt = decodeJwt;
 exports.encodeJwt = encodeJwt;
 exports.formatSyntaxErrorTree = formatSyntaxErrorTree;