@valbuild/server 0.63.2 → 0.64.0

package/dist/valbuild-server.esm.js

@@ -8,12 +8,12 @@ import fsPath__default from 'path';
 import fs, { promises } from 'fs';
 import { transform } from 'sucrase';
 import { VAL_CSS_PATH, VAL_APP_ID, VAL_OVERLAY_ID } from '@valbuild/ui';
+import { VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, Api } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
-import { MIME_TYPES_TO_EXT, filenameToMimeType, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE as VAL_STATE_COOKIE$1, VAL_SESSION_COOKIE as VAL_SESSION_COOKIE$1 } from '@valbuild/shared/internal';
 import crypto$1 from 'crypto';
 import z$1, { z } from 'zod';
 import sizeOf from 'image-size';
-import { fromError } from 'zod-validation-error';
+import { fromError, fromZodError } from 'zod-validation-error';
 
 class ValSyntaxError {
   constructor(message, node) {
@@ -1249,10 +1249,10 @@ async function extractImageMetadata(filename, input) {
   let mimeType = null;
   if (imageSize.type) {
     const possibleMimeType = `image/${imageSize.type}`;
-    if (MIME_TYPES_TO_EXT[possibleMimeType]) {
+    if (Internal.MIME_TYPES_TO_EXT[possibleMimeType]) {
       mimeType = possibleMimeType;
     }
-    const filenameBasedLookup = filenameToMimeType(filename);
+    const filenameBasedLookup = Internal.filenameToMimeType(filename);
     if (filenameBasedLookup) {
       mimeType = filenameBasedLookup;
     }
@@ -1282,7 +1282,7 @@ function getSha256(mimeType, input) {
   `data:${mimeType};base64,${input.toString("base64")}`));
 }
 async function extractFileMetadata(filename, input) {
-  let mimeType = filenameToMimeType(filename);
+  let mimeType = Internal.filenameToMimeType(filename);
   if (!mimeType) {
     mimeType = "application/octet-stream";
   }
@@ -1490,10 +1490,14 @@ class ValOps {
         if (!errors[path]) {
           errors[path] = [];
         }
-        errors[path].push({
+        errors[path].push(...patches.map(({
+          patchId
+        }) => ({
+          patchId,
           invalidPath: true,
+          skipped: true,
           error: new PatchError(`Module at path: '${path}' not found`)
-        });
+        })));
       }
       patchedSources[path] = sources[path];
       for (const {
@@ -1502,15 +1506,17 @@ class ValOps {
         if (errors[path]) {
           errors[path].push({
             patchId: patchId,
+            skipped: true,
             error: new PatchError(`Cannot apply patch: previous errors exists`)
           });
         } else {
           const patchData = analysis.patches[patchId];
           if (!patchData) {
-            errors[path].push({
+            errors[path] = [{
               patchId: patchId,
+              skipped: false,
               error: new PatchError(`Patch not found`)
-            });
+            }];
             continue;
           }
           const applicableOps = [];
@@ -1539,6 +1545,7 @@ class ValOps {
             }
             errors[path].push({
               patchId: patchId,
+              skipped: false,
               error: patchRes.error
             });
           } else {
@@ -1807,7 +1814,7 @@ class ValOps {
         let sourceFileText = unescape(tsSourceFile.getText(tsSourceFile).replace(/\\u/g, "%u"));
         if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.formatter) {
           try {
-            sourceFileText = this.options.formatter(sourceFileText, path);
+            sourceFileText = await this.options.formatter(sourceFileText, path);
           } catch (err) {
             errors.push({
               message: "Could not format source file: " + (err instanceof Error ? err.message : "Unknown error")
@@ -2237,7 +2244,7 @@ class ValOpsFS extends ValOps {
         throw new Error("Could not parse patch id from file name. Files found: " + patchJsonFiles.join(", "));
       }
       const patchId = patchIdNum.toString();
-      if (includes && !includes.includes(patchId)) {
+      if (includes && includes.length > 0 && !includes.includes(patchId)) {
         continue;
       }
       const parsedFSPatchRes = this.parseJsonFile(this.getPatchFilePath(patchId), FSPatch);
@@ -2266,22 +2273,23 @@ class ValOpsFS extends ValOps {
       patches
     };
   }
-  async getPatchOpsById(patchIds) {
-    return this.readPatches(patchIds);
-  }
-  async findPatches(filters) {
+  async fetchPatches(filters) {
     const patches = {};
     const errors = {};
     const {
       errors: allErrors,
       patches: allPatches
-    } = await this.readPatches();
+    } = await this.readPatches(filters.patchIds);
     for (const [patchIdS, patch] of Object.entries(allPatches)) {
       const patchId = patchIdS;
       if (filters.authors && !(patch.authorId === null || filters.authors.includes(patch.authorId))) {
         continue;
       }
+      if (filters.moduleFilePaths && !filters.moduleFilePaths.includes(patch.path)) {
+        continue;
+      }
       patches[patchId] = {
+        patch: filters.omitPatch ? undefined : patch.patch,
         path: patch.path,
         createdAt: patch.createdAt,
         authorId: patch.authorId,
@@ -2737,16 +2745,13 @@ const BasePatchResponse = z.object({
 });
 const GetPatches = z.object({
   patches: z.array(z.intersection(z.object({
-    patch: Patch
+    patch: Patch.optional()
   }), BasePatchResponse)),
   errors: z.array(z.object({
     patchId: PatchId.optional(),
     message: z.string()
   })).optional()
 });
-const SearchPatches = z.object({
-  patches: z.array(BasePatchResponse)
-});
 const FilesResponse = z.object({
   files: z.array(z.union([z.object({
     filePath: z.string(),
@@ -2805,13 +2810,29 @@ class ValOpsHttp extends ValOps {
   async onInit() {
     // TODO: unused for now. Implement or remove
   }
-  async getPatchOpsById(patchIds) {
-    const params = new URLSearchParams();
-    params.set("branch", this.branch);
-    if (patchIds.length > 0) {
-      params.set("patch_ids", encodeURIComponent(patchIds.join(",")));
+  async fetchPatches(filters) {
+    const params = [];
+    params.push(["branch", this.branch]);
+    if (filters.patchIds) {
+      for (const patchId of filters.patchIds) {
+        params.push(["patch_id", patchId]);
+      }
+    }
+    if (filters.authors) {
+      for (const author of filters.authors) {
+        params.push(["author_id", author]);
+      }
+    }
+    if (filters.omitPatch) {
+      params.push(["omit_patch", "true"]);
+    }
+    if (filters.moduleFilePaths) {
+      for (const moduleFilePath of filters.moduleFilePaths) {
+        params.push(["module_file_path", moduleFilePath]);
+      }
     }
-    return fetch(`${this.hostUrl}/v1/${this.project}/patches${params.size > 0 ? "?" + params : ""}`, {
+    const searchParams = new URLSearchParams(params);
+    return fetch(`${this.hostUrl}/v1/${this.project}/patches${searchParams.size > 0 ? `?${searchParams.toString()}` : ""}`, {
       headers: {
         ...this.authHeaders,
         "Content-Type": "application/json"
@@ -2859,55 +2880,6 @@ class ValOpsHttp extends ValOps {
       };
     });
   }
-  async findPatches(filters) {
-    const params = new URLSearchParams();
-    params.set("branch", this.branch);
-    if (filters.authors && filters.authors.length > 0) {
-      params.set("author_ids", encodeURIComponent(filters.authors.join(",")));
-    }
-    return fetch(`${this.hostUrl}/v1/${this.project}/search/patches${params.size > 0 ? "?" + params : ""}`, {
-      headers: {
-        ...this.authHeaders,
-        "Content-Type": "application/json"
-      }
-    }).then(async res => {
-      const patches = {};
-      if (res.ok) {
-        const parsed = SearchPatches.safeParse(await res.json());
-        if (parsed.success) {
-          for (const patchesRes of parsed.data.patches) {
-            patches[patchesRes.patchId] = {
-              path: patchesRes.path,
-              authorId: patchesRes.authorId,
-              createdAt: patchesRes.createdAt,
-              appliedAt: patchesRes.applied && {
-                baseSha: patchesRes.applied.baseSha,
-                timestamp: patchesRes.applied.appliedAt,
-                git: {
-                  commitSha: patchesRes.applied.commitSha
-                }
-              }
-            };
-          }
-          return {
-            patches
-          };
-        }
-        return {
-          patches,
-          error: {
-            message: `Could not parse search patches response. Error: ${fromError(parsed.error)}`
-          }
-        };
-      }
-      return {
-        patches,
-        error: {
-          message: "Could not find patches. HTTP error: " + res.status + " " + res.statusText
-        }
-      };
-    });
-  }
   async saveSourceFilePatch(path, patch, authorId) {
     return fetch(`${this.hostUrl}/v1/${this.project}/patches`, {
       method: "POST",
@@ -3246,251 +3218,59 @@ class ValOpsHttp extends ValOps {
 }
 
 /* eslint-disable @typescript-eslint/no-unused-vars */
-class ValServer {
-  constructor(valModules, options, callbacks) {
-    this.valModules = valModules;
-    this.options = options;
-    this.callbacks = callbacks;
-    if (options.mode === "fs") {
-      this.serverOps = new ValOpsFS(options.cwd, valModules, {
-        formatter: options.formatter
-      });
-    } else if (options.mode === "http") {
-      this.serverOps = new ValOpsHttp(options.valContentUrl, options.project, options.commit, options.branch, options.apiKey, valModules, {
-        formatter: options.formatter,
-        root: options.root
-      });
-    } else {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      throw new Error("Invalid mode: " + (options === null || options === void 0 ? void 0 : options.mode));
-    }
-  }
-
-  //#region auth
-  async enable(query) {
-    const redirectToRes = getRedirectUrl(query, this.options.valEnableRedirectUrl);
-    if (typeof redirectToRes !== "string") {
-      return redirectToRes;
-    }
-    await this.callbacks.onEnable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
-      },
-      status: 302,
-      redirectTo: redirectToRes
-    };
-  }
-  async disable(query) {
-    const redirectToRes = getRedirectUrl(query, this.options.valDisableRedirectUrl);
-    if (typeof redirectToRes !== "string") {
-      return redirectToRes;
-    }
-    await this.callbacks.onDisable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: {
-          value: "false"
-        }
-      },
-      status: 302,
-      redirectTo: redirectToRes
-    };
-  }
-  async authorize(query) {
-    if (typeof query.redirect_to !== "string") {
-      return {
-        status: 400,
-        json: {
-          message: "Missing redirect_to query param"
-        }
-      };
-    }
-    const token = crypto.randomUUID();
-    const redirectUrl = new URL(query.redirect_to);
-    const appAuthorizeUrl = this.getAuthorizeUrl(`${redirectUrl.origin}/${this.options.route}`, token);
-    await this.callbacks.onEnable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
-        [VAL_STATE_COOKIE$1]: {
-          value: createStateCookie({
-            redirect_to: query.redirect_to,
-            token
-          }),
-          options: {
-            httpOnly: true,
-            sameSite: "lax",
-            expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
-          }
-        }
-      },
-      status: 302,
-      redirectTo: appAuthorizeUrl
-    };
+const ValServer = (valModules, options, callbacks) => {
+  let serverOps;
+  if (options.mode === "fs") {
+    serverOps = new ValOpsFS(options.cwd, valModules, {
+      formatter: options.formatter
+    });
+  } else if (options.mode === "http") {
+    serverOps = new ValOpsHttp(options.valContentUrl, options.project, options.commit, options.branch, options.apiKey, valModules, {
+      formatter: options.formatter,
+      root: options.root
+    });
+  } else {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    throw new Error("Invalid mode: " + (options === null || options === void 0 ? void 0 : options.mode));
   }
-  async callback(query, cookies) {
-    if (!this.options.project) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Project is not set")
-      };
-    }
-    if (!this.options.valSecret) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Secret is not set")
-      };
-    }
-    const {
-      success: callbackReqSuccess,
-      error: callbackReqError
-    } = verifyCallbackReq(cookies[VAL_STATE_COOKIE$1], query);
-    if (callbackReqError !== null) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`)
-      };
-    }
-    const data = await this.consumeCode(callbackReqSuccess.code);
-    if (data === null) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Failed to exchange code for user")
-      };
-    }
-    const exp = getExpire();
-    const valSecret = this.options.valSecret;
-    if (!valSecret) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Setup is not correct: secret is missing")
-      };
+  const getAuthorizeUrl = (publicValApiRe, token) => {
+    if (!options.project) {
+      throw new Error("Project is not set");
     }
-    const cookie = encodeJwt({
-      ...data,
-      exp // this is the client side exp
-    }, valSecret);
-    return {
-      status: 302,
-      cookies: {
-        [VAL_STATE_COOKIE$1]: {
-          value: null
-        },
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
-        [VAL_SESSION_COOKIE$1]: {
-          value: cookie,
-          options: {
-            httpOnly: true,
-            sameSite: "strict",
-            path: "/",
-            secure: true,
-            expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
-          }
-        }
-      },
-      redirectTo: callbackReqSuccess.redirect_uri || "/"
-    };
-  }
-  async session(cookies) {
-    if (this.serverOps instanceof ValOpsFS) {
-      return {
-        status: 200,
-        json: {
-          mode: "local",
-          enabled: await this.callbacks.isEnabled()
-        }
-      };
+    if (!options.valBuildUrl) {
+      throw new Error("Val build url is not set");
     }
-    if (!this.options.project) {
-      return {
-        status: 500,
-        json: {
-          message: "Project is not set"
-        }
-      };
+    const url = new URL(`/auth/${options.project}/authorize`, options.valBuildUrl);
+    url.searchParams.set("redirect_uri", encodeURIComponent(`${publicValApiRe}/callback`));
+    url.searchParams.set("state", token);
+    return url.toString();
+  };
+  const getAppErrorUrl = error => {
+    if (!options.project) {
+      throw new Error("Project is not set");
     }
-    if (!this.options.valSecret) {
-      return {
-        status: 500,
-        json: {
-          message: "Secret is not set"
-        }
-      };
+    if (!options.valBuildUrl) {
+      throw new Error("Val build url is not set");
     }
-    return withAuth(this.options.valSecret, cookies, "session", async data => {
-      if (!this.options.valBuildUrl) {
-        return {
-          status: 500,
-          json: {
-            message: "Val is not correctly setup. Build url is missing"
-          }
-        };
-      }
-      const url = new URL(`/api/val/${this.options.project}/auth/session`, this.options.valBuildUrl);
-      const fetchRes = await fetch(url, {
-        headers: getAuthHeaders(data.token, "application/json")
-      });
-      if (fetchRes.status === 200) {
-        return {
-          status: fetchRes.status,
-          json: {
-            mode: "proxy",
-            enabled: await this.callbacks.isEnabled(),
-            ...(await fetchRes.json())
-          }
-        };
-      } else {
-        return {
-          status: fetchRes.status,
-          json: {
-            message: "Failed to authorize",
-            ...(await fetchRes.json())
-          }
-        };
-      }
-    });
-  }
-  async consumeCode(code) {
-    if (!this.options.project) {
+    const url = new URL(`/auth/${options.project}/authorize`, options.valBuildUrl);
+    url.searchParams.set("error", encodeURIComponent(error));
+    return url.toString();
+  };
+  const consumeCode = async code => {
+    if (!options.project) {
       throw new Error("Project is not set");
     }
-    if (!this.options.valBuildUrl) {
+    if (!options.valBuildUrl) {
       throw new Error("Val build url is not set");
     }
-    const url = new URL(`/api/val/${this.options.project}/auth/token`, this.options.valBuildUrl);
+    const url = new URL(`/api/val/${options.project}/auth/token`, options.valBuildUrl);
     url.searchParams.set("code", encodeURIComponent(code));
-    if (!this.options.apiKey) {
+    if (!options.apiKey) {
       return null;
     }
     return fetch(url, {
       method: "POST",
-      headers: getAuthHeaders(this.options.apiKey, "application/json") // NOTE: we use apiKey as auth on this endpoint (we do not have a token yet)
+      headers: getAuthHeaders(options.apiKey, "application/json") // NOTE: we use apiKey as auth on this endpoint (we do not have a token yet)
     }).then(async res => {
       if (res.status === 200) {
         const token = await res.text();
@@ -3510,34 +3290,11 @@ class ValServer {
       console.debug("Failed to get user from code: ", err);
       return null;
     });
-  }
-  getAuthorizeUrl(publicValApiRe, token) {
-    if (!this.options.project) {
-      throw new Error("Project is not set");
-    }
-    if (!this.options.valBuildUrl) {
-      throw new Error("Val build url is not set");
-    }
-    const url = new URL(`/auth/${this.options.project}/authorize`, this.options.valBuildUrl);
-    url.searchParams.set("redirect_uri", encodeURIComponent(`${publicValApiRe}/callback`));
-    url.searchParams.set("state", token);
-    return url.toString();
-  }
-  getAppErrorUrl(error) {
-    if (!this.options.project) {
-      throw new Error("Project is not set");
-    }
-    if (!this.options.valBuildUrl) {
-      throw new Error("Val build url is not set");
-    }
-    const url = new URL(`/auth/${this.options.project}/authorize`, this.options.valBuildUrl);
-    url.searchParams.set("error", encodeURIComponent(error));
-    return url.toString();
-  }
-  getAuth(cookies) {
-    const cookie = cookies[VAL_SESSION_COOKIE$1];
-    if (!this.options.valSecret) {
-      if (this.serverOps instanceof ValOpsFS) {
+  };
+  const getAuth = cookies => {
+    const cookie = cookies[VAL_SESSION_COOKIE];
+    if (!options.valSecret) {
+      if (serverOps instanceof ValOpsFS) {
         return {
           error: null,
           id: null
@@ -3549,9 +3306,9 @@ class ValServer {
       }
     }
     if (typeof cookie === "string") {
-      const decodedToken = decodeJwt(cookie, this.options.valSecret);
+      const decodedToken = decodeJwt(cookie, options.valSecret);
       if (!decodedToken) {
-        if (this.serverOps instanceof ValOpsFS) {
+        if (serverOps instanceof ValOpsFS) {
           return {
             error: null,
             id: null
@@ -3563,7 +3320,7 @@ class ValServer {
       }
       const verification = IntegratedServerJwtPayload.safeParse(decodedToken);
       if (!verification.success) {
-        if (this.serverOps instanceof ValOpsFS) {
+        if (serverOps instanceof ValOpsFS) {
           return {
             error: null,
             id: null
@@ -3577,7 +3334,7 @@ class ValServer {
         id: verification.data.sub
       };
     } else {
-      if (this.serverOps instanceof ValOpsFS) {
+      if (serverOps instanceof ValOpsFS) {
         return {
           error: null,
           id: null
@@ -3587,420 +3344,687 @@ class ValServer {
         error: "Login required: cookie not found"
       };
     }
-  }
-  async logout() {
-    return {
-      status: 200,
-      cookies: {
-        [VAL_SESSION_COOKIE$1]: {
-          value: null
-        },
-        [VAL_STATE_COOKIE$1]: {
-          value: null
+  };
+  return {
+    //#region auth
+    "/enable": {
+      GET: async req => {
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valEnableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
+        await callbacks.onEnable(true);
+        return {
+          cookies: {
+            [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
+          },
+          status: 302,
+          redirectTo: redirectToRes
+        };
       }
-    };
-  }
-
-  //#region patches
-  async getPatches(query, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+    },
+    "/disable": {
+      GET: async req => {
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valDisableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        await callbacks.onDisable(true);
+        return {
+          cookies: {
+            [VAL_ENABLE_COOKIE_NAME]: {
+              value: "false"
+            }
+          },
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/authorize": {
+      GET: async req => {
+        const query = req.query;
+        if (typeof query.redirect_to !== "string") {
+          return {
+            status: 400,
+            json: {
+              message: "Missing redirect_to query param"
+            }
+          };
         }
-      };
-    }
-    const authors = query.authors;
-    const patches = await this.serverOps.findPatches({
-      authors
-    });
-    if (patches.errors && Object.keys(patches.errors).length > 0) {
-      console.error("Val: Failed to get patches", patches.errors);
-      return {
-        status: 500,
-        json: {
-          message: "Failed to get patches",
-          details: patches.errors
+        const token = crypto.randomUUID();
+        const redirectUrl = new URL(query.redirect_to);
+        const appAuthorizeUrl = getAuthorizeUrl(`${redirectUrl.origin}/${options.route}`, token);
+        await callbacks.onEnable(true);
+        return {
+          cookies: {
+            [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
+            [VAL_STATE_COOKIE]: {
+              value: createStateCookie({
+                redirect_to: query.redirect_to,
+                token
+              }),
+              options: {
+                httpOnly: true,
+                sameSite: "lax",
+                expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
+              }
+            }
+          },
+          status: 302,
+          redirectTo: appAuthorizeUrl
+        };
+      }
+    },
+    "/callback": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const query = req.query;
+        if (!options.project) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Project is not set")
+          };
         }
-      };
-    }
-    const res = {};
-    for (const [patchIdS, patchData] of Object.entries(patches.patches)) {
-      var _patchData$appliedAt;
-      const patchId = patchIdS;
-      if (!res[patchData.path]) {
-        res[patchData.path] = [];
-      }
-      res[patchData.path].push({
-        patch_id: patchId,
-        created_at: patchData.createdAt,
-        applied_at_base_sha: ((_patchData$appliedAt = patchData.appliedAt) === null || _patchData$appliedAt === void 0 ? void 0 : _patchData$appliedAt.baseSha) || null,
-        author: patchData.authorId ?? undefined
-      });
-    }
-    return {
-      status: 200,
-      json: res
-    };
-  }
-  async deletePatches(query, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+        if (!options.valSecret) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Secret is not set")
+          };
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        const {
+          success: callbackReqSuccess,
+          error: callbackReqError
+        } = verifyCallbackReq(cookies[VAL_STATE_COOKIE], query);
+        if (callbackReqError !== null) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`)
+          };
         }
-      };
-    }
-    const ids = query.id;
-    const deleteRes = await this.serverOps.deletePatches(ids);
-    if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
-      console.error("Val: Failed to delete patches", deleteRes.errors);
-      return {
-        status: 500,
-        json: {
-          message: "Failed to delete patches",
-          details: deleteRes.errors
+        const data = await consumeCode(callbackReqSuccess.code);
+        if (data === null) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Failed to exchange code for user")
+          };
         }
-      };
-    }
-    return {
-      status: 200,
-      json: ids
-    };
-  }
-
-  //#region tree ops
-  async getSchema(cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+        const exp = getExpire();
+        const valSecret = options.valSecret;
+        if (!valSecret) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Setup is not correct: secret is missing")
+          };
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        const cookie = encodeJwt({
+          ...data,
+          exp // this is the client side exp
+        }, valSecret);
+        return {
+          status: 302,
+          cookies: {
+            [VAL_STATE_COOKIE]: {
+              value: null
+            },
+            [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
+            [VAL_SESSION_COOKIE]: {
+              value: cookie,
+              options: {
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                secure: true,
+                expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
+              }
+            }
+          },
+          redirectTo: callbackReqSuccess.redirect_uri || "/"
+        };
+      }
+    },
+    "/session": {
+      GET: async req => {
+        const cookies = req.cookies;
+        if (serverOps instanceof ValOpsFS) {
+          return {
+            status: 200,
+            json: {
+              mode: "local",
+              enabled: await callbacks.isEnabled()
+            }
+          };
         }
-      };
-    }
-    const moduleErrors = await this.serverOps.getModuleErrors();
-    if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-      console.error("Val: Module errors", moduleErrors);
-      return {
-        status: 500,
-        json: {
-          message: "Val is not correctly setup. Check the val.modules file",
-          details: moduleErrors
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not set"
+            }
+          };
         }
-      };
-    }
-    const schemaSha = await this.serverOps.getSchemaSha();
-    const schemas = await this.serverOps.getSchemas();
-    const serializedSchemas = {};
-    for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
-      const moduleFilePath = moduleFilePathS;
-      serializedSchemas[moduleFilePath] = schema.serialize();
-    }
-    return {
-      status: 200,
-      json: {
-        schemaSha,
-        schemas: serializedSchemas
-      }
-    };
-  }
-  async putTree(body, treePath, query, cookies) {
-    var _bodyRes$data, _bodyRes$data2, _bodyRes$data3;
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not set"
+            }
+          };
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        return withAuth(options.valSecret, cookies, "session", async data => {
+          if (!options.valBuildUrl) {
+            return {
+              status: 500,
+              json: {
+                message: "Val is not correctly setup. Build url is missing"
+              }
+            };
+          }
+          const url = new URL(`/api/val/${options.project}/auth/session`, options.valBuildUrl);
+          const fetchRes = await fetch(url, {
+            headers: getAuthHeaders(data.token, "application/json")
+          });
+          if (fetchRes.status === 200) {
+            return {
+              status: fetchRes.status,
+              json: {
+                mode: "proxy",
+                enabled: await callbacks.isEnabled(),
+                ...(await fetchRes.json())
+              }
+            };
+          } else {
+            return {
+              status: fetchRes.status,
+              json: {
+                message: "Failed to authorize",
+                ...(await fetchRes.json())
+              }
+            };
+          }
+        });
+      }
+    },
+    "/logout": {
+      GET: async () => {
+        return {
+          status: 200,
+          cookies: {
+            [VAL_SESSION_COOKIE]: {
+              value: null
+            },
+            [VAL_STATE_COOKIE]: {
+              value: null
+            }
+          }
+        };
+      }
+    },
+    //#region patches
+    "/patches/~": {
+      GET: async req => {
+        const query = req.query;
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    // TODO: move
-    const PutTreeBody = z.object({
-      patchIds: z.array(z.string().refine(id => true // TODO:
-      )).optional(),
-      addPatch: z.object({
-        path: z.string().refine(path => true // TODO:
-        ),
-        patch: Patch
-      }).optional()
-    }).optional();
-    const moduleErrors = await this.serverOps.getModuleErrors();
-    if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-      console.error("Val: Module errors", moduleErrors);
-      return {
-        status: 500,
-        json: {
-          message: "Val is not correctly setup. Check the val.modules file",
-          details: moduleErrors
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
         }
-      };
-    }
-    const bodyRes = PutTreeBody.safeParse(body);
-    if (!bodyRes.success) {
-      return {
-        status: 400,
-        json: {
-          message: "Invalid body: " + fromError(bodyRes.error).toString(),
-          details: bodyRes.error.errors
+        const authors = query.author;
+        const patches = await serverOps.fetchPatches({
+          authors,
+          patchIds: query.patch_id,
+          omitPatch: query.omit_patch === true,
+          moduleFilePaths: query.module_file_path
+        });
+        if (patches.error) {
+          // Error is singular
+          console.error("Val: Failed to get patches", patches.errors);
+          return {
+            status: 500,
+            json: {
+              message: patches.error.message,
+              details: patches.error
+            }
+          };
         }
-      };
-    }
-    let tree;
-    let patchAnalysis = null;
-    if ((_bodyRes$data = bodyRes.data) !== null && _bodyRes$data !== void 0 && _bodyRes$data.patchIds && ((_bodyRes$data2 = bodyRes.data) === null || _bodyRes$data2 === void 0 || (_bodyRes$data2 = _bodyRes$data2.patchIds) === null || _bodyRes$data2 === void 0 ? void 0 : _bodyRes$data2.length) > 0 || (_bodyRes$data3 = bodyRes.data) !== null && _bodyRes$data3 !== void 0 && _bodyRes$data3.addPatch) {
-      var _bodyRes$data4, _bodyRes$data5;
-      // TODO: validate patches_sha
-      const patchIds = (_bodyRes$data4 = bodyRes.data) === null || _bodyRes$data4 === void 0 ? void 0 : _bodyRes$data4.patchIds;
-      const patchOps = patchIds && patchIds.length > 0 ? await this.serverOps.getPatchOpsById(patchIds) : {
-        patches: {}
-      };
-      let patchErrors = undefined;
-      for (const [patchIdS, error] of Object.entries(patchOps.errors || {})) {
-        const patchId = patchIdS;
-        if (!patchErrors) {
-          patchErrors = {};
+        if (patches.errors && Object.keys(patches.errors).length > 0) {
+          // Errors is plural. Different property than above.
+          console.error("Val: Failed to get patches", patches.errors);
+          return {
+            status: 500,
+            json: {
+              message: "Failed to get patches",
+              details: patches.errors
+            }
+          };
         }
-        patchErrors[patchId] = {
-          message: error.message
+        return {
+          status: 200,
+          json: patches
         };
-      }
-      if ((_bodyRes$data5 = bodyRes.data) !== null && _bodyRes$data5 !== void 0 && _bodyRes$data5.addPatch) {
-        const newPatchModuleFilePath = bodyRes.data.addPatch.path;
-        const newPatchOps = bodyRes.data.addPatch.patch;
-        const authorId = "id" in auth ? auth.id : null;
-        const createPatchRes = await this.serverOps.createPatch(newPatchModuleFilePath, newPatchOps, authorId);
-        if (createPatchRes.error) {
+      },
+      DELETE: async req => {
+        const query = req.query;
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const ids = query.id;
+        const deleteRes = await serverOps.deletePatches(ids);
+        if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
+          console.error("Val: Failed to delete patches", deleteRes.errors);
           return {
             status: 500,
             json: {
-              message: "Failed to create patch: " + createPatchRes.error.message,
-              details: createPatchRes.error
+              message: "Failed to delete patches",
+              details: deleteRes.errors
             }
           };
         }
-        // TODO: evaluate if we need this: seems wrong to delete patches that are not applied
-        // for (const fileRes of createPatchRes.files) {
-        //   if (fileRes.error) {
-        //     // clean up broken patch:
-        //     await this.serverOps.deletePatches([createPatchRes.patchId]);
-        //     return {
-        //       status: 500,
-        //       json: {
-        //         message: "Failed to create patch",
-        //         details: fileRes.error,
-        //       },
-        //     };
-        //   }
-        // }
-        patchOps.patches[createPatchRes.patchId] = {
-          path: newPatchModuleFilePath,
-          patch: newPatchOps,
-          authorId,
-          createdAt: createPatchRes.createdAt,
-          appliedAt: null
+        return {
+          status: 200,
+          json: ids
         };
       }
-      // TODO: errors
-      patchAnalysis = this.serverOps.analyzePatches(patchOps.patches);
-      tree = {
-        ...(await this.serverOps.getTree({
-          ...patchAnalysis,
-          ...patchOps
-        }))
-      };
-      if (query.validate_all === "true") {
-        const allTree = await this.serverOps.getTree();
-        tree = {
-          sources: {
-            ...allTree.sources,
-            ...tree.sources
-          },
-          errors: {
-            ...allTree.errors,
-            ...tree.errors
+    },
+    //#region tree ops
+    "/schema": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const moduleErrors = await serverOps.getModuleErrors();
+        if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
+          console.error("Val: Module errors", moduleErrors);
+          return {
+            status: 500,
+            json: {
+              message: "Val is not correctly setup. Check the val.modules file",
+              details: moduleErrors
+            }
+          };
+        }
+        const schemaSha = await serverOps.getSchemaSha();
+        const schemas = await serverOps.getSchemas();
+        const serializedSchemas = {};
+        for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
+          const moduleFilePath = moduleFilePathS;
+          serializedSchemas[moduleFilePath] = schema.serialize();
+        }
+        return {
+          status: 200,
+          json: {
+            schemaSha,
+            schemas: serializedSchemas
           }
         };
       }
-    } else {
-      tree = await this.serverOps.getTree();
-    }
-    if (tree.errors && Object.keys(tree.errors).length > 0) {
-      console.error("Val: Failed to get tree", JSON.stringify(tree.errors));
-    }
-    if (query.validate_sources === "true" || query.validate_binary_files === "true") {
-      const schemas = await this.serverOps.getSchemas();
-      const sourcesValidation = await this.serverOps.validateSources(schemas, tree.sources);
+    },
+    "/tree/~": {
+      PUT: async req => {
+        var _body$patchIds;
+        const query = req.query;
+        const cookies = req.cookies;
+        const body = req.body;
+        const treePath = req.path || "";
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const moduleErrors = await serverOps.getModuleErrors();
+        if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
+          console.error("Val: Module errors", moduleErrors);
+          return {
+            status: 500,
+            json: {
+              message: "Val is not correctly setup. Check the val.modules file",
+              details: moduleErrors
+            }
+          };
+        }
+        let tree;
+        let patchAnalysis = null;
+        let newPatchId = undefined;
+        if (body !== null && body !== void 0 && body.patchIds && (body === null || body === void 0 || (_body$patchIds = body.patchIds) === null || _body$patchIds === void 0 ? void 0 : _body$patchIds.length) > 0 || body !== null && body !== void 0 && body.addPatch) {
+          // TODO: validate patches_sha
+          const patchIds = body === null || body === void 0 ? void 0 : body.patchIds;
+          const patchOps = patchIds && patchIds.length > 0 ? await serverOps.fetchPatches({
+            patchIds,
+            omitPatch: false
+          }) : {
+            patches: {}
+          };
+          let patchErrors = undefined;
+          for (const [patchIdS, error] of Object.entries(patchOps.errors || {})) {
+            const patchId = patchIdS;
+            if (!patchErrors) {
+              patchErrors = {};
+            }
+            patchErrors[patchId] = {
+              message: error.message
+            };
+          }
+          if (body !== null && body !== void 0 && body.addPatch) {
+            const newPatchModuleFilePath = body.addPatch.path;
+            const newPatchOps = body.addPatch.patch;
+            const authorId = "id" in auth ? auth.id : null;
+            const createPatchRes = await serverOps.createPatch(newPatchModuleFilePath, newPatchOps, authorId);
+            if (createPatchRes.error) {
+              return {
+                status: 500,
+                json: {
+                  message: "Failed to create patch: " + createPatchRes.error.message,
+                  details: createPatchRes.error
+                }
+              };
+            }
+            // TODO: evaluate if we need this: seems wrong to delete patches that are not applied
+            // for (const fileRes of createPatchRes.files) {
+            //   if (fileRes.error) {
+            //     // clean up broken patch:
+            //     await this.serverOps.deletePatches([createPatchRes.patchId]);
+            //     return {
+            //       status: 500,
+            //       json: {
+            //         message: "Failed to create patch",
+            //         details: fileRes.error,
+            //       },
+            //     };
+            //   }
+            // }
+            newPatchId = createPatchRes.patchId;
+            patchOps.patches[createPatchRes.patchId] = {
+              path: newPatchModuleFilePath,
+              patch: newPatchOps,
+              authorId,
+              createdAt: createPatchRes.createdAt,
+              appliedAt: null
+            };
+          }
+          // TODO: errors
+          patchAnalysis = serverOps.analyzePatches(patchOps.patches);
+          tree = {
+            ...(await serverOps.getTree({
+              ...patchAnalysis,
+              ...patchOps
+            }))
+          };
+          if (query.validate_all) {
+            const allTree = await serverOps.getTree();
+            tree = {
+              sources: {
+                ...allTree.sources,
+                ...tree.sources
+              },
+              errors: {
+                ...allTree.errors,
+                ...tree.errors
+              }
+            };
+          }
+        } else {
+          tree = await serverOps.getTree();
+        }
+        if (tree.errors && Object.keys(tree.errors).length > 0) {
+          console.error("Val: Failed to get tree", JSON.stringify(tree.errors));
+          const res = {
+            status: 400,
+            json: {
+              type: "patch-error",
+              errors: Object.fromEntries(Object.entries(tree.errors).map(([key, value]) => [key, value.map(error => ({
+                patchId: error.patchId,
+                skipped: error.skipped,
+                error: {
+                  message: error.error.message
+                }
+              }))])),
+              message: "One or more patches failed to be applied"
+            }
+          };
+          return res;
+        }
+        if (query.validate_sources || query.validate_binary_files) {
+          const schemas = await serverOps.getSchemas();
+          const sourcesValidation = await serverOps.validateSources(schemas, tree.sources);
 
-      // TODO: send validation errors
-      if (query.validate_binary_files === "true") {
-        await this.serverOps.validateFiles(schemas, tree.sources, sourcesValidation.files);
-      }
-    }
-    const schemaSha = await this.serverOps.getSchemaSha();
-    const modules = {};
-    for (const [moduleFilePathS, module] of Object.entries(tree.sources)) {
-      const moduleFilePath = moduleFilePathS;
-      if (moduleFilePath.startsWith(treePath)) {
-        modules[moduleFilePath] = {
-          source: module,
-          patches: patchAnalysis ? {
-            applied: patchAnalysis.patchesByModule[moduleFilePath].map(p => p.patchId)
-          } : undefined
+          // TODO: send validation errors
+          if (query.validate_binary_files) {
+            await serverOps.validateFiles(schemas, tree.sources, sourcesValidation.files);
+          }
+        }
+        const schemaSha = await serverOps.getSchemaSha();
+        const modules = {};
+        for (const [moduleFilePathS, module] of Object.entries(tree.sources)) {
+          const moduleFilePath = moduleFilePathS;
+          if (moduleFilePath.startsWith(treePath)) {
+            modules[moduleFilePath] = {
+              source: module,
+              patches: patchAnalysis && patchAnalysis.patchesByModule[moduleFilePath] ? {
+                applied: patchAnalysis.patchesByModule[moduleFilePath].map(p => p.patchId)
+              } : undefined
+            };
+          }
+        }
+        const res = {
+          status: 200,
+          json: {
+            schemaSha,
+            modules,
+            newPatchId
+          }
         };
+        return res;
       }
-    }
-    return {
-      status: 200,
-      json: {
-        schemaSha,
-        modules
-      }
-    };
-  }
-  async postSave(body, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+    },
+    "/save": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const body = req.body;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    const PostSaveBody = z.object({
-      patchIds: z.array(z.string().refine(id => true // TODO:
-      ))
-    });
-    const bodyRes = PostSaveBody.safeParse(body);
-    if (!bodyRes.success) {
-      return {
-        status: 400,
-        json: {
-          message: "Invalid body: " + fromError(bodyRes.error).toString(),
-          details: bodyRes.error.errors
+        const PostSaveBody = z.object({
+          patchIds: z.array(z.string().refine(id => true // TODO:
+          ))
+        });
+        const bodyRes = PostSaveBody.safeParse(body);
+        if (!bodyRes.success) {
+          return {
+            status: 400,
+            json: {
+              message: "Invalid body: " + fromError(bodyRes.error).toString(),
+              details: bodyRes.error.errors
+            }
+          };
         }
-      };
-    }
-    const {
-      patchIds
-    } = bodyRes.data;
-    const patches = await this.serverOps.getPatchOpsById(patchIds);
-    const analysis = this.serverOps.analyzePatches(patches.patches);
-    const preparedCommit = await this.serverOps.prepare({
-      ...analysis,
-      ...patches
-    });
-    if (preparedCommit.hasErrors) {
-      console.error("Failed to create commit", {
-        sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
-        binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
-      });
-      return {
-        status: 400,
-        json: {
-          message: "Failed to create commit",
-          details: {
+        const {
+          patchIds
+        } = bodyRes.data;
+        const patches = await serverOps.fetchPatches({
+          patchIds,
+          omitPatch: false
+        });
+        const analysis = serverOps.analyzePatches(patches.patches);
+        const preparedCommit = await serverOps.prepare({
+          ...analysis,
+          ...patches
+        });
+        if (preparedCommit.hasErrors) {
+          console.error("Failed to create commit", {
             sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
             binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
+          });
+          return {
+            status: 400,
+            json: {
+              message: "Failed to create commit",
+              details: {
+                sourceFilePatchErrors: Object.fromEntries(Object.entries(preparedCommit.sourceFilePatchErrors).map(([key, errors]) => [key, errors.map(e => ({
+                  message: formatPatchSourceError(e)
+                }))])),
+                binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
+              }
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsFS) {
+          await serverOps.saveFiles(preparedCommit);
+          return {
+            status: 200,
+            json: {} // TODO:
+          };
+        } else if (serverOps instanceof ValOpsHttp) {
+          if (auth.error === undefined && auth.id) {
+            await serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
+            return {
+              status: 200,
+              json: {} // TODO:
+            };
           }
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        } else {
+          throw new Error("Invalid server ops");
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsFS) {
-      await this.serverOps.saveFiles(preparedCommit);
-      return {
-        status: 200,
-        json: {} // TODO:
-      };
-    } else if (this.serverOps instanceof ValOpsHttp) {
-      if (auth.error === undefined && auth.id) {
-        await this.serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
-        return {
-          status: 200,
-          json: {} // TODO:
-        };
       }
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+    },
+    //#region files
+    "/files": {
+      GET: async req => {
+        const query = req.query;
+        const filePath = req.path;
+        // NOTE: no auth here since you would need the patch_id to get something that is not published.
+        // For everything that is published, well they are already public so no auth required there...
+        // We could imagine adding auth just to be a 200% certain,
+        // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
+        // So: 1) patch ids are not possible to guess (but possible to brute force)
+        //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
+        //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
+        // Thus: attack surface + ease of attack + benefit = low probability of attack
+        // If we couldn't argue that patch ids are secret enough, then this would be a problem.
+        let fileBuffer;
+        if (query.patch_id) {
+          fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id);
+        } else {
+          fileBuffer = await serverOps.getBinaryFile(filePath);
         }
-      };
-    } else {
-      throw new Error("Invalid server ops");
-    }
-  }
-
-  //#region files
-  async getFiles(filePath, query) {
-    // NOTE: no auth here since you would need the patch_id to get something that is not published.
-    // For everything that is published, well they are already public so no auth required there...
-    // We could imagine adding auth just to be a 200% certain,
-    // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
-    // So: 1) patch ids are not possible to guess (but possible to brute force)
-    //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
-    //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
-    // Thus: attack surface + ease of attack + benefit = low probability of attack
-    // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-    let fileBuffer;
-    if (query.patch_id) {
-      fileBuffer = await this.serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id);
-    } else {
-      fileBuffer = await this.serverOps.getBinaryFile(filePath);
-    }
-    if (fileBuffer) {
-      return {
-        status: 200,
-        body: bufferToReadableStream(fileBuffer)
-      };
-    } else {
-      return {
-        status: 404,
-        json: {
-          message: "File not found"
+        if (fileBuffer) {
+          return {
+            status: 200,
+            body: bufferToReadableStream(fileBuffer)
+          };
+        } else {
+          return {
+            status: 404,
+            json: {
+              message: "File not found"
+            }
+          };
         }
-      };
+      }
     }
+  };
+};
+function formatPatchSourceError(error) {
+  if ("message" in error) {
+    return error.message;
+  } else if (Array.isArray(error)) {
+    return error.map(formatPatchSourceError).join("\n");
+  } else {
+    const _exhaustiveCheck = error;
+    return "Unknown patch source error: " + JSON.stringify(_exhaustiveCheck);
   }
 }
 function verifyCallbackReq(stateCookie, queryParams) {
@@ -4120,7 +4144,7 @@ const IntegratedServerJwtPayload = z.object({
   project: z.string()
 });
 async function withAuth(secret, cookies, errorMessageType, handler) {
-  const cookie = cookies[VAL_SESSION_COOKIE$1];
+  const cookie = cookies[VAL_SESSION_COOKIE];
   if (typeof cookie === "string") {
     const decodedToken = decodeJwt(cookie, secret);
     if (!decodedToken) {
@@ -4138,7 +4162,7 @@ async function withAuth(secret, cookies, errorMessageType, handler) {
         status: 401,
         json: {
           message: "Session invalid or, most likely, expired. You will need to login again.",
-          details: verification.error
+          details: fromError(verification.error).toString()
         }
       };
     }
@@ -4300,7 +4324,7 @@ function guessMimeTypeFromPath(filePath) {
 
 async function createValServer(valModules, route, opts, callbacks, formatter) {
   const valServerConfig = await initHandlerOptions(route, opts);
-  return new ValServer(valModules, {
+  return ValServer(valModules, {
     formatter,
     ...valServerConfig
   }, callbacks);
@@ -4425,17 +4449,9 @@ async function readCommit(gitDir, branchName) {
     return undefined;
   }
 }
-const {
-  VAL_SESSION_COOKIE,
-  VAL_STATE_COOKIE
-} = Internal;
-const TREE_PATH_PREFIX = "/tree/~";
-const PATCHES_PATH_PREFIX = "/patches/~";
-const FILES_PATH_PREFIX = "/files";
 function createValApiRouter(route, valServerPromise, convert) {
   const uiRequestHandler = createUIRequestHandler();
   return async req => {
-    var _req$method;
     const valServer = await valServerPromise;
     const url = new URL(req.url);
     if (!url.pathname.startsWith(route)) {
@@ -4449,113 +4465,213 @@ function createValApiRouter(route, valServerPromise, convert) {
         json: error
       });
     }
-    const method = (_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase();
-    function withTreePath(path, prefix) {
-      return async useTreePath => {
-        const pathIndex = path.indexOf("~");
-        if (path.startsWith(prefix) && pathIndex !== -1) {
-          return useTreePath(path.slice(pathIndex + 1));
-        } else {
-          if (prefix.indexOf("/~") === -1) {
-            return convert({
-              status: 500,
-              json: {
-                message: `Route is incorrectly formed: ${prefix}!`
+    const path = url.pathname.slice(route.length);
+    const groupQueryParams = arr => {
+      const map = {};
+      for (const [key, value] of arr) {
+        const list = map[key] || [];
+        list.push(value);
+        map[key] = list;
+      }
+      return map;
+    };
+    async function getValServerResponse(reqApiRoutePath, req) {
+      var _req$method, _anyApi$route, _anyValServer$route;
+      const anyApi =
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Api;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const anyValServer = valServer;
+      const method = (_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase();
+      let route = null;
+      let path = undefined;
+      for (const routeDef of Object.keys(Api)) {
+        if (routeDef === reqApiRoutePath) {
+          route = routeDef;
+          break;
+        }
+        if (reqApiRoutePath.startsWith(routeDef)) {
+          var _anyApi$routeDef;
+          const reqDefinition = anyApi === null || anyApi === void 0 || (_anyApi$routeDef = anyApi[routeDef]) === null || _anyApi$routeDef === void 0 || (_anyApi$routeDef = _anyApi$routeDef[method]) === null || _anyApi$routeDef === void 0 ? void 0 : _anyApi$routeDef.req;
+          if (reqDefinition) {
+            route = routeDef;
+            if (reqDefinition.path) {
+              const subPath = reqApiRoutePath.slice(routeDef.length);
+              const pathRes = reqDefinition.path.safeParse(subPath);
+              if (!pathRes.success) {
+                return zodErrorResult(pathRes.error, `invalid path: '${subPath}' endpoint: '${routeDef}'`);
+              } else {
+                path = pathRes.data;
               }
-            });
+            }
+            break;
           }
-          return convert({
-            status: 404,
+        }
+      }
+      if (!route) {
+        return {
+          status: 404,
+          json: {
+            message: "Route not found. Valid routes are: " + Object.keys(Api),
+            details: {
+              route,
+              method
+            }
+          }
+        };
+      }
+      const apiEndpoint = anyApi === null || anyApi === void 0 || (_anyApi$route = anyApi[route]) === null || _anyApi$route === void 0 ? void 0 : _anyApi$route[method];
+      const reqDefinition = apiEndpoint === null || apiEndpoint === void 0 ? void 0 : apiEndpoint.req;
+      if (!reqDefinition) {
+        return {
+          status: 404,
+          json: {
+            message: `Requested method ${method} on route ${route} is not valid. Valid methods are: ${Object.keys(anyApi[route]).join(", ")}`,
+            details: {
+              route,
+              method
+            }
+          }
+        };
+      }
+      const endpointImpl = anyValServer === null || anyValServer === void 0 || (_anyValServer$route = anyValServer[route]) === null || _anyValServer$route === void 0 ? void 0 : _anyValServer$route[method];
+      if (!endpointImpl) {
+        return {
+          status: 500,
+          json: {
+            message: "Missing server implementation of route with method. This might be caused by a mismatch between Val package versions.",
+            details: {
+              valid: {
+                route: {
+                  server: Object.keys(anyValServer || {}),
+                  api: Object.keys(anyApi || {})
+                },
+                method: {
+                  server: Object.keys((anyValServer === null || anyValServer === void 0 ? void 0 : anyValServer[route]) || {}),
+                  api: Object.keys((anyApi === null || anyApi === void 0 ? void 0 : anyApi[route]) || {})
+                }
+              },
+              route,
+              method
+            }
+          }
+        };
+      }
+      const bodyRes = reqDefinition.body ? reqDefinition.body.safeParse(await req.json()) : {
+        success: true,
+        data: {}
+      };
+      if (!bodyRes.success) {
+        return zodErrorResult(bodyRes.error, "invalid body data");
+      }
+      const cookiesRes = reqDefinition.cookies ? getCookies(req, reqDefinition.cookies) : {
+        success: true,
+        data: {}
+      };
+      if (!cookiesRes.success) {
+        return zodErrorResult(cookiesRes.error, "invalid cookies");
+      }
+      const actualQueryParams = groupQueryParams(Array.from(url.searchParams.entries()));
+      let query = {};
+      if (reqDefinition.query) {
+        // This is code is particularly heavy, however
+        // @see ValidQueryParamTypes in ApiRouter.ts where we explain what we want to support
+        // We prioritized a declarative ApiRouter, so this code is what we ended up with for better of worse
+        const queryRules = {};
+        for (const [key, zodRule] of Object.entries(reqDefinition.query)) {
+          let innerType = zodRule;
+          let isOptional = false;
+          let isArray = false;
+          // extract inner types:
+          if (innerType instanceof z.ZodOptional) {
+            isOptional = true;
+            innerType = innerType.unwrap();
+          }
+          if (innerType instanceof z.ZodArray) {
+            isArray = true;
+            innerType = innerType.element;
+          }
+          // convert boolean to union of literals true and false so we can parse it as a string
+          if (innerType instanceof z.ZodBoolean) {
+            innerType = z.union([z.literal("true"), z.literal("false")]).transform(arg => Boolean(arg));
+          }
+          // re-build rules:
+          let arrayCompatibleRule = innerType;
+          arrayCompatibleRule = z.array(innerType); // we always want to parse an array because we group the query params by into an array
+          if (isOptional) {
+            arrayCompatibleRule = arrayCompatibleRule.optional();
+          }
+          if (!isArray) {
+            arrayCompatibleRule = arrayCompatibleRule.transform(arg => arg && arg[0]);
+          }
+          queryRules[key] = arrayCompatibleRule;
+        }
+        const queryRes = z.object(queryRules).safeParse(actualQueryParams);
+        if (!queryRes.success) {
+          return zodErrorResult(queryRes.error, `invalid query params: (${JSON.stringify(actualQueryParams)})`);
+        }
+        query = queryRes.data;
+      }
+      const res = await endpointImpl({
+        body: bodyRes.data,
+        cookies: cookiesRes.data,
+        query,
+        path
+      });
+      const resDef = apiEndpoint.res;
+      if (resDef) {
+        const responseResult = resDef.safeParse(res);
+        if (!responseResult.success) {
+          return {
+            status: 500,
             json: {
-              message: `Malformed ${prefix} path! Expected: '${prefix}'`
+              message: "Could not validate response. This is likely a bug in Val server.",
+              details: {
+                response: res,
+                errors: formatZodErrorString(responseResult.error)
+              }
             }
-          });
+          };
         }
-      };
+      }
+      return res;
     }
-    const path = url.pathname.slice(route.length);
     if (path.startsWith("/static")) {
       return convert(await uiRequestHandler(path.slice("/static".length), url.href));
-    } else if (path === "/session") {
-      return convert(await valServer.session(getCookies(req, [VAL_SESSION_COOKIE])));
-    } else if (path === "/authorize") {
-      return convert(await valServer.authorize({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (path === "/callback") {
-      return convert(await valServer.callback({
-        code: url.searchParams.get("code") || undefined,
-        state: url.searchParams.get("state") || undefined
-      }, getCookies(req, [VAL_STATE_COOKIE])));
-    } else if (path === "/logout") {
-      return convert(await valServer.logout());
-    } else if (path === "/enable") {
-      return convert(await valServer.enable({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (path === "/disable") {
-      return convert(await valServer.disable({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (method === "POST" && path === "/save") {
-      const body = await req.json();
-      return convert(await valServer.postSave(body, getCookies(req, [VAL_SESSION_COOKIE])));
-      // } else if (method === "POST" && path === "/validate") {
-      //   const body = (await req.json()) as unknown;
-      //   return convert(
-      //     await valServer.postValidate(
-      //       body,
-      //       getCookies(req, [VAL_SESSION_COOKIE]),
-      //       requestHeaders
-      //     )
-      //   );
-    } else if (method === "GET" && path === "/schema") {
-      return convert(await valServer.getSchema(getCookies(req, [VAL_SESSION_COOKIE])));
-    } else if (method === "PUT" && path.startsWith(TREE_PATH_PREFIX)) {
-      return withTreePath(path, TREE_PATH_PREFIX)(async treePath => convert(await valServer.putTree(await req.json(), treePath, {
-        patches_sha: url.searchParams.get("patches_sha") || undefined,
-        validate_all: url.searchParams.get("validate_all") || undefined,
-        validate_binary_files: url.searchParams.get("validate_binary_files") || undefined,
-        validate_sources: url.searchParams.get("validate_sources") || undefined
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "GET" && path.startsWith(PATCHES_PATH_PREFIX)) {
-      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.getPatches({
-        authors: url.searchParams.getAll("author")
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "DELETE" && path.startsWith(PATCHES_PATH_PREFIX)) {
-      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.deletePatches({
-        id: url.searchParams.getAll("id")
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "GET" && path.startsWith(FILES_PATH_PREFIX)) {
-      const treePath = path.slice(FILES_PATH_PREFIX.length);
-      return convert(await valServer.getFiles(treePath, {
-        patch_id: url.searchParams.get("patch_id") || undefined
-      }));
     } else {
-      return convert({
-        status: 404,
-        json: {
-          message: "Not Found",
-          details: {
-            method,
-            path
-          }
-        }
-      });
+      return convert(await getValServerResponse(path, req));
+    }
+  };
+}
+function formatZodErrorString(error) {
+  const errors = fromZodError(error).toString();
+  return errors.length > 640 ? `${errors.slice(0, 640)}...` : errors;
+}
+function zodErrorResult(error, message) {
+  return {
+    status: 400,
+    json: {
+      message: "Bad Request: " + message,
+      details: {
+        errors: formatZodErrorString(error)
+      }
     }
   };
 }
 
 // TODO: is this naive implementation is too naive?
-function getCookies(req, names) {
-  var _req$headers$get;
-  return ((_req$headers$get = req.headers.get("Cookie")) === null || _req$headers$get === void 0 ? void 0 : _req$headers$get.split("; ").reduce((acc, cookie) => {
-    const [name, value] = cookie.split("=");
-    if (names.includes(name.trim())) {
-      acc[name.trim()] = decodeURIComponent(value.trim());
-    }
-    return acc;
-  }, {})) || {};
+function getCookies(req, cookiesDef) {
+  var _req$headers;
+  const input = {};
+  const cookieParts = (_req$headers = req.headers) === null || _req$headers === void 0 || (_req$headers = _req$headers.get("Cookie")) === null || _req$headers === void 0 ? void 0 : _req$headers.split("; ");
+  for (const name of Object.keys(cookiesDef)) {
+    const cookie = cookieParts === null || cookieParts === void 0 ? void 0 : cookieParts.find(cookie => cookie.startsWith(`${name}=`));
+    const value = cookie ? decodeURIComponent(cookie === null || cookie === void 0 ? void 0 : cookie.split("=")[1]) : undefined;
+    if (value) {
+      input[name.trim()] = value;
+    }
+  }
+  return z.object(cookiesDef).safeParse(input);
 }
 
 /**