@valbuild/server 0.63.5 → 0.65.0

package/dist/valbuild-server.esm.js

@@ -8,12 +8,12 @@ import fsPath__default from 'path';
 import fs, { promises } from 'fs';
 import { transform } from 'sucrase';
 import { VAL_CSS_PATH, VAL_APP_ID, VAL_OVERLAY_ID } from '@valbuild/ui';
+import { VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, Api } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
-import { MIME_TYPES_TO_EXT, filenameToMimeType, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE as VAL_STATE_COOKIE$1, VAL_SESSION_COOKIE as VAL_SESSION_COOKIE$1 } from '@valbuild/shared/internal';
 import crypto$1 from 'crypto';
 import z$1, { z } from 'zod';
 import sizeOf from 'image-size';
-import { fromError } from 'zod-validation-error';
+import { fromError, fromZodError } from 'zod-validation-error';
 
 class ValSyntaxError {
   constructor(message, node) {
@@ -1243,56 +1243,6 @@ function encodeJwt(payload, sessionKey) {
   return `${jwtHeaderBase64}.${payloadBase64}.${crypto$1.createHmac("sha256", sessionKey).update(`${jwtHeaderBase64}.${payloadBase64}`).digest("base64")}`;
 }
 
-const textEncoder$2 = new TextEncoder();
-async function extractImageMetadata(filename, input) {
-  const imageSize = sizeOf(input);
-  let mimeType = null;
-  if (imageSize.type) {
-    const possibleMimeType = `image/${imageSize.type}`;
-    if (MIME_TYPES_TO_EXT[possibleMimeType]) {
-      mimeType = possibleMimeType;
-    }
-    const filenameBasedLookup = filenameToMimeType(filename);
-    if (filenameBasedLookup) {
-      mimeType = filenameBasedLookup;
-    }
-  }
-  if (!mimeType) {
-    mimeType = "application/octet-stream";
-  }
-  let {
-    width,
-    height
-  } = imageSize;
-  if (!width || !height) {
-    width = 0;
-    height = 0;
-  }
-  const sha256 = getSha256(mimeType, input);
-  return {
-    width,
-    height,
-    sha256,
-    mimeType
-  };
-}
-function getSha256(mimeType, input) {
-  return Internal.getSHA256Hash(textEncoder$2.encode(
-  // TODO: we should probably store the mimetype in the metadata and reuse it here
-  `data:${mimeType};base64,${input.toString("base64")}`));
-}
-async function extractFileMetadata(filename, input) {
-  let mimeType = filenameToMimeType(filename);
-  if (!mimeType) {
-    mimeType = "application/octet-stream";
-  }
-  const sha256 = getSha256(mimeType, input);
-  return {
-    sha256,
-    mimeType
-  };
-}
-
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const textEncoder$1 = new TextEncoder();
 const jsonOps = new JSONOps();
@@ -1321,15 +1271,20 @@ class ValOps {
     this.modulesErrors = null;
   }
   hash(input) {
-    let str;
-    if (typeof input === "string") {
-      str = input;
-    } else {
-      str = JSON.stringify(input);
-    }
-    return Internal.getSHA256Hash(textEncoder$1.encode(str));
+    return Internal.getSHA256Hash(textEncoder$1.encode(input));
   }
 
+  // #region stat
+  /**
+   * Get the status from Val
+   *
+   * This works differently in ValOpsFS and ValOpsHttp:
+   * - In ValOpsFS (for dev mode) works using long-polling operations since we cannot use WebSockets in the host Next.js server and we do not want to hammer the server with requests (though we could argue that it would be ok in dev, it is not up to our standards as a kick-ass CMS).
+   * - In ValOpsHttp (in production) it returns a WebSocket URL so that the client can connect directly.
+   *
+   * The reason we do not use long polling in production is that Vercel (a very likely host for Next.js), bills by wall time and long polling would therefore be very expensive.
+   */
+
   // #region initTree
   async initTree() {
     if (this.baseSha === null || this.schemaSha === null || this.sources === null || this.schemas === null || this.modulesErrors === null) {
@@ -1386,17 +1341,25 @@ class ValOps {
             addModuleError(`source in ${path} is undefined`, moduleIdx, path);
             return;
           }
+          let serializedSchema;
+          try {
+            serializedSchema = schema.serialize();
+          } catch (e) {
+            const message = e instanceof Error ? e.message : JSON.stringify(e);
+            addModuleError(`Could not serialize module: '${path}'. Error: ${message}`, moduleIdx, path);
+            return;
+          }
           const pathM = path;
           currentSources[pathM] = source;
           currentSchemas[pathM] = schema;
           // make sure the checks above is enough that this does not fail - even if val modules are not set up correctly
-          baseSha += this.hash({
+          baseSha = this.hash(baseSha + JSON.stringify({
             path,
-            schema: schema.serialize(),
+            schema: serializedSchema,
             source,
             modulesErrors: currentModulesErrors
-          });
-          schemaSha += this.hash(schema.serialize());
+          }));
+          schemaSha = this.hash(schemaSha + JSON.stringify(serializedSchema));
         });
       }
       this.sources = currentSources;
@@ -1490,10 +1453,14 @@ class ValOps {
         if (!errors[path]) {
           errors[path] = [];
         }
-        errors[path].push({
+        errors[path].push(...patches.map(({
+          patchId
+        }) => ({
+          patchId,
           invalidPath: true,
+          skipped: true,
           error: new PatchError(`Module at path: '${path}' not found`)
-        });
+        })));
       }
       patchedSources[path] = sources[path];
       for (const {
@@ -1502,6 +1469,7 @@ class ValOps {
         if (errors[path]) {
           errors[path].push({
             patchId: patchId,
+            skipped: true,
             error: new PatchError(`Cannot apply patch: previous errors exists`)
           });
         } else {
@@ -1509,6 +1477,7 @@ class ValOps {
           if (!patchData) {
             errors[path] = [{
               patchId: patchId,
+              skipped: false,
               error: new PatchError(`Patch not found`)
             }];
             continue;
@@ -1539,6 +1508,7 @@ class ValOps {
             }
             errors[path].push({
               patchId: patchId,
+              skipped: false,
               error: patchRes.error
             });
           } else {
@@ -1585,25 +1555,27 @@ class ValOps {
       }
       for (const [sourcePathS, validationErrors] of Object.entries(res)) {
         const sourcePath = sourcePathS;
-        for (const validationError of validationErrors) {
-          if (isOnlyFileCheckValidationError(validationError)) {
-            if (files[sourcePath]) {
-              throw new Error("Cannot have multiple files with same path. Path: " + sourcePath + "; Module: " + path);
-            }
-            const value = validationError.value;
-            if (isFileSource(value)) {
-              files[sourcePath] = value;
-            }
-          } else {
-            if (!errors[path]) {
-              errors[path] = {
-                validations: {}
-              };
-            }
-            if (!errors[path].validations[sourcePath]) {
-              errors[path].validations[sourcePath] = [];
+        if (validationErrors) {
+          for (const validationError of validationErrors) {
+            if (isOnlyFileCheckValidationError(validationError)) {
+              if (files[sourcePath]) {
+                throw new Error("Cannot have multiple files with same path. Path: " + sourcePath + "; Module: " + path);
+              }
+              const value = validationError.value;
+              if (isFileSource(value)) {
+                files[sourcePath] = value;
+              }
+            } else {
+              if (!errors[path]) {
+                errors[path] = {
+                  validations: {}
+                };
+              }
+              if (!errors[path].validations[sourcePath]) {
+                errors[path].validations[sourcePath] = [];
+              }
+              errors[path].validations[sourcePath].push(validationError);
             }
-            errors[path].validations[sourcePath].push(validationError);
           }
         }
       }
@@ -1791,8 +1763,22 @@ class ValOps {
         const patchRes = applyPatch(tsSourceFile, tsOps, sourceFileOps);
         if (result.isErr(patchRes)) {
           if (Array.isArray(patchRes.error)) {
+            for (const error of patchRes.error) {
+              console.error("Could not patch", JSON.stringify({
+                path,
+                patchId,
+                error,
+                sourceFileOps
+              }, null, 2));
+            }
             errors.push(...patchRes.error);
           } else {
+            console.error("Could not patch", JSON.stringify({
+              path,
+              patchId,
+              error: patchRes.error,
+              sourceFileOps
+            }, null, 2));
             errors.push(patchRes.error);
           }
           triedPatches.push(patchId);
@@ -1886,16 +1872,23 @@ class ValOps {
   }
 
   // #region createPatch
-  async createPatch(path, patch, authorId) {
-    const {
-      sources,
-      schemas,
-      moduleErrors
-    } = await this.initTree();
+  async createPatch(path, patchAnalysis, patch, authorId) {
+    const initTree = await this.initTree();
+    const schemas = initTree.schemas;
+    const moduleErrors = initTree.moduleErrors;
+    let sources = initTree.sources;
+    if (patchAnalysis) {
+      const tree = await this.getTree(patchAnalysis);
+      sources = {
+        ...sources,
+        ...tree.sources
+      };
+    }
     const source = sources[path];
     const schema = schemas[path];
     const moduleError = moduleErrors.find(e => e.path === path);
     if (moduleError) {
+      console.error(`Cannot patch. Module at path: '${path}' has fatal errors: "${moduleError.message}"`);
       return {
         error: {
           message: `Cannot patch. Module at path: '${path}' has fatal errors: ` + moduleErrors.map(m => `"${m.message}"`).join(" and ")
@@ -1903,6 +1896,7 @@ class ValOps {
       };
     }
     if (!source) {
+      console.error(`Cannot patch. Module source at path: '${path}' does not exist`);
       return {
         error: {
           message: `Cannot patch. Module source at path: '${path}' does not exist`
@@ -1910,6 +1904,7 @@ class ValOps {
       };
     }
     if (!schema) {
+      console.error(`Cannot patch. Module schema at path: '${path}' does not exist`);
       return {
         error: {
           message: `Cannot patch. Module schema at path: '${path}' does not exist`
@@ -1927,10 +1922,12 @@ class ValOps {
           filePath
         } = op;
         if (files[filePath]) {
+          console.error(`Cannot have multiple files with same path in same patch. Path: ${filePath}`);
           files[filePath] = {
             error: new PatchError("Cannot have multiple files with same path in same patch")
           };
         } else if (typeof value !== "string") {
+          console.error(`Value is not a string. Path: ${filePath}. Value: ${value}`);
           files[filePath] = {
             error: new PatchError("Value is not a string")
           };
@@ -1946,15 +1943,14 @@ class ValOps {
             path: op.path,
             filePath,
             nestedFilePath: op.nestedFilePath,
-            value: {
-              sha256
-            }
+            value: sha256
           });
         }
       }
     }
     const saveRes = await this.saveSourceFilePatch(path, sourceFileOps, authorId);
     if (saveRes.error) {
+      console.error(`Could not save source file patch at path: '${path}'. Error: ${saveRes.error.message}`);
       return {
         error: saveRes.error
       };
@@ -1978,17 +1974,20 @@ class ValOps {
           ? "image" : schemaAtPath instanceof FileSchema ? "file" : schemaAtPath.serialize().type;
         } catch (e) {
           if (e instanceof Error) {
+            console.error(`Could not resolve file type at: ${modulePath}. Error: ${e.message}`);
             return {
               filePath,
               error: new PatchError(`Could not resolve file type at: ${modulePath}. Error: ${e.message}`)
             };
           }
+          console.error(`Could not resolve file type at: ${modulePath}. Unknown error.`);
           return {
             filePath,
             error: new PatchError(`Could not resolve file type at: ${modulePath}. Unknown error.`)
           };
         }
         if (type !== "image" && type !== "file") {
+          console.error("Unknown file type (resolved from schema): " + type);
           return {
             filePath,
             error: new PatchError("Unknown file type (resolved from schema): " + type)
@@ -1996,6 +1995,7 @@ class ValOps {
         }
         const mimeType = getMimeTypeFromBase64(data.value);
         if (!mimeType) {
+          console.error("Could not get mimeType from base 64 encoded value");
           return {
             filePath,
             error: new PatchError("Could not get mimeType from base 64 encoded value. First chars were: " + data.value.slice(0, 20))
@@ -2003,6 +2003,7 @@ class ValOps {
         }
         const buffer = bufferFromDataUrl(data.value);
         if (!buffer) {
+          console.error("Could not create buffer from base 64 encoded value");
           return {
             filePath,
             error: new PatchError("Could not create buffer from base 64 encoded value")
@@ -2010,6 +2011,7 @@ class ValOps {
         }
         const metadataOps = createMetadataFromBuffer(type, mimeType, buffer);
         if (metadataOps.errors) {
+          console.error(`Could not get metadata. Errors: ${metadataOps.errors.map(error => error.message).join(", ")}`);
           return {
             filePath,
             error: new PatchError(`Could not get metadata. Errors: ${metadataOps.errors.map(error => error.message).join(", ")}`)
@@ -2031,6 +2033,14 @@ class ValOps {
         };
       }
     }));
+    const errors = saveFileRes.filter(f => !!f.error);
+    if (errors.length > 0) {
+      return {
+        error: {
+          message: "Could not save patch: " + errors.map(e => e.error.message).join(", ")
+        }
+      };
+    }
     return {
       patchId,
       files: saveFileRes,
@@ -2055,14 +2065,13 @@ function isFileSource(value) {
 }
 function getFieldsForType(type) {
   if (type === "file") {
-    return ["sha256", "mimeType"];
+    return ["mimeType"];
   } else if (type === "image") {
-    return ["sha256", "mimeType", "height", "width"];
+    return ["mimeType", "height", "width"];
   }
   throw new Error("Unknown type: " + type);
 }
 function createMetadataFromBuffer(type, mimeType, buffer) {
-  const sha256 = getSha256(mimeType, buffer);
   const errors = [];
   let availableMetadata;
   if (type === "image") {
@@ -2071,7 +2080,7 @@ function createMetadataFromBuffer(type, mimeType, buffer) {
       height,
       type
     } = sizeOf(buffer);
-    const normalizedType = type === "jpg" ? "jpeg" : type;
+    const normalizedType = type === "jpg" ? "jpeg" : type === "svg" ? "svg+xml" : type;
     if (type !== undefined && `image/${normalizedType}` !== mimeType) {
       return {
         errors: [{
@@ -2080,14 +2089,12 @@ function createMetadataFromBuffer(type, mimeType, buffer) {
       };
     }
     availableMetadata = {
-      sha256: sha256,
       mimeType,
       height,
       width
     };
   } else {
     availableMetadata = {
-      sha256: sha256,
       mimeType
     };
   }
@@ -2207,9 +2214,7 @@ const OperationT = z$1.discriminatedUnion("op", [z$1.object({
   path: z$1.array(z$1.string()),
   filePath: z$1.string(),
   nestedFilePath: z$1.array(z$1.string()).optional(),
-  value: z$1.union([z$1.string(), z$1.object({
-    sha256: z$1.string()
-  })])
+  value: z$1.string()
 }).strict()]);
 const Patch = z$1.array(OperationT);
 
@@ -2223,6 +2228,161 @@ class ValOpsFS extends ValOps {
   async onInit() {
     // do nothing
   }
+  async getStat(params) {
+    // In ValOpsFS, we don't have a websocket server to listen to file changes so we use long-polling.
+    // If a file that Val depends on changes, we break the connection and tell the client to request again to get the latest values.
+    try {
+      var _this$options, _this$options2;
+      const currentBaseSha = await this.getBaseSha();
+      const currentSchemaSha = await this.getSchemaSha();
+      const moduleFilePaths = Object.keys(await this.getSchemas());
+      const patchData = await this.readPatches();
+      const patches = [];
+      // TODO: use proper patch sequences when available:
+      for (const [patchId] of Object.entries(patchData.patches).sort(([, a], [, b]) => {
+        return a.createdAt.localeCompare(b.createdAt, undefined);
+      })) {
+        patches.push(patchId);
+      }
+      // something changed: return immediately
+      const didChange = !params || currentBaseSha !== params.baseSha || currentSchemaSha !== params.schemaSha || patches.length !== params.patches.length || patches.some((p, i) => p !== params.patches[i]);
+      if (didChange) {
+        return {
+          type: "did-change",
+          baseSha: currentBaseSha,
+          schemaSha: currentSchemaSha,
+          patches
+        };
+      }
+      let fsWatcher = null;
+      let stopPolling = false;
+      const didDirectoryChangeUsingPolling = (dir, interval, setHandle) => {
+        const mtimeInDir = {};
+        if (fs.existsSync(dir)) {
+          for (const file of fs.readdirSync(dir)) {
+            mtimeInDir[file] = fs.statSync(fsPath__default.join(dir, file)).mtime.getTime();
+          }
+        }
+        return new Promise(resolve => {
+          const go = resolve => {
+            const start = Date.now();
+            if (fs.existsSync(dir)) {
+              const subDirs = fs.readdirSync(dir);
+              // amount of files changed
+              if (subDirs.length !== Object.keys(mtimeInDir).length) {
+                resolve("request-again");
+              }
+              for (const file of fs.readdirSync(dir)) {
+                const mtime = fs.statSync(fsPath__default.join(dir, file)).mtime.getTime();
+                if (mtime !== mtimeInDir[file]) {
+                  resolve("request-again");
+                }
+              }
+            } else {
+              // dir had files, but now is deleted
+              if (Object.keys(mtimeInDir).length > 0) {
+                resolve("request-again");
+              }
+            }
+            if (Date.now() - start > interval) {
+              console.warn("Val: polling interval of patches exceeded");
+            }
+            if (stopPolling) {
+              return;
+            }
+            setHandle(setTimeout(() => go(resolve), interval));
+          };
+          setHandle(setTimeout(() => go(resolve), interval));
+        });
+      };
+      const didFilesChangeUsingPolling = (files, interval, setHandle) => {
+        const mtimes = {};
+        for (const file of files) {
+          if (fs.existsSync(file)) {
+            mtimes[file] = fs.statSync(file).mtime.getTime();
+          } else {
+            mtimes[file] = -1;
+          }
+        }
+        return new Promise(resolve => {
+          const go = resolve => {
+            const start = Date.now();
+            for (const file of files) {
+              const mtime = fs.existsSync(file) ? fs.statSync(file).mtime.getTime() : -1;
+              if (mtime !== mtimes[file]) {
+                resolve("request-again");
+              }
+            }
+            if (Date.now() - start > interval) {
+              console.warn("Val: polling interval of files exceeded");
+            }
+            setHandle(setTimeout(() => go(resolve), interval));
+          };
+          if (stopPolling) {
+            return;
+          }
+          setHandle(setTimeout(() => go(resolve), interval));
+        });
+      };
+      const statFilePollingInterval = ((_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.statFilePollingInterval) || 250; // relatively low interval, but there would typically not be that many files (less than 1000 at the very least) - hopefully if we have customers with more files than that, we also have devs working on Val that easily can fix this :) Besides this is just the default
+      const disableFilePolling = ((_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.disableFilePolling) || false;
+      let patchesDirHandle;
+      let valFilesIntervalHandle;
+      const type = await Promise.race([
+      // we poll the patches directory for changes since fs.watch does not work reliably on all system (in particular on WSL) and just checking the patches dir is relatively cheap
+      disableFilePolling ? new Promise(() => {}) : didDirectoryChangeUsingPolling(this.getPatchesDir(), statFilePollingInterval, handle => {
+        patchesDirHandle = handle;
+      }),
+      // we poll the files that Val depends on for changes
+      disableFilePolling ? new Promise(() => {}) : didFilesChangeUsingPolling([fsPath__default.join(this.rootDir, "val.config.ts"), fsPath__default.join(this.rootDir, "val.modules.ts"), fsPath__default.join(this.rootDir, "val.config.js"), fsPath__default.join(this.rootDir, "val.modules.js"), ...moduleFilePaths.map(p => fsPath__default.join(this.rootDir, p))], statFilePollingInterval, handle => {
+        valFilesIntervalHandle = handle;
+      }), new Promise(resolve => {
+        fsWatcher = fs.watch(this.rootDir, {
+          recursive: true
+        }, (eventType, filename) => {
+          if (!filename) {
+            return;
+          }
+          const isChange = filename.startsWith(this.getPatchesDir().slice(this.rootDir.length + 1)) || filename.endsWith(".val.ts") || filename.endsWith(".val.js") || filename.endsWith("val.config.ts") || filename.endsWith("val.config.js") || filename.endsWith("val.modules.ts") || filename.endsWith("val.modules.js");
+          if (isChange) {
+            // a file that Val depends on just changed or a patch was created, break connection and request stat again to get the new values
+            resolve("request-again");
+          }
+        });
+      }), new Promise(resolve => {
+        var _this$options3;
+        return setTimeout(() => resolve("no-change"), ((_this$options3 = this.options) === null || _this$options3 === void 0 ? void 0 : _this$options3.statPollingInterval) || 20000);
+      })]).finally(() => {
+        if (fsWatcher) {
+          fsWatcher.close();
+        }
+        stopPolling = true;
+        clearInterval(patchesDirHandle);
+        clearInterval(valFilesIntervalHandle);
+      });
+      return {
+        type,
+        baseSha: currentBaseSha,
+        schemaSha: currentSchemaSha,
+        patches
+      };
+    } catch (err) {
+      if (err instanceof Error) {
+        return {
+          type: "error",
+          error: {
+            message: err.message
+          }
+        };
+      }
+      return {
+        type: "error",
+        error: {
+          message: "Unknown error (getStat)"
+        }
+      };
+    }
+  }
   async readPatches(includes) {
     const patchesCacheDir = this.getPatchesDir();
     let patchJsonFiles = [];
@@ -2231,8 +2391,8 @@ class ValOpsFS extends ValOps {
     }
     const patches = {};
     const errors = {};
-    const sortedPatchIds = patchJsonFiles.map(file => parseInt(fsPath__default.basename(fsPath__default.dirname(file)), 10)).sort();
-    for (const patchIdNum of sortedPatchIds) {
+    const parsedPatchIds = patchJsonFiles.map(file => parseInt(fsPath__default.basename(fsPath__default.dirname(file)), 10)).sort();
+    for (const patchIdNum of parsedPatchIds) {
       if (Number.isNaN(patchIdNum)) {
         throw new Error("Could not parse patch id from file name. Files found: " + patchJsonFiles.join(", "));
       }
@@ -2273,6 +2433,12 @@ class ValOpsFS extends ValOps {
       errors: allErrors,
       patches: allPatches
     } = await this.readPatches(filters.patchIds);
+    if (allErrors && Object.keys(allErrors).length > 0) {
+      for (const [patchId, error] of Object.entries(allErrors)) {
+        console.error("Error reading patch", patchId, error);
+        errors[patchId] = error;
+      }
+    }
     for (const [patchIdS, patch] of Object.entries(allPatches)) {
       const patchId = patchIdS;
       if (filters.authors && !(patch.authorId === null || filters.authors.includes(patch.authorId))) {
@@ -2288,10 +2454,6 @@ class ValOpsFS extends ValOps {
         authorId: patch.authorId,
         appliedAt: patch.appliedAt
       };
-      const error = allErrors && allErrors[patchId];
-      if (error) {
-        errors[patchId] = error;
-      }
     }
     if (errors && Object.keys(errors).length > 0) {
       return {
@@ -2635,11 +2797,11 @@ class ValOpsFS extends ValOps {
   getPatchDir(patchId) {
     return fsPath__default.join(this.getPatchesDir(), patchId);
   }
-  getBinaryFilePath(filename, patchId) {
-    return fsPath__default.join(this.getPatchDir(patchId), "files", filename, fsPath__default.basename(filename));
+  getBinaryFilePath(filePath, patchId) {
+    return fsPath__default.join(this.getPatchDir(patchId), "files", filePath, fsPath__default.basename(filePath));
   }
-  getBinaryFileMetadataPath(filename, patchId) {
-    return fsPath__default.join(this.getPatchDir(patchId), "files", filename, "metadata.json");
+  getBinaryFileMetadataPath(filePath, patchId) {
+    return fsPath__default.join(this.getPatchDir(patchId), "files", filePath, "metadata.json");
   }
   getPatchFilePath(patchId) {
     return fsPath__default.join(this.getPatchDir(patchId), "patch.json");
@@ -2712,12 +2874,10 @@ const BaseSha = z.string().refine(s => !!s); // TODO: validate
 const AuthorId = z.string().refine(s => !!s); // TODO: validate
 const ModuleFilePath = z.string().refine(s => !!s); // TODO: validate
 const Metadata = z.union([z.object({
-  sha256: z.string(),
   mimeType: z.string(),
   width: z.number(),
   height: z.number()
 }), z.object({
-  sha256: z.string(),
   mimeType: z.string()
 })]);
 const MetadataRes = z.object({
@@ -2738,7 +2898,7 @@ const BasePatchResponse = z.object({
 });
 const GetPatches = z.object({
   patches: z.array(z.intersection(z.object({
-    patch: Patch
+    patch: Patch.optional()
   }), BasePatchResponse)),
   errors: z.array(z.object({
     patchId: PatchId.optional(),
@@ -2789,7 +2949,9 @@ const CommitResponse = z.object({
   branch: z.string()
 });
 class ValOpsHttp extends ValOps {
-  constructor(hostUrl, project, commitSha, branch, apiKey, valModules, options) {
+  constructor(hostUrl, project, commitSha,
+  // TODO: CommitSha
+  branch, apiKey, valModules, options) {
     super(valModules, options);
     this.hostUrl = hostUrl;
     this.project = project;
@@ -2803,7 +2965,150 @@ class ValOpsHttp extends ValOps {
   async onInit() {
     // TODO: unused for now. Implement or remove
   }
+  async getStat(params) {
+    if (!(params !== null && params !== void 0 && params.profileId)) {
+      return {
+        type: "error",
+        error: {
+          message: "No profileId provided"
+        }
+      };
+    }
+    const currentBaseSha = await this.getBaseSha();
+    const currentSchemaSha = await this.getSchemaSha();
+    const patchData = await this.fetchPatches({
+      omitPatch: true,
+      authors: undefined,
+      patchIds: undefined,
+      moduleFilePaths: undefined
+    });
+    const patches = [];
+    // TODO: use proper patch sequences when available:
+    for (const [patchId] of Object.entries(patchData.patches).sort(([, a], [, b]) => {
+      return a.createdAt.localeCompare(b.createdAt, undefined);
+    })) {
+      patches.push(patchId);
+    }
+    const webSocketNonceRes = await this.getWebSocketNonce(params.profileId);
+    if (webSocketNonceRes.status === "error") {
+      return {
+        type: "error",
+        error: webSocketNonceRes.error
+      };
+    }
+    const {
+      nonce,
+      url
+    } = webSocketNonceRes.data;
+    return {
+      type: "use-websocket",
+      url,
+      nonce,
+      baseSha: currentBaseSha,
+      schemaSha: currentSchemaSha,
+      patches,
+      commitSha: this.commitSha
+    };
+  }
+  async getWebSocketNonce(profileId) {
+    return fetch(`${this.hostUrl}/v1/${this.project}/websocket/nonces`, {
+      method: "POST",
+      body: JSON.stringify({
+        branch: this.branch,
+        profileId
+      }),
+      headers: {
+        ...this.authHeaders,
+        "Content-Type": "application/json"
+      }
+    }).then(async res => {
+      if (res.ok) {
+        const json = await res.json();
+        if (typeof json.nonce !== "string" || typeof json.url !== "string") {
+          return {
+            status: "error",
+            error: {
+              message: "Invalid nonce response: " + JSON.stringify(json)
+            }
+          };
+        }
+        if (!json.url.startsWith("ws://") && !json.url.startsWith("wss://")) {
+          return {
+            status: "error",
+            error: {
+              message: "Invalid websocket url: " + json.url
+            }
+          };
+        }
+        return {
+          status: "success",
+          data: {
+            nonce: json.nonce,
+            url: json.url
+          }
+        };
+      }
+      return {
+        status: "error",
+        error: {
+          message: "Could not get nonce. HTTP error: " + res.status + " " + res.statusText
+        }
+      };
+    }).catch(e => {
+      console.error("Could not get nonce (connection error?):", e instanceof Error ? e.message : e.toString());
+      return {
+        status: "error",
+        error: {
+          message: "Could not get nonce. Error: " + (e instanceof Error ? e.message : e.toString())
+        }
+      };
+    });
+  }
   async fetchPatches(filters) {
+    // Split patchIds into chunks to avoid too long query strings
+    // NOTE: fetching patches results are cached, so this should reduce the pressure on the server
+    const chunkSize = 100;
+    const patchIds = filters.patchIds || [];
+    const patchIdChunks = [];
+    for (let i = 0; i < patchIds.length; i += chunkSize) {
+      patchIdChunks.push(patchIds.slice(i, i + chunkSize));
+    }
+    let allPatches = {};
+    let allErrors = {};
+    if (patchIds === undefined || patchIds.length === 0) {
+      return this.fetchPatchesInternal({
+        patchIds: patchIds,
+        authors: filters.authors,
+        moduleFilePaths: filters.moduleFilePaths,
+        omitPatch: filters.omitPatch
+      });
+    }
+    for (const res of await Promise.all(patchIdChunks.map(patchIdChunk => this.fetchPatchesInternal({
+      patchIds: patchIdChunk,
+      authors: filters.authors,
+      moduleFilePaths: filters.moduleFilePaths,
+      omitPatch: filters.omitPatch
+    })))) {
+      if ("error" in res) {
+        return res;
+      }
+      allPatches = {
+        ...allPatches,
+        ...res.patches
+      };
+      if (res.errors) {
+        allErrors = {
+          ...allErrors,
+          ...res.errors
+        };
+      }
+    }
+    return {
+      patches: allPatches,
+      errors: Object.keys(allErrors).length > 0 ? allErrors : undefined
+    };
+  }
+  async fetchPatchesInternal(filters) {
     const params = [];
     params.push(["branch", this.branch]);
     if (filters.patchIds) {
@@ -3052,7 +3357,7 @@ class ValOpsHttp extends ValOps {
     if (!file) {
       return null;
     }
-    return Buffer.from(file.value, "base64");
+    return bufferFromDataUrl(file.value) ?? null;
   }
   async getBase64EncodedBinaryFileMetadataFromPatch(filePath, type, patchId) {
     const params = new URLSearchParams();
@@ -3160,6 +3465,7 @@ class ValOpsHttp extends ValOps {
   }
   async commit(prepared, message, committer, newBranch) {
     try {
+      var _res$headers$get;
       const existingBranch = this.branch;
       const res = await fetch(`${this.hostUrl}/v1/${this.project}/commit`, {
         method: "POST",
@@ -3195,6 +3501,22 @@ class ValOpsHttp extends ValOps {
           }
         };
       }
+      if ((_res$headers$get = res.headers.get("Content-Type")) !== null && _res$headers$get !== void 0 && _res$headers$get.includes("application/json")) {
+        const json = await res.json();
+        if (json.isNotFastForward) {
+          return {
+            isNotFastForward: true,
+            error: {
+              message: "Could not commit. Not a fast-forward commit"
+            }
+          };
+        }
+        return {
+          error: {
+            message: json.message
+          }
+        };
+      }
       return {
         error: {
           message: "Could not commit. HTTP error: " + res.status + " " + res.statusText
@@ -3211,251 +3533,61 @@ class ValOpsHttp extends ValOps {
 }
 
 /* eslint-disable @typescript-eslint/no-unused-vars */
-class ValServer {
-  constructor(valModules, options, callbacks) {
-    this.valModules = valModules;
-    this.options = options;
-    this.callbacks = callbacks;
-    if (options.mode === "fs") {
-      this.serverOps = new ValOpsFS(options.cwd, valModules, {
-        formatter: options.formatter
-      });
-    } else if (options.mode === "http") {
-      this.serverOps = new ValOpsHttp(options.valContentUrl, options.project, options.commit, options.branch, options.apiKey, valModules, {
-        formatter: options.formatter,
-        root: options.root
-      });
-    } else {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      throw new Error("Invalid mode: " + (options === null || options === void 0 ? void 0 : options.mode));
-    }
+const ValServer = (valModules, options, callbacks) => {
+  let serverOps;
+  if (options.mode === "fs") {
+    serverOps = new ValOpsFS(options.cwd, valModules, {
+      formatter: options.formatter,
+      config: options.config
+    });
+  } else if (options.mode === "http") {
+    serverOps = new ValOpsHttp(options.valContentUrl, options.project, options.commit, options.branch, options.apiKey, valModules, {
+      formatter: options.formatter,
+      root: options.root,
+      config: options.config
+    });
+  } else {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    throw new Error("Invalid mode: " + (options === null || options === void 0 ? void 0 : options.mode));
   }
-
-  //#region auth
-  async enable(query) {
-    const redirectToRes = getRedirectUrl(query, this.options.valEnableRedirectUrl);
-    if (typeof redirectToRes !== "string") {
-      return redirectToRes;
+  const getAuthorizeUrl = (publicValApiRe, token) => {
+    if (!options.project) {
+      throw new Error("Project is not set");
     }
-    await this.callbacks.onEnable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
-      },
-      status: 302,
-      redirectTo: redirectToRes
-    };
-  }
-  async disable(query) {
-    const redirectToRes = getRedirectUrl(query, this.options.valDisableRedirectUrl);
-    if (typeof redirectToRes !== "string") {
-      return redirectToRes;
+    if (!options.valBuildUrl) {
+      throw new Error("Val build url is not set");
     }
-    await this.callbacks.onDisable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: {
-          value: "false"
-        }
-      },
-      status: 302,
-      redirectTo: redirectToRes
-    };
-  }
-  async authorize(query) {
-    if (typeof query.redirect_to !== "string") {
-      return {
-        status: 400,
-        json: {
-          message: "Missing redirect_to query param"
-        }
-      };
+    const url = new URL(`/auth/${options.project}/authorize`, options.valBuildUrl);
+    url.searchParams.set("redirect_uri", encodeURIComponent(`${publicValApiRe}/callback`));
+    url.searchParams.set("state", token);
+    return url.toString();
+  };
+  const getAppErrorUrl = error => {
+    if (!options.project) {
+      throw new Error("Project is not set");
     }
-    const token = crypto.randomUUID();
-    const redirectUrl = new URL(query.redirect_to);
-    const appAuthorizeUrl = this.getAuthorizeUrl(`${redirectUrl.origin}/${this.options.route}`, token);
-    await this.callbacks.onEnable(true);
-    return {
-      cookies: {
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
-        [VAL_STATE_COOKIE$1]: {
-          value: createStateCookie({
-            redirect_to: query.redirect_to,
-            token
-          }),
-          options: {
-            httpOnly: true,
-            sameSite: "lax",
-            expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
-          }
-        }
-      },
-      status: 302,
-      redirectTo: appAuthorizeUrl
-    };
-  }
-  async callback(query, cookies) {
-    if (!this.options.project) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Project is not set")
-      };
-    }
-    if (!this.options.valSecret) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Secret is not set")
-      };
-    }
-    const {
-      success: callbackReqSuccess,
-      error: callbackReqError
-    } = verifyCallbackReq(cookies[VAL_STATE_COOKIE$1], query);
-    if (callbackReqError !== null) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`)
-      };
-    }
-    const data = await this.consumeCode(callbackReqSuccess.code);
-    if (data === null) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Failed to exchange code for user")
-      };
-    }
-    const exp = getExpire();
-    const valSecret = this.options.valSecret;
-    if (!valSecret) {
-      return {
-        status: 302,
-        cookies: {
-          [VAL_STATE_COOKIE$1]: {
-            value: null
-          }
-        },
-        redirectTo: this.getAppErrorUrl("Setup is not correct: secret is missing")
-      };
-    }
-    const cookie = encodeJwt({
-      ...data,
-      exp // this is the client side exp
-    }, valSecret);
-    return {
-      status: 302,
-      cookies: {
-        [VAL_STATE_COOKIE$1]: {
-          value: null
-        },
-        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
-        [VAL_SESSION_COOKIE$1]: {
-          value: cookie,
-          options: {
-            httpOnly: true,
-            sameSite: "strict",
-            path: "/",
-            secure: true,
-            expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
-          }
-        }
-      },
-      redirectTo: callbackReqSuccess.redirect_uri || "/"
-    };
-  }
-  async session(cookies) {
-    if (this.serverOps instanceof ValOpsFS) {
-      return {
-        status: 200,
-        json: {
-          mode: "local",
-          enabled: await this.callbacks.isEnabled()
-        }
-      };
-    }
-    if (!this.options.project) {
-      return {
-        status: 500,
-        json: {
-          message: "Project is not set"
-        }
-      };
-    }
-    if (!this.options.valSecret) {
-      return {
-        status: 500,
-        json: {
-          message: "Secret is not set"
-        }
-      };
+    if (!options.valBuildUrl) {
+      throw new Error("Val build url is not set");
     }
-    return withAuth(this.options.valSecret, cookies, "session", async data => {
-      if (!this.options.valBuildUrl) {
-        return {
-          status: 500,
-          json: {
-            message: "Val is not correctly setup. Build url is missing"
-          }
-        };
-      }
-      const url = new URL(`/api/val/${this.options.project}/auth/session`, this.options.valBuildUrl);
-      const fetchRes = await fetch(url, {
-        headers: getAuthHeaders(data.token, "application/json")
-      });
-      if (fetchRes.status === 200) {
-        return {
-          status: fetchRes.status,
-          json: {
-            mode: "proxy",
-            enabled: await this.callbacks.isEnabled(),
-            ...(await fetchRes.json())
-          }
-        };
-      } else {
-        return {
-          status: fetchRes.status,
-          json: {
-            message: "Failed to authorize",
-            ...(await fetchRes.json())
-          }
-        };
-      }
-    });
-  }
-  async consumeCode(code) {
-    if (!this.options.project) {
+    const url = new URL(`/auth/${options.project}/authorize`, options.valBuildUrl);
+    url.searchParams.set("error", encodeURIComponent(error));
+    return url.toString();
+  };
+  const consumeCode = async code => {
+    if (!options.project) {
       throw new Error("Project is not set");
     }
-    if (!this.options.valBuildUrl) {
+    if (!options.valBuildUrl) {
       throw new Error("Val build url is not set");
     }
-    const url = new URL(`/api/val/${this.options.project}/auth/token`, this.options.valBuildUrl);
+    const url = new URL(`/api/val/${options.project}/auth/token`, options.valBuildUrl);
     url.searchParams.set("code", encodeURIComponent(code));
-    if (!this.options.apiKey) {
+    if (!options.apiKey) {
       return null;
     }
     return fetch(url, {
       method: "POST",
-      headers: getAuthHeaders(this.options.apiKey, "application/json") // NOTE: we use apiKey as auth on this endpoint (we do not have a token yet)
+      headers: getAuthHeaders(options.apiKey, "application/json") // NOTE: we use apiKey as auth on this endpoint (we do not have a token yet)
     }).then(async res => {
       if (res.status === 200) {
         const token = await res.text();
@@ -3475,34 +3607,11 @@ class ValServer {
       console.debug("Failed to get user from code: ", err);
       return null;
     });
-  }
-  getAuthorizeUrl(publicValApiRe, token) {
-    if (!this.options.project) {
-      throw new Error("Project is not set");
-    }
-    if (!this.options.valBuildUrl) {
-      throw new Error("Val build url is not set");
-    }
-    const url = new URL(`/auth/${this.options.project}/authorize`, this.options.valBuildUrl);
-    url.searchParams.set("redirect_uri", encodeURIComponent(`${publicValApiRe}/callback`));
-    url.searchParams.set("state", token);
-    return url.toString();
-  }
-  getAppErrorUrl(error) {
-    if (!this.options.project) {
-      throw new Error("Project is not set");
-    }
-    if (!this.options.valBuildUrl) {
-      throw new Error("Val build url is not set");
-    }
-    const url = new URL(`/auth/${this.options.project}/authorize`, this.options.valBuildUrl);
-    url.searchParams.set("error", encodeURIComponent(error));
-    return url.toString();
-  }
-  getAuth(cookies) {
-    const cookie = cookies[VAL_SESSION_COOKIE$1];
-    if (!this.options.valSecret) {
-      if (this.serverOps instanceof ValOpsFS) {
+  };
+  const getAuth = cookies => {
+    const cookie = cookies[VAL_SESSION_COOKIE];
+    if (!options.valSecret) {
+      if (serverOps instanceof ValOpsFS) {
         return {
           error: null,
           id: null
@@ -3514,9 +3623,9 @@ class ValServer {
       }
     }
     if (typeof cookie === "string") {
-      const decodedToken = decodeJwt(cookie, this.options.valSecret);
+      const decodedToken = decodeJwt(cookie, options.valSecret);
       if (!decodedToken) {
-        if (this.serverOps instanceof ValOpsFS) {
+        if (serverOps instanceof ValOpsFS) {
           return {
             error: null,
             id: null
@@ -3528,7 +3637,7 @@ class ValServer {
       }
       const verification = IntegratedServerJwtPayload.safeParse(decodedToken);
       if (!verification.success) {
-        if (this.serverOps instanceof ValOpsFS) {
+        if (serverOps instanceof ValOpsFS) {
           return {
             error: null,
             id: null
@@ -3542,7 +3651,7 @@ class ValServer {
         id: verification.data.sub
       };
     } else {
-      if (this.serverOps instanceof ValOpsFS) {
+      if (serverOps instanceof ValOpsFS) {
         return {
           error: null,
           id: null
@@ -3552,417 +3661,880 @@ class ValServer {
         error: "Login required: cookie not found"
       };
     }
-  }
-  async logout() {
+  };
+  const authorize = async redirectTo => {
+    const token = crypto.randomUUID();
+    const redirectUrl = new URL(redirectTo);
+    const appAuthorizeUrl = getAuthorizeUrl(`${redirectUrl.origin}/${options.route}`, token);
+    await callbacks.onEnable(true);
     return {
-      status: 200,
       cookies: {
-        [VAL_SESSION_COOKIE$1]: {
-          value: null
-        },
-        [VAL_STATE_COOKIE$1]: {
-          value: null
+        [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
+        [VAL_STATE_COOKIE]: {
+          value: createStateCookie({
+            redirect_to: redirectTo,
+            token
+          }),
+          options: {
+            httpOnly: true,
+            sameSite: "lax",
+            expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
+          }
         }
-      }
+      },
+      status: 302,
+      redirectTo: appAuthorizeUrl
     };
-  }
-
-  //#region patches
-  async getPatches(query, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+  };
+  return {
+    "/draft/enable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valEnableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
-      };
-    }
-    const authors = query.authors;
-    const patches = await this.serverOps.fetchPatches({
-      authors,
-      patchIds: query.patchIds,
-      omitPatch: query.omitPatch === "true"
-    });
-    if (patches.errors && Object.keys(patches.errors).length > 0) {
-      console.error("Val: Failed to get patches", patches.errors);
-      return {
-        status: 500,
-        json: {
-          message: "Failed to get patches",
-          details: patches.errors
+        await callbacks.onEnable(true);
+        return {
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/draft/disable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    return {
-      status: 200,
-      json: patches
-    };
-  }
-  async deletePatches(query, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valDisableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        await callbacks.onDisable(true);
+        return {
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/draft/stat": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    const ids = query.id;
-    const deleteRes = await this.serverOps.deletePatches(ids);
-    if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
-      console.error("Val: Failed to delete patches", deleteRes.errors);
-      return {
-        status: 500,
-        json: {
-          message: "Failed to delete patches",
-          details: deleteRes.errors
+        return {
+          status: 200,
+          json: {
+            draftMode: await callbacks.isEnabled()
+          }
+        };
+      }
+    },
+    "/enable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valEnableRedirectUrl);
+        if (auth.error) {
+          if (typeof redirectToRes === "string") {
+            return authorize(redirectToRes);
+          }
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    return {
-      status: 200,
-      json: ids
-    };
-  }
-
-  //#region tree ops
-  async getSchema(cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        await callbacks.onEnable(true);
+        return {
+          cookies: {
+            [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE
+          },
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/disable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    const moduleErrors = await this.serverOps.getModuleErrors();
-    if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-      console.error("Val: Module errors", moduleErrors);
-      return {
-        status: 500,
-        json: {
-          message: "Val is not correctly setup. Check the val.modules file",
-          details: moduleErrors
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valDisableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
         }
-      };
-    }
-    const schemaSha = await this.serverOps.getSchemaSha();
-    const schemas = await this.serverOps.getSchemas();
-    const serializedSchemas = {};
-    for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
-      const moduleFilePath = moduleFilePathS;
-      serializedSchemas[moduleFilePath] = schema.serialize();
-    }
-    return {
-      status: 200,
-      json: {
-        schemaSha,
-        schemas: serializedSchemas
+        await callbacks.onDisable(true);
+        return {
+          cookies: {
+            [VAL_ENABLE_COOKIE_NAME]: {
+              value: "false"
+            }
+          },
+          status: 302,
+          redirectTo: redirectToRes
+        };
       }
-    };
-  }
-  async putTree(body, treePath, query, cookies) {
-    var _bodyRes$data, _bodyRes$data2, _bodyRes$data3;
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+    },
+    //#region auth
+    "/authorize": {
+      GET: async req => {
+        const query = req.query;
+        if (typeof query.redirect_to !== "string") {
+          return {
+            status: 400,
+            json: {
+              message: "Missing redirect_to query param"
+            }
+          };
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsHttp && !("id" in auth)) {
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+        const redirectTo = query.redirect_to;
+        return authorize(redirectTo);
+      }
+    },
+    "/callback": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const query = req.query;
+        if (!options.project) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Project is not set")
+          };
         }
-      };
-    }
-    // TODO: move
-    const PutTreeBody = z.object({
-      patchIds: z.array(z.string().refine(id => true // TODO:
-      )).optional(),
-      addPatch: z.object({
-        path: z.string().refine(path => true // TODO:
-        ),
-        patch: Patch
-      }).optional()
-    }).optional();
-    const moduleErrors = await this.serverOps.getModuleErrors();
-    if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
-      console.error("Val: Module errors", moduleErrors);
-      return {
-        status: 500,
-        json: {
-          message: "Val is not correctly setup. Check the val.modules file",
-          details: moduleErrors
+        if (!options.valSecret) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Secret is not set")
+          };
         }
-      };
-    }
-    const bodyRes = PutTreeBody.safeParse(body);
-    if (!bodyRes.success) {
-      return {
-        status: 400,
-        json: {
-          message: "Invalid body: " + fromError(bodyRes.error).toString(),
-          details: bodyRes.error.errors
+        const {
+          success: callbackReqSuccess,
+          error: callbackReqError
+        } = verifyCallbackReq(cookies[VAL_STATE_COOKIE], query);
+        if (callbackReqError !== null) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl(`Authorization callback failed. Details: ${callbackReqError}`)
+          };
+        }
+        const data = await consumeCode(callbackReqSuccess.code);
+        if (data === null) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Failed to exchange code for user")
+          };
+        }
+        const exp = getExpire();
+        const valSecret = options.valSecret;
+        if (!valSecret) {
+          return {
+            status: 302,
+            cookies: {
+              [VAL_STATE_COOKIE]: {
+                value: null
+              }
+            },
+            redirectTo: getAppErrorUrl("Setup is not correct: secret is missing")
+          };
+        }
+        const cookie = encodeJwt({
+          ...data,
+          exp // this is the client side exp
+        }, valSecret);
+        return {
+          status: 302,
+          cookies: {
+            [VAL_STATE_COOKIE]: {
+              value: null
+            },
+            [VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
+            [VAL_SESSION_COOKIE]: {
+              value: cookie,
+              options: {
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                secure: true,
+                expires: new Date(exp * 1000) // NOTE: this is not used for authorization, only for authentication
+              }
+            }
+          },
+          redirectTo: callbackReqSuccess.redirect_uri || "/"
+        };
+      }
+    },
+    "/session": {
+      GET: async req => {
+        const cookies = req.cookies;
+        if (serverOps instanceof ValOpsFS) {
+          return {
+            status: 200,
+            json: {
+              mode: "local",
+              enabled: await callbacks.isEnabled()
+            }
+          };
+        }
+        if (!options.project) {
+          return {
+            status: 500,
+            json: {
+              message: "Project is not set"
+            }
+          };
+        }
+        if (!options.valSecret) {
+          return {
+            status: 500,
+            json: {
+              message: "Secret is not set"
+            }
+          };
+        }
+        return withAuth(options.valSecret, cookies, "session", async data => {
+          if (!options.valBuildUrl) {
+            return {
+              status: 500,
+              json: {
+                message: "Val is not correctly setup. Build url is missing"
+              }
+            };
+          }
+          const url = new URL(`/api/val/${options.project}/auth/session`, options.valBuildUrl);
+          const fetchRes = await fetch(url, {
+            headers: getAuthHeaders(data.token, "application/json")
+          });
+          if (fetchRes.status === 200) {
+            return {
+              status: fetchRes.status,
+              json: {
+                mode: "proxy",
+                enabled: await callbacks.isEnabled(),
+                ...(await fetchRes.json())
+              }
+            };
+          } else {
+            return {
+              status: fetchRes.status,
+              json: {
+                message: "Failed to authorize",
+                ...(await fetchRes.json())
+              }
+            };
+          }
+        });
+      }
+    },
+    "/logout": {
+      GET: async () => {
+        return {
+          status: 200,
+          cookies: {
+            [VAL_SESSION_COOKIE]: {
+              value: null
+            },
+            [VAL_STATE_COOKIE]: {
+              value: null
+            }
+          }
+        };
+      }
+    },
+    //#region stat
+    "/stat": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const currentStat = await serverOps.getStat({
+          ...req.body,
+          profileId: "id" in auth ? auth.id : undefined
+        });
+        if (currentStat.type === "error") {
+          return {
+            status: 500,
+            json: currentStat.error
+          };
+        }
+        return {
+          status: 200,
+          json: {
+            ...currentStat,
+            config: options.config
+          }
+        };
+      }
+    },
+    //#region patches
+    "/patches/~": {
+      GET: async req => {
+        const query = req.query;
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const authors = query.author;
+        const patches = await serverOps.fetchPatches({
+          authors,
+          patchIds: query.patch_id,
+          omitPatch: query.omit_patch === true,
+          moduleFilePaths: query.module_file_path
+        });
+        if (patches.error) {
+          // Error is singular
+          console.error("Val: Failed to get patches", patches.errors);
+          return {
+            status: 500,
+            json: {
+              message: patches.error.message,
+              details: patches.error
+            }
+          };
+        }
+        if (patches.errors && Object.keys(patches.errors).length > 0) {
+          // Errors is plural. Different property than above.
+          console.error("Val: Failed to get patches", patches.errors);
+          return {
+            status: 500,
+            json: {
+              message: "Failed to get patches",
+              details: patches.errors
+            }
+          };
+        }
+        return {
+          status: 200,
+          json: patches
+        };
+      },
+      DELETE: async req => {
+        const query = req.query;
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const ids = query.id;
+        const deleteRes = await serverOps.deletePatches(ids);
+        if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
+          console.error("Val: Failed to delete patches", deleteRes.errors);
+          return {
+            status: 500,
+            json: {
+              message: "Failed to delete patches",
+              details: deleteRes.errors
+            }
+          };
+        }
+        return {
+          status: 200,
+          json: ids
+        };
+      }
+    },
+    //#region schema
+    "/schema": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const moduleErrors = await serverOps.getModuleErrors();
+        if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
+          console.error("Val: Module errors", moduleErrors);
+          return {
+            status: 500,
+            json: {
+              message: `Got errors while fetching modules: ${moduleErrors.filter(error => error).map(error => error.message).join(", ")}`,
+              details: moduleErrors
+            }
+          };
+        }
+        const schemaSha = await serverOps.getSchemaSha();
+        const schemas = await serverOps.getSchemas();
+        const serializedSchemas = {};
+        try {
+          for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
+            const moduleFilePath = moduleFilePathS;
+            serializedSchemas[moduleFilePath] = schema.serialize();
+          }
+        } catch (e) {
+          console.error("Val: Failed to serialize schemas", e);
+          return {
+            status: 500,
+            json: {
+              message: "Failed to serialize schemas",
+              details: [{
+                message: e instanceof Error ? e.message : JSON.stringify(e)
+              }]
+            }
+          };
+        }
+        return {
+          status: 200,
+          json: {
+            schemaSha,
+            schemas: serializedSchemas
+          }
+        };
+      }
+    },
+    // #region sources
+    "/sources": {
+      PUT: async req => {
+        var _body$patchIds;
+        const query = req.query;
+        const cookies = req.cookies;
+        const body = req.body;
+        const treePath = req.path || "";
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const moduleErrors = await serverOps.getModuleErrors();
+        if ((moduleErrors === null || moduleErrors === void 0 ? void 0 : moduleErrors.length) > 0) {
+          console.error("Val: Module errors", moduleErrors);
+          return {
+            status: 500,
+            json: {
+              message: "Val is not correctly setup. Check the val.modules file",
+              details: moduleErrors
+            }
+          };
+        }
+        let tree;
+        let patchAnalysis = null;
+        let newPatchIds = undefined;
+        if (body !== null && body !== void 0 && body.patchIds && (body === null || body === void 0 || (_body$patchIds = body.patchIds) === null || _body$patchIds === void 0 ? void 0 : _body$patchIds.length) > 0 || body !== null && body !== void 0 && body.addPatches) {
+          // TODO: validate patches_sha
+          const patchIds = body === null || body === void 0 ? void 0 : body.patchIds;
+          const patchOps = patchIds && patchIds.length > 0 ? await serverOps.fetchPatches({
+            patchIds,
+            omitPatch: false
+          }) : {
+            patches: {}
+          };
+          if (patchOps.error) {
+            return {
+              status: 400,
+              json: {
+                message: "Failed to fetch patches: " + patchOps.error.message,
+                details: []
+              }
+            };
+          }
+          let patchErrors = undefined;
+          for (const [patchIdS, error] of Object.entries(patchOps.errors || {})) {
+            const patchId = patchIdS;
+            if (!patchErrors) {
+              patchErrors = {};
+            }
+            patchErrors[patchId] = {
+              message: error.message
+            };
+          }
+          // TODO: errors
+          patchAnalysis = serverOps.analyzePatches(patchOps.patches);
+          if (body !== null && body !== void 0 && body.addPatches) {
+            for (const addPatch of body.addPatches) {
+              const newPatchModuleFilePath = addPatch.path;
+              const newPatchOps = addPatch.patch;
+              const authorId = "id" in auth ? auth.id : null;
+              const createPatchRes = await serverOps.createPatch(newPatchModuleFilePath, {
+                ...patchAnalysis,
+                ...patchOps
+              }, newPatchOps, authorId);
+              if (createPatchRes.error) {
+                return {
+                  status: 500,
+                  json: {
+                    message: "Failed to create patch: " + createPatchRes.error.message,
+                    details: createPatchRes.error
+                  }
+                };
+              }
+              if (!newPatchIds) {
+                newPatchIds = [createPatchRes.patchId];
+              } else {
+                newPatchIds.push(createPatchRes.patchId);
+              }
+              patchOps.patches[createPatchRes.patchId] = {
+                path: newPatchModuleFilePath,
+                patch: newPatchOps,
+                authorId,
+                createdAt: createPatchRes.createdAt,
+                appliedAt: null
+              };
+              patchAnalysis.patchesByModule[newPatchModuleFilePath] = [...(patchAnalysis.patchesByModule[newPatchModuleFilePath] || []), {
+                patchId: createPatchRes.patchId
+              }];
+            }
+          }
+          tree = {
+            ...(await serverOps.getTree({
+              ...patchAnalysis,
+              ...patchOps
+            }))
+          };
+          if (query.validate_all) {
+            const allTree = await serverOps.getTree();
+            tree = {
+              sources: {
+                ...allTree.sources,
+                ...tree.sources
+              },
+              errors: {
+                ...allTree.errors,
+                ...tree.errors
+              }
+            };
+          }
+        } else {
+          tree = await serverOps.getTree();
         }
-      };
-    }
-    let tree;
-    let patchAnalysis = null;
-    let newPatchId = undefined;
-    if ((_bodyRes$data = bodyRes.data) !== null && _bodyRes$data !== void 0 && _bodyRes$data.patchIds && ((_bodyRes$data2 = bodyRes.data) === null || _bodyRes$data2 === void 0 || (_bodyRes$data2 = _bodyRes$data2.patchIds) === null || _bodyRes$data2 === void 0 ? void 0 : _bodyRes$data2.length) > 0 || (_bodyRes$data3 = bodyRes.data) !== null && _bodyRes$data3 !== void 0 && _bodyRes$data3.addPatch) {
-      var _bodyRes$data4, _bodyRes$data5;
-      // TODO: validate patches_sha
-      const patchIds = (_bodyRes$data4 = bodyRes.data) === null || _bodyRes$data4 === void 0 ? void 0 : _bodyRes$data4.patchIds;
-      const patchOps = patchIds && patchIds.length > 0 ? await this.serverOps.fetchPatches({
-        patchIds,
-        omitPatch: false
-      }) : {
-        patches: {}
-      };
-      let patchErrors = undefined;
-      for (const [patchIdS, error] of Object.entries(patchOps.errors || {})) {
-        const patchId = patchIdS;
-        if (!patchErrors) {
-          patchErrors = {};
-        }
-        patchErrors[patchId] = {
-          message: error.message
+        let sourcesValidation = {
+          errors: {},
+          files: {}
         };
-      }
-      if ((_bodyRes$data5 = bodyRes.data) !== null && _bodyRes$data5 !== void 0 && _bodyRes$data5.addPatch) {
-        const newPatchModuleFilePath = bodyRes.data.addPatch.path;
-        const newPatchOps = bodyRes.data.addPatch.patch;
-        const authorId = "id" in auth ? auth.id : null;
-        const createPatchRes = await this.serverOps.createPatch(newPatchModuleFilePath, newPatchOps, authorId);
-        if (createPatchRes.error) {
-          return {
-            status: 500,
+        if (query.validate_sources || query.validate_binary_files) {
+          const schemas = await serverOps.getSchemas();
+          sourcesValidation = await serverOps.validateSources(schemas, tree.sources);
+
+          // TODO: send validation errors
+          if (query.validate_binary_files) {
+            await serverOps.validateFiles(schemas, tree.sources, sourcesValidation.files);
+          }
+        }
+        const schemaSha = await serverOps.getSchemaSha();
+        const modules = {};
+        for (const [moduleFilePathS, module] of Object.entries(tree.sources)) {
+          const moduleFilePath = moduleFilePathS;
+          if (moduleFilePath.startsWith(treePath)) {
+            var _sourcesValidation$er;
+            modules[moduleFilePath] = {
+              source: module,
+              patches: patchAnalysis && patchAnalysis.patchesByModule[moduleFilePath] ? {
+                applied: patchAnalysis.patchesByModule[moduleFilePath].map(p => p.patchId)
+              } : undefined,
+              validationErrors: (_sourcesValidation$er = sourcesValidation.errors[moduleFilePath]) === null || _sourcesValidation$er === void 0 ? void 0 : _sourcesValidation$er.validations
+            };
+          }
+        }
+        if (tree.errors && Object.keys(tree.errors).length > 0) {
+          const res = {
+            status: 400,
             json: {
-              message: "Failed to create patch: " + createPatchRes.error.message,
-              details: createPatchRes.error
+              type: "patch-error",
+              schemaSha,
+              modules,
+              errors: Object.fromEntries(Object.entries(tree.errors).map(([key, value]) => [key, value.map(error => ({
+                patchId: error.patchId,
+                skipped: error.skipped,
+                error: {
+                  message: error.error.message
+                }
+              }))])),
+              message: "One or more patches failed to be applied"
             }
           };
+          return res;
         }
-        // TODO: evaluate if we need this: seems wrong to delete patches that are not applied
-        // for (const fileRes of createPatchRes.files) {
-        //   if (fileRes.error) {
-        //     // clean up broken patch:
-        //     await this.serverOps.deletePatches([createPatchRes.patchId]);
-        //     return {
-        //       status: 500,
-        //       json: {
-        //         message: "Failed to create patch",
-        //         details: fileRes.error,
-        //       },
-        //     };
-        //   }
-        // }
-        newPatchId = createPatchRes.patchId;
-        patchOps.patches[createPatchRes.patchId] = {
-          path: newPatchModuleFilePath,
-          patch: newPatchOps,
-          authorId,
-          createdAt: createPatchRes.createdAt,
-          appliedAt: null
-        };
-      }
-      // TODO: errors
-      patchAnalysis = this.serverOps.analyzePatches(patchOps.patches);
-      tree = {
-        ...(await this.serverOps.getTree({
-          ...patchAnalysis,
-          ...patchOps
-        }))
-      };
-      if (query.validate_all === "true") {
-        const allTree = await this.serverOps.getTree();
-        tree = {
-          sources: {
-            ...allTree.sources,
-            ...tree.sources
-          },
-          errors: {
-            ...allTree.errors,
-            ...tree.errors
+        const res = {
+          status: 200,
+          json: {
+            schemaSha,
+            modules,
+            newPatchIds
           }
         };
+        return res;
       }
-    } else {
-      tree = await this.serverOps.getTree();
-    }
-    if (tree.errors && Object.keys(tree.errors).length > 0) {
-      console.error("Val: Failed to get tree", JSON.stringify(tree.errors));
-    }
-    if (query.validate_sources === "true" || query.validate_binary_files === "true") {
-      const schemas = await this.serverOps.getSchemas();
-      const sourcesValidation = await this.serverOps.validateSources(schemas, tree.sources);
-
-      // TODO: send validation errors
-      if (query.validate_binary_files === "true") {
-        await this.serverOps.validateFiles(schemas, tree.sources, sourcesValidation.files);
-      }
-    }
-    const schemaSha = await this.serverOps.getSchemaSha();
-    const modules = {};
-    for (const [moduleFilePathS, module] of Object.entries(tree.sources)) {
-      const moduleFilePath = moduleFilePathS;
-      if (moduleFilePath.startsWith(treePath)) {
-        modules[moduleFilePath] = {
-          source: module,
-          patches: patchAnalysis ? {
-            applied: patchAnalysis.patchesByModule[moduleFilePath].map(p => p.patchId)
-          } : undefined
-        };
-      }
-    }
-    return {
-      status: 200,
-      json: {
-        schemaSha,
-        modules,
-        newPatchId
-      }
-    };
-  }
-  async postSave(body, cookies) {
-    const auth = this.getAuth(cookies);
-    if (auth.error) {
-      return {
-        status: 401,
-        json: {
-          message: auth.error
+    },
+    "/save": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const body = req.body;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
         }
-      };
-    }
-    const PostSaveBody = z.object({
-      patchIds: z.array(z.string().refine(id => true // TODO:
-      ))
-    });
-    const bodyRes = PostSaveBody.safeParse(body);
-    if (!bodyRes.success) {
-      return {
-        status: 400,
-        json: {
-          message: "Invalid body: " + fromError(bodyRes.error).toString(),
-          details: bodyRes.error.errors
+        const PostSaveBody = z.object({
+          patchIds: z.array(z.string().refine(id => true // TODO:
+          ))
+        });
+        const bodyRes = PostSaveBody.safeParse(body);
+        if (!bodyRes.success) {
+          return {
+            status: 400,
+            json: {
+              message: "Invalid body: " + fromError(bodyRes.error).toString(),
+              details: bodyRes.error.errors
+            }
+          };
         }
-      };
-    }
-    const {
-      patchIds
-    } = bodyRes.data;
-    const patches = await this.serverOps.fetchPatches({
-      patchIds,
-      omitPatch: false
-    });
-    const analysis = this.serverOps.analyzePatches(patches.patches);
-    const preparedCommit = await this.serverOps.prepare({
-      ...analysis,
-      ...patches
-    });
-    if (preparedCommit.hasErrors) {
-      console.error("Failed to create commit", {
-        sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
-        binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
-      });
-      return {
-        status: 400,
-        json: {
-          message: "Failed to create commit",
-          details: {
+        const {
+          patchIds
+        } = bodyRes.data;
+        const patches = await serverOps.fetchPatches({
+          patchIds,
+          omitPatch: false
+        });
+        const analysis = serverOps.analyzePatches(patches.patches);
+        const preparedCommit = await serverOps.prepare({
+          ...analysis,
+          ...patches
+        });
+        if (preparedCommit.hasErrors) {
+          console.error("Failed to create commit", JSON.stringify({
             sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
             binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
+          }, null, 2));
+          return {
+            status: 400,
+            json: {
+              message: "Failed to create commit",
+              details: {
+                sourceFilePatchErrors: Object.fromEntries(Object.entries(preparedCommit.sourceFilePatchErrors).map(([key, errors]) => [key, errors.map(e => ({
+                  message: formatPatchSourceError(e)
+                }))])),
+                binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
+              }
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsFS) {
+          await serverOps.saveFiles(preparedCommit);
+          await serverOps.deletePatches(patchIds);
+          return {
+            status: 200,
+            json: {} // TODO:
+          };
+        } else if (serverOps instanceof ValOpsHttp) {
+          if (auth.error === undefined && auth.id) {
+            const commitRes = await serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
+            if (commitRes.error) {
+              console.error("Failed to commit", commitRes.error);
+              if ("isNotFastForward" in commitRes && commitRes.isNotFastForward) {
+                return {
+                  status: 409,
+                  json: {
+                    isNotFastForward: true,
+                    message: "Cannot commit: this is not the latest version of this branch"
+                  }
+                };
+              }
+              return {
+                status: 400,
+                json: {
+                  message: commitRes.error.message,
+                  details: []
+                }
+              };
+            }
+            // TODO: serverOps.markApplied(patchIds);
+            return {
+              status: 200,
+              json: {} // TODO:
+            };
           }
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        } else {
+          throw new Error("Invalid server ops");
         }
-      };
-    }
-    if (this.serverOps instanceof ValOpsFS) {
-      await this.serverOps.saveFiles(preparedCommit);
-      return {
-        status: 200,
-        json: {} // TODO:
-      };
-    } else if (this.serverOps instanceof ValOpsHttp) {
-      if (auth.error === undefined && auth.id) {
-        await this.serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
-        return {
-          status: 200,
-          json: {} // TODO:
-        };
       }
-      return {
-        status: 401,
-        json: {
-          message: "Unauthorized"
+    },
+    //#region files
+    "/files": {
+      GET: async req => {
+        const query = req.query;
+        const filePath = req.path;
+        // NOTE: no auth here since you would need the patch_id to get something that is not published.
+        // For everything that is published, well they are already public so no auth required there...
+        // We could imagine adding auth just to be a 200% certain,
+        // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
+        // So: 1) patch ids are not possible to guess (but possible to brute force)
+        //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
+        //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
+        // Thus: attack surface + ease of attack + benefit = low probability of attack
+        // If we couldn't argue that patch ids are secret enough, then this would be a problem.
+        let cacheControl;
+        let fileBuffer;
+        let mimeType;
+        if (query.patch_id) {
+          fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id);
+          mimeType = Internal.filenameToMimeType(filePath);
+          cacheControl = "public, max-age=20000, immutable";
+        } else {
+          fileBuffer = await serverOps.getBinaryFile(filePath);
         }
-      };
-    } else {
-      throw new Error("Invalid server ops");
-    }
-  }
-
-  //#region files
-  async getFiles(filePath, query) {
-    // NOTE: no auth here since you would need the patch_id to get something that is not published.
-    // For everything that is published, well they are already public so no auth required there...
-    // We could imagine adding auth just to be a 200% certain,
-    // However that won't work since images are requested by the nextjs backend as a part of image optimization (again: as an example) which is a backend-to-backend op (no cookies, ...).
-    // So: 1) patch ids are not possible to guess (but possible to brute force)
-    //     2) the process of shimming a patch into the frontend would be quite challenging (so just trying out this attack would require a lot of effort)
-    //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
-    // Thus: attack surface + ease of attack + benefit = low probability of attack
-    // If we couldn't argue that patch ids are secret enough, then this would be a problem.
-    let fileBuffer;
-    if (query.patch_id) {
-      fileBuffer = await this.serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id);
-    } else {
-      fileBuffer = await this.serverOps.getBinaryFile(filePath);
-    }
-    if (fileBuffer) {
-      return {
-        status: 200,
-        body: bufferToReadableStream(fileBuffer)
-      };
-    } else {
-      return {
-        status: 404,
-        json: {
-          message: "File not found"
+        if (fileBuffer) {
+          return {
+            status: 200,
+            headers: {
+              // TODO: we could use ETag and return 304 instead
+              "Content-Type": mimeType || "application/octet-stream",
+              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+            },
+            body: bufferToReadableStream(fileBuffer)
+          };
+        } else {
+          return {
+            status: 404,
+            json: {
+              message: "File not found"
+            }
+          };
         }
-      };
+      }
     }
+  };
+};
+function formatPatchSourceError(error) {
+  if ("message" in error) {
+    return error.message;
+  } else if (Array.isArray(error)) {
+    return error.map(formatPatchSourceError).join("\n");
+  } else {
+    const _exhaustiveCheck = error;
+    return "Unknown patch source error: " + JSON.stringify(_exhaustiveCheck);
   }
 }
 function verifyCallbackReq(stateCookie, queryParams) {
@@ -4082,7 +4654,7 @@ const IntegratedServerJwtPayload = z.object({
   project: z.string()
 });
 async function withAuth(secret, cookies, errorMessageType, handler) {
-  const cookie = cookies[VAL_SESSION_COOKIE$1];
+  const cookie = cookies[VAL_SESSION_COOKIE];
   if (typeof cookie === "string") {
     const decodedToken = decodeJwt(cookie, secret);
     if (!decodedToken) {
@@ -4100,7 +4672,7 @@ async function withAuth(secret, cookies, errorMessageType, handler) {
         status: 401,
         json: {
           message: "Session invalid or, most likely, expired. You will need to login again.",
-          details: verification.error
+          details: fromError(verification.error).toString()
         }
       };
     }
@@ -4260,14 +4832,14 @@ function guessMimeTypeFromPath(filePath) {
   return null;
 }
 
-async function createValServer(valModules, route, opts, callbacks, formatter) {
-  const valServerConfig = await initHandlerOptions(route, opts);
-  return new ValServer(valModules, {
+async function createValServer(valModules, route, opts, config, callbacks, formatter) {
+  const valServerConfig = await initHandlerOptions(route, opts, config);
+  return ValServer(valModules, {
     formatter,
     ...valServerConfig
   }, callbacks);
 }
-async function initHandlerOptions(route, opts) {
+async function initHandlerOptions(route, opts, config) {
   const maybeApiKey = opts.apiKey || process.env.VAL_API_KEY;
   const maybeValSecret = opts.valSecret || process.env.VAL_SECRET;
   const isProxyMode = opts.mode === "proxy" || opts.mode === undefined && (maybeApiKey || maybeValSecret);
@@ -4312,7 +4884,8 @@ async function initHandlerOptions(route, opts) {
       valEnableRedirectUrl,
       valDisableRedirectUrl,
       valContentUrl,
-      valBuildUrl
+      valBuildUrl,
+      config
     };
   } else {
     const cwd = process.cwd();
@@ -4326,7 +4899,8 @@ async function initHandlerOptions(route, opts) {
       valBuildUrl,
       apiKey: maybeApiKey,
       valSecret: maybeValSecret,
-      project: maybeValProject
+      project: maybeValProject,
+      config
     };
   }
 }
@@ -4387,17 +4961,9 @@ async function readCommit(gitDir, branchName) {
     return undefined;
   }
 }
-const {
-  VAL_SESSION_COOKIE,
-  VAL_STATE_COOKIE
-} = Internal;
-const TREE_PATH_PREFIX = "/tree/~";
-const PATCHES_PATH_PREFIX = "/patches/~";
-const FILES_PATH_PREFIX = "/files";
 function createValApiRouter(route, valServerPromise, convert) {
   const uiRequestHandler = createUIRequestHandler();
   return async req => {
-    var _req$method;
     const valServer = await valServerPromise;
     const url = new URL(req.url);
     if (!url.pathname.startsWith(route)) {
@@ -4411,115 +4977,235 @@ function createValApiRouter(route, valServerPromise, convert) {
         json: error
       });
     }
-    const method = (_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase();
-    function withTreePath(path, prefix) {
-      return async useTreePath => {
-        const pathIndex = path.indexOf("~");
-        if (path.startsWith(prefix) && pathIndex !== -1) {
-          return useTreePath(path.slice(pathIndex + 1));
-        } else {
-          if (prefix.indexOf("/~") === -1) {
-            return convert({
-              status: 500,
-              json: {
-                message: `Route is incorrectly formed: ${prefix}!`
+    const path = url.pathname.slice(route.length);
+    const groupQueryParams = arr => {
+      const map = {};
+      for (const [key, value] of arr) {
+        const list = map[key] || [];
+        list.push(value);
+        map[key] = list;
+      }
+      return map;
+    };
+    async function getValServerResponse(reqApiRoutePath, req) {
+      var _req$method, _anyApi$route, _anyValServer$route;
+      const anyApi =
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Api;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const anyValServer = valServer;
+      const method = (_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase();
+      let route = null;
+      let path = undefined;
+      for (const routeDef of Object.keys(Api)) {
+        if (routeDef === reqApiRoutePath) {
+          route = routeDef;
+          break;
+        }
+        if (reqApiRoutePath.startsWith(routeDef)) {
+          var _anyApi$routeDef;
+          const reqDefinition = anyApi === null || anyApi === void 0 || (_anyApi$routeDef = anyApi[routeDef]) === null || _anyApi$routeDef === void 0 || (_anyApi$routeDef = _anyApi$routeDef[method]) === null || _anyApi$routeDef === void 0 ? void 0 : _anyApi$routeDef.req;
+          if (reqDefinition) {
+            route = routeDef;
+            if (reqDefinition.path) {
+              const subPath = reqApiRoutePath.slice(routeDef.length);
+              const pathRes = reqDefinition.path.safeParse(subPath);
+              if (!pathRes.success) {
+                return zodErrorResult(pathRes.error, `invalid path: '${subPath}' endpoint: '${routeDef}'`);
+              } else {
+                path = pathRes.data;
               }
-            });
+            }
+            break;
           }
-          return convert({
-            status: 404,
-            json: {
-              message: `Malformed ${prefix} path! Expected: '${prefix}'`
+        }
+      }
+      if (!route) {
+        return {
+          status: 404,
+          json: {
+            message: "Route not found. Valid routes are: " + Object.keys(Api),
+            details: {
+              route,
+              method
             }
-          });
+          }
+        };
+      }
+      const apiEndpoint = anyApi === null || anyApi === void 0 || (_anyApi$route = anyApi[route]) === null || _anyApi$route === void 0 ? void 0 : _anyApi$route[method];
+      const reqDefinition = apiEndpoint === null || apiEndpoint === void 0 ? void 0 : apiEndpoint.req;
+      if (!reqDefinition) {
+        return {
+          status: 404,
+          json: {
+            message: `Requested method ${method} on route ${route} is not valid. Valid methods are: ${Object.keys(anyApi[route]).join(", ")}`,
+            details: {
+              route,
+              method
+            }
+          }
+        };
+      }
+      const endpointImpl = anyValServer === null || anyValServer === void 0 || (_anyValServer$route = anyValServer[route]) === null || _anyValServer$route === void 0 ? void 0 : _anyValServer$route[method];
+      if (!endpointImpl) {
+        return {
+          status: 500,
+          json: {
+            message: "Missing server implementation of route with method. This might be caused by a mismatch between Val package versions.",
+            details: {
+              valid: {
+                route: {
+                  server: Object.keys(anyValServer || {}),
+                  api: Object.keys(anyApi || {})
+                },
+                method: {
+                  server: Object.keys((anyValServer === null || anyValServer === void 0 ? void 0 : anyValServer[route]) || {}),
+                  api: Object.keys((anyApi === null || anyApi === void 0 ? void 0 : anyApi[route]) || {})
+                }
+              },
+              route,
+              method
+            }
+          }
+        };
+      }
+      let bodyRes;
+      try {
+        bodyRes = reqDefinition.body ? reqDefinition.body.safeParse(await req.json()) : {
+          success: true,
+          data: {}
+        };
+        if (!bodyRes.success) {
+          return zodErrorResult(bodyRes.error, "invalid body data");
         }
+      } catch (e) {
+        return {
+          status: 400,
+          json: {
+            message: "Could not parse request body",
+            details: {
+              error: JSON.stringify(e)
+            }
+          }
+        };
+      }
+      const cookiesRes = reqDefinition.cookies ? getCookies(req, reqDefinition.cookies) : {
+        success: true,
+        data: {}
       };
+      if (!cookiesRes.success) {
+        return zodErrorResult(cookiesRes.error, "invalid cookies");
+      }
+      const actualQueryParams = groupQueryParams(Array.from(url.searchParams.entries()));
+      let query = {};
+      if (reqDefinition.query) {
+        // This is code is particularly heavy, however
+        // @see ValidQueryParamTypes in ApiRouter.ts where we explain what we want to support
+        // We prioritized a declarative ApiRouter, so this code is what we ended up with for better of worse
+        const queryRules = {};
+        for (const [key, zodRule] of Object.entries(reqDefinition.query)) {
+          let innerType = zodRule;
+          let isOptional = false;
+          let isArray = false;
+          // extract inner types:
+          if (innerType instanceof z.ZodOptional) {
+            isOptional = true;
+            innerType = innerType.unwrap();
+          }
+          if (innerType instanceof z.ZodArray) {
+            isArray = true;
+            innerType = innerType.element;
+          }
+          // convert boolean to union of literals true and false so we can parse it as a string
+          if (innerType instanceof z.ZodBoolean) {
+            innerType = z.union([z.literal("true"), z.literal("false")]).transform(arg => arg === "true");
+          }
+          // re-build rules:
+          let arrayCompatibleRule = innerType;
+          arrayCompatibleRule = z.array(innerType); // we always want to parse an array because we group the query params by into an array
+          if (isOptional) {
+            arrayCompatibleRule = arrayCompatibleRule.optional();
+          }
+          if (!isArray) {
+            arrayCompatibleRule = arrayCompatibleRule.transform(arg => arg && arg[0]);
+          }
+          queryRules[key] = arrayCompatibleRule;
+        }
+        const queryRes = z.object(queryRules).safeParse(actualQueryParams);
+        if (!queryRes.success) {
+          return zodErrorResult(queryRes.error, `invalid query params: (${JSON.stringify(actualQueryParams)})`);
+        }
+        query = queryRes.data;
+      }
+      const res = await endpointImpl({
+        body: bodyRes.data,
+        cookies: cookiesRes.data,
+        query,
+        path
+      });
+      if (res.status === 500) {
+        var _res$json;
+        return {
+          status: 500,
+          json: {
+            message: ((_res$json = res.json) === null || _res$json === void 0 ? void 0 : _res$json.message) || "Internal Server Error"
+          }
+        };
+      }
+      const resDef = apiEndpoint.res;
+      if (resDef) {
+        const responseResult = resDef.safeParse(res);
+        if (!responseResult.success) {
+          return {
+            status: 500,
+            json: {
+              message: "Could not validate response. This is likely a bug in Val server.",
+              details: {
+                response: res,
+                errors: formatZodErrorString(responseResult.error)
+              }
+            }
+          };
+        }
+      }
+      return res;
     }
-    const path = url.pathname.slice(route.length);
     if (path.startsWith("/static")) {
       return convert(await uiRequestHandler(path.slice("/static".length), url.href));
-    } else if (path === "/session") {
-      return convert(await valServer.session(getCookies(req, [VAL_SESSION_COOKIE])));
-    } else if (path === "/authorize") {
-      return convert(await valServer.authorize({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (path === "/callback") {
-      return convert(await valServer.callback({
-        code: url.searchParams.get("code") || undefined,
-        state: url.searchParams.get("state") || undefined
-      }, getCookies(req, [VAL_STATE_COOKIE])));
-    } else if (path === "/logout") {
-      return convert(await valServer.logout());
-    } else if (path === "/enable") {
-      return convert(await valServer.enable({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (path === "/disable") {
-      return convert(await valServer.disable({
-        redirect_to: url.searchParams.get("redirect_to") || undefined
-      }));
-    } else if (method === "POST" && path === "/save") {
-      const body = await req.json();
-      return convert(await valServer.postSave(body, getCookies(req, [VAL_SESSION_COOKIE])));
-      // } else if (method === "POST" && path === "/validate") {
-      //   const body = (await req.json()) as unknown;
-      //   return convert(
-      //     await valServer.postValidate(
-      //       body,
-      //       getCookies(req, [VAL_SESSION_COOKIE]),
-      //       requestHeaders
-      //     )
-      //   );
-    } else if (method === "GET" && path === "/schema") {
-      return convert(await valServer.getSchema(getCookies(req, [VAL_SESSION_COOKIE])));
-    } else if (method === "PUT" && path.startsWith(TREE_PATH_PREFIX)) {
-      return withTreePath(path, TREE_PATH_PREFIX)(async treePath => convert(await valServer.putTree(await req.json(), treePath, {
-        patches_sha: url.searchParams.get("patches_sha") || undefined,
-        validate_all: url.searchParams.get("validate_all") || undefined,
-        validate_binary_files: url.searchParams.get("validate_binary_files") || undefined,
-        validate_sources: url.searchParams.get("validate_sources") || undefined
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "GET" && path.startsWith(PATCHES_PATH_PREFIX)) {
-      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.getPatches({
-        authors: url.searchParams.getAll("author"),
-        patchIds: url.searchParams.getAll("patch_id"),
-        omitPatch: url.searchParams.get("omit_patch") || undefined
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "DELETE" && path.startsWith(PATCHES_PATH_PREFIX)) {
-      return withTreePath(path, PATCHES_PATH_PREFIX)(async () => convert(await valServer.deletePatches({
-        id: url.searchParams.getAll("id")
-      }, getCookies(req, [VAL_SESSION_COOKIE]))));
-    } else if (method === "GET" && path.startsWith(FILES_PATH_PREFIX)) {
-      const treePath = path.slice(FILES_PATH_PREFIX.length);
-      return convert(await valServer.getFiles(treePath, {
-        patch_id: url.searchParams.get("patch_id") || undefined
-      }));
     } else {
-      return convert({
-        status: 404,
-        json: {
-          message: "Not Found",
-          details: {
-            method,
-            path
-          }
-        }
-      });
+      return convert(await getValServerResponse(path, req));
+    }
+  };
+}
+function formatZodErrorString(error) {
+  const errors = fromZodError(error).toString();
+  return errors.length > 640 ? `${errors.slice(0, 640)}...` : errors;
+}
+function zodErrorResult(error, message) {
+  return {
+    status: 400,
+    json: {
+      message: "Bad Request: " + message,
+      details: {
+        errors: formatZodErrorString(error)
+      }
     }
   };
 }
 
 // TODO: is this naive implementation is too naive?
-function getCookies(req, names) {
-  var _req$headers$get;
-  return ((_req$headers$get = req.headers.get("Cookie")) === null || _req$headers$get === void 0 ? void 0 : _req$headers$get.split("; ").reduce((acc, cookie) => {
-    const [name, value] = cookie.split("=");
-    if (names.includes(name.trim())) {
-      acc[name.trim()] = decodeURIComponent(value.trim());
-    }
-    return acc;
-  }, {})) || {};
+function getCookies(req, cookiesDef) {
+  var _req$headers;
+  const input = {};
+  const cookieParts = (_req$headers = req.headers) === null || _req$headers === void 0 || (_req$headers = _req$headers.get("Cookie")) === null || _req$headers === void 0 ? void 0 : _req$headers.split("; ");
+  for (const name of Object.keys(cookiesDef)) {
+    const cookie = cookieParts === null || cookieParts === void 0 ? void 0 : cookieParts.find(cookie => cookie.startsWith(`${name}=`));
+    const value = cookie ? decodeURIComponent(cookie === null || cookie === void 0 ? void 0 : cookie.split("=")[1]) : undefined;
+    if (value) {
+      input[name.trim()] = value;
+    }
+  }
+  return z.object(cookiesDef).safeParse(input);
 }
 
 /**
@@ -4562,6 +5248,49 @@ class ValFSHost {
   }
 }
 
+async function extractImageMetadata(filename, input) {
+  const imageSize = sizeOf(input);
+  let mimeType = null;
+  if (imageSize.type) {
+    const possibleMimeType = `image/${imageSize.type}`;
+    if (Internal.MIME_TYPES_TO_EXT[possibleMimeType]) {
+      mimeType = possibleMimeType;
+    }
+    const filenameBasedLookup = Internal.filenameToMimeType(filename);
+    if (filenameBasedLookup) {
+      mimeType = filenameBasedLookup;
+    }
+  }
+  if (!mimeType) {
+    mimeType = "application/octet-stream";
+  }
+  let {
+    width,
+    height
+  } = imageSize;
+  if (!width || !height) {
+    width = 0;
+    height = 0;
+  }
+  return {
+    width,
+    height,
+    mimeType
+  };
+}
+async function extractFileMetadata(filename,
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_input // TODO: use buffer to determine mimetype
+) {
+  let mimeType = Internal.filenameToMimeType(filename);
+  if (!mimeType) {
+    mimeType = "application/octet-stream";
+  }
+  return {
+    mimeType
+  };
+}
+
 function getValidationErrorFileRef(validationError) {
   const maybeRef = validationError.value && typeof validationError.value === "object" && FILE_REF_PROP in validationError.value && typeof validationError.value[FILE_REF_PROP] === "string" ? validationError.value[FILE_REF_PROP] : undefined;
   if (!maybeRef) {
@@ -4589,15 +5318,15 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
       throw Error("Cannot fix file without a file reference");
     }
     const filename = fsPath__default.join(config.projectRoot, fileRef);
-    const buffer = fs.readFileSync(filename);
-    return extractFileMetadata(fileRef, buffer);
+    fs.readFileSync(filename);
+    return extractFileMetadata(fileRef);
   }
   const remainingErrors = [];
   const patch = [];
   for (const fix of validationError.fixes || []) {
     if (fix === "image:replace-metadata" || fix === "image:add-metadata") {
       const imageMetadata = await getImageMetadata();
-      if (imageMetadata.width === undefined || imageMetadata.height === undefined || imageMetadata.sha256 === undefined) {
+      if (imageMetadata.width === undefined || imageMetadata.height === undefined) {
         remainingErrors.push({
           ...validationError,
           message: "Failed to get image metadata",
@@ -4608,8 +5337,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
         const metadataIsCorrect =
         // metadata is a prop that is an object
         typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object" &&
-        // sha256 is correct
-        "sha256" in currentValue.metadata && currentValue.metadata.sha256 === imageMetadata.sha256 &&
         // width is correct
         "width" in currentValue.metadata && currentValue.metadata.width === imageMetadata.width &&
         // height is correct
@@ -4626,18 +5353,11 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
               value: {
                 width: imageMetadata.width,
                 height: imageMetadata.height,
-                sha256: imageMetadata.sha256,
                 mimeType: imageMetadata.mimeType
               }
             });
           } else {
             if (typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object") {
-              if (!("sha256" in currentValue.metadata) || currentValue.metadata.sha256 !== imageMetadata.sha256) {
-                remainingErrors.push({
-                  message: "Image metadata sha256 is incorrect! Found: " + ("sha256" in currentValue.metadata ? currentValue.metadata.sha256 : "<empty>") + ". Expected: " + imageMetadata.sha256 + ".",
-                  fixes: undefined
-                });
-              }
               if (!("width" in currentValue.metadata) || currentValue.metadata.width !== imageMetadata.width) {
                 remainingErrors.push({
                   message: "Image metadata width is incorrect! Found: " + ("width" in currentValue.metadata ? currentValue.metadata.width : "<empty>") + ". Expected: " + imageMetadata.width,
@@ -4672,14 +5392,13 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
           value: {
             width: imageMetadata.width,
             height: imageMetadata.height,
-            sha256: imageMetadata.sha256,
             mimeType: imageMetadata.mimeType
           }
         });
       }
     } else if (fix === "file:add-metadata" || fix === "file:check-metadata") {
       const fileMetadata = await getFileMetadata();
-      if (fileMetadata.sha256 === undefined) {
+      if (fileMetadata === undefined) {
         remainingErrors.push({
           ...validationError,
           message: "Failed to get image metadata",
@@ -4690,8 +5409,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
         const metadataIsCorrect =
         // metadata is a prop that is an object
         typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object" &&
-        // sha256 is correct
-        "sha256" in currentValue.metadata && currentValue.metadata.sha256 === fileMetadata.sha256 &&
         // mimeType is correct
         "mimeType" in currentValue.metadata && currentValue.metadata.mimeType === fileMetadata.mimeType;
 
@@ -4702,7 +5419,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
               op: "replace",
               path: sourceToPatchPath(sourcePath).concat("metadata"),
               value: {
-                sha256: fileMetadata.sha256,
                 ...(fileMetadata.mimeType ? {
                   mimeType: fileMetadata.mimeType
                 } : {})
@@ -4710,12 +5426,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
             });
           } else {
             if (typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object") {
-              if (!("sha256" in currentValue.metadata) || currentValue.metadata.sha256 !== fileMetadata.sha256) {
-                remainingErrors.push({
-                  message: "File metadata sha256 is incorrect! Found: " + ("sha256" in currentValue.metadata ? currentValue.metadata.sha256 : "<empty>") + ". Expected: " + fileMetadata.sha256 + ".",
-                  fixes: undefined
-                });
-              }
               if (!("mimeType" in currentValue.metadata) || currentValue.metadata.mimeType !== fileMetadata.mimeType) {
                 remainingErrors.push({
                   message: "File metadata mimeType is incorrect! Found: " + ("mimeType" in currentValue.metadata ? currentValue.metadata.mimeType : "<empty>") + ". Expected: " + fileMetadata.mimeType,
@@ -4736,7 +5446,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
           op: "add",
           path: sourceToPatchPath(sourcePath).concat("metadata"),
           value: {
-            sha256: fileMetadata.sha256,
             ...(fileMetadata.mimeType ? {
               mimeType: fileMetadata.mimeType
             } : {})