@valbuild/server 0.64.0 → 0.65.0

package/dist/valbuild-server.cjs.dev.js

@@ -1273,56 +1273,6 @@ function encodeJwt(payload, sessionKey) {
   return `${jwtHeaderBase64}.${payloadBase64}.${crypto__default["default"].createHmac("sha256", sessionKey).update(`${jwtHeaderBase64}.${payloadBase64}`).digest("base64")}`;
 }
 
-const textEncoder$2 = new TextEncoder();
-async function extractImageMetadata(filename, input) {
-  const imageSize = sizeOf__default["default"](input);
-  let mimeType = null;
-  if (imageSize.type) {
-    const possibleMimeType = `image/${imageSize.type}`;
-    if (core.Internal.MIME_TYPES_TO_EXT[possibleMimeType]) {
-      mimeType = possibleMimeType;
-    }
-    const filenameBasedLookup = core.Internal.filenameToMimeType(filename);
-    if (filenameBasedLookup) {
-      mimeType = filenameBasedLookup;
-    }
-  }
-  if (!mimeType) {
-    mimeType = "application/octet-stream";
-  }
-  let {
-    width,
-    height
-  } = imageSize;
-  if (!width || !height) {
-    width = 0;
-    height = 0;
-  }
-  const sha256 = getSha256(mimeType, input);
-  return {
-    width,
-    height,
-    sha256,
-    mimeType
-  };
-}
-function getSha256(mimeType, input) {
-  return core.Internal.getSHA256Hash(textEncoder$2.encode(
-  // TODO: we should probably store the mimetype in the metadata and reuse it here
-  `data:${mimeType};base64,${input.toString("base64")}`));
-}
-async function extractFileMetadata(filename, input) {
-  let mimeType = core.Internal.filenameToMimeType(filename);
-  if (!mimeType) {
-    mimeType = "application/octet-stream";
-  }
-  const sha256 = getSha256(mimeType, input);
-  return {
-    sha256,
-    mimeType
-  };
-}
-
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const textEncoder$1 = new TextEncoder();
 const jsonOps = new patch.JSONOps();
@@ -1351,15 +1301,20 @@ class ValOps {
     this.modulesErrors = null;
   }
   hash(input) {
-    let str;
-    if (typeof input === "string") {
-      str = input;
-    } else {
-      str = JSON.stringify(input);
-    }
-    return core.Internal.getSHA256Hash(textEncoder$1.encode(str));
+    return core.Internal.getSHA256Hash(textEncoder$1.encode(input));
   }
 
+  // #region stat
+  /**
+   * Get the status from Val
+   *
+   * This works differently in ValOpsFS and ValOpsHttp:
+   * - In ValOpsFS (for dev mode) works using long-polling operations since we cannot use WebSockets in the host Next.js server and we do not want to hammer the server with requests (though we could argue that it would be ok in dev, it is not up to our standards as a kick-ass CMS).
+   * - In ValOpsHttp (in production) it returns a WebSocket URL so that the client can connect directly.
+   *
+   * The reason we do not use long polling in production is that Vercel (a very likely host for Next.js), bills by wall time and long polling would therefore be very expensive.
+   */
+
   // #region initTree
   async initTree() {
     if (this.baseSha === null || this.schemaSha === null || this.sources === null || this.schemas === null || this.modulesErrors === null) {
@@ -1416,17 +1371,25 @@ class ValOps {
             addModuleError(`source in ${path} is undefined`, moduleIdx, path);
             return;
           }
+          let serializedSchema;
+          try {
+            serializedSchema = schema.serialize();
+          } catch (e) {
+            const message = e instanceof Error ? e.message : JSON.stringify(e);
+            addModuleError(`Could not serialize module: '${path}'. Error: ${message}`, moduleIdx, path);
+            return;
+          }
           const pathM = path;
           currentSources[pathM] = source;
           currentSchemas[pathM] = schema;
           // make sure the checks above is enough that this does not fail - even if val modules are not set up correctly
-          baseSha += this.hash({
+          baseSha = this.hash(baseSha + JSON.stringify({
             path,
-            schema: schema.serialize(),
+            schema: serializedSchema,
             source,
             modulesErrors: currentModulesErrors
-          });
-          schemaSha += this.hash(schema.serialize());
+          }));
+          schemaSha = this.hash(schemaSha + JSON.stringify(serializedSchema));
         });
       }
       this.sources = currentSources;
@@ -1622,25 +1585,27 @@ class ValOps {
       }
       for (const [sourcePathS, validationErrors] of Object.entries(res)) {
         const sourcePath = sourcePathS;
-        for (const validationError of validationErrors) {
-          if (isOnlyFileCheckValidationError(validationError)) {
-            if (files[sourcePath]) {
-              throw new Error("Cannot have multiple files with same path. Path: " + sourcePath + "; Module: " + path);
-            }
-            const value = validationError.value;
-            if (isFileSource(value)) {
-              files[sourcePath] = value;
-            }
-          } else {
-            if (!errors[path]) {
-              errors[path] = {
-                validations: {}
-              };
-            }
-            if (!errors[path].validations[sourcePath]) {
-              errors[path].validations[sourcePath] = [];
+        if (validationErrors) {
+          for (const validationError of validationErrors) {
+            if (isOnlyFileCheckValidationError(validationError)) {
+              if (files[sourcePath]) {
+                throw new Error("Cannot have multiple files with same path. Path: " + sourcePath + "; Module: " + path);
+              }
+              const value = validationError.value;
+              if (isFileSource(value)) {
+                files[sourcePath] = value;
+              }
+            } else {
+              if (!errors[path]) {
+                errors[path] = {
+                  validations: {}
+                };
+              }
+              if (!errors[path].validations[sourcePath]) {
+                errors[path].validations[sourcePath] = [];
+              }
+              errors[path].validations[sourcePath].push(validationError);
             }
-            errors[path].validations[sourcePath].push(validationError);
           }
         }
       }
@@ -1828,8 +1793,22 @@ class ValOps {
         const patchRes = patch.applyPatch(tsSourceFile, tsOps, sourceFileOps);
         if (fp.result.isErr(patchRes)) {
           if (Array.isArray(patchRes.error)) {
+            for (const error of patchRes.error) {
+              console.error("Could not patch", JSON.stringify({
+                path,
+                patchId,
+                error,
+                sourceFileOps
+              }, null, 2));
+            }
             errors.push(...patchRes.error);
           } else {
+            console.error("Could not patch", JSON.stringify({
+              path,
+              patchId,
+              error: patchRes.error,
+              sourceFileOps
+            }, null, 2));
             errors.push(patchRes.error);
           }
           triedPatches.push(patchId);
@@ -1923,16 +1902,23 @@ class ValOps {
   }
 
   // #region createPatch
-  async createPatch(path, patch$1, authorId) {
-    const {
-      sources,
-      schemas,
-      moduleErrors
-    } = await this.initTree();
+  async createPatch(path, patchAnalysis, patch$1, authorId) {
+    const initTree = await this.initTree();
+    const schemas = initTree.schemas;
+    const moduleErrors = initTree.moduleErrors;
+    let sources = initTree.sources;
+    if (patchAnalysis) {
+      const tree = await this.getTree(patchAnalysis);
+      sources = {
+        ...sources,
+        ...tree.sources
+      };
+    }
     const source = sources[path];
     const schema = schemas[path];
     const moduleError = moduleErrors.find(e => e.path === path);
     if (moduleError) {
+      console.error(`Cannot patch. Module at path: '${path}' has fatal errors: "${moduleError.message}"`);
       return {
         error: {
           message: `Cannot patch. Module at path: '${path}' has fatal errors: ` + moduleErrors.map(m => `"${m.message}"`).join(" and ")
@@ -1940,6 +1926,7 @@ class ValOps {
       };
     }
     if (!source) {
+      console.error(`Cannot patch. Module source at path: '${path}' does not exist`);
       return {
         error: {
           message: `Cannot patch. Module source at path: '${path}' does not exist`
@@ -1947,6 +1934,7 @@ class ValOps {
       };
     }
     if (!schema) {
+      console.error(`Cannot patch. Module schema at path: '${path}' does not exist`);
       return {
         error: {
           message: `Cannot patch. Module schema at path: '${path}' does not exist`
@@ -1964,10 +1952,12 @@ class ValOps {
           filePath
         } = op;
         if (files[filePath]) {
+          console.error(`Cannot have multiple files with same path in same patch. Path: ${filePath}`);
           files[filePath] = {
             error: new patch.PatchError("Cannot have multiple files with same path in same patch")
           };
         } else if (typeof value !== "string") {
+          console.error(`Value is not a string. Path: ${filePath}. Value: ${value}`);
           files[filePath] = {
             error: new patch.PatchError("Value is not a string")
           };
@@ -1983,15 +1973,14 @@ class ValOps {
             path: op.path,
             filePath,
             nestedFilePath: op.nestedFilePath,
-            value: {
-              sha256
-            }
+            value: sha256
           });
         }
       }
     }
     const saveRes = await this.saveSourceFilePatch(path, sourceFileOps, authorId);
     if (saveRes.error) {
+      console.error(`Could not save source file patch at path: '${path}'. Error: ${saveRes.error.message}`);
       return {
         error: saveRes.error
       };
@@ -2015,17 +2004,20 @@ class ValOps {
           ? "image" : schemaAtPath instanceof core.FileSchema ? "file" : schemaAtPath.serialize().type;
         } catch (e) {
           if (e instanceof Error) {
+            console.error(`Could not resolve file type at: ${modulePath}. Error: ${e.message}`);
             return {
               filePath,
               error: new patch.PatchError(`Could not resolve file type at: ${modulePath}. Error: ${e.message}`)
             };
           }
+          console.error(`Could not resolve file type at: ${modulePath}. Unknown error.`);
           return {
             filePath,
             error: new patch.PatchError(`Could not resolve file type at: ${modulePath}. Unknown error.`)
           };
         }
         if (type !== "image" && type !== "file") {
+          console.error("Unknown file type (resolved from schema): " + type);
           return {
             filePath,
             error: new patch.PatchError("Unknown file type (resolved from schema): " + type)
@@ -2033,6 +2025,7 @@ class ValOps {
         }
         const mimeType = getMimeTypeFromBase64(data.value);
         if (!mimeType) {
+          console.error("Could not get mimeType from base 64 encoded value");
           return {
             filePath,
             error: new patch.PatchError("Could not get mimeType from base 64 encoded value. First chars were: " + data.value.slice(0, 20))
@@ -2040,6 +2033,7 @@ class ValOps {
         }
         const buffer = bufferFromDataUrl(data.value);
         if (!buffer) {
+          console.error("Could not create buffer from base 64 encoded value");
           return {
             filePath,
             error: new patch.PatchError("Could not create buffer from base 64 encoded value")
@@ -2047,6 +2041,7 @@ class ValOps {
         }
         const metadataOps = createMetadataFromBuffer(type, mimeType, buffer);
         if (metadataOps.errors) {
+          console.error(`Could not get metadata. Errors: ${metadataOps.errors.map(error => error.message).join(", ")}`);
           return {
             filePath,
             error: new patch.PatchError(`Could not get metadata. Errors: ${metadataOps.errors.map(error => error.message).join(", ")}`)
@@ -2068,6 +2063,14 @@ class ValOps {
         };
       }
     }));
+    const errors = saveFileRes.filter(f => !!f.error);
+    if (errors.length > 0) {
+      return {
+        error: {
+          message: "Could not save patch: " + errors.map(e => e.error.message).join(", ")
+        }
+      };
+    }
     return {
       patchId,
       files: saveFileRes,
@@ -2092,14 +2095,13 @@ function isFileSource(value) {
 }
 function getFieldsForType(type) {
   if (type === "file") {
-    return ["sha256", "mimeType"];
+    return ["mimeType"];
   } else if (type === "image") {
-    return ["sha256", "mimeType", "height", "width"];
+    return ["mimeType", "height", "width"];
   }
   throw new Error("Unknown type: " + type);
 }
 function createMetadataFromBuffer(type, mimeType, buffer) {
-  const sha256 = getSha256(mimeType, buffer);
   const errors = [];
   let availableMetadata;
   if (type === "image") {
@@ -2108,7 +2110,7 @@ function createMetadataFromBuffer(type, mimeType, buffer) {
       height,
       type
     } = sizeOf__default["default"](buffer);
-    const normalizedType = type === "jpg" ? "jpeg" : type;
+    const normalizedType = type === "jpg" ? "jpeg" : type === "svg" ? "svg+xml" : type;
     if (type !== undefined && `image/${normalizedType}` !== mimeType) {
       return {
         errors: [{
@@ -2117,14 +2119,12 @@ function createMetadataFromBuffer(type, mimeType, buffer) {
       };
     }
     availableMetadata = {
-      sha256: sha256,
       mimeType,
       height,
       width
     };
   } else {
     availableMetadata = {
-      sha256: sha256,
       mimeType
     };
   }
@@ -2244,9 +2244,7 @@ const OperationT = z__default["default"].discriminatedUnion("op", [z__default["d
   path: z__default["default"].array(z__default["default"].string()),
   filePath: z__default["default"].string(),
   nestedFilePath: z__default["default"].array(z__default["default"].string()).optional(),
-  value: z__default["default"].union([z__default["default"].string(), z__default["default"].object({
-    sha256: z__default["default"].string()
-  })])
+  value: z__default["default"].string()
 }).strict()]);
 const Patch = z__default["default"].array(OperationT);
 
@@ -2260,6 +2258,161 @@ class ValOpsFS extends ValOps {
   async onInit() {
     // do nothing
   }
+  async getStat(params) {
+    // In ValOpsFS, we don't have a websocket server to listen to file changes so we use long-polling.
+    // If a file that Val depends on changes, we break the connection and tell the client to request again to get the latest values.
+    try {
+      var _this$options, _this$options2;
+      const currentBaseSha = await this.getBaseSha();
+      const currentSchemaSha = await this.getSchemaSha();
+      const moduleFilePaths = Object.keys(await this.getSchemas());
+      const patchData = await this.readPatches();
+      const patches = [];
+      // TODO: use proper patch sequences when available:
+      for (const [patchId] of Object.entries(patchData.patches).sort(([, a], [, b]) => {
+        return a.createdAt.localeCompare(b.createdAt, undefined);
+      })) {
+        patches.push(patchId);
+      }
+      // something changed: return immediately
+      const didChange = !params || currentBaseSha !== params.baseSha || currentSchemaSha !== params.schemaSha || patches.length !== params.patches.length || patches.some((p, i) => p !== params.patches[i]);
+      if (didChange) {
+        return {
+          type: "did-change",
+          baseSha: currentBaseSha,
+          schemaSha: currentSchemaSha,
+          patches
+        };
+      }
+      let fsWatcher = null;
+      let stopPolling = false;
+      const didDirectoryChangeUsingPolling = (dir, interval, setHandle) => {
+        const mtimeInDir = {};
+        if (fs__default["default"].existsSync(dir)) {
+          for (const file of fs__default["default"].readdirSync(dir)) {
+            mtimeInDir[file] = fs__default["default"].statSync(fsPath__namespace["default"].join(dir, file)).mtime.getTime();
+          }
+        }
+        return new Promise(resolve => {
+          const go = resolve => {
+            const start = Date.now();
+            if (fs__default["default"].existsSync(dir)) {
+              const subDirs = fs__default["default"].readdirSync(dir);
+              // amount of files changed
+              if (subDirs.length !== Object.keys(mtimeInDir).length) {
+                resolve("request-again");
+              }
+              for (const file of fs__default["default"].readdirSync(dir)) {
+                const mtime = fs__default["default"].statSync(fsPath__namespace["default"].join(dir, file)).mtime.getTime();
+                if (mtime !== mtimeInDir[file]) {
+                  resolve("request-again");
+                }
+              }
+            } else {
+              // dir had files, but now is deleted
+              if (Object.keys(mtimeInDir).length > 0) {
+                resolve("request-again");
+              }
+            }
+            if (Date.now() - start > interval) {
+              console.warn("Val: polling interval of patches exceeded");
+            }
+            if (stopPolling) {
+              return;
+            }
+            setHandle(setTimeout(() => go(resolve), interval));
+          };
+          setHandle(setTimeout(() => go(resolve), interval));
+        });
+      };
+      const didFilesChangeUsingPolling = (files, interval, setHandle) => {
+        const mtimes = {};
+        for (const file of files) {
+          if (fs__default["default"].existsSync(file)) {
+            mtimes[file] = fs__default["default"].statSync(file).mtime.getTime();
+          } else {
+            mtimes[file] = -1;
+          }
+        }
+        return new Promise(resolve => {
+          const go = resolve => {
+            const start = Date.now();
+            for (const file of files) {
+              const mtime = fs__default["default"].existsSync(file) ? fs__default["default"].statSync(file).mtime.getTime() : -1;
+              if (mtime !== mtimes[file]) {
+                resolve("request-again");
+              }
+            }
+            if (Date.now() - start > interval) {
+              console.warn("Val: polling interval of files exceeded");
+            }
+            setHandle(setTimeout(() => go(resolve), interval));
+          };
+          if (stopPolling) {
+            return;
+          }
+          setHandle(setTimeout(() => go(resolve), interval));
+        });
+      };
+      const statFilePollingInterval = ((_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.statFilePollingInterval) || 250; // relatively low interval, but there would typically not be that many files (less than 1000 at the very least) - hopefully if we have customers with more files than that, we also have devs working on Val that easily can fix this :) Besides this is just the default
+      const disableFilePolling = ((_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.disableFilePolling) || false;
+      let patchesDirHandle;
+      let valFilesIntervalHandle;
+      const type = await Promise.race([
+      // we poll the patches directory for changes since fs.watch does not work reliably on all system (in particular on WSL) and just checking the patches dir is relatively cheap
+      disableFilePolling ? new Promise(() => {}) : didDirectoryChangeUsingPolling(this.getPatchesDir(), statFilePollingInterval, handle => {
+        patchesDirHandle = handle;
+      }),
+      // we poll the files that Val depends on for changes
+      disableFilePolling ? new Promise(() => {}) : didFilesChangeUsingPolling([fsPath__namespace["default"].join(this.rootDir, "val.config.ts"), fsPath__namespace["default"].join(this.rootDir, "val.modules.ts"), fsPath__namespace["default"].join(this.rootDir, "val.config.js"), fsPath__namespace["default"].join(this.rootDir, "val.modules.js"), ...moduleFilePaths.map(p => fsPath__namespace["default"].join(this.rootDir, p))], statFilePollingInterval, handle => {
+        valFilesIntervalHandle = handle;
+      }), new Promise(resolve => {
+        fsWatcher = fs__default["default"].watch(this.rootDir, {
+          recursive: true
+        }, (eventType, filename) => {
+          if (!filename) {
+            return;
+          }
+          const isChange = filename.startsWith(this.getPatchesDir().slice(this.rootDir.length + 1)) || filename.endsWith(".val.ts") || filename.endsWith(".val.js") || filename.endsWith("val.config.ts") || filename.endsWith("val.config.js") || filename.endsWith("val.modules.ts") || filename.endsWith("val.modules.js");
+          if (isChange) {
+            // a file that Val depends on just changed or a patch was created, break connection and request stat again to get the new values
+            resolve("request-again");
+          }
+        });
+      }), new Promise(resolve => {
+        var _this$options3;
+        return setTimeout(() => resolve("no-change"), ((_this$options3 = this.options) === null || _this$options3 === void 0 ? void 0 : _this$options3.statPollingInterval) || 20000);
+      })]).finally(() => {
+        if (fsWatcher) {
+          fsWatcher.close();
+        }
+        stopPolling = true;
+        clearInterval(patchesDirHandle);
+        clearInterval(valFilesIntervalHandle);
+      });
+      return {
+        type,
+        baseSha: currentBaseSha,
+        schemaSha: currentSchemaSha,
+        patches
+      };
+    } catch (err) {
+      if (err instanceof Error) {
+        return {
+          type: "error",
+          error: {
+            message: err.message
+          }
+        };
+      }
+      return {
+        type: "error",
+        error: {
+          message: "Unknown error (getStat)"
+        }
+      };
+    }
+  }
   async readPatches(includes) {
     const patchesCacheDir = this.getPatchesDir();
     let patchJsonFiles = [];
@@ -2268,8 +2421,8 @@ class ValOpsFS extends ValOps {
     }
     const patches = {};
     const errors = {};
-    const sortedPatchIds = patchJsonFiles.map(file => parseInt(fsPath__namespace["default"].basename(fsPath__namespace["default"].dirname(file)), 10)).sort();
-    for (const patchIdNum of sortedPatchIds) {
+    const parsedPatchIds = patchJsonFiles.map(file => parseInt(fsPath__namespace["default"].basename(fsPath__namespace["default"].dirname(file)), 10)).sort();
+    for (const patchIdNum of parsedPatchIds) {
       if (Number.isNaN(patchIdNum)) {
         throw new Error("Could not parse patch id from file name. Files found: " + patchJsonFiles.join(", "));
       }
@@ -2310,6 +2463,12 @@ class ValOpsFS extends ValOps {
       errors: allErrors,
       patches: allPatches
     } = await this.readPatches(filters.patchIds);
+    if (allErrors && Object.keys(allErrors).length > 0) {
+      for (const [patchId, error] of Object.entries(allErrors)) {
+        console.error("Error reading patch", patchId, error);
+        errors[patchId] = error;
+      }
+    }
     for (const [patchIdS, patch] of Object.entries(allPatches)) {
       const patchId = patchIdS;
       if (filters.authors && !(patch.authorId === null || filters.authors.includes(patch.authorId))) {
@@ -2325,10 +2484,6 @@ class ValOpsFS extends ValOps {
         authorId: patch.authorId,
         appliedAt: patch.appliedAt
       };
-      const error = allErrors && allErrors[patchId];
-      if (error) {
-        errors[patchId] = error;
-      }
     }
     if (errors && Object.keys(errors).length > 0) {
       return {
@@ -2672,11 +2827,11 @@ class ValOpsFS extends ValOps {
   getPatchDir(patchId) {
     return fsPath__namespace["default"].join(this.getPatchesDir(), patchId);
   }
-  getBinaryFilePath(filename, patchId) {
-    return fsPath__namespace["default"].join(this.getPatchDir(patchId), "files", filename, fsPath__namespace["default"].basename(filename));
+  getBinaryFilePath(filePath, patchId) {
+    return fsPath__namespace["default"].join(this.getPatchDir(patchId), "files", filePath, fsPath__namespace["default"].basename(filePath));
   }
-  getBinaryFileMetadataPath(filename, patchId) {
-    return fsPath__namespace["default"].join(this.getPatchDir(patchId), "files", filename, "metadata.json");
+  getBinaryFileMetadataPath(filePath, patchId) {
+    return fsPath__namespace["default"].join(this.getPatchDir(patchId), "files", filePath, "metadata.json");
   }
   getPatchFilePath(patchId) {
     return fsPath__namespace["default"].join(this.getPatchDir(patchId), "patch.json");
@@ -2749,12 +2904,10 @@ const BaseSha = z.z.string().refine(s => !!s); // TODO: validate
 const AuthorId = z.z.string().refine(s => !!s); // TODO: validate
 const ModuleFilePath = z.z.string().refine(s => !!s); // TODO: validate
 const Metadata = z.z.union([z.z.object({
-  sha256: z.z.string(),
   mimeType: z.z.string(),
   width: z.z.number(),
   height: z.z.number()
 }), z.z.object({
-  sha256: z.z.string(),
   mimeType: z.z.string()
 })]);
 const MetadataRes = z.z.object({
@@ -2826,7 +2979,9 @@ const CommitResponse = z.z.object({
   branch: z.z.string()
 });
 class ValOpsHttp extends ValOps {
-  constructor(hostUrl, project, commitSha, branch, apiKey, valModules, options) {
+  constructor(hostUrl, project, commitSha,
+  // TODO: CommitSha
+  branch, apiKey, valModules, options) {
     super(valModules, options);
     this.hostUrl = hostUrl;
     this.project = project;
@@ -2840,7 +2995,150 @@ class ValOpsHttp extends ValOps {
   async onInit() {
     // TODO: unused for now. Implement or remove
   }
+  async getStat(params) {
+    if (!(params !== null && params !== void 0 && params.profileId)) {
+      return {
+        type: "error",
+        error: {
+          message: "No profileId provided"
+        }
+      };
+    }
+    const currentBaseSha = await this.getBaseSha();
+    const currentSchemaSha = await this.getSchemaSha();
+    const patchData = await this.fetchPatches({
+      omitPatch: true,
+      authors: undefined,
+      patchIds: undefined,
+      moduleFilePaths: undefined
+    });
+    const patches = [];
+    // TODO: use proper patch sequences when available:
+    for (const [patchId] of Object.entries(patchData.patches).sort(([, a], [, b]) => {
+      return a.createdAt.localeCompare(b.createdAt, undefined);
+    })) {
+      patches.push(patchId);
+    }
+    const webSocketNonceRes = await this.getWebSocketNonce(params.profileId);
+    if (webSocketNonceRes.status === "error") {
+      return {
+        type: "error",
+        error: webSocketNonceRes.error
+      };
+    }
+    const {
+      nonce,
+      url
+    } = webSocketNonceRes.data;
+    return {
+      type: "use-websocket",
+      url,
+      nonce,
+      baseSha: currentBaseSha,
+      schemaSha: currentSchemaSha,
+      patches,
+      commitSha: this.commitSha
+    };
+  }
+  async getWebSocketNonce(profileId) {
+    return fetch(`${this.hostUrl}/v1/${this.project}/websocket/nonces`, {
+      method: "POST",
+      body: JSON.stringify({
+        branch: this.branch,
+        profileId
+      }),
+      headers: {
+        ...this.authHeaders,
+        "Content-Type": "application/json"
+      }
+    }).then(async res => {
+      if (res.ok) {
+        const json = await res.json();
+        if (typeof json.nonce !== "string" || typeof json.url !== "string") {
+          return {
+            status: "error",
+            error: {
+              message: "Invalid nonce response: " + JSON.stringify(json)
+            }
+          };
+        }
+        if (!json.url.startsWith("ws://") && !json.url.startsWith("wss://")) {
+          return {
+            status: "error",
+            error: {
+              message: "Invalid websocket url: " + json.url
+            }
+          };
+        }
+        return {
+          status: "success",
+          data: {
+            nonce: json.nonce,
+            url: json.url
+          }
+        };
+      }
+      return {
+        status: "error",
+        error: {
+          message: "Could not get nonce. HTTP error: " + res.status + " " + res.statusText
+        }
+      };
+    }).catch(e => {
+      console.error("Could not get nonce (connection error?):", e instanceof Error ? e.message : e.toString());
+      return {
+        status: "error",
+        error: {
+          message: "Could not get nonce. Error: " + (e instanceof Error ? e.message : e.toString())
+        }
+      };
+    });
+  }
   async fetchPatches(filters) {
+    // Split patchIds into chunks to avoid too long query strings
+    // NOTE: fetching patches results are cached, so this should reduce the pressure on the server
+    const chunkSize = 100;
+    const patchIds = filters.patchIds || [];
+    const patchIdChunks = [];
+    for (let i = 0; i < patchIds.length; i += chunkSize) {
+      patchIdChunks.push(patchIds.slice(i, i + chunkSize));
+    }
+    let allPatches = {};
+    let allErrors = {};
+    if (patchIds === undefined || patchIds.length === 0) {
+      return this.fetchPatchesInternal({
+        patchIds: patchIds,
+        authors: filters.authors,
+        moduleFilePaths: filters.moduleFilePaths,
+        omitPatch: filters.omitPatch
+      });
+    }
+    for (const res of await Promise.all(patchIdChunks.map(patchIdChunk => this.fetchPatchesInternal({
+      patchIds: patchIdChunk,
+      authors: filters.authors,
+      moduleFilePaths: filters.moduleFilePaths,
+      omitPatch: filters.omitPatch
+    })))) {
+      if ("error" in res) {
+        return res;
+      }
+      allPatches = {
+        ...allPatches,
+        ...res.patches
+      };
+      if (res.errors) {
+        allErrors = {
+          ...allErrors,
+          ...res.errors
+        };
+      }
+    }
+    return {
+      patches: allPatches,
+      errors: Object.keys(allErrors).length > 0 ? allErrors : undefined
+    };
+  }
+  async fetchPatchesInternal(filters) {
     const params = [];
     params.push(["branch", this.branch]);
     if (filters.patchIds) {
@@ -3089,7 +3387,7 @@ class ValOpsHttp extends ValOps {
     if (!file) {
       return null;
     }
-    return Buffer.from(file.value, "base64");
+    return bufferFromDataUrl(file.value) ?? null;
   }
   async getBase64EncodedBinaryFileMetadataFromPatch(filePath, type, patchId) {
     const params = new URLSearchParams();
@@ -3197,6 +3495,7 @@ class ValOpsHttp extends ValOps {
   }
   async commit(prepared, message, committer, newBranch) {
     try {
+      var _res$headers$get;
       const existingBranch = this.branch;
       const res = await fetch(`${this.hostUrl}/v1/${this.project}/commit`, {
         method: "POST",
@@ -3232,6 +3531,22 @@ class ValOpsHttp extends ValOps {
           }
         };
       }
+      if ((_res$headers$get = res.headers.get("Content-Type")) !== null && _res$headers$get !== void 0 && _res$headers$get.includes("application/json")) {
+        const json = await res.json();
+        if (json.isNotFastForward) {
+          return {
+            isNotFastForward: true,
+            error: {
+              message: "Could not commit. Not a fast-forward commit"
+            }
+          };
+        }
+        return {
+          error: {
+            message: json.message
+          }
+        };
+      }
       return {
         error: {
           message: "Could not commit. HTTP error: " + res.status + " " + res.statusText
@@ -3252,12 +3567,14 @@ const ValServer = (valModules, options, callbacks) => {
   let serverOps;
   if (options.mode === "fs") {
     serverOps = new ValOpsFS(options.cwd, valModules, {
-      formatter: options.formatter
+      formatter: options.formatter,
+      config: options.config
     });
   } else if (options.mode === "http") {
     serverOps = new ValOpsHttp(options.valContentUrl, options.project, options.commit, options.branch, options.apiKey, valModules, {
       formatter: options.formatter,
-      root: options.root
+      root: options.root,
+      config: options.config
     });
   } else {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -3375,12 +3692,116 @@ const ValServer = (valModules, options, callbacks) => {
       };
     }
   };
+  const authorize = async redirectTo => {
+    const token = crypto.randomUUID();
+    const redirectUrl = new URL(redirectTo);
+    const appAuthorizeUrl = getAuthorizeUrl(`${redirectUrl.origin}/${options.route}`, token);
+    await callbacks.onEnable(true);
+    return {
+      cookies: {
+        [internal.VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
+        [internal.VAL_STATE_COOKIE]: {
+          value: createStateCookie({
+            redirect_to: redirectTo,
+            token
+          }),
+          options: {
+            httpOnly: true,
+            sameSite: "lax",
+            expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
+          }
+        }
+      },
+      status: 302,
+      redirectTo: appAuthorizeUrl
+    };
+  };
   return {
-    //#region auth
+    "/draft/enable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valEnableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
+        }
+        await callbacks.onEnable(true);
+        return {
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/draft/disable": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        const query = req.query;
+        const redirectToRes = getRedirectUrl(query, options.valDisableRedirectUrl);
+        if (typeof redirectToRes !== "string") {
+          return redirectToRes;
+        }
+        await callbacks.onDisable(true);
+        return {
+          status: 302,
+          redirectTo: redirectToRes
+        };
+      }
+    },
+    "/draft/stat": {
+      GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        return {
+          status: 200,
+          json: {
+            draftMode: await callbacks.isEnabled()
+          }
+        };
+      }
+    },
     "/enable": {
       GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
         const query = req.query;
         const redirectToRes = getRedirectUrl(query, options.valEnableRedirectUrl);
+        if (auth.error) {
+          if (typeof redirectToRes === "string") {
+            return authorize(redirectToRes);
+          }
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
         if (typeof redirectToRes !== "string") {
           return redirectToRes;
         }
@@ -3396,6 +3817,16 @@ const ValServer = (valModules, options, callbacks) => {
     },
     "/disable": {
       GET: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
         const query = req.query;
         const redirectToRes = getRedirectUrl(query, options.valDisableRedirectUrl);
         if (typeof redirectToRes !== "string") {
@@ -3413,6 +3844,7 @@ const ValServer = (valModules, options, callbacks) => {
         };
       }
     },
+    //#region auth
     "/authorize": {
       GET: async req => {
         const query = req.query;
@@ -3424,28 +3856,8 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        const token = crypto.randomUUID();
-        const redirectUrl = new URL(query.redirect_to);
-        const appAuthorizeUrl = getAuthorizeUrl(`${redirectUrl.origin}/${options.route}`, token);
-        await callbacks.onEnable(true);
-        return {
-          cookies: {
-            [internal.VAL_ENABLE_COOKIE_NAME]: ENABLE_COOKIE_VALUE,
-            [internal.VAL_STATE_COOKIE]: {
-              value: createStateCookie({
-                redirect_to: query.redirect_to,
-                token
-              }),
-              options: {
-                httpOnly: true,
-                sameSite: "lax",
-                expires: new Date(Date.now() + 1000 * 60 * 60) // 1 hour
-              }
-            }
-          },
-          status: 302,
-          redirectTo: appAuthorizeUrl
-        };
+        const redirectTo = query.redirect_to;
+        return authorize(redirectTo);
       }
     },
     "/callback": {
@@ -3617,6 +4029,46 @@ const ValServer = (valModules, options, callbacks) => {
         };
       }
     },
+    //#region stat
+    "/stat": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp && !("id" in auth)) {
+          return {
+            status: 401,
+            json: {
+              message: "Unauthorized"
+            }
+          };
+        }
+        const currentStat = await serverOps.getStat({
+          ...req.body,
+          profileId: "id" in auth ? auth.id : undefined
+        });
+        if (currentStat.type === "error") {
+          return {
+            status: 500,
+            json: currentStat.error
+          };
+        }
+        return {
+          status: 200,
+          json: {
+            ...currentStat,
+            config: options.config
+          }
+        };
+      }
+    },
     //#region patches
     "/patches/~": {
       GET: async req => {
@@ -3711,7 +4163,7 @@ const ValServer = (valModules, options, callbacks) => {
         };
       }
     },
-    //#region tree ops
+    //#region schema
     "/schema": {
       GET: async req => {
         const cookies = req.cookies;
@@ -3738,7 +4190,7 @@ const ValServer = (valModules, options, callbacks) => {
           return {
             status: 500,
             json: {
-              message: "Val is not correctly setup. Check the val.modules file",
+              message: `Got errors while fetching modules: ${moduleErrors.filter(error => error).map(error => error.message).join(", ")}`,
               details: moduleErrors
             }
           };
@@ -3746,9 +4198,22 @@ const ValServer = (valModules, options, callbacks) => {
         const schemaSha = await serverOps.getSchemaSha();
         const schemas = await serverOps.getSchemas();
         const serializedSchemas = {};
-        for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
-          const moduleFilePath = moduleFilePathS;
-          serializedSchemas[moduleFilePath] = schema.serialize();
+        try {
+          for (const [moduleFilePathS, schema] of Object.entries(schemas)) {
+            const moduleFilePath = moduleFilePathS;
+            serializedSchemas[moduleFilePath] = schema.serialize();
+          }
+        } catch (e) {
+          console.error("Val: Failed to serialize schemas", e);
+          return {
+            status: 500,
+            json: {
+              message: "Failed to serialize schemas",
+              details: [{
+                message: e instanceof Error ? e.message : JSON.stringify(e)
+              }]
+            }
+          };
         }
         return {
           status: 200,
@@ -3759,7 +4224,8 @@ const ValServer = (valModules, options, callbacks) => {
         };
       }
     },
-    "/tree/~": {
+    // #region sources
+    "/sources": {
       PUT: async req => {
         var _body$patchIds;
         const query = req.query;
@@ -3796,8 +4262,8 @@ const ValServer = (valModules, options, callbacks) => {
         }
         let tree;
         let patchAnalysis = null;
-        let newPatchId = undefined;
-        if (body !== null && body !== void 0 && body.patchIds && (body === null || body === void 0 || (_body$patchIds = body.patchIds) === null || _body$patchIds === void 0 ? void 0 : _body$patchIds.length) > 0 || body !== null && body !== void 0 && body.addPatch) {
+        let newPatchIds = undefined;
+        if (body !== null && body !== void 0 && body.patchIds && (body === null || body === void 0 || (_body$patchIds = body.patchIds) === null || _body$patchIds === void 0 ? void 0 : _body$patchIds.length) > 0 || body !== null && body !== void 0 && body.addPatches) {
           // TODO: validate patches_sha
           const patchIds = body === null || body === void 0 ? void 0 : body.patchIds;
           const patchOps = patchIds && patchIds.length > 0 ? await serverOps.fetchPatches({
@@ -3806,6 +4272,15 @@ const ValServer = (valModules, options, callbacks) => {
           }) : {
             patches: {}
           };
+          if (patchOps.error) {
+            return {
+              status: 400,
+              json: {
+                message: "Failed to fetch patches: " + patchOps.error.message,
+                details: []
+              }
+            };
+          }
           let patchErrors = undefined;
           for (const [patchIdS, error] of Object.entries(patchOps.errors || {})) {
             const patchId = patchIdS;
@@ -3816,45 +4291,43 @@ const ValServer = (valModules, options, callbacks) => {
               message: error.message
             };
           }
-          if (body !== null && body !== void 0 && body.addPatch) {
-            const newPatchModuleFilePath = body.addPatch.path;
-            const newPatchOps = body.addPatch.patch;
-            const authorId = "id" in auth ? auth.id : null;
-            const createPatchRes = await serverOps.createPatch(newPatchModuleFilePath, newPatchOps, authorId);
-            if (createPatchRes.error) {
-              return {
-                status: 500,
-                json: {
-                  message: "Failed to create patch: " + createPatchRes.error.message,
-                  details: createPatchRes.error
-                }
+          // TODO: errors
+          patchAnalysis = serverOps.analyzePatches(patchOps.patches);
+          if (body !== null && body !== void 0 && body.addPatches) {
+            for (const addPatch of body.addPatches) {
+              const newPatchModuleFilePath = addPatch.path;
+              const newPatchOps = addPatch.patch;
+              const authorId = "id" in auth ? auth.id : null;
+              const createPatchRes = await serverOps.createPatch(newPatchModuleFilePath, {
+                ...patchAnalysis,
+                ...patchOps
+              }, newPatchOps, authorId);
+              if (createPatchRes.error) {
+                return {
+                  status: 500,
+                  json: {
+                    message: "Failed to create patch: " + createPatchRes.error.message,
+                    details: createPatchRes.error
+                  }
+                };
+              }
+              if (!newPatchIds) {
+                newPatchIds = [createPatchRes.patchId];
+              } else {
+                newPatchIds.push(createPatchRes.patchId);
+              }
+              patchOps.patches[createPatchRes.patchId] = {
+                path: newPatchModuleFilePath,
+                patch: newPatchOps,
+                authorId,
+                createdAt: createPatchRes.createdAt,
+                appliedAt: null
               };
+              patchAnalysis.patchesByModule[newPatchModuleFilePath] = [...(patchAnalysis.patchesByModule[newPatchModuleFilePath] || []), {
+                patchId: createPatchRes.patchId
+              }];
             }
-            // TODO: evaluate if we need this: seems wrong to delete patches that are not applied
-            // for (const fileRes of createPatchRes.files) {
-            //   if (fileRes.error) {
-            //     // clean up broken patch:
-            //     await this.serverOps.deletePatches([createPatchRes.patchId]);
-            //     return {
-            //       status: 500,
-            //       json: {
-            //         message: "Failed to create patch",
-            //         details: fileRes.error,
-            //       },
-            //     };
-            //   }
-            // }
-            newPatchId = createPatchRes.patchId;
-            patchOps.patches[createPatchRes.patchId] = {
-              path: newPatchModuleFilePath,
-              patch: newPatchOps,
-              authorId,
-              createdAt: createPatchRes.createdAt,
-              appliedAt: null
-            };
           }
-          // TODO: errors
-          patchAnalysis = serverOps.analyzePatches(patchOps.patches);
           tree = {
             ...(await serverOps.getTree({
               ...patchAnalysis,
@@ -3877,27 +4350,13 @@ const ValServer = (valModules, options, callbacks) => {
         } else {
           tree = await serverOps.getTree();
         }
-        if (tree.errors && Object.keys(tree.errors).length > 0) {
-          console.error("Val: Failed to get tree", JSON.stringify(tree.errors));
-          const res = {
-            status: 400,
-            json: {
-              type: "patch-error",
-              errors: Object.fromEntries(Object.entries(tree.errors).map(([key, value]) => [key, value.map(error => ({
-                patchId: error.patchId,
-                skipped: error.skipped,
-                error: {
-                  message: error.error.message
-                }
-              }))])),
-              message: "One or more patches failed to be applied"
-            }
-          };
-          return res;
-        }
+        let sourcesValidation = {
+          errors: {},
+          files: {}
+        };
         if (query.validate_sources || query.validate_binary_files) {
           const schemas = await serverOps.getSchemas();
-          const sourcesValidation = await serverOps.validateSources(schemas, tree.sources);
+          sourcesValidation = await serverOps.validateSources(schemas, tree.sources);
 
           // TODO: send validation errors
           if (query.validate_binary_files) {
@@ -3909,20 +4368,41 @@ const ValServer = (valModules, options, callbacks) => {
         for (const [moduleFilePathS, module] of Object.entries(tree.sources)) {
           const moduleFilePath = moduleFilePathS;
           if (moduleFilePath.startsWith(treePath)) {
+            var _sourcesValidation$er;
             modules[moduleFilePath] = {
               source: module,
               patches: patchAnalysis && patchAnalysis.patchesByModule[moduleFilePath] ? {
                 applied: patchAnalysis.patchesByModule[moduleFilePath].map(p => p.patchId)
-              } : undefined
+              } : undefined,
+              validationErrors: (_sourcesValidation$er = sourcesValidation.errors[moduleFilePath]) === null || _sourcesValidation$er === void 0 ? void 0 : _sourcesValidation$er.validations
             };
           }
         }
+        if (tree.errors && Object.keys(tree.errors).length > 0) {
+          const res = {
+            status: 400,
+            json: {
+              type: "patch-error",
+              schemaSha,
+              modules,
+              errors: Object.fromEntries(Object.entries(tree.errors).map(([key, value]) => [key, value.map(error => ({
+                patchId: error.patchId,
+                skipped: error.skipped,
+                error: {
+                  message: error.error.message
+                }
+              }))])),
+              message: "One or more patches failed to be applied"
+            }
+          };
+          return res;
+        }
         const res = {
           status: 200,
           json: {
             schemaSha,
             modules,
-            newPatchId
+            newPatchIds
           }
         };
         return res;
@@ -3968,10 +4448,10 @@ const ValServer = (valModules, options, callbacks) => {
           ...patches
         });
         if (preparedCommit.hasErrors) {
-          console.error("Failed to create commit", {
+          console.error("Failed to create commit", JSON.stringify({
             sourceFilePatchErrors: preparedCommit.sourceFilePatchErrors,
             binaryFilePatchErrors: preparedCommit.binaryFilePatchErrors
-          });
+          }, null, 2));
           return {
             status: 400,
             json: {
@@ -3987,13 +4467,34 @@ const ValServer = (valModules, options, callbacks) => {
         }
         if (serverOps instanceof ValOpsFS) {
           await serverOps.saveFiles(preparedCommit);
+          await serverOps.deletePatches(patchIds);
           return {
             status: 200,
             json: {} // TODO:
           };
         } else if (serverOps instanceof ValOpsHttp) {
           if (auth.error === undefined && auth.id) {
-            await serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
+            const commitRes = await serverOps.commit(preparedCommit, "Update content: " + Object.keys(analysis.patchesByModule) + " modules changed", auth.id);
+            if (commitRes.error) {
+              console.error("Failed to commit", commitRes.error);
+              if ("isNotFastForward" in commitRes && commitRes.isNotFastForward) {
+                return {
+                  status: 409,
+                  json: {
+                    isNotFastForward: true,
+                    message: "Cannot commit: this is not the latest version of this branch"
+                  }
+                };
+              }
+              return {
+                status: 400,
+                json: {
+                  message: commitRes.error.message,
+                  details: []
+                }
+              };
+            }
+            // TODO: serverOps.markApplied(patchIds);
             return {
               status: 200,
               json: {} // TODO:
@@ -4024,15 +4525,24 @@ const ValServer = (valModules, options, callbacks) => {
         //     3) the benefit an attacker would get is an image that is not yet published (i.e. most cases: not very interesting)
         // Thus: attack surface + ease of attack + benefit = low probability of attack
         // If we couldn't argue that patch ids are secret enough, then this would be a problem.
+        let cacheControl;
         let fileBuffer;
+        let mimeType;
         if (query.patch_id) {
           fileBuffer = await serverOps.getBase64EncodedBinaryFileFromPatch(filePath, query.patch_id);
+          mimeType = core.Internal.filenameToMimeType(filePath);
+          cacheControl = "public, max-age=20000, immutable";
         } else {
           fileBuffer = await serverOps.getBinaryFile(filePath);
         }
         if (fileBuffer) {
           return {
             status: 200,
+            headers: {
+              // TODO: we could use ETag and return 304 instead
+              "Content-Type": mimeType || "application/octet-stream",
+              "Cache-Control": cacheControl || "public, max-age=0, must-revalidate"
+            },
             body: bufferToReadableStream(fileBuffer)
           };
         } else {
@@ -4352,14 +4862,14 @@ function guessMimeTypeFromPath(filePath) {
   return null;
 }
 
-async function createValServer(valModules, route, opts, callbacks, formatter) {
-  const valServerConfig = await initHandlerOptions(route, opts);
+async function createValServer(valModules, route, opts, config, callbacks, formatter) {
+  const valServerConfig = await initHandlerOptions(route, opts, config);
   return ValServer(valModules, {
     formatter,
     ...valServerConfig
   }, callbacks);
 }
-async function initHandlerOptions(route, opts) {
+async function initHandlerOptions(route, opts, config) {
   const maybeApiKey = opts.apiKey || process.env.VAL_API_KEY;
   const maybeValSecret = opts.valSecret || process.env.VAL_SECRET;
   const isProxyMode = opts.mode === "proxy" || opts.mode === undefined && (maybeApiKey || maybeValSecret);
@@ -4404,7 +4914,8 @@ async function initHandlerOptions(route, opts) {
       valEnableRedirectUrl,
       valDisableRedirectUrl,
       valContentUrl,
-      valBuildUrl
+      valBuildUrl,
+      config
     };
   } else {
     const cwd = process.cwd();
@@ -4418,7 +4929,8 @@ async function initHandlerOptions(route, opts) {
       valBuildUrl,
       apiKey: maybeApiKey,
       valSecret: maybeValSecret,
-      project: maybeValProject
+      project: maybeValProject,
+      config
     };
   }
 }
@@ -4587,12 +5099,25 @@ function createValApiRouter(route, valServerPromise, convert) {
           }
         };
       }
-      const bodyRes = reqDefinition.body ? reqDefinition.body.safeParse(await req.json()) : {
-        success: true,
-        data: {}
-      };
-      if (!bodyRes.success) {
-        return zodErrorResult(bodyRes.error, "invalid body data");
+      let bodyRes;
+      try {
+        bodyRes = reqDefinition.body ? reqDefinition.body.safeParse(await req.json()) : {
+          success: true,
+          data: {}
+        };
+        if (!bodyRes.success) {
+          return zodErrorResult(bodyRes.error, "invalid body data");
+        }
+      } catch (e) {
+        return {
+          status: 400,
+          json: {
+            message: "Could not parse request body",
+            details: {
+              error: JSON.stringify(e)
+            }
+          }
+        };
       }
       const cookiesRes = reqDefinition.cookies ? getCookies(req, reqDefinition.cookies) : {
         success: true,
@@ -4623,7 +5148,7 @@ function createValApiRouter(route, valServerPromise, convert) {
           }
           // convert boolean to union of literals true and false so we can parse it as a string
           if (innerType instanceof z.z.ZodBoolean) {
-            innerType = z.z.union([z.z.literal("true"), z.z.literal("false")]).transform(arg => Boolean(arg));
+            innerType = z.z.union([z.z.literal("true"), z.z.literal("false")]).transform(arg => arg === "true");
           }
           // re-build rules:
           let arrayCompatibleRule = innerType;
@@ -4648,6 +5173,15 @@ function createValApiRouter(route, valServerPromise, convert) {
         query,
         path
       });
+      if (res.status === 500) {
+        var _res$json;
+        return {
+          status: 500,
+          json: {
+            message: ((_res$json = res.json) === null || _res$json === void 0 ? void 0 : _res$json.message) || "Internal Server Error"
+          }
+        };
+      }
       const resDef = apiEndpoint.res;
       if (resDef) {
         const responseResult = resDef.safeParse(res);
@@ -4744,6 +5278,49 @@ class ValFSHost {
   }
 }
 
+async function extractImageMetadata(filename, input) {
+  const imageSize = sizeOf__default["default"](input);
+  let mimeType = null;
+  if (imageSize.type) {
+    const possibleMimeType = `image/${imageSize.type}`;
+    if (core.Internal.MIME_TYPES_TO_EXT[possibleMimeType]) {
+      mimeType = possibleMimeType;
+    }
+    const filenameBasedLookup = core.Internal.filenameToMimeType(filename);
+    if (filenameBasedLookup) {
+      mimeType = filenameBasedLookup;
+    }
+  }
+  if (!mimeType) {
+    mimeType = "application/octet-stream";
+  }
+  let {
+    width,
+    height
+  } = imageSize;
+  if (!width || !height) {
+    width = 0;
+    height = 0;
+  }
+  return {
+    width,
+    height,
+    mimeType
+  };
+}
+async function extractFileMetadata(filename,
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_input // TODO: use buffer to determine mimetype
+) {
+  let mimeType = core.Internal.filenameToMimeType(filename);
+  if (!mimeType) {
+    mimeType = "application/octet-stream";
+  }
+  return {
+    mimeType
+  };
+}
+
 function getValidationErrorFileRef(validationError) {
   const maybeRef = validationError.value && typeof validationError.value === "object" && core.FILE_REF_PROP in validationError.value && typeof validationError.value[core.FILE_REF_PROP] === "string" ? validationError.value[core.FILE_REF_PROP] : undefined;
   if (!maybeRef) {
@@ -4771,15 +5348,15 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
       throw Error("Cannot fix file without a file reference");
     }
     const filename = fsPath__namespace["default"].join(config.projectRoot, fileRef);
-    const buffer = fs__default["default"].readFileSync(filename);
-    return extractFileMetadata(fileRef, buffer);
+    fs__default["default"].readFileSync(filename);
+    return extractFileMetadata(fileRef);
   }
   const remainingErrors = [];
   const patch$1 = [];
   for (const fix of validationError.fixes || []) {
     if (fix === "image:replace-metadata" || fix === "image:add-metadata") {
       const imageMetadata = await getImageMetadata();
-      if (imageMetadata.width === undefined || imageMetadata.height === undefined || imageMetadata.sha256 === undefined) {
+      if (imageMetadata.width === undefined || imageMetadata.height === undefined) {
         remainingErrors.push({
           ...validationError,
           message: "Failed to get image metadata",
@@ -4790,8 +5367,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
         const metadataIsCorrect =
         // metadata is a prop that is an object
         typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object" &&
-        // sha256 is correct
-        "sha256" in currentValue.metadata && currentValue.metadata.sha256 === imageMetadata.sha256 &&
         // width is correct
         "width" in currentValue.metadata && currentValue.metadata.width === imageMetadata.width &&
         // height is correct
@@ -4808,18 +5383,11 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
               value: {
                 width: imageMetadata.width,
                 height: imageMetadata.height,
-                sha256: imageMetadata.sha256,
                 mimeType: imageMetadata.mimeType
               }
             });
           } else {
             if (typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object") {
-              if (!("sha256" in currentValue.metadata) || currentValue.metadata.sha256 !== imageMetadata.sha256) {
-                remainingErrors.push({
-                  message: "Image metadata sha256 is incorrect! Found: " + ("sha256" in currentValue.metadata ? currentValue.metadata.sha256 : "<empty>") + ". Expected: " + imageMetadata.sha256 + ".",
-                  fixes: undefined
-                });
-              }
               if (!("width" in currentValue.metadata) || currentValue.metadata.width !== imageMetadata.width) {
                 remainingErrors.push({
                   message: "Image metadata width is incorrect! Found: " + ("width" in currentValue.metadata ? currentValue.metadata.width : "<empty>") + ". Expected: " + imageMetadata.width,
@@ -4854,14 +5422,13 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
           value: {
             width: imageMetadata.width,
             height: imageMetadata.height,
-            sha256: imageMetadata.sha256,
             mimeType: imageMetadata.mimeType
           }
         });
       }
     } else if (fix === "file:add-metadata" || fix === "file:check-metadata") {
       const fileMetadata = await getFileMetadata();
-      if (fileMetadata.sha256 === undefined) {
+      if (fileMetadata === undefined) {
         remainingErrors.push({
           ...validationError,
           message: "Failed to get image metadata",
@@ -4872,8 +5439,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
         const metadataIsCorrect =
         // metadata is a prop that is an object
         typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object" &&
-        // sha256 is correct
-        "sha256" in currentValue.metadata && currentValue.metadata.sha256 === fileMetadata.sha256 &&
         // mimeType is correct
         "mimeType" in currentValue.metadata && currentValue.metadata.mimeType === fileMetadata.mimeType;
 
@@ -4884,7 +5449,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
               op: "replace",
               path: patch.sourceToPatchPath(sourcePath).concat("metadata"),
               value: {
-                sha256: fileMetadata.sha256,
                 ...(fileMetadata.mimeType ? {
                   mimeType: fileMetadata.mimeType
                 } : {})
@@ -4892,12 +5456,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
             });
           } else {
             if (typeof currentValue === "object" && currentValue && "metadata" in currentValue && currentValue.metadata && typeof currentValue.metadata === "object") {
-              if (!("sha256" in currentValue.metadata) || currentValue.metadata.sha256 !== fileMetadata.sha256) {
-                remainingErrors.push({
-                  message: "File metadata sha256 is incorrect! Found: " + ("sha256" in currentValue.metadata ? currentValue.metadata.sha256 : "<empty>") + ". Expected: " + fileMetadata.sha256 + ".",
-                  fixes: undefined
-                });
-              }
               if (!("mimeType" in currentValue.metadata) || currentValue.metadata.mimeType !== fileMetadata.mimeType) {
                 remainingErrors.push({
                   message: "File metadata mimeType is incorrect! Found: " + ("mimeType" in currentValue.metadata ? currentValue.metadata.mimeType : "<empty>") + ". Expected: " + fileMetadata.mimeType,
@@ -4918,7 +5476,6 @@ async function createFixPatch(config, apply, sourcePath, validationError) {
           op: "add",
           path: patch.sourceToPatchPath(sourcePath).concat("metadata"),
           value: {
-            sha256: fileMetadata.sha256,
             ...(fileMetadata.mimeType ? {
               mimeType: fileMetadata.mimeType
             } : {})