@valbuild/server 0.97.7 → 0.99.0

package/dist/valbuild-server.cjs.prod.js

@@ -13,12 +13,13 @@ var node_module = require('node:module');
 var internal = require('@valbuild/shared/internal');
 var server = require('@valbuild/ui/server');
 var crypto$1 = require('crypto');
-var zod = require('zod');
+var z = require('zod');
 var sizeOf = require('image-size');
 var zodValidationError = require('zod-validation-error');
 var sucrase = require('sucrase');
 var http = require('http');
 var https = require('https');
+var fs$1 = require('fs/promises');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
 
@@ -45,9 +46,11 @@ var path__namespace = /*#__PURE__*/_interopNamespace(path);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
 var vm__default = /*#__PURE__*/_interopDefault(vm);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto$1);
+var z__default = /*#__PURE__*/_interopDefault(z);
 var sizeOf__default = /*#__PURE__*/_interopDefault(sizeOf);
 var http__default = /*#__PURE__*/_interopDefault(http);
 var https__default = /*#__PURE__*/_interopDefault(https);
+var fs__default$1 = /*#__PURE__*/_interopDefault(fs$1);
 
 class ValSyntaxError {
   constructor(message, node) {
@@ -957,6 +960,15 @@ const getCompilerOptions = (rootDir, parseConfigHost) => {
   return parsedConfigFile.options;
 };
 
+/**
+ * The filesystem seam `loadValModules` reads through.
+ *
+ * Defaults to `ts.sys`, i.e. the real filesystem. An editor integration (see
+ * `@valbuild/language-server`) passes a host that overlays unsaved buffers, so
+ * that evaluation sees what the user is looking at rather than what was last
+ * saved.
+ */
+
 /**
  * Loads the project's root `val.modules.ts` (or `.js`) using Node's `vm`
  * module and returns its default export (a `ValModules` registry).
@@ -978,24 +990,24 @@ const getCompilerOptions = (rootDir, parseConfigHost) => {
  * same trust level as running the project's build. It must never be used to
  * evaluate untrusted or third-party modules.
  */
-function loadValModules(projectRoot) {
-  const valModulesPath = findValModulesPath(projectRoot);
+function loadValModules(projectRoot, host = ts__default["default"].sys) {
+  const valModulesPath = findValModulesPath(projectRoot, host);
   if (!valModulesPath) {
     throw Error(`Could not find 'val.modules.ts' nor 'val.modules.js' in project root: '${projectRoot}'`);
   }
-  const compilerOptions = getCompilerOptions(projectRoot, ts__default["default"].sys);
+  const compilerOptions = getCompilerOptions(projectRoot, host);
   const cache = {};
-  const loaded = loadModule(valModulesPath, cache, compilerOptions);
+  const loaded = loadModule(valModulesPath, cache, compilerOptions, host);
   const valModules = loaded.exports.default;
   if (!valModules) {
     throw Error(`Val modules file at path: '${valModulesPath}' must have a default export. Got: ${valModules}`);
   }
   return valModules;
 }
-function findValModulesPath(projectRoot) {
+function findValModulesPath(projectRoot, host) {
   for (const fileName of ["val.modules.ts", "val.modules.js"]) {
     const candidate = path__namespace["default"].join(projectRoot, fileName);
-    if (fs__default["default"].existsSync(candidate)) {
+    if (host.fileExists(candidate)) {
       return candidate;
     }
   }
@@ -1036,12 +1048,15 @@ function makeStub(spec) {
   const stub = new Proxy({}, handler);
   return stub;
 }
-function loadModule(absPath, cache, compilerOptions) {
+function loadModule(absPath, cache, compilerOptions, host) {
   const cached = cache[absPath];
   if (cached) {
     return cached;
   }
-  const code = fs__default["default"].readFileSync(absPath, "utf-8");
+  const code = host.readFile(absPath);
+  if (code === undefined) {
+    throw Error(`Could not read Val module file: '${absPath}'`);
+  }
   const transpiled = ts__default["default"].transpileModule(code, {
     compilerOptions: {
       target: ts__default["default"].ScriptTarget.ES2020,
@@ -1064,17 +1079,17 @@ function loadModule(absPath, cache, compilerOptions) {
       return makeStub(spec);
     }
     if (spec.startsWith(".") || path__namespace["default"].isAbsolute(spec)) {
-      const resolved = resolveRelative(dirName, spec);
+      const resolved = resolveRelative(dirName, spec, host);
       if (!resolved) {
         throw Error(`Could not resolve module '${spec}' from '${absPath}'`);
       }
-      return loadModule(resolved, cache, compilerOptions).exports;
+      return loadModule(resolved, cache, compilerOptions, host).exports;
     }
     // Non-relative specifier: it might be a tsconfig path alias (e.g. "_/val.config")
     // pointing at a local source file, or an actual node_modules package.
-    const tsResolved = (_ts$resolveModuleName = ts__default["default"].resolveModuleName(spec, absPath, compilerOptions, ts__default["default"].sys).resolvedModule) === null || _ts$resolveModuleName === void 0 ? void 0 : _ts$resolveModuleName.resolvedFileName;
+    const tsResolved = (_ts$resolveModuleName = ts__default["default"].resolveModuleName(spec, absPath, compilerOptions, host).resolvedModule) === null || _ts$resolveModuleName === void 0 ? void 0 : _ts$resolveModuleName.resolvedFileName;
     if (tsResolved && !tsResolved.includes("/node_modules/") && !tsResolved.endsWith(".d.ts")) {
-      return loadModule(tsResolved, cache, compilerOptions).exports;
+      return loadModule(tsResolved, cache, compilerOptions, host).exports;
     }
     // Real node_modules package – use the real require so user modules share
     // the same @valbuild/core instance as extractValModules.
@@ -1100,24 +1115,25 @@ function loadModule(absPath, cache, compilerOptions) {
   script.runInContext(context);
   return moduleObj;
 }
-function resolveRelative(dirName, spec) {
+function resolveRelative(dirName, spec, host) {
+  var _host$directoryExists;
   const base = path__namespace["default"].resolve(dirName, spec);
   // Exact file (with extension)
-  if (fs__default["default"].existsSync(base) && fs__default["default"].statSync(base).isFile()) {
+  if (host.fileExists(base)) {
     return base;
   }
   // Probe extensions (handles `./x.val` -> `./x.val.ts`)
   for (const ext of RESOLVE_EXTENSIONS) {
     const candidate = base + ext;
-    if (fs__default["default"].existsSync(candidate)) {
+    if (host.fileExists(candidate)) {
       return candidate;
     }
   }
   // Directory index
-  if (fs__default["default"].existsSync(base) && fs__default["default"].statSync(base).isDirectory()) {
+  if (((_host$directoryExists = host.directoryExists) === null || _host$directoryExists === void 0 ? void 0 : _host$directoryExists.call(host, base)) ?? fs__default["default"].existsSync(base)) {
     for (const ext of RESOLVE_EXTENSIONS) {
       const candidate = path__namespace["default"].join(base, "index" + ext);
-      if (fs__default["default"].existsSync(candidate)) {
+      if (host.fileExists(candidate)) {
         return candidate;
       }
     }
@@ -1144,7 +1160,9 @@ async function createService(projectRoot, host = {
 }) {
   const compilerOptions = getCompilerOptions(projectRoot, host);
   const sourceFileHandler = new ValSourceFileHandler(projectRoot, compilerOptions, host);
-  const valModules = loadValModules(projectRoot);
+  // Read val.modules (and everything it imports) through the same host, so an
+  // embedder that overlays unsaved editor buffers evaluates what the user sees.
+  const valModules = loadValModules(projectRoot, host);
   const extracted = await core.extractValModules(valModules);
   return new Service(projectRoot, sourceFileHandler, extracted);
 }
@@ -1254,9 +1272,9 @@ function decodeJwt(token, secretKey) {
 function getExpire() {
   return Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 4; // 4 days
 }
-const JwtHeaderSchema = zod.z.object({
-  alg: zod.z.literal("HS256"),
-  typ: zod.z.literal("JWT")
+const JwtHeaderSchema = z.z.object({
+  alg: z.z.literal("HS256"),
+  typ: z.z.literal("JWT")
 });
 const jwtHeader = {
   alg: "HS256",
@@ -2271,9 +2289,9 @@ class ValOpsFS extends ValOps {
       });
       if (res.ok) {
         const json = await res.json();
-        const parsed = zod.z.object({
-          nonce: zod.z.string(),
-          expiresAt: zod.z.string()
+        const parsed = z.z.object({
+          nonce: z.z.string(),
+          expiresAt: z.z.string()
         }).safeParse(json);
         if (parsed.success) {
           return {
@@ -2834,7 +2852,7 @@ class ValOpsFS extends ValOps {
         }]
       };
     }
-    const metadataParseRes = this.parseJsonFile(metadataFilePath, zod.z.record(zod.z.string(), zod.z.union([zod.z.string(), zod.z.number()])));
+    const metadataParseRes = this.parseJsonFile(metadataFilePath, z.z.record(z.z.string(), z.z.union([z.z.string(), z.z.number()])));
     if (metadataParseRes.error) {
       return {
         errors: [metadataParseRes.error]
@@ -3240,121 +3258,121 @@ class FSOpsHost {
     fs__default["default"].copyFileSync(from, to);
   }
 }
-const FSPatch = zod.z.object({
-  path: zod.z.string().refine(p => p.startsWith("/") && p.includes(".val."), "Path is not valid. Must start with '/' and include '.val.'"),
+const FSPatch = z.z.object({
+  path: z.z.string().refine(p => p.startsWith("/") && p.includes(".val."), "Path is not valid. Must start with '/' and include '.val.'"),
   patch: internal.Patch,
-  patchId: zod.z.string(),
-  baseSha: zod.z.string(),
+  patchId: z.z.string(),
+  baseSha: z.z.string(),
   parentRef: internal.ParentRef,
-  authorId: zod.z.string().refine(p => true).nullable(),
-  createdAt: zod.z.string().datetime(),
-  coreVersion: zod.z.string().nullable(),
+  authorId: z.z.string().refine(p => true).nullable(),
+  createdAt: z.z.string().datetime(),
+  coreVersion: z.z.string().nullable(),
   // TODO: use this to check if patch is compatible with current core version?
-  sessionId: zod.z.string().nullable()
+  sessionId: z.z.string().nullable()
 });
-const FSPatchBase = zod.z.object({
-  baseSha: zod.z.string().refine(p => true),
-  timestamp: zod.z.string().datetime()
+const FSPatchBase = z.z.object({
+  baseSha: z.z.string().refine(p => true),
+  timestamp: z.z.string().datetime()
 });
 
 const textEncoder$1 = new TextEncoder();
-const PatchId = zod.z.string().refine(s => !!s); // TODO: validate
-const CommitSha = zod.z.string().refine(s => !!s); // TODO: validate
-zod.z.string().refine(s => !!s); // TODO: validate
-zod.z.string().refine(s => !!s); // TODO: validate
-const ModuleFilePath = zod.z.string().refine(s => !!s); // TODO: validate
-const Metadata = zod.z.union([zod.z.object({
-  mimeType: zod.z.string(),
-  width: zod.z.number(),
-  height: zod.z.number()
-}), zod.z.object({
-  mimeType: zod.z.string()
+const PatchId = z.z.string().refine(s => !!s); // TODO: validate
+const CommitSha = z.z.string().refine(s => !!s); // TODO: validate
+z.z.string().refine(s => !!s); // TODO: validate
+z.z.string().refine(s => !!s); // TODO: validate
+const ModuleFilePath = z.z.string().refine(s => !!s); // TODO: validate
+const Metadata = z.z.union([z.z.object({
+  mimeType: z.z.string(),
+  width: z.z.number(),
+  height: z.z.number()
+}), z.z.object({
+  mimeType: z.z.string()
 })]);
-const MetadataRes = zod.z.object({
+const MetadataRes = z.z.object({
   filePath: ModuleFilePath,
   metadata: Metadata,
-  type: zod.z.union([zod.z.literal("file"), zod.z.literal("image")]).nullable()
+  type: z.z.union([z.z.literal("file"), z.z.literal("image")]).nullable()
 });
-const SummaryResponse = zod.z.object({
-  commitSummary: zod.z.string()
+const SummaryResponse = z.z.object({
+  commitSummary: z.z.string()
 });
-const GetApplicablePatches = zod.z.object({
-  patches: zod.z.array(zod.z.object({
-    path: zod.z.string(),
+const GetApplicablePatches = z.z.object({
+  patches: z.z.array(z.z.object({
+    path: z.z.string(),
     patch: internal.Patch.nullable(),
-    patchId: zod.z.string(),
-    authorId: zod.z.string().nullable(),
-    baseSha: zod.z.string(),
-    createdAt: zod.z.string(),
-    applied: zod.z.object({
-      commitSha: zod.z.string()
+    patchId: z.z.string(),
+    authorId: z.z.string().nullable(),
+    baseSha: z.z.string(),
+    createdAt: z.z.string(),
+    applied: z.z.object({
+      commitSha: z.z.string()
     }).nullable()
   })),
-  commits: zod.z.array(zod.z.object({
-    commitSha: zod.z.string(),
-    clientCommitSha: zod.z.string(),
-    parentCommitSha: zod.z.string(),
-    commitMessage: zod.z.string().nullable(),
-    branch: zod.z.string(),
-    creator: zod.z.string(),
-    createdAt: zod.z.string()
+  commits: z.z.array(z.z.object({
+    commitSha: z.z.string(),
+    clientCommitSha: z.z.string(),
+    parentCommitSha: z.z.string(),
+    commitMessage: z.z.string().nullable(),
+    branch: z.z.string(),
+    creator: z.z.string(),
+    createdAt: z.z.string()
   })).optional(),
-  deployments: zod.z.array(zod.z.object({
-    deploymentId: zod.z.string(),
-    commitSha: zod.z.string(),
-    deploymentState: zod.z.string(),
-    createdAt: zod.z.string(),
-    updatedAt: zod.z.string()
+  deployments: z.z.array(z.z.object({
+    deploymentId: z.z.string(),
+    commitSha: z.z.string(),
+    deploymentState: z.z.string(),
+    createdAt: z.z.string(),
+    updatedAt: z.z.string()
   })).optional()
 });
-const FilesResponse = zod.z.object({
-  files: zod.z.array(zod.z.union([zod.z.object({
-    filePath: zod.z.string(),
-    location: zod.z.literal("patch"),
+const FilesResponse = z.z.object({
+  files: z.z.array(z.z.union([z.z.object({
+    filePath: z.z.string(),
+    location: z.z.literal("patch"),
     patchId: PatchId,
-    value: zod.z.string(),
-    remote: zod.z.boolean()
-  }), zod.z.object({
-    filePath: zod.z.string(),
-    location: zod.z.literal("repo"),
+    value: z.z.string(),
+    remote: z.z.boolean()
+  }), z.z.object({
+    filePath: z.z.string(),
+    location: z.z.literal("repo"),
     commitSha: CommitSha,
-    value: zod.z.string()
+    value: z.z.string()
   })])),
-  errors: zod.z.array(zod.z.union([zod.z.object({
-    filePath: zod.z.string(),
-    location: zod.z.literal("patch"),
+  errors: z.z.array(z.z.union([z.z.object({
+    filePath: z.z.string(),
+    location: z.z.literal("patch"),
     patchId: PatchId,
-    message: zod.z.string(),
-    remote: zod.z.boolean()
-  }), zod.z.object({
-    filePath: zod.z.string(),
-    location: zod.z.literal("repo"),
+    message: z.z.string(),
+    remote: z.z.boolean()
+  }), z.z.object({
+    filePath: z.z.string(),
+    location: z.z.literal("repo"),
     commitSha: CommitSha,
-    message: zod.z.string()
+    message: z.z.string()
   })])).optional()
 });
-const SavePatchResponse = zod.z.object({
+const SavePatchResponse = z.z.object({
   patchId: PatchId
 });
-const DeletePatchesResponse = zod.z.object({
-  deleted: zod.z.array(PatchId),
-  errors: zod.z.array(zod.z.object({
-    message: zod.z.string(),
+const DeletePatchesResponse = z.z.object({
+  deleted: z.z.array(PatchId),
+  errors: z.z.array(z.z.object({
+    message: z.z.string(),
     patchId: PatchId
   })).optional()
 });
-const SavePatchFileResponse = zod.z.object({
+const SavePatchFileResponse = z.z.object({
   patchId: PatchId,
   filePath: ModuleFilePath
 });
-const CommitResponse = zod.z.object({
-  updatedFiles: zod.z.array(zod.z.string()),
+const CommitResponse = z.z.object({
+  updatedFiles: z.z.array(z.z.string()),
   commit: CommitSha,
-  branch: zod.z.string()
+  branch: z.z.string()
 });
-const NonceResponse = zod.z.object({
-  nonce: zod.z.string(),
-  url: zod.z.string()
+const NonceResponse = z.z.object({
+  nonce: z.z.string(),
+  url: z.z.string()
 });
 class ValOpsHttp extends ValOps {
   constructor(contentUrl, project, commitSha,
@@ -3397,9 +3415,9 @@ class ValOpsHttp extends ValOps {
       });
       if (res.ok) {
         const json = await res.json();
-        const parsed = zod.z.object({
-          nonce: zod.z.string(),
-          expiresAt: zod.z.string()
+        const parsed = z.z.object({
+          nonce: z.z.string(),
+          expiresAt: z.z.string()
         }).safeParse(json);
         if (parsed.success) {
           const {
@@ -4238,8 +4256,8 @@ class ValOpsHttp extends ValOps {
         };
       }
       if ((_res$headers$get5 = res.headers.get("Content-Type")) !== null && _res$headers$get5 !== void 0 && _res$headers$get5.includes("application/json")) {
-        const json = zod.z.object({
-          isNotFastForward: zod.z.boolean().optional()
+        const json = z.z.object({
+          isNotFastForward: z.z.boolean().optional()
         }).safeParse(await res.json());
         if (json.success && json.data.isNotFastForward) {
           return {
@@ -4272,10 +4290,10 @@ class ValOpsHttp extends ValOps {
 }
 
 const host = process.env.VAL_CONTENT_URL || core.DEFAULT_CONTENT_HOST;
-const SettingsSchema = zod.z.object({
-  publicProjectId: zod.z.string(),
-  remoteFileBuckets: zod.z.array(zod.z.object({
-    bucket: zod.z.string()
+const SettingsSchema = z.z.object({
+  publicProjectId: z.z.string(),
+  remoteFileBuckets: z.z.array(z.z.object({
+    bucket: z.z.string()
   }))
 });
 async function getSettings(projectName, auth) {
@@ -4421,21 +4439,21 @@ function hasRemoteFileSchema(schema) {
 
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const ValServer = (valModules, options, callbacks) => {
-  const AIContentBlock = zod.z.union([zod.z.object({
-    type: zod.z.literal("text"),
-    text: zod.z.string()
-  }), zod.z.object({
-    type: zod.z.literal("image_url"),
-    url: zod.z.string()
+  const AIContentBlock = z.z.union([z.z.object({
+    type: z.z.literal("text"),
+    text: z.z.string()
+  }), z.z.object({
+    type: z.z.literal("image_url"),
+    url: z.z.string()
   })]);
-  const AIMessageContent = zod.z.union([zod.z.string(), zod.z.array(AIContentBlock)]);
-  const ProfilesResponse = zod.z.object({
-    profiles: zod.z.array(zod.z.object({
-      profileId: zod.z.string(),
-      fullName: zod.z.string(),
-      email: zod.z.string().optional(),
-      avatar: zod.z.object({
-        url: zod.z.string()
+  const AIMessageContent = z.z.union([z.z.string(), z.z.array(AIContentBlock)]);
+  const ProfilesResponse = z.z.object({
+    profiles: z.z.array(z.z.object({
+      profileId: z.z.string(),
+      fullName: z.z.string(),
+      email: z.z.string().optional(),
+      avatar: z.z.object({
+        url: z.z.string()
       }).nullable()
     }))
   });
@@ -4942,12 +4960,12 @@ const ValServer = (valModules, options, callbacks) => {
             headers: getAuthHeaders(data.token, "application/json")
           });
           if (fetchRes.status === 200) {
-            const json = zod.z.object({
-              member_role: zod.z.union([zod.z.literal("owner"), zod.z.literal("developer"), zod.z.literal("editor")]).optional(),
-              id: zod.z.string(),
-              full_name: zod.z.string().optional(),
-              username: zod.z.string().optional(),
-              avatar_url: zod.z.string().optional()
+            const json = z.z.object({
+              member_role: z.z.union([z.z.literal("owner"), z.z.literal("developer"), z.z.literal("editor")]).optional(),
+              id: z.z.string(),
+              full_name: z.z.string().optional(),
+              username: z.z.string().optional(),
+              avatar_url: z.z.string().optional()
             }).safeParse(await fetchRes.json());
             if (json.success) {
               return {
@@ -4969,8 +4987,8 @@ const ValServer = (valModules, options, callbacks) => {
               };
             }
           } else {
-            const json = zod.z.object({
-              message: zod.z.string()
+            const json = z.z.object({
+              message: z.z.string()
             }).safeParse(await fetchRes.json());
             const message = internal.getErrorMessageFromUnknownJson(json, "Unknown error");
             return {
@@ -5832,8 +5850,8 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        const PostSaveBody = zod.z.object({
-          patchIds: zod.z.array(zod.z.string().refine(id => true // TODO:
+        const PostSaveBody = z.z.object({
+          patchIds: z.z.array(z.z.string().refine(id => true // TODO:
           ))
         });
         const bodyRes = PostSaveBody.safeParse(body);
@@ -6069,16 +6087,16 @@ const ValServer = (valModules, options, callbacks) => {
         const authData = authDataRes.json.remoteFileAuth;
         const execFetch = async headers => {
           try {
-            const SessionsResponse = zod.z.object({
-              sessions: zod.z.array(zod.z.object({
-                id: zod.z.string(),
-                name: zod.z.string().nullable(),
-                createdAt: zod.z.string(),
-                updatedAt: zod.z.string()
+            const SessionsResponse = z.z.object({
+              sessions: z.z.array(z.z.object({
+                id: z.z.string(),
+                name: z.z.string().nullable(),
+                createdAt: z.z.string(),
+                updatedAt: z.z.string()
               })),
-              nextCursor: zod.z.object({
-                updatedAt: zod.z.string(),
-                id: zod.z.string()
+              nextCursor: z.z.object({
+                updatedAt: z.z.string(),
+                id: z.z.string()
               }).nullable().optional()
             });
             const params = new URLSearchParams();
@@ -6269,14 +6287,14 @@ const ValServer = (valModules, options, callbacks) => {
         const authData = authDataRes.json.remoteFileAuth;
         const execFetch = async headers => {
           try {
-            const SessionMessagesResponse = zod.z.object({
-              messages: zod.z.array(zod.z.object({
-                role: zod.z.string(),
+            const SessionMessagesResponse = z.z.object({
+              messages: z.z.array(z.z.object({
+                role: z.z.string(),
                 content: AIMessageContent
               })),
-              nextCursor: zod.z.object({
-                updatedAt: zod.z.string(),
-                id: zod.z.string()
+              nextCursor: z.z.object({
+                updatedAt: z.z.string(),
+                id: z.z.string()
               }).nullable().optional()
             });
             const params = new URLSearchParams();
@@ -6425,14 +6443,14 @@ const ValServer = (valModules, options, callbacks) => {
               };
             }
             const rawUpstreamJson = await upstreamRes.json();
-            const UpstreamResponse = zod.z.object({
-              patchId: zod.z.string(),
-              files: zod.z.array(zod.z.object({
-                filePath: zod.z.string(),
-                metadata: zod.z.object({
-                  width: zod.z.number(),
-                  height: zod.z.number(),
-                  mimeType: zod.z.string()
+            const UpstreamResponse = z.z.object({
+              patchId: z.z.string(),
+              files: z.z.array(z.z.object({
+                filePath: z.z.string(),
+                metadata: z.z.object({
+                  width: z.z.number(),
+                  height: z.z.number(),
+                  mimeType: z.z.string()
                 })
               }))
             });
@@ -6591,8 +6609,8 @@ const ValServer = (valModules, options, callbacks) => {
                 }
               };
             }
-            const UpstreamResponse = zod.z.object({
-              key: zod.z.string()
+            const UpstreamResponse = z.z.object({
+              key: z.z.string()
             });
             const json = UpstreamResponse.safeParse(await upstreamRes.json());
             if (!json.success) {
@@ -6775,18 +6793,18 @@ function getStateFromCookie(stateCookie) {
 function createStateCookie(state) {
   return Buffer.from(JSON.stringify(state), "utf8").toString("base64");
 }
-const ValAppJwtPayload = zod.z.object({
-  sub: zod.z.string(),
-  exp: zod.z.number(),
-  project: zod.z.string(),
-  org: zod.z.string()
+const ValAppJwtPayload = z.z.object({
+  sub: z.z.string(),
+  exp: z.z.number(),
+  project: z.z.string(),
+  org: z.z.string()
 });
-const IntegratedServerJwtPayload = zod.z.object({
-  sub: zod.z.string(),
-  exp: zod.z.number(),
-  token: zod.z.string(),
-  org: zod.z.string(),
-  project: zod.z.string()
+const IntegratedServerJwtPayload = z.z.object({
+  sub: z.z.string(),
+  exp: z.z.number(),
+  token: z.z.string(),
+  org: z.z.string(),
+  project: z.z.string()
 });
 async function withAuth(secret, cookies, errorMessageType, handler) {
   const cookie = cookies[internal.VAL_SESSION_COOKIE];
@@ -7282,7 +7300,7 @@ function createValApiRouter(route, valServerPromise, convert) {
       let query = {};
       if (reqDefinition.query) {
         const queryRules = reqDefinition.query;
-        const queryRes = zod.z.object(queryRules).safeParse(actualQueryParams);
+        const queryRes = z.z.object(queryRules).safeParse(actualQueryParams);
         if (!queryRes.success) {
           return zodErrorResult(queryRes.error, `invalid query params: (${JSON.stringify(actualQueryParams)})`);
         }
@@ -7356,7 +7374,7 @@ function getCookies(req, cookiesDef) {
       input[name.trim()] = value;
     }
   }
-  return zod.z.object(cookiesDef).safeParse(input);
+  return z.z.object(cookiesDef).safeParse(input);
 }
 
 const JsFileLookupMapping = [
@@ -7760,6 +7778,33 @@ async function downloadFileFromRemote(ref, filePath) {
 // record-level fix expands into per-entry errors that should point at the
 // individual entry (e.g. `?p="/public/val/logo.png"`) rather than the record.
 
+// Gallery entries are keyed by their file path. Remote galleries key uploaded
+// entries by a remote URL while keeping the file on disk at its local path, so
+// normalize a remote-URL key back to that local path for on-disk reads.
+function galleryKeyToLocalPath(key) {
+  const res = core.Internal.remote.splitRemoteRef(key);
+  return res.status === "success" ? `/${res.filePath}` : key;
+}
+
+// Patch path of the record that holds a media entry. Media keys are file paths
+// that can contain dots, which sourceToPatchPath cannot round-trip, so strip
+// the (JSON-encoded) key segment off the entry source path and convert the
+// remaining parent path — whose ancestors are plain object keys / array
+// indices — instead.
+function parentPatchPathOfMediaEntry(sourcePath, entryKey) {
+  const jsonKey = JSON.stringify(entryKey);
+  let parent = sourcePath;
+  if (parent.endsWith(jsonKey)) {
+    parent = parent.slice(0, parent.length - jsonKey.length);
+  }
+  if (parent.endsWith(".")) {
+    parent = parent.slice(0, -1);
+  } else if (parent.endsWith(core.Internal.ModuleFilePathSep)) {
+    parent = parent.slice(0, parent.length - core.Internal.ModuleFilePathSep.length);
+  }
+  return patch.sourceToPatchPath(parent);
+}
+
 // TODO: find a better name? transformFixesToPatch?
 async function createFixPatch(config, apply, sourcePath, validationError, remoteFiles, moduleSource, moduleSchema) {
   const remainingErrors = [];
@@ -7937,6 +7982,61 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           path: patch.sourceToPatchPath(sourcePath)
         });
       }
+    } else if (fix === "images:upload-remote" || fix === "files:upload-remote") {
+      // Gallery entry: the record is keyed by the file path, so uploading to
+      // remote means renaming the key from the local path to the remote URL
+      // (remove the old key, add the new one with the same metadata).
+      const remoteFile = remoteFiles[sourcePath];
+      if (!remoteFile) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot fix local to remote gallery entry: remote file was not uploaded",
+          fixes: undefined
+        });
+        continue;
+      }
+      const metadata = remoteFile.metadata;
+      if (!metadata) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Failed to get metadata for remote gallery file",
+          fixes: undefined
+        });
+        continue;
+      }
+      // The entry is keyed by its (local) file path, which can contain dots
+      // (e.g. image.png). sourceToPatchPath can't round-trip such keys, so
+      // build the patch path from the parent record path plus the key (which
+      // validateMediaKey carries as the error value), like the UI does.
+      const entryKey = validationError.value;
+      if (typeof entryKey !== "string") {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry: missing entry key",
+          fixes: undefined
+        });
+        continue;
+      }
+      const parentPath = parentPatchPathOfMediaEntry(sourcePath, entryKey);
+      const removePath = parentPath.concat(entryKey);
+      const addPath = parentPath.concat(remoteFile.ref);
+      if (!patch.isNotRoot(removePath) || !patch.isNotRoot(addPath)) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry at root path",
+          fixes: undefined
+        });
+        continue;
+      }
+      patch$1.push({
+        op: "remove",
+        path: removePath
+      });
+      patch$1.push({
+        op: "add",
+        path: addPath,
+        value: metadata
+      });
     } else if (fix === "image:download-remote" || fix === "file:download-remote") {
       const v = getRemoteValueFromValidationError(validationError);
       if (!v.success) {
@@ -8013,7 +8113,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       }
       const gallerySource = moduleSource;
       for (const [entryKey, storedEntry] of Object.entries(gallerySource)) {
-        const filename = path__namespace["default"].join(config.projectRoot, entryKey);
+        const filename = path__namespace["default"].join(config.projectRoot, galleryKeyToLocalPath(entryKey));
         let buffer;
         try {
           buffer = fs__default["default"].readFileSync(filename);
@@ -8241,6 +8341,294 @@ async function getFileMetadata(projectRoot, validationError) {
   return extractFileMetadata(fileRef);
 }
 
+function validateMetadata(actualMetadata, expectedMetadata) {
+  const missingMetadata = [];
+  const erroneousMetadata = {};
+  if (typeof actualMetadata !== "object" || actualMetadata === null) {
+    return {
+      globalErrors: ["Metadata is wrong type: must be an object."]
+    };
+  }
+  if (Array.isArray(actualMetadata)) {
+    return {
+      globalErrors: ["Metadata is wrong type: cannot be an array."]
+    };
+  }
+  const recordMetadata = actualMetadata;
+  const globalErrors = [];
+  for (const anyKey in expectedMetadata) {
+    if (typeof anyKey !== "string") {
+      globalErrors.push(`Expected metadata has key '${anyKey}' that is not typeof 'string', but: '${typeof anyKey}'. This is most likely a Val bug.`);
+    } else {
+      if (anyKey in actualMetadata) {
+        const key = anyKey;
+        if (expectedMetadata[key] !== recordMetadata[key]) {
+          erroneousMetadata[key] = `Expected metadata '${key}' to be ${JSON.stringify(expectedMetadata[key])}, but got ${JSON.stringify(recordMetadata[key])}.`;
+        }
+      } else {
+        missingMetadata.push(anyKey);
+      }
+    }
+  }
+  if (globalErrors.length === 0 && missingMetadata.length === 0 && Object.keys(erroneousMetadata).length === 0) {
+    return false;
+  }
+  return {
+    missingMetadata,
+    erroneousMetadata
+  };
+}
+
+/**
+ * NOTE: this is intentionally NOT `SharedValConfig` from `@valbuild/shared`.
+ * That schema requires `files.directory` to be exactly `/public/val`, whereas
+ * this one accepts any path beneath `/public`. Unifying them would change which
+ * configs are accepted, so they are kept separate on purpose.
+ */
+const ValConfigSchema = z__default["default"].object({
+  project: z__default["default"].string().optional(),
+  root: z__default["default"].string().optional(),
+  files: z__default["default"].object({
+    directory: z__default["default"].string().refine(val => (val === "/public" || val.startsWith("/public/") && !val.endsWith("/")) &&
+    // Reject path traversal so the directory cannot escape /public
+    !val.split("/").some(segment => segment === "." || segment === ".."), {
+      message: "files.directory must start with '/public', must not end with '/' and must not contain '.' or '..' segments"
+    })
+  }).optional(),
+  gitCommit: z__default["default"].string().optional(),
+  gitBranch: z__default["default"].string().optional(),
+  defaultTheme: z__default["default"].union([z__default["default"].literal("light"), z__default["default"].literal("dark")]).optional(),
+  ai: z__default["default"].object({
+    commitMessages: z__default["default"].object({
+      disabled: z__default["default"].boolean().optional()
+    }).optional()
+  }).optional()
+});
+
+/**
+ * `ENOENT` (nothing at this path) and `ENOTDIR` (a path segment is a file) both
+ * mean the config file simply is not there.
+ */
+function isFileNotFound(err) {
+  const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+
+/**
+ * Read and evaluate a `val.config.{ts,js}` file from disk.
+ *
+ * Returns `null` if the file does not exist, and throws if it exists but does
+ * not export a valid `config` object.
+ *
+ * Used by the Val CLI and by `@valbuild/language-server`, so that an editor
+ * resolves project config exactly the way the CLI does.
+ */
+async function evalValConfigFile(projectRoot, configFileName) {
+  const valConfigPath = path__namespace["default"].join(projectRoot, configFileName);
+  let code;
+  try {
+    code = await fs__default$1["default"].readFile(valConfigPath, "utf-8");
+  } catch (err) {
+    // A missing file means "this project does not use this config file name",
+    // which callers handle by trying the next candidate. Anything else (no read
+    // permission, an IO error, a directory where a file was expected) is a real
+    // problem and must not be reported as "no config".
+    if (isFileNotFound(err)) {
+      return null;
+    }
+    throw Error(`Could not read Val config file at path: '${valConfigPath}': ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!code.trim()) {
+    return null;
+  }
+  const transpiled = ts__default["default"].transpileModule(code, {
+    compilerOptions: {
+      target: ts__default["default"].ScriptTarget.ES2020,
+      module: ts__default["default"].ModuleKind.CommonJS,
+      esModuleInterop: true
+    },
+    fileName: valConfigPath
+  });
+  const projectRootRequire = node_module.createRequire(valConfigPath);
+  const exportsObj = {};
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const sandbox = {
+    exports: exportsObj,
+    module: {
+      exports: exportsObj
+    },
+    require: projectRootRequire,
+    // NOTE: this is a security risk, but this code is running in the users own environment at the CLI level
+    __filename: valConfigPath,
+    __dirname: projectRoot,
+    console,
+    process
+  };
+  sandbox.global = sandbox;
+  const context = vm__default["default"].createContext(sandbox);
+  const script = new vm__default["default"].Script(transpiled.outputText, {
+    filename: valConfigPath
+  });
+  script.runInContext(context);
+  const valConfig = sandbox.module.exports.config;
+  if (!valConfig) {
+    throw Error(`Val config file at path: '${valConfigPath}' must export a config object. Got: ${valConfig}`);
+  }
+  const result = ValConfigSchema.safeParse(valConfig);
+  if (!result.success) {
+    throw Error(`Val config file at path: '${valConfigPath}' has invalid schema: ${result.error.message}`);
+  }
+  return result.data;
+}
+
+/**
+ * Resolve the project's Val config, trying the TypeScript file first and
+ * falling back to JavaScript. Mirrors what the CLI has always done at each of
+ * its call sites.
+ */
+async function findAndEvalValConfigFile(projectRoot) {
+  return (await evalValConfigFile(projectRoot, "val.config.ts")) || (await evalValConfigFile(projectRoot, "val.config.js"));
+}
+
+/**
+ * The Val login device flow, as reusable primitives.
+ *
+ * The CLI wraps these with terminal output, and `@valbuild/language-server`
+ * wraps them with LSP `window/showDocument` and progress reporting. Neither the
+ * polling nor the token handling is duplicated between them.
+ *
+ * Deliberately no `console` output and no `process.exit`: every failure is a
+ * thrown {@link ValLoginError} so an embedder can decide how to surface it.
+ */
+
+const DEFAULT_LOGIN_HOST = "https://admin.val.build";
+function defaultHost() {
+  return process.env.VAL_BUILD_URL || DEFAULT_LOGIN_HOST;
+}
+class ValLoginError extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "ValLoginError";
+  }
+}
+
+/** A login attempt that is waiting for the user to confirm in a browser. */
+
+/**
+ * Begin a login attempt. The caller is responsible for getting
+ * {@link ValLoginSession.url} in front of the user.
+ */
+async function startValLogin(options = {}) {
+  var _response$headers$get;
+  const host = options.host ?? defaultHost();
+  const response = await fetch(`${host}/api/login`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+  if (response.status >= 500) {
+    const text = await response.text().catch(() => "");
+    throw new ValLoginError("server-error", "An error occurred on the server.", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
+  }
+  if (!((_response$headers$get = response.headers.get("content-type")) !== null && _response$headers$get !== void 0 && _response$headers$get.includes("application/json"))) {
+    const text = await response.text().catch(() => "");
+    throw new ValLoginError("unexpected-content-type", "Unexpected failure while trying to login (content type was not JSON).", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
+  }
+  const json = await response.json();
+  const nonce = json === null || json === void 0 ? void 0 : json.nonce;
+  const url = json === null || json === void 0 ? void 0 : json.url;
+  if (typeof nonce !== "string" || typeof url !== "string") {
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+  }
+  return {
+    nonce,
+    url
+  };
+}
+const DEFAULT_LOGIN_MAX_DURATION = 5 * 60 * 1000; // 5 minutes
+const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+
+/**
+ * Poll until the user confirms the login in their browser.
+ *
+ * Accepts an `AbortSignal` so an editor can cancel the flow when the user
+ * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ */
+async function awaitValLoginConfirmation(nonce, options = {}) {
+  const host = options.host ?? defaultHost();
+  const maxDuration = options.maxDurationMs ?? DEFAULT_LOGIN_MAX_DURATION;
+  const pollInterval = options.pollIntervalMs ?? DEFAULT_LOGIN_POLL_INTERVAL;
+  const now = options.now ?? (() => Date.now());
+  const start = now();
+  while (now() - start < maxDuration) {
+    var _options$signal, _options$signal2;
+    if ((_options$signal = options.signal) !== null && _options$signal !== void 0 && _options$signal.aborted) {
+      throw new ValLoginError("aborted", "Login was cancelled.");
+    }
+    await new Promise(resolve => setTimeout(resolve, pollInterval));
+    if ((_options$signal2 = options.signal) !== null && _options$signal2 !== void 0 && _options$signal2.aborted) {
+      throw new ValLoginError("aborted", "Login was cancelled.");
+    }
+    const response = await fetch(`${host}/api/login?token=${nonce}&consume=true`, {
+      method: "POST"
+    });
+    if (response.status >= 500) {
+      throw new ValLoginError("server-error", "An error occurred on the server.", `Status: ${response.status}`);
+    }
+    if (response.status === 200) {
+      var _json$profile;
+      const json = await response.json().catch(() => null);
+      if (!json) {
+        // A 200 with an empty body is not a confirmation; keep polling rather
+        // than failing the login, which is what the CLI has always done.
+        continue;
+      }
+      if (typeof ((_json$profile = json.profile) === null || _json$profile === void 0 ? void 0 : _json$profile.email) === "string" && typeof json.pat === "string") {
+        return json;
+      }
+      throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+    }
+  }
+  throw new ValLoginError("timeout", "Login confirmation timed out.");
+}
+
+/**
+ * Write a completed login to the project's personal access token file.
+ *
+ * @returns the path the token was written to.
+ */
+function persistPersonalAccessToken(projectRoot, result) {
+  const filePath = getPersonalAccessTokenPath(projectRoot);
+  // NOTE: no restrictive mode on the directory. This is the project's shared
+  // `.val`, which also holds the pending patches the dev server reads and
+  // writes; making it owner-only would lock out anyone who did not run the
+  // login. Only the token file itself is tightened.
+  fs__default["default"].mkdirSync(path__namespace["default"].dirname(filePath), {
+    recursive: true
+  });
+  // The token is a credential: keep it owner-only rather than at the mercy of
+  // the process umask. `mode` only applies when the file is created, so an
+  // already existing file is chmod-ed explicitly.
+  fs__default["default"].writeFileSync(filePath, JSON.stringify(result, null, 2), {
+    mode: 0o600
+  });
+  try {
+    fs__default["default"].chmodSync(filePath, 0o600);
+  } catch {
+    // Not all platforms / filesystems support POSIX modes (Windows, some
+    // network mounts). Failing to tighten them must not fail the login.
+  }
+  return filePath;
+}
+
+/**
+ * NOTE: `@valbuild/language-server` has a near-identical `modulePathMap.ts`.
+ * Fix traversal bugs in both, or fold them together.
+ */
+
 function getModulePathRange(modulePath, modulePathMap,
 // Which part of an object/record member to point at. For an object property
 // the resolved node's own range is the *key* (property name); the *value*
@@ -8250,31 +8638,39 @@ function getModulePathRange(modulePath, modulePathMap,
 // existing callers.
 target = "key") {
   var _range$children;
-  // Handle empty or invalid module paths gracefully
-  if (!modulePath || typeof modulePath !== "string") {
-    return undefined;
-  }
-  let segments;
-  try {
-    // Quote-aware splitter that correctly handles keys containing dots
-    // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
-    // split on ".". Throws on malformed input (e.g. unbalanced quotes).
-    segments = core.Internal.splitModulePath(modulePath);
-  } catch {
-    // Return undefined if the module path is malformed. This can happen when
-    // there are upstream errors in schema serialization.
+  // Handle invalid module paths gracefully
+  if (typeof modulePath !== "string") {
     return undefined;
   }
-  if (segments.length === 0) {
-    return undefined;
-  }
-  let range = modulePathMap[segments[0]];
-  for (const pathSegment of segments.slice(1)) {
-    var _range;
-    if (!range) {
-      break;
+  let range;
+  if (modulePath === "") {
+    // The empty module path is the module root, stored under the "" key: the
+    // source argument of `c.define`. This is what module-level diagnostics
+    // (which have no module path) resolve to.
+    range = modulePathMap[""];
+  } else {
+    let segments;
+    try {
+      // Quote-aware splitter that correctly handles keys containing dots
+      // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
+      // split on ".". Throws on malformed input (e.g. unbalanced quotes).
+      segments = core.Internal.splitModulePath(modulePath);
+    } catch {
+      // Return undefined if the module path is malformed. This can happen when
+      // there are upstream errors in schema serialization.
+      return undefined;
+    }
+    if (segments.length === 0) {
+      return undefined;
+    }
+    range = modulePathMap[segments[0]];
+    for (const pathSegment of segments.slice(1)) {
+      var _range;
+      if (!range) {
+        break;
+      }
+      range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
     }
-    range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
   }
   if (!range) {
     return undefined;
@@ -8306,7 +8702,20 @@ function createModulePathMap(sourceFile) {
     if (ts__default["default"].isExportAssignment(child)) {
       const contentNode = child.expression && ts__default["default"].isCallExpression(child.expression) && child.expression.arguments[2];
       if (contentNode) {
-        return traverse(contentNode, sourceFile);
+        const map = traverse(contentNode, sourceFile) ?? {};
+        // Always expose the module root under the "" key so diagnostics without
+        // a module path still resolve to a location. `traverse` already emits ""
+        // for primitive roots (with a tighter range), so keep that if present.
+        // Object/record keys are never "" (see traverseObjectLiteral), so this
+        // cannot collide with a real key.
+        return {
+          ...map,
+          "": map[""] ?? {
+            children: {},
+            start: sourceFile.getLineAndCharacterOfPosition(contentNode.getStart(sourceFile)),
+            end: sourceFile.getLineAndCharacterOfPosition(contentNode.getEnd())
+          }
+        };
       }
     }
   }
@@ -8499,12 +8908,19 @@ function readCapturedReport(snapshotDir) {
   return JSON.parse(fs__default["default"].readFileSync(reportPath, "utf-8"));
 }
 
+exports.DEFAULT_LOGIN_HOST = DEFAULT_LOGIN_HOST;
+exports.DEFAULT_LOGIN_MAX_DURATION = DEFAULT_LOGIN_MAX_DURATION;
+exports.DEFAULT_LOGIN_POLL_INTERVAL = DEFAULT_LOGIN_POLL_INTERVAL;
 exports.Service = Service;
 exports.ValFSHost = ValFSHost;
+exports.ValLoginError = ValLoginError;
 exports.ValModuleLoader = ValModuleLoader;
 exports.ValOpsFS = ValOpsFS;
 exports.ValOpsHttp = ValOpsHttp;
 exports.ValSourceFileHandler = ValSourceFileHandler;
+exports.analyzeValModule = analyzeValModule;
+exports.awaitValLoginConfirmation = awaitValLoginConfirmation;
+exports.checkRemoteRef = checkRemoteRef;
 exports.compareWithCapturedReport = compareWithCapturedReport;
 exports.createFixPatch = createFixPatch;
 exports.createModulePathMap = createModulePathMap;
@@ -8512,18 +8928,31 @@ exports.createService = createService;
 exports.createValApiRouter = createValApiRouter;
 exports.createValServer = createValServer;
 exports.decodeJwt = decodeJwt;
+exports.downloadFileFromRemote = downloadFileFromRemote;
 exports.encodeJwt = encodeJwt;
+exports.evalValConfigFile = evalValConfigFile;
+exports.extractFileMetadata = extractFileMetadata;
+exports.extractImageMetadata = extractImageMetadata;
+exports.findAndEvalValConfigFile = findAndEvalValConfigFile;
 exports.formatPatchSourceError = formatPatchSourceError;
 exports.formatSyntaxErrorTree = formatSyntaxErrorTree;
+exports.getCachedRemoteFileDir = getCachedRemoteFileDir;
+exports.getCachedRemoteFilePath = getCachedRemoteFilePath;
 exports.getCompilerOptions = getCompilerOptions;
 exports.getExpire = getExpire;
+exports.getFileExt = getFileExt;
 exports.getModulePathRange = getModulePathRange;
 exports.getPersonalAccessTokenPath = getPersonalAccessTokenPath;
 exports.getSettings = getSettings;
+exports.getValidationErrorFileRef = getValidationErrorFileRef;
+exports.hasRemoteFileSchema = hasRemoteFileSchema;
 exports.loadValModules = loadValModules;
 exports.parsePersonalAccessTokenFile = parsePersonalAccessTokenFile;
 exports.patchSourceFile = patchSourceFile;
+exports.persistPersonalAccessToken = persistPersonalAccessToken;
 exports.readCapturedReport = readCapturedReport;
 exports.replaySnapshot = replaySnapshot;
 exports.safeReadGit = safeReadGit;
+exports.startValLogin = startValLogin;
 exports.uploadRemoteFile = uploadRemoteFile;
+exports.validateMetadata = validateMetadata;