@valbuild/server 0.98.0 → 0.99.1

package/dist/declarations/src/getValidationErrorFileRef.d.ts

@@ -1,2 +1,2 @@
 import { ValidationError } from "@valbuild/core";
-export declare function getValidationErrorFileRef(validationError: ValidationError): string | null;
+export declare function getValidationErrorFileRef(validationError: ValidationError): any;

package/dist/valbuild-server.cjs.dev.js

@@ -1187,14 +1187,24 @@ class Service {
     const schema = this.extracted.schemas[moduleFilePath];
     const serializedSchema = this.extracted.serializedSchemas[moduleFilePath];
     const moduleError = this.extracted.moduleErrors.find(e => e.path === moduleFilePath);
+    // A module whose `def()` threw is recorded WITHOUT a path: the import never
+    // got far enough to reveal one, so it cannot be matched above. Those errors
+    // are precisely why a module can be missing here, so report them too -
+    // "was not found in val.modules" alone sends the reader hunting for a
+    // registration that is already there.
+    const unattributedModuleErrors = this.extracted.moduleErrors.filter(e => e.path === undefined);
     if (source === undefined || schema === undefined || serializedSchema === undefined) {
       return {
         path: moduleFilePath,
         errors: {
           invalidModulePath: moduleFilePath,
-          fatal: [{
-            message: (moduleError === null || moduleError === void 0 ? void 0 : moduleError.message) ?? `Module '${moduleFilePath}' was not found in val.modules`
-          }]
+          fatal: moduleError ? [{
+            message: moduleError.message
+          }] : [{
+            message: `Module '${moduleFilePath}' was not found in val.modules`
+          }, ...unattributedModuleErrors.map(e => ({
+            message: e.message
+          }))]
         }
       };
     }
@@ -5550,6 +5560,7 @@ const ValServer = (valModules, options, callbacks) => {
     // #region sources
     "/sources/~": {
       PUT: async req => {
+        var _patchOps$patches;
         const query = req.query;
         const cookies = req.cookies;
         // TODO: filter results by moduleFilePath
@@ -5607,27 +5618,34 @@ const ValServer = (valModules, options, callbacks) => {
         const unpatchedSources = sourcesRes.sources;
         // Default to true to keep the legacy contract for older clients.
         // The studio client always passes false: it owns patch application
-        // and rendering, and treats /sources/~ as a pure un-patched read.
+        // and validation, and treats /sources/~ as a pure un-patched read.
         const applyPatches = query.apply_patches !== false;
-        if (applyPatches) {
+        // NOTE: renders are computed here even when the client applies patches
+        // itself: the render select functions live on the Schema instances and
+        // are not part of the serialized schema, so the client cannot derive
+        // them. They are computed on the patched sources, so that previews
+        // (list titles / subtitles / images) reflect the patches that apply.
+        let patchedSources = sourcesRes.sources;
+        if ((((_patchOps$patches = patchOps.patches) === null || _patchOps$patches === void 0 ? void 0 : _patchOps$patches.length) ?? 0) > 0) {
           const onlyPatchedTreeModules = await serverOps.getSources({
             ...patchAnalysis,
             ...patchOps
           });
-          sourcesRes = {
-            sources: {
-              ...sourcesRes.sources,
-              ...(onlyPatchedTreeModules.sources || {})
-            },
-            errors: {
-              ...sourcesRes.errors,
-              ...(onlyPatchedTreeModules.errors || {})
-            }
+          patchedSources = {
+            ...sourcesRes.sources,
+            ...(onlyPatchedTreeModules.sources || {})
           };
+          if (applyPatches) {
+            sourcesRes = {
+              sources: patchedSources,
+              errors: {
+                ...sourcesRes.errors,
+                ...(onlyPatchedTreeModules.errors || {})
+              }
+            };
+          }
         }
-        const renderRes = applyPatches ? await serverOps.getRenders(schemasRes, sourcesRes.sources) : {
-          renders: {}
-        };
+        const renderRes = await serverOps.getRenders(schemasRes, patchedSources);
         let sourcesValidation = {
           errors: {},
           files: {},
@@ -7778,6 +7796,33 @@ async function downloadFileFromRemote(ref, filePath) {
 // record-level fix expands into per-entry errors that should point at the
 // individual entry (e.g. `?p="/public/val/logo.png"`) rather than the record.
 
+// Gallery entries are keyed by their file path. Remote galleries key uploaded
+// entries by a remote URL while keeping the file on disk at its local path, so
+// normalize a remote-URL key back to that local path for on-disk reads.
+function galleryKeyToLocalPath(key) {
+  const res = core.Internal.remote.splitRemoteRef(key);
+  return res.status === "success" ? `/${res.filePath}` : key;
+}
+
+// Patch path of the record that holds a media entry. Media keys are file paths
+// that can contain dots, which sourceToPatchPath cannot round-trip, so strip
+// the (JSON-encoded) key segment off the entry source path and convert the
+// remaining parent path — whose ancestors are plain object keys / array
+// indices — instead.
+function parentPatchPathOfMediaEntry(sourcePath, entryKey) {
+  const jsonKey = JSON.stringify(entryKey);
+  let parent = sourcePath;
+  if (parent.endsWith(jsonKey)) {
+    parent = parent.slice(0, parent.length - jsonKey.length);
+  }
+  if (parent.endsWith(".")) {
+    parent = parent.slice(0, -1);
+  } else if (parent.endsWith(core.Internal.ModuleFilePathSep)) {
+    parent = parent.slice(0, parent.length - core.Internal.ModuleFilePathSep.length);
+  }
+  return patch.sourceToPatchPath(parent);
+}
+
 // TODO: find a better name? transformFixesToPatch?
 async function createFixPatch(config, apply, sourcePath, validationError, remoteFiles, moduleSource, moduleSchema) {
   const remainingErrors = [];
@@ -7955,6 +8000,61 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           path: patch.sourceToPatchPath(sourcePath)
         });
       }
+    } else if (fix === "images:upload-remote" || fix === "files:upload-remote") {
+      // Gallery entry: the record is keyed by the file path, so uploading to
+      // remote means renaming the key from the local path to the remote URL
+      // (remove the old key, add the new one with the same metadata).
+      const remoteFile = remoteFiles[sourcePath];
+      if (!remoteFile) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot fix local to remote gallery entry: remote file was not uploaded",
+          fixes: undefined
+        });
+        continue;
+      }
+      const metadata = remoteFile.metadata;
+      if (!metadata) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Failed to get metadata for remote gallery file",
+          fixes: undefined
+        });
+        continue;
+      }
+      // The entry is keyed by its (local) file path, which can contain dots
+      // (e.g. image.png). sourceToPatchPath can't round-trip such keys, so
+      // build the patch path from the parent record path plus the key (which
+      // validateMediaKey carries as the error value), like the UI does.
+      const entryKey = validationError.value;
+      if (typeof entryKey !== "string") {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry: missing entry key",
+          fixes: undefined
+        });
+        continue;
+      }
+      const parentPath = parentPatchPathOfMediaEntry(sourcePath, entryKey);
+      const removePath = parentPath.concat(entryKey);
+      const addPath = parentPath.concat(remoteFile.ref);
+      if (!patch.isNotRoot(removePath) || !patch.isNotRoot(addPath)) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry at root path",
+          fixes: undefined
+        });
+        continue;
+      }
+      patch$1.push({
+        op: "remove",
+        path: removePath
+      });
+      patch$1.push({
+        op: "add",
+        path: addPath,
+        value: metadata
+      });
     } else if (fix === "image:download-remote" || fix === "file:download-remote") {
       const v = getRemoteValueFromValidationError(validationError);
       if (!v.success) {
@@ -8031,7 +8131,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       }
       const gallerySource = moduleSource;
       for (const [entryKey, storedEntry] of Object.entries(gallerySource)) {
-        const filename = path__namespace["default"].join(config.projectRoot, entryKey);
+        const filename = path__namespace["default"].join(config.projectRoot, galleryKeyToLocalPath(entryKey));
         let buffer;
         try {
           buffer = fs__default["default"].readFileSync(filename);
@@ -8556,31 +8656,39 @@ function getModulePathRange(modulePath, modulePathMap,
 // existing callers.
 target = "key") {
   var _range$children;
-  // Handle empty or invalid module paths gracefully
-  if (!modulePath || typeof modulePath !== "string") {
-    return undefined;
-  }
-  let segments;
-  try {
-    // Quote-aware splitter that correctly handles keys containing dots
-    // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
-    // split on ".". Throws on malformed input (e.g. unbalanced quotes).
-    segments = core.Internal.splitModulePath(modulePath);
-  } catch {
-    // Return undefined if the module path is malformed. This can happen when
-    // there are upstream errors in schema serialization.
+  // Handle invalid module paths gracefully
+  if (typeof modulePath !== "string") {
     return undefined;
   }
-  if (segments.length === 0) {
-    return undefined;
-  }
-  let range = modulePathMap[segments[0]];
-  for (const pathSegment of segments.slice(1)) {
-    var _range;
-    if (!range) {
-      break;
+  let range;
+  if (modulePath === "") {
+    // The empty module path is the module root, stored under the "" key: the
+    // source argument of `c.define`. This is what module-level diagnostics
+    // (which have no module path) resolve to.
+    range = modulePathMap[""];
+  } else {
+    let segments;
+    try {
+      // Quote-aware splitter that correctly handles keys containing dots
+      // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
+      // split on ".". Throws on malformed input (e.g. unbalanced quotes).
+      segments = core.Internal.splitModulePath(modulePath);
+    } catch {
+      // Return undefined if the module path is malformed. This can happen when
+      // there are upstream errors in schema serialization.
+      return undefined;
+    }
+    if (segments.length === 0) {
+      return undefined;
+    }
+    range = modulePathMap[segments[0]];
+    for (const pathSegment of segments.slice(1)) {
+      var _range;
+      if (!range) {
+        break;
+      }
+      range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
     }
-    range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
   }
   if (!range) {
     return undefined;
@@ -8612,7 +8720,20 @@ function createModulePathMap(sourceFile) {
     if (ts__default["default"].isExportAssignment(child)) {
       const contentNode = child.expression && ts__default["default"].isCallExpression(child.expression) && child.expression.arguments[2];
       if (contentNode) {
-        return traverse(contentNode, sourceFile);
+        const map = traverse(contentNode, sourceFile) ?? {};
+        // Always expose the module root under the "" key so diagnostics without
+        // a module path still resolve to a location. `traverse` already emits ""
+        // for primitive roots (with a tighter range), so keep that if present.
+        // Object/record keys are never "" (see traverseObjectLiteral), so this
+        // cannot collide with a real key.
+        return {
+          ...map,
+          "": map[""] ?? {
+            children: {},
+            start: sourceFile.getLineAndCharacterOfPosition(contentNode.getStart(sourceFile)),
+            end: sourceFile.getLineAndCharacterOfPosition(contentNode.getEnd())
+          }
+        };
       }
     }
   }

package/dist/valbuild-server.cjs.prod.js

@@ -1187,14 +1187,24 @@ class Service {
     const schema = this.extracted.schemas[moduleFilePath];
     const serializedSchema = this.extracted.serializedSchemas[moduleFilePath];
     const moduleError = this.extracted.moduleErrors.find(e => e.path === moduleFilePath);
+    // A module whose `def()` threw is recorded WITHOUT a path: the import never
+    // got far enough to reveal one, so it cannot be matched above. Those errors
+    // are precisely why a module can be missing here, so report them too -
+    // "was not found in val.modules" alone sends the reader hunting for a
+    // registration that is already there.
+    const unattributedModuleErrors = this.extracted.moduleErrors.filter(e => e.path === undefined);
     if (source === undefined || schema === undefined || serializedSchema === undefined) {
       return {
         path: moduleFilePath,
         errors: {
           invalidModulePath: moduleFilePath,
-          fatal: [{
-            message: (moduleError === null || moduleError === void 0 ? void 0 : moduleError.message) ?? `Module '${moduleFilePath}' was not found in val.modules`
-          }]
+          fatal: moduleError ? [{
+            message: moduleError.message
+          }] : [{
+            message: `Module '${moduleFilePath}' was not found in val.modules`
+          }, ...unattributedModuleErrors.map(e => ({
+            message: e.message
+          }))]
         }
       };
     }
@@ -5550,6 +5560,7 @@ const ValServer = (valModules, options, callbacks) => {
     // #region sources
     "/sources/~": {
       PUT: async req => {
+        var _patchOps$patches;
         const query = req.query;
         const cookies = req.cookies;
         // TODO: filter results by moduleFilePath
@@ -5607,27 +5618,34 @@ const ValServer = (valModules, options, callbacks) => {
         const unpatchedSources = sourcesRes.sources;
         // Default to true to keep the legacy contract for older clients.
         // The studio client always passes false: it owns patch application
-        // and rendering, and treats /sources/~ as a pure un-patched read.
+        // and validation, and treats /sources/~ as a pure un-patched read.
         const applyPatches = query.apply_patches !== false;
-        if (applyPatches) {
+        // NOTE: renders are computed here even when the client applies patches
+        // itself: the render select functions live on the Schema instances and
+        // are not part of the serialized schema, so the client cannot derive
+        // them. They are computed on the patched sources, so that previews
+        // (list titles / subtitles / images) reflect the patches that apply.
+        let patchedSources = sourcesRes.sources;
+        if ((((_patchOps$patches = patchOps.patches) === null || _patchOps$patches === void 0 ? void 0 : _patchOps$patches.length) ?? 0) > 0) {
           const onlyPatchedTreeModules = await serverOps.getSources({
             ...patchAnalysis,
             ...patchOps
           });
-          sourcesRes = {
-            sources: {
-              ...sourcesRes.sources,
-              ...(onlyPatchedTreeModules.sources || {})
-            },
-            errors: {
-              ...sourcesRes.errors,
-              ...(onlyPatchedTreeModules.errors || {})
-            }
+          patchedSources = {
+            ...sourcesRes.sources,
+            ...(onlyPatchedTreeModules.sources || {})
           };
+          if (applyPatches) {
+            sourcesRes = {
+              sources: patchedSources,
+              errors: {
+                ...sourcesRes.errors,
+                ...(onlyPatchedTreeModules.errors || {})
+              }
+            };
+          }
         }
-        const renderRes = applyPatches ? await serverOps.getRenders(schemasRes, sourcesRes.sources) : {
-          renders: {}
-        };
+        const renderRes = await serverOps.getRenders(schemasRes, patchedSources);
         let sourcesValidation = {
           errors: {},
           files: {},
@@ -7778,6 +7796,33 @@ async function downloadFileFromRemote(ref, filePath) {
 // record-level fix expands into per-entry errors that should point at the
 // individual entry (e.g. `?p="/public/val/logo.png"`) rather than the record.
 
+// Gallery entries are keyed by their file path. Remote galleries key uploaded
+// entries by a remote URL while keeping the file on disk at its local path, so
+// normalize a remote-URL key back to that local path for on-disk reads.
+function galleryKeyToLocalPath(key) {
+  const res = core.Internal.remote.splitRemoteRef(key);
+  return res.status === "success" ? `/${res.filePath}` : key;
+}
+
+// Patch path of the record that holds a media entry. Media keys are file paths
+// that can contain dots, which sourceToPatchPath cannot round-trip, so strip
+// the (JSON-encoded) key segment off the entry source path and convert the
+// remaining parent path — whose ancestors are plain object keys / array
+// indices — instead.
+function parentPatchPathOfMediaEntry(sourcePath, entryKey) {
+  const jsonKey = JSON.stringify(entryKey);
+  let parent = sourcePath;
+  if (parent.endsWith(jsonKey)) {
+    parent = parent.slice(0, parent.length - jsonKey.length);
+  }
+  if (parent.endsWith(".")) {
+    parent = parent.slice(0, -1);
+  } else if (parent.endsWith(core.Internal.ModuleFilePathSep)) {
+    parent = parent.slice(0, parent.length - core.Internal.ModuleFilePathSep.length);
+  }
+  return patch.sourceToPatchPath(parent);
+}
+
 // TODO: find a better name? transformFixesToPatch?
 async function createFixPatch(config, apply, sourcePath, validationError, remoteFiles, moduleSource, moduleSchema) {
   const remainingErrors = [];
@@ -7955,6 +8000,61 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           path: patch.sourceToPatchPath(sourcePath)
         });
       }
+    } else if (fix === "images:upload-remote" || fix === "files:upload-remote") {
+      // Gallery entry: the record is keyed by the file path, so uploading to
+      // remote means renaming the key from the local path to the remote URL
+      // (remove the old key, add the new one with the same metadata).
+      const remoteFile = remoteFiles[sourcePath];
+      if (!remoteFile) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot fix local to remote gallery entry: remote file was not uploaded",
+          fixes: undefined
+        });
+        continue;
+      }
+      const metadata = remoteFile.metadata;
+      if (!metadata) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Failed to get metadata for remote gallery file",
+          fixes: undefined
+        });
+        continue;
+      }
+      // The entry is keyed by its (local) file path, which can contain dots
+      // (e.g. image.png). sourceToPatchPath can't round-trip such keys, so
+      // build the patch path from the parent record path plus the key (which
+      // validateMediaKey carries as the error value), like the UI does.
+      const entryKey = validationError.value;
+      if (typeof entryKey !== "string") {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry: missing entry key",
+          fixes: undefined
+        });
+        continue;
+      }
+      const parentPath = parentPatchPathOfMediaEntry(sourcePath, entryKey);
+      const removePath = parentPath.concat(entryKey);
+      const addPath = parentPath.concat(remoteFile.ref);
+      if (!patch.isNotRoot(removePath) || !patch.isNotRoot(addPath)) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry at root path",
+          fixes: undefined
+        });
+        continue;
+      }
+      patch$1.push({
+        op: "remove",
+        path: removePath
+      });
+      patch$1.push({
+        op: "add",
+        path: addPath,
+        value: metadata
+      });
     } else if (fix === "image:download-remote" || fix === "file:download-remote") {
       const v = getRemoteValueFromValidationError(validationError);
       if (!v.success) {
@@ -8031,7 +8131,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       }
       const gallerySource = moduleSource;
       for (const [entryKey, storedEntry] of Object.entries(gallerySource)) {
-        const filename = path__namespace["default"].join(config.projectRoot, entryKey);
+        const filename = path__namespace["default"].join(config.projectRoot, galleryKeyToLocalPath(entryKey));
         let buffer;
         try {
           buffer = fs__default["default"].readFileSync(filename);
@@ -8556,31 +8656,39 @@ function getModulePathRange(modulePath, modulePathMap,
 // existing callers.
 target = "key") {
   var _range$children;
-  // Handle empty or invalid module paths gracefully
-  if (!modulePath || typeof modulePath !== "string") {
-    return undefined;
-  }
-  let segments;
-  try {
-    // Quote-aware splitter that correctly handles keys containing dots
-    // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
-    // split on ".". Throws on malformed input (e.g. unbalanced quotes).
-    segments = core.Internal.splitModulePath(modulePath);
-  } catch {
-    // Return undefined if the module path is malformed. This can happen when
-    // there are upstream errors in schema serialization.
+  // Handle invalid module paths gracefully
+  if (typeof modulePath !== "string") {
     return undefined;
   }
-  if (segments.length === 0) {
-    return undefined;
-  }
-  let range = modulePathMap[segments[0]];
-  for (const pathSegment of segments.slice(1)) {
-    var _range;
-    if (!range) {
-      break;
+  let range;
+  if (modulePath === "") {
+    // The empty module path is the module root, stored under the "" key: the
+    // source argument of `c.define`. This is what module-level diagnostics
+    // (which have no module path) resolve to.
+    range = modulePathMap[""];
+  } else {
+    let segments;
+    try {
+      // Quote-aware splitter that correctly handles keys containing dots
+      // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
+      // split on ".". Throws on malformed input (e.g. unbalanced quotes).
+      segments = core.Internal.splitModulePath(modulePath);
+    } catch {
+      // Return undefined if the module path is malformed. This can happen when
+      // there are upstream errors in schema serialization.
+      return undefined;
+    }
+    if (segments.length === 0) {
+      return undefined;
+    }
+    range = modulePathMap[segments[0]];
+    for (const pathSegment of segments.slice(1)) {
+      var _range;
+      if (!range) {
+        break;
+      }
+      range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
     }
-    range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
   }
   if (!range) {
     return undefined;
@@ -8612,7 +8720,20 @@ function createModulePathMap(sourceFile) {
     if (ts__default["default"].isExportAssignment(child)) {
       const contentNode = child.expression && ts__default["default"].isCallExpression(child.expression) && child.expression.arguments[2];
       if (contentNode) {
-        return traverse(contentNode, sourceFile);
+        const map = traverse(contentNode, sourceFile) ?? {};
+        // Always expose the module root under the "" key so diagnostics without
+        // a module path still resolve to a location. `traverse` already emits ""
+        // for primitive roots (with a tighter range), so keep that if present.
+        // Object/record keys are never "" (see traverseObjectLiteral), so this
+        // cannot collide with a real key.
+        return {
+          ...map,
+          "": map[""] ?? {
+            children: {},
+            start: sourceFile.getLineAndCharacterOfPosition(contentNode.getStart(sourceFile)),
+            end: sourceFile.getLineAndCharacterOfPosition(contentNode.getEnd())
+          }
+        };
       }
     }
   }

package/dist/valbuild-server.esm.js

@@ -1153,14 +1153,24 @@ class Service {
     const schema = this.extracted.schemas[moduleFilePath];
     const serializedSchema = this.extracted.serializedSchemas[moduleFilePath];
     const moduleError = this.extracted.moduleErrors.find(e => e.path === moduleFilePath);
+    // A module whose `def()` threw is recorded WITHOUT a path: the import never
+    // got far enough to reveal one, so it cannot be matched above. Those errors
+    // are precisely why a module can be missing here, so report them too -
+    // "was not found in val.modules" alone sends the reader hunting for a
+    // registration that is already there.
+    const unattributedModuleErrors = this.extracted.moduleErrors.filter(e => e.path === undefined);
     if (source === undefined || schema === undefined || serializedSchema === undefined) {
       return {
         path: moduleFilePath,
         errors: {
           invalidModulePath: moduleFilePath,
-          fatal: [{
-            message: (moduleError === null || moduleError === void 0 ? void 0 : moduleError.message) ?? `Module '${moduleFilePath}' was not found in val.modules`
-          }]
+          fatal: moduleError ? [{
+            message: moduleError.message
+          }] : [{
+            message: `Module '${moduleFilePath}' was not found in val.modules`
+          }, ...unattributedModuleErrors.map(e => ({
+            message: e.message
+          }))]
         }
       };
     }
@@ -5516,6 +5526,7 @@ const ValServer = (valModules, options, callbacks) => {
     // #region sources
     "/sources/~": {
       PUT: async req => {
+        var _patchOps$patches;
         const query = req.query;
         const cookies = req.cookies;
         // TODO: filter results by moduleFilePath
@@ -5573,27 +5584,34 @@ const ValServer = (valModules, options, callbacks) => {
         const unpatchedSources = sourcesRes.sources;
         // Default to true to keep the legacy contract for older clients.
         // The studio client always passes false: it owns patch application
-        // and rendering, and treats /sources/~ as a pure un-patched read.
+        // and validation, and treats /sources/~ as a pure un-patched read.
         const applyPatches = query.apply_patches !== false;
-        if (applyPatches) {
+        // NOTE: renders are computed here even when the client applies patches
+        // itself: the render select functions live on the Schema instances and
+        // are not part of the serialized schema, so the client cannot derive
+        // them. They are computed on the patched sources, so that previews
+        // (list titles / subtitles / images) reflect the patches that apply.
+        let patchedSources = sourcesRes.sources;
+        if ((((_patchOps$patches = patchOps.patches) === null || _patchOps$patches === void 0 ? void 0 : _patchOps$patches.length) ?? 0) > 0) {
           const onlyPatchedTreeModules = await serverOps.getSources({
             ...patchAnalysis,
             ...patchOps
           });
-          sourcesRes = {
-            sources: {
-              ...sourcesRes.sources,
-              ...(onlyPatchedTreeModules.sources || {})
-            },
-            errors: {
-              ...sourcesRes.errors,
-              ...(onlyPatchedTreeModules.errors || {})
-            }
+          patchedSources = {
+            ...sourcesRes.sources,
+            ...(onlyPatchedTreeModules.sources || {})
           };
+          if (applyPatches) {
+            sourcesRes = {
+              sources: patchedSources,
+              errors: {
+                ...sourcesRes.errors,
+                ...(onlyPatchedTreeModules.errors || {})
+              }
+            };
+          }
         }
-        const renderRes = applyPatches ? await serverOps.getRenders(schemasRes, sourcesRes.sources) : {
-          renders: {}
-        };
+        const renderRes = await serverOps.getRenders(schemasRes, patchedSources);
         let sourcesValidation = {
           errors: {},
           files: {},
@@ -7744,6 +7762,33 @@ async function downloadFileFromRemote(ref, filePath) {
 // record-level fix expands into per-entry errors that should point at the
 // individual entry (e.g. `?p="/public/val/logo.png"`) rather than the record.
 
+// Gallery entries are keyed by their file path. Remote galleries key uploaded
+// entries by a remote URL while keeping the file on disk at its local path, so
+// normalize a remote-URL key back to that local path for on-disk reads.
+function galleryKeyToLocalPath(key) {
+  const res = Internal.remote.splitRemoteRef(key);
+  return res.status === "success" ? `/${res.filePath}` : key;
+}
+
+// Patch path of the record that holds a media entry. Media keys are file paths
+// that can contain dots, which sourceToPatchPath cannot round-trip, so strip
+// the (JSON-encoded) key segment off the entry source path and convert the
+// remaining parent path — whose ancestors are plain object keys / array
+// indices — instead.
+function parentPatchPathOfMediaEntry(sourcePath, entryKey) {
+  const jsonKey = JSON.stringify(entryKey);
+  let parent = sourcePath;
+  if (parent.endsWith(jsonKey)) {
+    parent = parent.slice(0, parent.length - jsonKey.length);
+  }
+  if (parent.endsWith(".")) {
+    parent = parent.slice(0, -1);
+  } else if (parent.endsWith(Internal.ModuleFilePathSep)) {
+    parent = parent.slice(0, parent.length - Internal.ModuleFilePathSep.length);
+  }
+  return sourceToPatchPath(parent);
+}
+
 // TODO: find a better name? transformFixesToPatch?
 async function createFixPatch(config, apply, sourcePath, validationError, remoteFiles, moduleSource, moduleSchema) {
   const remainingErrors = [];
@@ -7921,6 +7966,61 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
           path: sourceToPatchPath(sourcePath)
         });
       }
+    } else if (fix === "images:upload-remote" || fix === "files:upload-remote") {
+      // Gallery entry: the record is keyed by the file path, so uploading to
+      // remote means renaming the key from the local path to the remote URL
+      // (remove the old key, add the new one with the same metadata).
+      const remoteFile = remoteFiles[sourcePath];
+      if (!remoteFile) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot fix local to remote gallery entry: remote file was not uploaded",
+          fixes: undefined
+        });
+        continue;
+      }
+      const metadata = remoteFile.metadata;
+      if (!metadata) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Failed to get metadata for remote gallery file",
+          fixes: undefined
+        });
+        continue;
+      }
+      // The entry is keyed by its (local) file path, which can contain dots
+      // (e.g. image.png). sourceToPatchPath can't round-trip such keys, so
+      // build the patch path from the parent record path plus the key (which
+      // validateMediaKey carries as the error value), like the UI does.
+      const entryKey = validationError.value;
+      if (typeof entryKey !== "string") {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry: missing entry key",
+          fixes: undefined
+        });
+        continue;
+      }
+      const parentPath = parentPatchPathOfMediaEntry(sourcePath, entryKey);
+      const removePath = parentPath.concat(entryKey);
+      const addPath = parentPath.concat(remoteFile.ref);
+      if (!isNotRoot(removePath) || !isNotRoot(addPath)) {
+        remainingErrors.push({
+          ...validationError,
+          message: "Cannot rewrite remote gallery entry at root path",
+          fixes: undefined
+        });
+        continue;
+      }
+      patch.push({
+        op: "remove",
+        path: removePath
+      });
+      patch.push({
+        op: "add",
+        path: addPath,
+        value: metadata
+      });
     } else if (fix === "image:download-remote" || fix === "file:download-remote") {
       const v = getRemoteValueFromValidationError(validationError);
       if (!v.success) {
@@ -7997,7 +8097,7 @@ async function createFixPatch(config, apply, sourcePath, validationError, remote
       }
       const gallerySource = moduleSource;
       for (const [entryKey, storedEntry] of Object.entries(gallerySource)) {
-        const filename = path__default.join(config.projectRoot, entryKey);
+        const filename = path__default.join(config.projectRoot, galleryKeyToLocalPath(entryKey));
         let buffer;
         try {
           buffer = fs.readFileSync(filename);
@@ -8522,31 +8622,39 @@ function getModulePathRange(modulePath, modulePathMap,
 // existing callers.
 target = "key") {
   var _range$children;
-  // Handle empty or invalid module paths gracefully
-  if (!modulePath || typeof modulePath !== "string") {
-    return undefined;
-  }
-  let segments;
-  try {
-    // Quote-aware splitter that correctly handles keys containing dots
-    // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
-    // split on ".". Throws on malformed input (e.g. unbalanced quotes).
-    segments = Internal.splitModulePath(modulePath);
-  } catch {
-    // Return undefined if the module path is malformed. This can happen when
-    // there are upstream errors in schema serialization.
+  // Handle invalid module paths gracefully
+  if (typeof modulePath !== "string") {
     return undefined;
   }
-  if (segments.length === 0) {
-    return undefined;
-  }
-  let range = modulePathMap[segments[0]];
-  for (const pathSegment of segments.slice(1)) {
-    var _range;
-    if (!range) {
-      break;
+  let range;
+  if (modulePath === "") {
+    // The empty module path is the module root, stored under the "" key: the
+    // source argument of `c.define`. This is what module-level diagnostics
+    // (which have no module path) resolve to.
+    range = modulePathMap[""];
+  } else {
+    let segments;
+    try {
+      // Quote-aware splitter that correctly handles keys containing dots
+      // (e.g. file refs like `"/public/val/images/logo.png"`), unlike a naive
+      // split on ".". Throws on malformed input (e.g. unbalanced quotes).
+      segments = Internal.splitModulePath(modulePath);
+    } catch {
+      // Return undefined if the module path is malformed. This can happen when
+      // there are upstream errors in schema serialization.
+      return undefined;
+    }
+    if (segments.length === 0) {
+      return undefined;
+    }
+    range = modulePathMap[segments[0]];
+    for (const pathSegment of segments.slice(1)) {
+      var _range;
+      if (!range) {
+        break;
+      }
+      range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
     }
-    range = (_range = range) === null || _range === void 0 || (_range = _range.children) === null || _range === void 0 ? void 0 : _range[pathSegment];
   }
   if (!range) {
     return undefined;
@@ -8578,7 +8686,20 @@ function createModulePathMap(sourceFile) {
     if (ts.isExportAssignment(child)) {
       const contentNode = child.expression && ts.isCallExpression(child.expression) && child.expression.arguments[2];
       if (contentNode) {
-        return traverse(contentNode, sourceFile);
+        const map = traverse(contentNode, sourceFile) ?? {};
+        // Always expose the module root under the "" key so diagnostics without
+        // a module path still resolve to a location. `traverse` already emits ""
+        // for primitive roots (with a tighter range), so keep that if present.
+        // Object/record keys are never "" (see traverseObjectLiteral), so this
+        // cannot collide with a real key.
+        return {
+          ...map,
+          "": map[""] ?? {
+            children: {},
+            start: sourceFile.getLineAndCharacterOfPosition(contentNode.getStart(sourceFile)),
+            end: sourceFile.getLineAndCharacterOfPosition(contentNode.getEnd())
+          }
+        };
       }
     }
   }

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.98.0",
+  "version": "0.99.1",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0"
@@ -29,9 +29,9 @@
     "typescript": "^5.9.3",
     "zod": "^4.3.5",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.97.7",
-    "@valbuild/shared": "0.97.7",
-    "@valbuild/ui": "0.97.7"
+    "@valbuild/core": "0.99.1",
+    "@valbuild/shared": "0.99.1",
+    "@valbuild/ui": "0.99.1"
   },
   "engines": {
     "node": ">=18.17.0"