@valbuild/tanstack 0.129.0 → 0.130.0

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # @valbuild/tanstack
 
+## 0.130.0
+
+### Minor Changes
+
+- [#684](https://github.com/valbuild/val/pull/684) [`cab4098`](https://github.com/valbuild/val/commit/cab4098969585977b8d7574e86d66fcb01cb1d75) Thanks [@freekh](https://github.com/freekh)! - A third ValOps mode, for a host that already holds its own source
+
+  EXPERIMENTAL. `fs` mode assumes a working tree it can watch and write; `http`
+  mode assumes Val's content service owns the patch chain and that a commit is a
+  git commit. A host that builds and publishes its own output is neither: it holds
+  the source already, it has nowhere to watch, and its "commit" is a new build.
+
+  Forcing such a host into `fs` mode cost three things, all now fixed: `/stat`
+  long-polled against watchers that could never fire, burning CPU for the whole
+  hold to learn nothing;
+  `/api/val/enable` 500'd; and every read of a `.val.ts` went through a shimmed
+  filesystem when the host could simply hand the source over.
+
+  `ValOpsMemory` takes the source as `sourceFiles`, refuses the local binary
+  members by name — this configuration uses Val's remote files — and answers the
+  history members with the same closed `not-supported-in-fs-mode` error `ValOpsFS`
+  gives, so the History UI degrades the way it already knows how rather than
+  inventing a commit list.
+
+  `getStat` still long-polls -- the hold is what paces the client, and an earlier
+  version that answered immediately turned a 20-second poll into a request every
+  6ms -- but it parks on a SIGNAL rather than a timer. This mode owns its store,
+  so it is told when something changes: no timers while parked, and a patch
+  written by another tab is seen at once rather than up to 250ms later.
+
+  Two seams come with it. `commitPrepared` lets a host take what a save produced
+  instead of a git commit, and `publishOverride` lets a publish be something other
+  than a push. Both are opt-in; an app that sets neither behaves exactly as before.
+
+  The in-memory patch store is explicitly **not durable**. It is behind
+  `ValPatchStore`, so a durable implementation is a swap rather than a rewrite,
+  but as shipped a restart loses unpublished patches.
+
+  **Memory mode authenticates.** `ValOps` gained `requiresAuth` alongside
+  `patchesAreLocal`, because one flag was answering two questions: whether a store
+  auto-saves or publishes (behaviour, reported as `mode` and keyed off by the UI),
+  and whether an unauthenticated request may write (security). With two
+  implementations the answers coincided — `fs` is a developer's own machine where
+  no credential exists, `http` is remote — so `getAuth` was written against
+  `patchesAreLocal` and returned anonymous _success_ for a missing cookie, an
+  invalid JWT, an unparseable payload, or no configured secret.
+
+  Memory mode splits them: its store is local, and it runs deployed. It therefore
+  requires a verified session, like `http` mode. A host that authorises requests
+  before Val sees them can opt out with `unsafelyAllowUnauthenticated`, which is
+  spelled that way on purpose and warns at startup. `fs` mode is unchanged.
+
+  Val's own MCP endpoint refuses memory mode outright. It has the same absence fs
+  mode has — no credential, no backend, every permission check on the far side of
+  one — and unlike fs mode it is meant to run deployed, so the existing
+  "development only" and loopback guards refuse nothing. A host in this mode owns
+  its own trust boundary and can offer the tools through it.
+
+  Internally, the routes' `instanceof ValOpsFS` checks meant "is this a local
+  store" — correct with two implementations and silently wrong with three. They are
+  now `ValOps.patchesAreLocal` at all 17 policy sites.
+
+### Patch Changes
+
+- [#684](https://github.com/valbuild/val/pull/684) [`cab4098`](https://github.com/valbuild/val/commit/cab4098969585977b8d7574e86d66fcb01cb1d75) Thanks [@freekh](https://github.com/freekh)! - `@valbuild/tanstack` can be bundled for a browser again
+
+  The root entry — the one every client component imports — reached TanStack
+  Start's server module from inside `isValEnabled`:
+
+  ```js
+  const { getCookie } = await import("@tanstack/react-start/server");
+  ```
+
+  At runtime that is already correct anywhere but a server: the import fails, the
+  `catch` returns `false`, which is what the function's documentation says it does.
+  Under Vite the dynamic form also keeps it out of the client bundle.
+
+  It does not everywhere. A host that bundles this package ahead of time and audits
+  what each chunk imports sees a dynamically imported chunk as a chunk like any
+  other — and this one reaches Start's SSR path and lands on `node:stream`. The
+  package could not be built for a browser or a Cloudflare Worker at all, which
+  made every component importing it unusable there.
+
+  The edge is now inverted. The root entry holds a slot, `@valbuild/tanstack/server`
+  fills it on import with the implementation that was already there, and the root
+  entry no longer names TanStack's server module. Nothing changes for an app that
+  imports `/server`, which is every app with a Val API. An `isValEnabled()` call
+  before `/server` is first imported returns `false` — the same answer the old
+  implementation's `catch` gave in that situation.
+
+- Updated dependencies [[`be1e8be`](https://github.com/valbuild/val/commit/be1e8bee673207596b3eb3d9a9886b8ade9b332f), [`cab4098`](https://github.com/valbuild/val/commit/cab4098969585977b8d7574e86d66fcb01cb1d75), [`8425378`](https://github.com/valbuild/val/commit/8425378c315ea46b5d822f1130b633e0449ff1b0), [`7d13dbc`](https://github.com/valbuild/val/commit/7d13dbced9ea49d8243b6b6cf9854cd1a259501f), [`cab4098`](https://github.com/valbuild/val/commit/cab4098969585977b8d7574e86d66fcb01cb1d75), [`07db94c`](https://github.com/valbuild/val/commit/07db94c23b73c8c0b2b50a30a89926823c2da1d6), [`473a185`](https://github.com/valbuild/val/commit/473a185f70351b44388f3bc1852649e2c1dbe001), [`64f0de3`](https://github.com/valbuild/val/commit/64f0de339b8621cb5a6c422dfe55cae5b2bbe2a0), [`cab4098`](https://github.com/valbuild/val/commit/cab4098969585977b8d7574e86d66fcb01cb1d75)]:
+  - @valbuild/ui@0.130.0
+  - @valbuild/server@0.130.0
+  - @valbuild/mcp@0.130.0
+  - @valbuild/core@0.130.0
+  - @valbuild/react@0.130.0
+  - @valbuild/language-server@0.130.0
+  - @valbuild/shared@0.130.0
+
 ## 0.129.0
 
 ### Patch Changes

package/dist/declarations/src/server/index.d.ts

@@ -1,4 +1,5 @@
 export { initValServer } from "./initValServer.js";
+export type { ValHttpMode } from "./initValServer.js";
 export { initValContent } from "./initValContent.js";
 export { valDraftMode, hasValEnableCookieOnServer, VAL_DRAFT_MODE_COOKIE, type ValDraftMode, } from "./valDraftMode.js";
 export { initValMcp } from "./initValMcp.js";

package/dist/declarations/src/server/initValServer.d.ts

@@ -1,5 +1,37 @@
 import { ValConfig, ValModules } from "@valbuild/core";
+import { type CommitContext, type CommitResult, type ValPatchStore } from "@valbuild/server";
 import { type ValDraftMode } from "./valDraftMode.js";
+/**
+ * What `http` mode needs, as one object.
+ *
+ * A publish there is a commit on the project's repository, so this is the
+ * shape of "Val's content service holds my patches and my repo holds my
+ * content".
+ */
+export type ValHttpMode = {
+    /** Names the PROJECT to the content service. */
+    apiKey: string;
+    /** Signs the session cookie. Any sufficiently random string. */
+    valSecret: string;
+    /** The commit the running code was built from. See the note at the use. */
+    gitCommit: string;
+    /** The branch a publish commits to. */
+    gitBranch: string;
+    /**
+     * Val's content service, when it is not the real one.
+     *
+     * For pointing at a local stand-in — `e2e/mock-content-host` in the Val
+     * repository, which implements the patch, commit and file routes without a
+     * git repository behind them.
+     *
+     * NOTE this does not redirect everything. `getSettings`, which remote files
+     * use, reads `process.env.VAL_CONTENT_URL` at module scope inside
+     * `@valbuild/server`; a host that bundles its dependencies separately cannot
+     * set that, so remote FILES still address the real host even when patches and
+     * commits go here.
+     */
+    valContentUrl?: string;
+};
 export declare function initValServer(valModules: ValModules, config: ValConfig & {
     disableCache?: boolean;
 }, opts?: {
@@ -13,6 +45,83 @@ export declare function initValServer(valModules: ValModules, config: ValConfig
      * get, or the API will enable a preview the loaders cannot see.
      */
     draftMode?: ValDraftMode;
+    /**
+     * Called after a save has applied its patches, with the files it produced.
+     *
+     * EXPERIMENTAL — see VAL_PROMPT.md. For a host where "commit" is not
+     * "write to the working tree and let git take it from here": the files are
+     * `path -> content` (null = delete), which is what such a host publishes.
+     * It runs in addition to the save, not instead of it.
+     */
+    commitPrepared?: (commit: {
+        patchedSourceFiles: Record<string, string | null>;
+    }) => Promise<void>;
+    /**
+     * The project's source, by path — and, by being present, the choice of an
+     * in-memory store over the local filesystem.
+     *
+     * EXPERIMENTAL — see VAL_PROMPT.md. For a host that HOLDS the source rather
+     * than having it on a disk: `fs` mode wants a working tree it can watch and
+     * write, and giving such a host a shimmed filesystem to read through is
+     * what produced a `/stat` long-polling watchers that cannot fire. Here it
+     * simply hands the source over, and `commitPrepared` is where the publish
+     * goes.
+     */
+    /**
+     * Val's api key, for a host that cannot give the server one through the
+     * environment.
+     *
+     * `@valbuild/server` normally reads `VAL_API_KEY` itself. That works where
+     * it and the app are built together; it does not where the app is bundled
+     * separately from its dependencies — the build inlines env vars into the
+     * APP and leaves the dependency chunks alone, so Val's own
+     * `process.env.VAL_API_KEY` is undefined however the host sets it. The app
+     * can see it, so the app passes it.
+     *
+     * Only needed for REMOTE files, which upload to Val's content host at
+     * publish.
+     */
+    apiKey?: string;
+    /**
+     * Val's content service, when it is not the real one.
+     *
+     * Needed by REMOTE files in any mode: the bytes are pushed there at
+     * publish. In `http` mode the patches go there too, and
+     * {@link ValHttpMode.valContentUrl} says the same thing — pass either.
+     */
+    valContentUrl?: string;
+    /**
+     * What a publish DOES, when Val's content service holds the patches.
+     *
+     * EXPERIMENTAL — see `ValServerOptions.publishOverride`. By default a
+     * publish in that mode is a git commit; a host that publishes by building
+     * says so here. It is handed the default as `commitToGit`, so it can
+     * replace the commit or also perform it.
+     */
+    publishOverride?: (context: CommitContext) => Promise<CommitResult>;
+    /**
+     * Put this server in `http` mode: Val's content service owns the patches.
+     *
+     * Everything here is required together — `initHandlerOptions` throws for a
+     * proxy config missing any of them — which is why it is one option and not
+     * four.
+     */
+    http?: ValHttpMode;
+    sourceFiles?: Record<string, string>;
+    /**
+     * Where pending patches live, with {@link sourceFiles}. Defaults to memory,
+     * which dies with the process — see `ValPatchStore` for the durable swap.
+     */
+    patchStore?: ValPatchStore;
+    /**
+     * Serve without authenticating any request. Off by default.
+     *
+     * Only correct when this app authorises every request before Val sees it.
+     * Unlike local `fs` mode, {@link sourceFiles} is for a DEPLOYED host, so
+     * without this a session is required as in proxy mode -- otherwise anyone
+     * who can reach the route can create patches and trigger a publish.
+     */
+    unsafelyAllowUnauthenticated?: boolean;
 }): {
     /**
      * The Val API. Mount it on `/api/val/$` for every method:

package/dist/valbuild-tanstack.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = require('./version-8aeb5ebd.cjs.dev.js');
+var version = require('./version-f2ffc76f.cjs.dev.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-e75681d7.cjs.dev.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
@@ -66,23 +66,12 @@ function isValEnabled() {
 }
 function _isValEnabled() {
   _isValEnabled = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
-    var _yield$import, getCookie;
     return version._regenerator().w(function (_context) {
-      while (1) switch (_context.p = _context.n) {
+      while (1) switch (_context.n) {
         case 0:
-          _context.p = 0;
-          _context.n = 1;
-          return Promise.resolve().then(function () { return /*#__PURE__*/_interopNamespace(require('@tanstack/react-start/server')); });
-        case 1:
-          _yield$import = _context.v;
-          getCookie = _yield$import.getCookie;
-          return _context.a(2, getCookie(core.Internal.VAL_ENABLE_COOKIE_NAME) === "true");
-        case 2:
-          _context.p = 2;
-          _context.v;
-          return _context.a(2, false);
+          return _context.a(2, version.readValEnableCookie());
       }
-    }, _callee, null, [[0, 2]]);
+    }, _callee);
   }));
   return _isValEnabled.apply(this, arguments);
 }

package/dist/valbuild-tanstack.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = require('./version-ecfd83cc.cjs.prod.js');
+var version = require('./version-68d92818.cjs.prod.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-0324e063.cjs.prod.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
@@ -66,23 +66,12 @@ function isValEnabled() {
 }
 function _isValEnabled() {
   _isValEnabled = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
-    var _yield$import, getCookie;
     return version._regenerator().w(function (_context) {
-      while (1) switch (_context.p = _context.n) {
+      while (1) switch (_context.n) {
         case 0:
-          _context.p = 0;
-          _context.n = 1;
-          return Promise.resolve().then(function () { return /*#__PURE__*/_interopNamespace(require('@tanstack/react-start/server')); });
-        case 1:
-          _yield$import = _context.v;
-          getCookie = _yield$import.getCookie;
-          return _context.a(2, getCookie(core.Internal.VAL_ENABLE_COOKIE_NAME) === "true");
-        case 2:
-          _context.p = 2;
-          _context.v;
-          return _context.a(2, false);
+          return _context.a(2, version.readValEnableCookie());
       }
-    }, _callee, null, [[0, 2]]);
+    }, _callee);
   }));
   return _isValEnabled.apply(this, arguments);
 }

package/dist/valbuild-tanstack.esm.js

@@ -1,4 +1,4 @@
-import { _ as _asyncToGenerator, a as _regenerator, V as VERSION$1 } from './version-a2bd1bca.esm.js';
+import { _ as _asyncToGenerator, a as _regenerator, r as readValEnableCookie, V as VERSION$1 } from './version-d388ee0d.esm.js';
 import { _ as _objectSpread2, a as _slicedToArray, b as _createForOfIteratorHelper } from './createForOfIteratorHelper-485c2ce1.esm.js';
 import { Internal as Internal$1, initVal as initVal$1, DEFAULT_CONTENT_HOST } from '@valbuild/core';
 import * as core from '@valbuild/core';
@@ -42,23 +42,12 @@ function isValEnabled() {
 }
 function _isValEnabled() {
   _isValEnabled = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
-    var _yield$import, getCookie;
     return _regenerator().w(function (_context) {
-      while (1) switch (_context.p = _context.n) {
+      while (1) switch (_context.n) {
         case 0:
-          _context.p = 0;
-          _context.n = 1;
-          return import('@tanstack/react-start/server');
-        case 1:
-          _yield$import = _context.v;
-          getCookie = _yield$import.getCookie;
-          return _context.a(2, getCookie(Internal$1.VAL_ENABLE_COOKIE_NAME) === "true");
-        case 2:
-          _context.p = 2;
-          _context.v;
-          return _context.a(2, false);
+          return _context.a(2, readValEnableCookie());
       }
-    }, _callee, null, [[0, 2]]);
+    }, _callee);
   }));
   return _isValEnabled.apply(this, arguments);
 }

package/dist/{version-8aeb5ebd.cjs.dev.js → version-68d92818.cjs.prod.js}

@@ -136,6 +136,66 @@ function _asyncToGenerator(n) {
   };
 }
 
+/**
+ * How `initVal().isValEnabled()` reaches the server without importing it.
+ *
+ * EXPERIMENTAL — see VAL_PROMPT.md.
+ *
+ * The cookie can only be read through `@tanstack/react-start/server`, and that
+ * module is reachable from this package's ROOT entry, which every client
+ * component imports. `initVal.ts` used `await import()` for exactly that reason,
+ * and under Vite the dynamic form does keep it out of the client bundle.
+ *
+ * It does not everywhere. A host that bundles this package ahead of time and
+ * audits what each chunk imports sees a dynamically imported chunk as a chunk
+ * like any other, and this one reaches TanStack's SSR path and lands on
+ * `node:stream/web`. That is why `@valbuild/tanstack` could not be built for a
+ * Cloudflare Worker at all.
+ *
+ * So the edge is inverted. The root entry holds a slot; `@valbuild/tanstack/server`
+ * fills it on import with the implementation that was already there,
+ * `hasValEnableCookieOnServer`. Nothing about the behaviour changes for an app
+ * that imports `/server` — which every app with a Val API does — and the root
+ * entry no longer names TanStack's server module at all.
+ *
+ * Ordering: the slot is filled when `/server` is first imported. An
+ * `isValEnabled()` call that somehow happens before that returns false, which
+ * is what the old implementation's `catch` returned in the same situation.
+ */
+
+var reader = null;
+function setValEnableCookieReader(read) {
+  reader = read;
+}
+function readValEnableCookie() {
+  return _readValEnableCookie.apply(this, arguments);
+}
+function _readValEnableCookie() {
+  _readValEnableCookie = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.p = _context.n) {
+        case 0:
+          if (reader) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, false);
+        case 1:
+          _context.p = 1;
+          _context.n = 2;
+          return reader();
+        case 2:
+          return _context.a(2, _context.v);
+        case 3:
+          _context.p = 3;
+          _context.v;
+          return _context.a(2, false);
+      }
+    }, _callee, null, [[1, 3]]);
+  }));
+  return _readValEnableCookie.apply(this, arguments);
+}
+
 var packageJson = {
 	name: "@valbuild/tanstack",
 	description: "Val for TanStack Start: hard-coded content - super-charged",
@@ -152,7 +212,7 @@ var packageJson = {
 		"tanstack-router",
 		"react"
 	],
-	version: "0.129.0",
+	version: "0.130.0",
 	scripts: {
 		typecheck: "tsc --noEmit",
 		test: "jest"
@@ -227,3 +287,5 @@ var VERSION = (_packageJson$version = packageJson.version) !== null && _packageJ
 exports.VERSION = VERSION;
 exports._asyncToGenerator = _asyncToGenerator;
 exports._regenerator = _regenerator;
+exports.readValEnableCookie = readValEnableCookie;
+exports.setValEnableCookieReader = setValEnableCookieReader;

package/dist/{version-a2bd1bca.esm.js → version-d388ee0d.esm.js}

@@ -134,6 +134,66 @@ function _asyncToGenerator(n) {
   };
 }
 
+/**
+ * How `initVal().isValEnabled()` reaches the server without importing it.
+ *
+ * EXPERIMENTAL — see VAL_PROMPT.md.
+ *
+ * The cookie can only be read through `@tanstack/react-start/server`, and that
+ * module is reachable from this package's ROOT entry, which every client
+ * component imports. `initVal.ts` used `await import()` for exactly that reason,
+ * and under Vite the dynamic form does keep it out of the client bundle.
+ *
+ * It does not everywhere. A host that bundles this package ahead of time and
+ * audits what each chunk imports sees a dynamically imported chunk as a chunk
+ * like any other, and this one reaches TanStack's SSR path and lands on
+ * `node:stream/web`. That is why `@valbuild/tanstack` could not be built for a
+ * Cloudflare Worker at all.
+ *
+ * So the edge is inverted. The root entry holds a slot; `@valbuild/tanstack/server`
+ * fills it on import with the implementation that was already there,
+ * `hasValEnableCookieOnServer`. Nothing about the behaviour changes for an app
+ * that imports `/server` — which every app with a Val API does — and the root
+ * entry no longer names TanStack's server module at all.
+ *
+ * Ordering: the slot is filled when `/server` is first imported. An
+ * `isValEnabled()` call that somehow happens before that returns false, which
+ * is what the old implementation's `catch` returned in the same situation.
+ */
+
+var reader = null;
+function setValEnableCookieReader(read) {
+  reader = read;
+}
+function readValEnableCookie() {
+  return _readValEnableCookie.apply(this, arguments);
+}
+function _readValEnableCookie() {
+  _readValEnableCookie = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.p = _context.n) {
+        case 0:
+          if (reader) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, false);
+        case 1:
+          _context.p = 1;
+          _context.n = 2;
+          return reader();
+        case 2:
+          return _context.a(2, _context.v);
+        case 3:
+          _context.p = 3;
+          _context.v;
+          return _context.a(2, false);
+      }
+    }, _callee, null, [[1, 3]]);
+  }));
+  return _readValEnableCookie.apply(this, arguments);
+}
+
 var packageJson = {
 	name: "@valbuild/tanstack",
 	description: "Val for TanStack Start: hard-coded content - super-charged",
@@ -150,7 +210,7 @@ var packageJson = {
 		"tanstack-router",
 		"react"
 	],
-	version: "0.129.0",
+	version: "0.130.0",
 	scripts: {
 		typecheck: "tsc --noEmit",
 		test: "jest"
@@ -222,4 +282,4 @@ var packageJson = {
 var _packageJson$version;
 var VERSION = (_packageJson$version = packageJson.version) !== null && _packageJson$version !== void 0 ? _packageJson$version : null;
 
-export { VERSION as V, _asyncToGenerator as _, _regenerator as a };
+export { VERSION as V, _asyncToGenerator as _, _regenerator as a, readValEnableCookie as r, setValEnableCookieReader as s };

package/dist/{version-ecfd83cc.cjs.prod.js → version-f2ffc76f.cjs.dev.js}

@@ -136,6 +136,66 @@ function _asyncToGenerator(n) {
   };
 }
 
+/**
+ * How `initVal().isValEnabled()` reaches the server without importing it.
+ *
+ * EXPERIMENTAL — see VAL_PROMPT.md.
+ *
+ * The cookie can only be read through `@tanstack/react-start/server`, and that
+ * module is reachable from this package's ROOT entry, which every client
+ * component imports. `initVal.ts` used `await import()` for exactly that reason,
+ * and under Vite the dynamic form does keep it out of the client bundle.
+ *
+ * It does not everywhere. A host that bundles this package ahead of time and
+ * audits what each chunk imports sees a dynamically imported chunk as a chunk
+ * like any other, and this one reaches TanStack's SSR path and lands on
+ * `node:stream/web`. That is why `@valbuild/tanstack` could not be built for a
+ * Cloudflare Worker at all.
+ *
+ * So the edge is inverted. The root entry holds a slot; `@valbuild/tanstack/server`
+ * fills it on import with the implementation that was already there,
+ * `hasValEnableCookieOnServer`. Nothing about the behaviour changes for an app
+ * that imports `/server` — which every app with a Val API does — and the root
+ * entry no longer names TanStack's server module at all.
+ *
+ * Ordering: the slot is filled when `/server` is first imported. An
+ * `isValEnabled()` call that somehow happens before that returns false, which
+ * is what the old implementation's `catch` returned in the same situation.
+ */
+
+var reader = null;
+function setValEnableCookieReader(read) {
+  reader = read;
+}
+function readValEnableCookie() {
+  return _readValEnableCookie.apply(this, arguments);
+}
+function _readValEnableCookie() {
+  _readValEnableCookie = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.p = _context.n) {
+        case 0:
+          if (reader) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, false);
+        case 1:
+          _context.p = 1;
+          _context.n = 2;
+          return reader();
+        case 2:
+          return _context.a(2, _context.v);
+        case 3:
+          _context.p = 3;
+          _context.v;
+          return _context.a(2, false);
+      }
+    }, _callee, null, [[1, 3]]);
+  }));
+  return _readValEnableCookie.apply(this, arguments);
+}
+
 var packageJson = {
 	name: "@valbuild/tanstack",
 	description: "Val for TanStack Start: hard-coded content - super-charged",
@@ -152,7 +212,7 @@ var packageJson = {
 		"tanstack-router",
 		"react"
 	],
-	version: "0.129.0",
+	version: "0.130.0",
 	scripts: {
 		typecheck: "tsc --noEmit",
 		test: "jest"
@@ -227,3 +287,5 @@ var VERSION = (_packageJson$version = packageJson.version) !== null && _packageJ
 exports.VERSION = VERSION;
 exports._asyncToGenerator = _asyncToGenerator;
 exports._regenerator = _regenerator;
+exports.readValEnableCookie = readValEnableCookie;
+exports.setValEnableCookieReader = setValEnableCookieReader;

package/package.json

@@ -14,7 +14,7 @@
     "tanstack-router",
     "react"
   ],
-  "version": "0.129.0",
+  "version": "0.130.0",
   "main": "dist/valbuild-tanstack.cjs.js",
   "module": "dist/valbuild-tanstack.esm.js",
   "exports": {
@@ -42,13 +42,13 @@
     "exports": true
   },
   "dependencies": {
-    "@valbuild/core": "0.129.0",
-    "@valbuild/language-server": "0.129.0",
-    "@valbuild/mcp": "0.129.0",
-    "@valbuild/react": "0.129.0",
-    "@valbuild/server": "0.129.0",
-    "@valbuild/ui": "0.129.0",
-    "@valbuild/shared": "0.129.0"
+    "@valbuild/core": "0.130.0",
+    "@valbuild/language-server": "0.130.0",
+    "@valbuild/mcp": "0.130.0",
+    "@valbuild/react": "0.130.0",
+    "@valbuild/server": "0.130.0",
+    "@valbuild/shared": "0.130.0",
+    "@valbuild/ui": "0.130.0"
   },
   "devDependencies": {
     "@tanstack/react-router": "^1.170.33",

package/server/dist/valbuild-tanstack-server.cjs.dev.js

@@ -2,10 +2,10 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var createForOfIteratorHelper = require('../../dist/createForOfIteratorHelper-e75681d7.cjs.dev.js');
+var version = require('../../dist/version-f2ffc76f.cjs.dev.js');
 var core = require('@valbuild/core');
+var createForOfIteratorHelper = require('../../dist/createForOfIteratorHelper-e75681d7.cjs.dev.js');
 var server = require('@valbuild/server');
-var version = require('../../dist/version-8aeb5ebd.cjs.dev.js');
 var routeFromVal = require('../../dist/routeFromVal-a9147ceb.cjs.dev.js');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/shared/internal');
@@ -178,6 +178,14 @@ function _hasValEnableCookieOnServer() {
   return _hasValEnableCookieOnServer.apply(this, arguments);
 }
 
+/**
+ * What `http` mode needs, as one object.
+ *
+ * A publish there is a commit on the project's repository, so this is the
+ * shape of "Val's content service holds my patches and my repo holds my
+ * content".
+ */
+
 /**
  * The Val API, as a handler you can mount on a TanStack Start server route.
  *
@@ -186,7 +194,7 @@ function _hasValEnableCookieOnServer() {
  * the conversion to a `Response`, which for Next needed `NextResponse` and here
  * does not need anything.
  */
-var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter) {
+var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter, commitPrepared, sourceFiles, patchStore, unsafelyAllowUnauthenticated, apiKey, publishOverride, http, valContentUrl) {
   var route = "/api/val"; // TODO: get from config
   var coreVersion = core.Internal.VERSION.core;
   if (!coreVersion) {
@@ -196,7 +204,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
   if (!tanstackVersion) {
     throw new Error("Could not get @valbuild/tanstack package version");
   }
-  return server.createValApiRouter(route, server.createValServer(valModules, route, createForOfIteratorHelper._objectSpread2({
+  return server.createValApiRouter(route, server.createValServer(valModules, route, createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2({
     versions: {
       /*
        * Reported as `next` because that is the field the wire contract has.
@@ -210,7 +218,17 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
       next: tanstackVersion,
       core: coreVersion
     }
-  }, config), config, {
+  }, config), sourceFiles !== undefined ? {
+    sourceFiles: sourceFiles
+  } : {}), patchStore !== undefined ? {
+    patchStore: patchStore
+  } : {}), unsafelyAllowUnauthenticated !== undefined ? {
+    unsafelyAllowUnauthenticated: unsafelyAllowUnauthenticated
+  } : {}), apiKey !== undefined ? {
+    apiKey: apiKey
+  } : {}), http !== undefined ? http : {}), valContentUrl !== undefined ? {
+    valContentUrl: valContentUrl
+  } : {}), config, {
     isEnabled: function isEnabled() {
       return draftMode.isEnabled();
     },
@@ -220,7 +238,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
     onDisable: function onDisable() {
       return draftMode.disable();
     }
-  }, formatter), function (valRes) {
+  }, formatter, commitPrepared, publishOverride), function (valRes) {
     var headers = new Headers();
     var valResHeaders = "headers" in valRes && valRes.headers || {};
     for (var key in valResHeaders) {
@@ -294,7 +312,7 @@ function initValServer(valModules, config, opts) {
   var _opts$draftMode;
   var draftMode = (_opts$draftMode = opts === null || opts === void 0 ? void 0 : opts.draftMode) !== null && _opts$draftMode !== void 0 ? _opts$draftMode : valDraftMode();
   return {
-    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter),
+    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter, opts === null || opts === void 0 ? void 0 : opts.commitPrepared, opts === null || opts === void 0 ? void 0 : opts.sourceFiles, opts === null || opts === void 0 ? void 0 : opts.patchStore, opts === null || opts === void 0 ? void 0 : opts.unsafelyAllowUnauthenticated, opts === null || opts === void 0 ? void 0 : opts.apiKey, opts === null || opts === void 0 ? void 0 : opts.publishOverride, opts === null || opts === void 0 ? void 0 : opts.http, opts === null || opts === void 0 ? void 0 : opts.valContentUrl),
     draftMode: draftMode
   };
 }
@@ -1024,6 +1042,13 @@ function initValMcp(valModules, config, opts) {
   }));
 }
 
+// Fills the slot the root entry holds, so `initVal().isValEnabled()` works
+// without the root entry importing TanStack's server module. See
+// valEnableCookieBridge.ts.
+version.setValEnableCookieReader(hasValEnableCookieOnServer);
+// Re-exported so an app that mounts the MCP endpoint through this package does
+// not also have to depend on `@valbuild/mcp` for the types it hands back.
+
 exports.VAL_DRAFT_MODE_COOKIE = VAL_DRAFT_MODE_COOKIE;
 exports.hasValEnableCookieOnServer = hasValEnableCookieOnServer;
 exports.initValContent = initValContent;

package/server/dist/valbuild-tanstack-server.cjs.prod.js

@@ -2,10 +2,10 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var createForOfIteratorHelper = require('../../dist/createForOfIteratorHelper-0324e063.cjs.prod.js');
+var version = require('../../dist/version-68d92818.cjs.prod.js');
 var core = require('@valbuild/core');
+var createForOfIteratorHelper = require('../../dist/createForOfIteratorHelper-0324e063.cjs.prod.js');
 var server = require('@valbuild/server');
-var version = require('../../dist/version-ecfd83cc.cjs.prod.js');
 var routeFromVal = require('../../dist/routeFromVal-6693e037.cjs.prod.js');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/shared/internal');
@@ -178,6 +178,14 @@ function _hasValEnableCookieOnServer() {
   return _hasValEnableCookieOnServer.apply(this, arguments);
 }
 
+/**
+ * What `http` mode needs, as one object.
+ *
+ * A publish there is a commit on the project's repository, so this is the
+ * shape of "Val's content service holds my patches and my repo holds my
+ * content".
+ */
+
 /**
  * The Val API, as a handler you can mount on a TanStack Start server route.
  *
@@ -186,7 +194,7 @@ function _hasValEnableCookieOnServer() {
  * the conversion to a `Response`, which for Next needed `NextResponse` and here
  * does not need anything.
  */
-var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter) {
+var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter, commitPrepared, sourceFiles, patchStore, unsafelyAllowUnauthenticated, apiKey, publishOverride, http, valContentUrl) {
   var route = "/api/val"; // TODO: get from config
   var coreVersion = core.Internal.VERSION.core;
   if (!coreVersion) {
@@ -196,7 +204,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
   if (!tanstackVersion) {
     throw new Error("Could not get @valbuild/tanstack package version");
   }
-  return server.createValApiRouter(route, server.createValServer(valModules, route, createForOfIteratorHelper._objectSpread2({
+  return server.createValApiRouter(route, server.createValServer(valModules, route, createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2(createForOfIteratorHelper._objectSpread2({
     versions: {
       /*
        * Reported as `next` because that is the field the wire contract has.
@@ -210,7 +218,17 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
       next: tanstackVersion,
       core: coreVersion
     }
-  }, config), config, {
+  }, config), sourceFiles !== undefined ? {
+    sourceFiles: sourceFiles
+  } : {}), patchStore !== undefined ? {
+    patchStore: patchStore
+  } : {}), unsafelyAllowUnauthenticated !== undefined ? {
+    unsafelyAllowUnauthenticated: unsafelyAllowUnauthenticated
+  } : {}), apiKey !== undefined ? {
+    apiKey: apiKey
+  } : {}), http !== undefined ? http : {}), valContentUrl !== undefined ? {
+    valContentUrl: valContentUrl
+  } : {}), config, {
     isEnabled: function isEnabled() {
       return draftMode.isEnabled();
     },
@@ -220,7 +238,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
     onDisable: function onDisable() {
       return draftMode.disable();
     }
-  }, formatter), function (valRes) {
+  }, formatter, commitPrepared, publishOverride), function (valRes) {
     var headers = new Headers();
     var valResHeaders = "headers" in valRes && valRes.headers || {};
     for (var key in valResHeaders) {
@@ -294,7 +312,7 @@ function initValServer(valModules, config, opts) {
   var _opts$draftMode;
   var draftMode = (_opts$draftMode = opts === null || opts === void 0 ? void 0 : opts.draftMode) !== null && _opts$draftMode !== void 0 ? _opts$draftMode : valDraftMode();
   return {
-    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter),
+    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter, opts === null || opts === void 0 ? void 0 : opts.commitPrepared, opts === null || opts === void 0 ? void 0 : opts.sourceFiles, opts === null || opts === void 0 ? void 0 : opts.patchStore, opts === null || opts === void 0 ? void 0 : opts.unsafelyAllowUnauthenticated, opts === null || opts === void 0 ? void 0 : opts.apiKey, opts === null || opts === void 0 ? void 0 : opts.publishOverride, opts === null || opts === void 0 ? void 0 : opts.http, opts === null || opts === void 0 ? void 0 : opts.valContentUrl),
     draftMode: draftMode
   };
 }
@@ -1024,6 +1042,13 @@ function initValMcp(valModules, config, opts) {
   }));
 }
 
+// Fills the slot the root entry holds, so `initVal().isValEnabled()` works
+// without the root entry importing TanStack's server module. See
+// valEnableCookieBridge.ts.
+version.setValEnableCookieReader(hasValEnableCookieOnServer);
+// Re-exported so an app that mounts the MCP endpoint through this package does
+// not also have to depend on `@valbuild/mcp` for the types it hands back.
+
 exports.VAL_DRAFT_MODE_COOKIE = VAL_DRAFT_MODE_COOKIE;
 exports.hasValEnableCookieOnServer = hasValEnableCookieOnServer;
 exports.initValContent = initValContent;

package/server/dist/valbuild-tanstack-server.esm.js

@@ -1,7 +1,7 @@
-import { _ as _objectSpread2, a as _slicedToArray, d as _defineProperty } from '../../dist/createForOfIteratorHelper-485c2ce1.esm.js';
+import { _ as _asyncToGenerator, a as _regenerator, V as VERSION, s as setValEnableCookieReader } from '../../dist/version-d388ee0d.esm.js';
 import { Internal } from '@valbuild/core';
+import { _ as _objectSpread2, a as _slicedToArray, d as _defineProperty } from '../../dist/createForOfIteratorHelper-485c2ce1.esm.js';
 import { createValApiRouter, createValServer } from '@valbuild/server';
-import { _ as _asyncToGenerator, a as _regenerator, V as VERSION } from '../../dist/version-a2bd1bca.esm.js';
 import { b as initValRouteFromVal, g as getJsonEntryStegaRoot, i as isJsonValuesRecordSchema, a as getValRouteUrlFromVal, _ as _typeof } from '../../dist/routeFromVal-728295a0.esm.js';
 import { stegaEncode, SET_AUTO_TAG_JSX_ENABLED } from '@valbuild/react/stega';
 import { VAL_SESSION_COOKIE } from '@valbuild/shared/internal';
@@ -156,6 +156,14 @@ function _hasValEnableCookieOnServer() {
   return _hasValEnableCookieOnServer.apply(this, arguments);
 }
 
+/**
+ * What `http` mode needs, as one object.
+ *
+ * A publish there is a commit on the project's repository, so this is the
+ * shape of "Val's content service holds my patches and my repo holds my
+ * content".
+ */
+
 /**
  * The Val API, as a handler you can mount on a TanStack Start server route.
  *
@@ -164,7 +172,7 @@ function _hasValEnableCookieOnServer() {
  * the conversion to a `Response`, which for Next needed `NextResponse` and here
  * does not need anything.
  */
-var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter) {
+var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter, commitPrepared, sourceFiles, patchStore, unsafelyAllowUnauthenticated, apiKey, publishOverride, http, valContentUrl) {
   var route = "/api/val"; // TODO: get from config
   var coreVersion = Internal.VERSION.core;
   if (!coreVersion) {
@@ -174,7 +182,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
   if (!tanstackVersion) {
     throw new Error("Could not get @valbuild/tanstack package version");
   }
-  return createValApiRouter(route, createValServer(valModules, route, _objectSpread2({
+  return createValApiRouter(route, createValServer(valModules, route, _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
     versions: {
       /*
        * Reported as `next` because that is the field the wire contract has.
@@ -188,7 +196,17 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
       next: tanstackVersion,
       core: coreVersion
     }
-  }, config), config, {
+  }, config), sourceFiles !== undefined ? {
+    sourceFiles: sourceFiles
+  } : {}), patchStore !== undefined ? {
+    patchStore: patchStore
+  } : {}), unsafelyAllowUnauthenticated !== undefined ? {
+    unsafelyAllowUnauthenticated: unsafelyAllowUnauthenticated
+  } : {}), apiKey !== undefined ? {
+    apiKey: apiKey
+  } : {}), http !== undefined ? http : {}), valContentUrl !== undefined ? {
+    valContentUrl: valContentUrl
+  } : {}), config, {
     isEnabled: function isEnabled() {
       return draftMode.isEnabled();
     },
@@ -198,7 +216,7 @@ var initValApiHandler = function initValApiHandler(valModules, config, draftMode
     onDisable: function onDisable() {
       return draftMode.disable();
     }
-  }, formatter), function (valRes) {
+  }, formatter, commitPrepared, publishOverride), function (valRes) {
     var headers = new Headers();
     var valResHeaders = "headers" in valRes && valRes.headers || {};
     for (var key in valResHeaders) {
@@ -272,7 +290,7 @@ function initValServer(valModules, config, opts) {
   var _opts$draftMode;
   var draftMode = (_opts$draftMode = opts === null || opts === void 0 ? void 0 : opts.draftMode) !== null && _opts$draftMode !== void 0 ? _opts$draftMode : valDraftMode();
   return {
-    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter),
+    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter, opts === null || opts === void 0 ? void 0 : opts.commitPrepared, opts === null || opts === void 0 ? void 0 : opts.sourceFiles, opts === null || opts === void 0 ? void 0 : opts.patchStore, opts === null || opts === void 0 ? void 0 : opts.unsafelyAllowUnauthenticated, opts === null || opts === void 0 ? void 0 : opts.apiKey, opts === null || opts === void 0 ? void 0 : opts.publishOverride, opts === null || opts === void 0 ? void 0 : opts.http, opts === null || opts === void 0 ? void 0 : opts.valContentUrl),
     draftMode: draftMode
   };
 }
@@ -1002,4 +1020,11 @@ function initValMcp(valModules, config, opts) {
   }));
 }
 
+// Fills the slot the root entry holds, so `initVal().isValEnabled()` works
+// without the root entry importing TanStack's server module. See
+// valEnableCookieBridge.ts.
+setValEnableCookieReader(hasValEnableCookieOnServer);
+// Re-exported so an app that mounts the MCP endpoint through this package does
+// not also have to depend on `@valbuild/mcp` for the types it hands back.
+
 export { VAL_DRAFT_MODE_COOKIE, hasValEnableCookieOnServer, initValContent, initValMcp, initValServer, valDraftMode };