@valbuild/cli 0.132.1 → 0.134.0

package/CHANGELOG.md

@@ -1,5 +1,118 @@
 # @valbuild/cli
 
+## 0.134.0
+
+### Minor Changes
+
+- [#698](https://github.com/valbuild/val/pull/698) [`15c5367`](https://github.com/valbuild/val/commit/15c536746c0f813a51a2dce8a2cb1e617174c238) Thanks [@freekh](https://github.com/freekh)! - Add `val publish`, which publishes a project's build through content.val.build.
+
+  ```sh
+  npx val publish                          # publish the artifacts in .val/publish
+  npx val publish --artifacts build/out    # publish a directory by name
+  npx val publish --dry-run                # verify, and stop before the site changes
+  ```
+
+  It declares what the build is made of — every artifact by key, sha256 and size
+  — uploads only the ones content does not already hold, straight to object
+  storage, and then has content build and render the build as a canary before
+  anything goes live. A build content already holds uploads nothing. A canary
+  that does not render is never promoted, and the command exits non-zero with
+  content's own problem codes, hints included, so CI gates on it. Declaring the
+  same build twice resumes that publish rather than starting a second one, so a
+  re-run of a CI job picks up where it left off.
+
+  The artifacts are read from a directory whose layout is the key namespace:
+  the path of each file under it is its artifact key — `server`, `client`,
+  `css`, `rsc`, `layer`, or a path under `chunk/server`, `chunk/client`,
+  `chunk/rsc`, `asset`, `public`. Nothing is renamed on the way, since an asset
+  is addressed by the path the built code imports it at.
+
+  Authenticates with `VAL_PROJECT_TOKEN` — the single secret a repository needs,
+  since the token names its project — or with the `val login` token in
+  `.val/pat.json`, which is exchanged for a ten minute publish token and needs
+  the project (`"<org>/<project>"`) in `val.config` or `VAL_PROJECT`. Never a
+  command line flag: an argument is visible to anyone who can list processes,
+  and it is kept in shell history and in the log of every CI job that echoes its
+  command line.
+
+  The commit and branch the build is of are taken from `--commit` / `--branch`,
+  then `VAL_GIT_COMMIT` / `VAL_GIT_BRANCH`, then `GITHUB_SHA` / `GITHUB_REF_NAME`,
+  then git. The commit is baked into the published site and decides which version
+  of its own content it reads, so the command refuses rather than guessing when
+  it cannot tell.
+
+### Patch Changes
+
+- Updated dependencies [[`be78a9b`](https://github.com/valbuild/val/commit/be78a9b51678439f7ecb1c7f3887f9e8e1261a13), [`16c49ea`](https://github.com/valbuild/val/commit/16c49ea6dd97c7a96bbfdf211af9bab5884579e2), [`eaa265e`](https://github.com/valbuild/val/commit/eaa265e78d9f6d2a1b685c38901612b8a3704eed)]:
+  - @valbuild/server@0.134.0
+  - @valbuild/core@0.134.0
+  - @valbuild/shared@0.134.0
+  - @valbuild/language-server@0.134.0
+
+## 0.133.0
+
+### Minor Changes
+
+- [#700](https://github.com/valbuild/val/pull/700) [`802412b`](https://github.com/valbuild/val/commit/802412b92c06bc1abbca78c86885e39c8710dd83) Thanks [@freekh](https://github.com/freekh)! - http mode no longer needs a git repository
+
+  A Val app can now run in http mode with no commit and no branch — its content
+  service is the store of record, and git is an optional mirror of the code. This
+  is what `fs` mode has always done: it has never had git, and it works.
+
+  Before this, `VAL_API_KEY` and `VAL_SECRET` were not enough. `VAL_GIT_COMMIT`
+  and `VAL_GIT_BRANCH` were required too, so a deployment with no commit to name
+  either threw at boot or fell through to `fs` mode and reached for a working
+  tree that was not there.
+
+  **Breaking, if you pass `http` options in code.** `gitCommit` and `gitBranch`
+  are replaced by one optional `git`:
+
+  ```diff
+   initValServer(valModules, config, {
+     http: {
+       apiKey,
+       valSecret,
+  -    gitCommit: process.env.VAL_GIT_COMMIT,
+  -    gitBranch: "main",
+  +    // Only for a project whose content is mirrored into a repository.
+  +    // Omit it entirely otherwise.
+  +    git: { commit: process.env.VAL_GIT_COMMIT, branch: "main" },
+     },
+   })
+  ```
+
+  `VAL_GIT_COMMIT` and `VAL_GIT_BRANCH` still work and are still read; they are
+  simply no longer required. Set both or neither — a commit without a branch, or
+  a branch without a commit, is refused at startup with a message naming the
+  missing half, rather than failing later at a publish.
+
+  **What a commit is for, where you have one.** Turning pending patches into new
+  `.val.ts` text means reading the current text first, and that read goes to the
+  content service at that commit. It is the publish path, not the serving path: a
+  committed render reads the source compiled into the build and asks the content
+  service nothing. With no repository there is nothing to write `.val.ts` into,
+  so a publish records the module's data and its schema and skips the file — and
+  that data is what history reads, so nothing is lost.
+
+  **A publish can now be refused by name, before it is attempted.** If a project
+  mirrors its commits into a repository but the running deployment was built
+  before that repository existed, it has no commit to write the mirror against.
+  Publishing anyway would save the content and silently leave the repository
+  behind. The Studio now disables Publish and shows why, and `/save` refuses with
+  a `no-base` code instead of failing partway.
+
+  **Also:** `ValCommit` and `HistoricalCommit` have nullable `parentCommitSha`
+  and `clientCommitSha`, and `/stat`'s `commitSha` is optional. A root commit has
+  no parent, and a publisher with no repository does not report where it was. If
+  you read these fields, handle `null`.
+
+### Patch Changes
+
+- Updated dependencies [[`802412b`](https://github.com/valbuild/val/commit/802412b92c06bc1abbca78c86885e39c8710dd83)]:
+  - @valbuild/server@0.133.0
+  - @valbuild/shared@0.133.0
+  - @valbuild/language-server@0.133.0
+
 ## 0.132.1
 
 ### Patch Changes