@valbuild/cli 0.136.0 → 0.136.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @valbuild/cli
 
+## 0.136.2
+
+### Patch Changes
+
+- Updated dependencies [[`f76cd56`](https://github.com/valbuild/val/commit/f76cd56b9f1c1bcc0a608a7a4de24b1e776adccb)]:
+  - @valbuild/server@0.136.2
+  - @valbuild/shared@0.136.2
+  - @valbuild/language-server@0.136.2
+
+## 0.136.1
+
+### Patch Changes
+
+- Updated dependencies [[`e673b43`](https://github.com/valbuild/val/commit/e673b43feaf48b7f30881d6786c858a0cb6a44a2), [`5c82928`](https://github.com/valbuild/val/commit/5c82928992d29f133f81cf0704a273c0449b18f1), [`4450be5`](https://github.com/valbuild/val/commit/4450be570ec3a66d7d98ba273c333ca2d2f163d9), [`d2f385a`](https://github.com/valbuild/val/commit/d2f385a04978992a5036379235e447ba7775faef)]:
+  - @valbuild/shared@0.136.1
+  - @valbuild/server@0.136.1
+  - @valbuild/core@0.136.1
+  - @valbuild/language-server@0.136.1
+
 ## 0.136.0
 
 ### Patch Changes

package/cli/dist/valbuild-cli-cli.cjs.dev.js

@@ -15,8 +15,6 @@ var JSZip = require('jszip');
 var readline = require('readline');
 var crypto = require('crypto');
 var zlib = require('zlib');
-var zod = require('zod');
-var zodValidationError = require('zod-validation-error');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
 
@@ -2419,127 +2417,6 @@ function errorDetailsOf(body) {
   return undefined;
 }
 
-/**
- * Reading what content answers.
- *
- * Every type here comes from `contentApi.ts`, which is a copy of the
- * service's own `Api.ts` - so the shapes are not re-derived from what this end
- * wishes it received, and a copy brought up to date fails to compile wherever
- * this CLI has not caught up.
- *
- * The schemas are the runtime half, and they are needed as well as the types:
- * what arrives is JSON over HTTP from a service that versions separately, so a
- * type alone asserts a shape rather than checking one. Each schema is
- * annotated with the copied type it must produce (`z.ZodType<DeclareResponse>`
- * and so on), which is what ties the two halves together - a schema that drifts
- * from the copy does not compile, and an answer that drifts from the schema
- * does not parse. `ValOpsHttp` in `@valbuild/server` reads every other content
- * route the same way.
- *
- * Nothing here is laxer than the copy. An optional field is optional because
- * the service says so; making a required one optional here would hide exactly
- * the drift this file exists to catch.
- */
-
-/** An artifact, as it is declared: by key, by hash, by size. */
-
-/** Permission to write one artifact's bytes to object storage. */
-
-const publishState = zod.z.enum(["awaiting-artifacts", "ready", "verified", "live", "failed", "expired"]);
-const publishProblem = zod.z.object({
-  code: zod.z.string(),
-  message: zod.z.string(),
-  hint: zod.z.string().optional(),
-  keys: zod.z.array(zod.z.string()).optional()
-});
-const uploadSlot = zod.z.object({
-  key: zod.z.string(),
-  url: zod.z.string(),
-  method: zod.z.literal("PUT"),
-  headers: zod.z.record(zod.z.string(), zod.z.string()),
-  expiresAt: zod.z.string()
-});
-const declareResponse = zod.z.object({
-  publishId: zod.z.string(),
-  state: publishState,
-  project: zod.z.object({
-    publicProjectId: zod.z.string(),
-    siteUrl: zod.z.string().nullable()
-  }),
-  uploads: zod.z.array(uploadSlot),
-  have: zod.z.array(zod.z.string())
-});
-const artifactsResponse = zod.z.object({
-  state: publishState,
-  problems: zod.z.array(publishProblem)
-});
-const verifyResponse = zod.z.object({
-  state: publishState,
-  ok: zod.z.boolean(),
-  previewUrl: zod.z.string().nullable(),
-  problems: zod.z.array(publishProblem)
-});
-const promoteResponse = zod.z.object({
-  state: publishState,
-  url: zod.z.string().nullable(),
-  commit: zod.z.string().nullable()
-});
-const statusResponse = zod.z.object({
-  publishId: zod.z.string(),
-  state: publishState,
-  buildHash: zod.z.string(),
-  missing: zod.z.array(zod.z.string()),
-  problems: zod.z.array(publishProblem)
-});
-const publishTokenResponse = zod.z.object({
-  token: zod.z.string(),
-  expiresAt: zod.z.string().nullable(),
-  publicProjectId: zod.z.string(),
-  productionUrl: zod.z.string().nullable()
-});
-
-/**
- * Content answered, and the answer was not one this CLI can act on.
- *
- * Separate from a refusal, which is content saying no in a sentence meant for
- * a person. This is two programs disagreeing - the copy in `contentApi.ts` and
- * the service that has moved on from it - and the two want opposite things
- * said about them.
- */
-class PublishProtocolError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PublishProtocolError";
-  }
-}
-const parseDeclare = body => parse(declareResponse, body, "POST /v1/publish");
-const parseArtifacts = body => parse(artifactsResponse, body, "POST /v1/publish/{id}/artifacts");
-const parseVerify = body => parse(verifyResponse, body, "POST /v1/publish/{id}/verify");
-const parsePromote = body => parse(promoteResponse, body, "POST /v1/publish/{id}/promote");
-const parseStatus = body => parse(statusResponse, body, "GET /v1/publish/{id}");
-const parsePublishToken = (body, call) => parse(publishTokenResponse, body, call);
-
-/**
- * The `details` of a refusal, when it carries a list of problems.
- *
- * Every non-2xx is `{ statusCode, message, details? }`, and the publish routes
- * put `PublishProblem[]` in `details` - a declaration is answered with EVERY
- * problem rather than the first, because finding them one round trip at a time
- * is how a publish takes six attempts. Anything else in there is somebody
- * else's `details` and is left to the caller's own message.
- */
-function parseProblems(details) {
-  const parsed = zod.z.array(publishProblem).safeParse(details);
-  return parsed.success ? parsed.data : [];
-}
-function parse(schema, body, call) {
-  const parsed = schema.safeParse(body);
-  if (!parsed.success) {
-    throw new PublishProtocolError(`${call} answered with something this CLI cannot read: ${zodValidationError.fromError(parsed.error).toString()}`);
-  }
-  return parsed.data;
-}
-
 function createPublishClient(options) {
   const {
     host,
@@ -2553,28 +2430,28 @@ function createPublishClient(options) {
   };
   const publishUrl = (publishId, step) => `${host}/v1/publish/${encodeURIComponent(publishId)}${step ? `/${step}` : ""}`;
   return {
-    declare: async body => parseDeclare(await postJson({
+    declare: async body => internal.parseDeclare(await postJson({
       url: `${host}/v1/publish`,
       headers,
       body,
       fetchImpl
     })),
-    confirmArtifacts: async publishId => parseArtifacts(await postJson({
+    confirmArtifacts: async publishId => internal.parseArtifacts(await postJson({
       url: publishUrl(publishId, "artifacts"),
       headers,
       fetchImpl
     })),
-    verify: async publishId => parseVerify(await postJson({
+    verify: async publishId => internal.parseVerify(await postJson({
       url: publishUrl(publishId, "verify"),
       headers,
       fetchImpl
     })),
-    promote: async publishId => parsePromote(await postJson({
+    promote: async publishId => internal.parsePromote(await postJson({
       url: publishUrl(publishId, "promote"),
       headers,
       fetchImpl
     })),
-    status: async publishId => parseStatus(await getJson({
+    status: async publishId => internal.parseStatus(await getJson({
       url: publishUrl(publishId),
       headers,
       fetchImpl
@@ -2808,9 +2685,9 @@ async function exchangePersonalAccessToken(options) {
   }
   let exchanged;
   try {
-    exchanged = parsePublishToken(body, `POST ${url}`);
+    exchanged = internal.parsePublishToken(body, `POST ${url}`);
   } catch (err) {
-    if (err instanceof PublishProtocolError) {
+    if (err instanceof internal.PublishProtocolError) {
       return {
         status: "error",
         message: err.message
@@ -3166,7 +3043,7 @@ async function declare(client, body) {
       return {
         status: "refused",
         message: err.message,
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3186,7 +3063,7 @@ async function confirmArtifacts(client, publishId) {
       // Both are fixed by fresh slots and sending again.
       return {
         status: "mismatch",
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3230,7 +3107,7 @@ async function promote(client, publishId) {
       return {
         status: "stale",
         message: err.message + (head ? ` The branch is at ${head.slice(0, 7)} now.` : ""),
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3265,7 +3142,7 @@ async function uploadAll(args) {
       if (file === undefined) {
         // Content asked for a key this build does not have. Declaring again
         // cannot fix that, so it is not a round; it is a bug on one side.
-        throw new PublishProtocolError(`Content asked for an artifact this build does not have: ${slot.key}`);
+        throw new internal.PublishProtocolError(`Content asked for an artifact this build does not have: ${slot.key}`);
       }
       for (let attempt = 1;; attempt++) {
         try {
@@ -3313,7 +3190,7 @@ function errorFrom(err) {
       message: err.statusCode === 401 || err.statusCode === 403 ? `${err.message}\n\nThe credential was refused. A project token can be revoked, and only a token carrying val:publish may publish.` : `${err.message}${detail ? `\n${detail}` : ""}`
     };
   }
-  if (err instanceof UploadError || err instanceof PublishProtocolError) {
+  if (err instanceof UploadError || err instanceof internal.PublishProtocolError) {
     return {
       status: "error",
       message: err.message

package/cli/dist/valbuild-cli-cli.cjs.prod.js

@@ -15,8 +15,6 @@ var JSZip = require('jszip');
 var readline = require('readline');
 var crypto = require('crypto');
 var zlib = require('zlib');
-var zod = require('zod');
-var zodValidationError = require('zod-validation-error');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
 
@@ -2419,127 +2417,6 @@ function errorDetailsOf(body) {
   return undefined;
 }
 
-/**
- * Reading what content answers.
- *
- * Every type here comes from `contentApi.ts`, which is a copy of the
- * service's own `Api.ts` - so the shapes are not re-derived from what this end
- * wishes it received, and a copy brought up to date fails to compile wherever
- * this CLI has not caught up.
- *
- * The schemas are the runtime half, and they are needed as well as the types:
- * what arrives is JSON over HTTP from a service that versions separately, so a
- * type alone asserts a shape rather than checking one. Each schema is
- * annotated with the copied type it must produce (`z.ZodType<DeclareResponse>`
- * and so on), which is what ties the two halves together - a schema that drifts
- * from the copy does not compile, and an answer that drifts from the schema
- * does not parse. `ValOpsHttp` in `@valbuild/server` reads every other content
- * route the same way.
- *
- * Nothing here is laxer than the copy. An optional field is optional because
- * the service says so; making a required one optional here would hide exactly
- * the drift this file exists to catch.
- */
-
-/** An artifact, as it is declared: by key, by hash, by size. */
-
-/** Permission to write one artifact's bytes to object storage. */
-
-const publishState = zod.z.enum(["awaiting-artifacts", "ready", "verified", "live", "failed", "expired"]);
-const publishProblem = zod.z.object({
-  code: zod.z.string(),
-  message: zod.z.string(),
-  hint: zod.z.string().optional(),
-  keys: zod.z.array(zod.z.string()).optional()
-});
-const uploadSlot = zod.z.object({
-  key: zod.z.string(),
-  url: zod.z.string(),
-  method: zod.z.literal("PUT"),
-  headers: zod.z.record(zod.z.string(), zod.z.string()),
-  expiresAt: zod.z.string()
-});
-const declareResponse = zod.z.object({
-  publishId: zod.z.string(),
-  state: publishState,
-  project: zod.z.object({
-    publicProjectId: zod.z.string(),
-    siteUrl: zod.z.string().nullable()
-  }),
-  uploads: zod.z.array(uploadSlot),
-  have: zod.z.array(zod.z.string())
-});
-const artifactsResponse = zod.z.object({
-  state: publishState,
-  problems: zod.z.array(publishProblem)
-});
-const verifyResponse = zod.z.object({
-  state: publishState,
-  ok: zod.z.boolean(),
-  previewUrl: zod.z.string().nullable(),
-  problems: zod.z.array(publishProblem)
-});
-const promoteResponse = zod.z.object({
-  state: publishState,
-  url: zod.z.string().nullable(),
-  commit: zod.z.string().nullable()
-});
-const statusResponse = zod.z.object({
-  publishId: zod.z.string(),
-  state: publishState,
-  buildHash: zod.z.string(),
-  missing: zod.z.array(zod.z.string()),
-  problems: zod.z.array(publishProblem)
-});
-const publishTokenResponse = zod.z.object({
-  token: zod.z.string(),
-  expiresAt: zod.z.string().nullable(),
-  publicProjectId: zod.z.string(),
-  productionUrl: zod.z.string().nullable()
-});
-
-/**
- * Content answered, and the answer was not one this CLI can act on.
- *
- * Separate from a refusal, which is content saying no in a sentence meant for
- * a person. This is two programs disagreeing - the copy in `contentApi.ts` and
- * the service that has moved on from it - and the two want opposite things
- * said about them.
- */
-class PublishProtocolError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PublishProtocolError";
-  }
-}
-const parseDeclare = body => parse(declareResponse, body, "POST /v1/publish");
-const parseArtifacts = body => parse(artifactsResponse, body, "POST /v1/publish/{id}/artifacts");
-const parseVerify = body => parse(verifyResponse, body, "POST /v1/publish/{id}/verify");
-const parsePromote = body => parse(promoteResponse, body, "POST /v1/publish/{id}/promote");
-const parseStatus = body => parse(statusResponse, body, "GET /v1/publish/{id}");
-const parsePublishToken = (body, call) => parse(publishTokenResponse, body, call);
-
-/**
- * The `details` of a refusal, when it carries a list of problems.
- *
- * Every non-2xx is `{ statusCode, message, details? }`, and the publish routes
- * put `PublishProblem[]` in `details` - a declaration is answered with EVERY
- * problem rather than the first, because finding them one round trip at a time
- * is how a publish takes six attempts. Anything else in there is somebody
- * else's `details` and is left to the caller's own message.
- */
-function parseProblems(details) {
-  const parsed = zod.z.array(publishProblem).safeParse(details);
-  return parsed.success ? parsed.data : [];
-}
-function parse(schema, body, call) {
-  const parsed = schema.safeParse(body);
-  if (!parsed.success) {
-    throw new PublishProtocolError(`${call} answered with something this CLI cannot read: ${zodValidationError.fromError(parsed.error).toString()}`);
-  }
-  return parsed.data;
-}
-
 function createPublishClient(options) {
   const {
     host,
@@ -2553,28 +2430,28 @@ function createPublishClient(options) {
   };
   const publishUrl = (publishId, step) => `${host}/v1/publish/${encodeURIComponent(publishId)}${step ? `/${step}` : ""}`;
   return {
-    declare: async body => parseDeclare(await postJson({
+    declare: async body => internal.parseDeclare(await postJson({
       url: `${host}/v1/publish`,
       headers,
       body,
       fetchImpl
     })),
-    confirmArtifacts: async publishId => parseArtifacts(await postJson({
+    confirmArtifacts: async publishId => internal.parseArtifacts(await postJson({
       url: publishUrl(publishId, "artifacts"),
       headers,
       fetchImpl
     })),
-    verify: async publishId => parseVerify(await postJson({
+    verify: async publishId => internal.parseVerify(await postJson({
       url: publishUrl(publishId, "verify"),
       headers,
       fetchImpl
     })),
-    promote: async publishId => parsePromote(await postJson({
+    promote: async publishId => internal.parsePromote(await postJson({
       url: publishUrl(publishId, "promote"),
       headers,
       fetchImpl
     })),
-    status: async publishId => parseStatus(await getJson({
+    status: async publishId => internal.parseStatus(await getJson({
       url: publishUrl(publishId),
       headers,
       fetchImpl
@@ -2808,9 +2685,9 @@ async function exchangePersonalAccessToken(options) {
   }
   let exchanged;
   try {
-    exchanged = parsePublishToken(body, `POST ${url}`);
+    exchanged = internal.parsePublishToken(body, `POST ${url}`);
   } catch (err) {
-    if (err instanceof PublishProtocolError) {
+    if (err instanceof internal.PublishProtocolError) {
       return {
         status: "error",
         message: err.message
@@ -3166,7 +3043,7 @@ async function declare(client, body) {
       return {
         status: "refused",
         message: err.message,
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3186,7 +3063,7 @@ async function confirmArtifacts(client, publishId) {
       // Both are fixed by fresh slots and sending again.
       return {
         status: "mismatch",
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3230,7 +3107,7 @@ async function promote(client, publishId) {
       return {
         status: "stale",
         message: err.message + (head ? ` The branch is at ${head.slice(0, 7)} now.` : ""),
-        problems: parseProblems(err.details)
+        problems: internal.parseProblems(err.details)
       };
     }
     throw err;
@@ -3265,7 +3142,7 @@ async function uploadAll(args) {
       if (file === undefined) {
         // Content asked for a key this build does not have. Declaring again
         // cannot fix that, so it is not a round; it is a bug on one side.
-        throw new PublishProtocolError(`Content asked for an artifact this build does not have: ${slot.key}`);
+        throw new internal.PublishProtocolError(`Content asked for an artifact this build does not have: ${slot.key}`);
       }
       for (let attempt = 1;; attempt++) {
         try {
@@ -3313,7 +3190,7 @@ function errorFrom(err) {
       message: err.statusCode === 401 || err.statusCode === 403 ? `${err.message}\n\nThe credential was refused. A project token can be revoked, and only a token carrying val:publish may publish.` : `${err.message}${detail ? `\n${detail}` : ""}`
     };
   }
-  if (err instanceof UploadError || err instanceof PublishProtocolError) {
+  if (err instanceof UploadError || err instanceof internal.PublishProtocolError) {
     return {
       status: "error",
       message: err.message

package/cli/dist/valbuild-cli-cli.esm.js

@@ -6,15 +6,13 @@ import { glob } from 'fast-glob';
 import { Internal, DEFAULT_VAL_REMOTE_HOST, DEFAULT_CONTENT_HOST } from '@valbuild/core';
 import { createPrettierFormatter, createService, createValModuleFileInspector, fixHandlers, createFixPatch, getModulePathRange, findJsonEntryFilePath, createJsonEntryPathMap, createModulePathMap, findAndEvalValConfigFile, getSettings, uploadRemoteFile, createDefaultValFSHost, startValLogin, awaitValLoginConfirmation, persistPersonalAccessToken, ValLoginError, loadValModules, safeReadGit, ValOpsHttp, ValOpsFS, getPersonalAccessTokenPath, parsePersonalAccessTokenFile, formatPatchSourceError } from '@valbuild/server';
 import fs from 'fs/promises';
-import { resolveSchemaSourceFixes } from '@valbuild/shared/internal';
+import { resolveSchemaSourceFixes, parseDeclare, parseArtifacts, parseVerify, parsePromote, parseStatus, parsePublishToken, PublishProtocolError, parseProblems } from '@valbuild/shared/internal';
 import fs$1 from 'fs';
 import ts from 'typescript';
 import JSZip from 'jszip';
 import readline from 'readline';
 import crypto from 'crypto';
 import zlib from 'zlib';
-import { z } from 'zod';
-import { fromError } from 'zod-validation-error';
 
 function error(message) {
   console.error(chalk.red("❌Error: ") + message);
@@ -2385,127 +2383,6 @@ function errorDetailsOf(body) {
   return undefined;
 }
 
-/**
- * Reading what content answers.
- *
- * Every type here comes from `contentApi.ts`, which is a copy of the
- * service's own `Api.ts` - so the shapes are not re-derived from what this end
- * wishes it received, and a copy brought up to date fails to compile wherever
- * this CLI has not caught up.
- *
- * The schemas are the runtime half, and they are needed as well as the types:
- * what arrives is JSON over HTTP from a service that versions separately, so a
- * type alone asserts a shape rather than checking one. Each schema is
- * annotated with the copied type it must produce (`z.ZodType<DeclareResponse>`
- * and so on), which is what ties the two halves together - a schema that drifts
- * from the copy does not compile, and an answer that drifts from the schema
- * does not parse. `ValOpsHttp` in `@valbuild/server` reads every other content
- * route the same way.
- *
- * Nothing here is laxer than the copy. An optional field is optional because
- * the service says so; making a required one optional here would hide exactly
- * the drift this file exists to catch.
- */
-
-/** An artifact, as it is declared: by key, by hash, by size. */
-
-/** Permission to write one artifact's bytes to object storage. */
-
-const publishState = z.enum(["awaiting-artifacts", "ready", "verified", "live", "failed", "expired"]);
-const publishProblem = z.object({
-  code: z.string(),
-  message: z.string(),
-  hint: z.string().optional(),
-  keys: z.array(z.string()).optional()
-});
-const uploadSlot = z.object({
-  key: z.string(),
-  url: z.string(),
-  method: z.literal("PUT"),
-  headers: z.record(z.string(), z.string()),
-  expiresAt: z.string()
-});
-const declareResponse = z.object({
-  publishId: z.string(),
-  state: publishState,
-  project: z.object({
-    publicProjectId: z.string(),
-    siteUrl: z.string().nullable()
-  }),
-  uploads: z.array(uploadSlot),
-  have: z.array(z.string())
-});
-const artifactsResponse = z.object({
-  state: publishState,
-  problems: z.array(publishProblem)
-});
-const verifyResponse = z.object({
-  state: publishState,
-  ok: z.boolean(),
-  previewUrl: z.string().nullable(),
-  problems: z.array(publishProblem)
-});
-const promoteResponse = z.object({
-  state: publishState,
-  url: z.string().nullable(),
-  commit: z.string().nullable()
-});
-const statusResponse = z.object({
-  publishId: z.string(),
-  state: publishState,
-  buildHash: z.string(),
-  missing: z.array(z.string()),
-  problems: z.array(publishProblem)
-});
-const publishTokenResponse = z.object({
-  token: z.string(),
-  expiresAt: z.string().nullable(),
-  publicProjectId: z.string(),
-  productionUrl: z.string().nullable()
-});
-
-/**
- * Content answered, and the answer was not one this CLI can act on.
- *
- * Separate from a refusal, which is content saying no in a sentence meant for
- * a person. This is two programs disagreeing - the copy in `contentApi.ts` and
- * the service that has moved on from it - and the two want opposite things
- * said about them.
- */
-class PublishProtocolError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PublishProtocolError";
-  }
-}
-const parseDeclare = body => parse(declareResponse, body, "POST /v1/publish");
-const parseArtifacts = body => parse(artifactsResponse, body, "POST /v1/publish/{id}/artifacts");
-const parseVerify = body => parse(verifyResponse, body, "POST /v1/publish/{id}/verify");
-const parsePromote = body => parse(promoteResponse, body, "POST /v1/publish/{id}/promote");
-const parseStatus = body => parse(statusResponse, body, "GET /v1/publish/{id}");
-const parsePublishToken = (body, call) => parse(publishTokenResponse, body, call);
-
-/**
- * The `details` of a refusal, when it carries a list of problems.
- *
- * Every non-2xx is `{ statusCode, message, details? }`, and the publish routes
- * put `PublishProblem[]` in `details` - a declaration is answered with EVERY
- * problem rather than the first, because finding them one round trip at a time
- * is how a publish takes six attempts. Anything else in there is somebody
- * else's `details` and is left to the caller's own message.
- */
-function parseProblems(details) {
-  const parsed = z.array(publishProblem).safeParse(details);
-  return parsed.success ? parsed.data : [];
-}
-function parse(schema, body, call) {
-  const parsed = schema.safeParse(body);
-  if (!parsed.success) {
-    throw new PublishProtocolError(`${call} answered with something this CLI cannot read: ${fromError(parsed.error).toString()}`);
-  }
-  return parsed.data;
-}
-
 function createPublishClient(options) {
   const {
     host,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@valbuild/cli",
   "private": false,
-  "version": "0.136.0",
+  "version": "0.136.2",
   "description": "Val CLI tools",
   "repository": {
     "type": "git",
@@ -26,11 +26,11 @@
     "picocolors": "^1.1.1",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.136.0",
+    "@valbuild/core": "0.136.1",
     "@valbuild/eslint-plugin": "0.125.0",
-    "@valbuild/language-server": "0.136.0",
-    "@valbuild/server": "0.136.0",
-    "@valbuild/shared": "0.136.0"
+    "@valbuild/language-server": "0.136.2",
+    "@valbuild/server": "0.136.2",
+    "@valbuild/shared": "0.136.2"
   },
   "peerDependencies": {
     "prettier": "*",

package/src/publish/artifacts.ts

@@ -2,7 +2,7 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import zlib from "zlib";
-import { DeclaredArtifact } from "./protocol";
+import { DeclaredArtifact } from "@valbuild/shared/internal";
 
 /**
  * Where an artifact's bytes are, and what it is called on the wire.

package/src/publish/client.ts

@@ -13,7 +13,7 @@ import {
   parsePromote,
   parseStatus,
   parseVerify,
-} from "./protocol";
+} from "@valbuild/shared/internal";
 
 export type PublishClient = {
   declare(body: DeclareBody): Promise<DeclareResponse>;

package/src/publish/credentials.ts

@@ -4,7 +4,10 @@ import {
   parsePersonalAccessTokenFile,
 } from "@valbuild/server";
 import { ContentHostError, getContentHost, postJson } from "./contentHost";
-import { PublishProtocolError, parsePublishToken } from "./protocol";
+import {
+  PublishProtocolError,
+  parsePublishToken,
+} from "@valbuild/shared/internal";
 
 /**
  * The credential `val publish` presents to content, and where it came from.

package/src/publish/fakeContent.ts

@@ -1,6 +1,6 @@
 import crypto from "crypto";
 import http from "http";
-import { PublishProblem } from "./contentApi";
+import { PublishProblem } from "@valbuild/shared/internal";
 
 /**
  * A local stand-in for the publish API on content.val.build.

package/src/publish/publishWireContract.test.ts

@@ -6,7 +6,7 @@ import {
   parsePublishToken,
   parseStatus,
   parseVerify,
-} from "./protocol";
+} from "@valbuild/shared/internal";
 
 /**
  * What content actually answers, run through the parsers that read it.

package/src/publish/runPublish.ts

@@ -27,7 +27,7 @@ import {
   UploadSlot,
   VerifyResponse,
   parseProblems,
-} from "./protocol";
+} from "@valbuild/shared/internal";
 
 export type PublishOptions = {
   root?: string;

package/src/publish.ts

@@ -1,6 +1,6 @@
 import pc from "picocolors";
 import { error } from "./logger";
-import { PublishProblem } from "./publish/protocol";
+import { PublishProblem } from "@valbuild/shared/internal";
 import { formatBytes, runPublish } from "./publish/runPublish";
 
 /**

package/src/publish/contentApi.ts

@@ -1,210 +0,0 @@
-/**
- * The publish API's types, COPIED from the service that serves them.
- *
- * Source: `content/src/handlers/Api.ts` in valbuild/home, branch
- * `claude/new-project-studio-saves-0g9ksb`, commit `ecf3b8d`. The routes below
- * are that file's `/publish*` entries and the two types they use, verbatim,
- * comments included, so that the two can be diffed by eye.
- *
- * **Copied rather than imported, because it cannot be imported.** That file
- * lives in a private repository which publishes nothing to npm, and its own
- * header says this is how it is kept in step: "We have also used it (by just
- * copying it in and setting the types there) in the @valbuild/server package to
- * check that we are more or less in sync."
- *
- * **When home's `Api.ts` changes, change this with it.** Everything in
- * `protocol.ts` is checked against these types, so a copy brought up to date
- * fails to compile wherever this CLI has not caught up. That is the whole
- * value: without it a wire change is a runtime 500 in somebody's CI, which is
- * how `home` and `@valbuild/server` have already diverged three times - see
- * `homeWireContract.test.ts` in `@valbuild/server` for the last one, and
- * `publishWireContract.test.ts` here for the fixtures that go with these types.
- *
- * A copy is not a guarantee, only a tripwire: nothing checks it against the
- * service, and the parsers in `protocol.ts` are what actually holds at runtime.
- */
-
-export type ContentPublishApi = {
-  /**
-   * Publishing a build, as a resource with a lifecycle.
-   *
-   * ```
-   * POST /publish                  declare  -> an upload slot per MISSING artifact
-   * PUT  <presigned url>           upload   -> each artifact, straight to storage
-   * POST /publish/{id}/artifacts   confirm  -> the uploads are checked
-   * POST /publish/{id}/verify      render   -> a canary build, server side
-   * POST /publish/{id}/promote     go live  -> the pointer moves
-   * GET  /publish/{id}             status
-   * ```
-   *
-   * Four steps rather than one `POST /publish`, because they fail differently
-   * and one call cannot say "the bytes are fine but it did not render" -- which
-   * is the sentence a publisher most needs. `promote` is separate from `verify`
-   * so that a dry run is the absence of a call rather than a flag.
-   *
-   * Not keyed by a project, like `/publish-target` above and for the same
-   * reason: a project token names one. That is what lets a generated repository
-   * hold one secret and no variables at all.
-   *
-   * ## What is deliberately not here
-   *
-   * No loader URL, no `vendorRev`, no `x-platform-project`. This service holds
-   * the operator relationship with the build platform and calls it; a publisher
-   * talks to this API and nothing else. The one exception is the presigned
-   * upload URL, which points at object storage -- bytes do not travel through
-   * here.
-   *
-   * It is also what makes this publishable by a project token at all. The
-   * platform's own verify step publishes a canary to a throwaway project, and a
-   * throwaway has no secrets, so the loader has nothing to check a caller
-   * against and refuses with a 503 naming a project nobody has heard of. Behind
-   * this API the caller is never involved in that exchange.
-   */
-  "/publish": {
-    POST: {
-      body: {
-        /** The build's own hash. Repeating it returns the same publish. */
-        buildHash: string;
-        /** Null only for a seed publish. See `publishPlan.ts`. */
-        commit: string | null;
-        /** The branch content saves commit to. Required when `commit` is set. */
-        branch: string | null;
-        /** Which dependency layer this was built against, sent or not. */
-        layerRev: string | null;
-        /**
-         * Whether the app links its own CSS.
-         *
-         * Build metadata the loader needs and no artifact carries, so it has to
-         * be declared. Null is a third answer -- "this build did not say" --
-         * and is not false.
-         */
-        linksOwnCss: boolean | null;
-        artifacts: {
-          /** See `publishPlan.ts` for the namespace. */
-          key: string;
-          sha256: string;
-          bytes: number;
-        }[];
-      };
-      res: {
-        publishId: string;
-        state: PublishState;
-        project: {
-          publicProjectId: string;
-          /** Null when the project has no site yet -- reported, not refused. */
-          siteUrl: string | null;
-        };
-        /**
-         * One per artifact this project does not already hold, and nothing else.
-         *
-         * So this doubles as the answer to "what is missing": there is no
-         * separate field to keep in step with it. Slots expire; a presigned PUT
-         * that answers 403 means declare again, not that the publish failed.
-         */
-        uploads: {
-          key: string;
-          url: string;
-          method: "PUT";
-          headers: Record<string, string>;
-          /** ISO 8601. */
-          expiresAt: string;
-        }[];
-        /** Keys already held, so a caller can see what it did not have to send. */
-        have: string[];
-      };
-    };
-  };
-  "/publish/:publishId": {
-    GET: {
-      res: {
-        publishId: string;
-        state: PublishState;
-        buildHash: string;
-        /** Artifact keys still not uploaded. */
-        missing: string[];
-        problems: PublishProblem[];
-      };
-    };
-  };
-  /** Everything asked for has been uploaded. The uploads are checked here. */
-  "/publish/:publishId/artifacts": {
-    POST: {
-      res: {
-        state: PublishState;
-        problems: PublishProblem[];
-      };
-    };
-  };
-  /** A canary build and render, on the build platform, with our credential. */
-  "/publish/:publishId/verify": {
-    POST: {
-      res: {
-        state: PublishState;
-        ok: boolean;
-        /** Where the canary can be looked at, when it rendered. */
-        previewUrl: string | null;
-        problems: PublishProblem[];
-      };
-    };
-  };
-  /**
-   * Move the project's pointer to this build.
-   *
-   * Refused when the commit is no longer the branch head -- which this service
-   * is the authority on (see `getGitHead`), so the rule is enforced where the
-   * data already is rather than a round trip away.
-   */
-  "/publish/:publishId/promote": {
-    POST: {
-      res: {
-        state: PublishState;
-        url: string | null;
-        commit: string | null;
-      };
-    };
-  };
-  /** Exchange a personal access token for a short-lived publish token. */
-  "/publish-token": {
-    POST: {
-      res: {
-        /** Shown once, here. Nothing can produce it again. */
-        token: string;
-        /** ISO 8601, because a `Date` does not survive JSON as one. */
-        expiresAt: string | null;
-        publicProjectId: string;
-        productionUrl: string | null;
-      };
-    };
-  };
-};
-
-/**
- * Where a publish is. Mirrors `PublishState` in `utils/publishPlan.ts`, which
- * owns the transition table; this is the wire spelling of it.
- */
-export type PublishState =
-  | "awaiting-artifacts"
-  | "ready"
-  | "verified"
-  | "live"
-  | "failed"
-  | "expired";
-
-/**
- * Why a publish is not going anywhere.
- *
- * `code` is the stable half -- a pipeline gates on it -- and carries both this
- * API's own codes (`ARTIFACT_MISMATCH`, `POINTER_STALE`, the declaration codes
- * in `publishPlan.ts`) and the build platform's `PLATFORM*` codes passed
- * through from a verify, because rewording those would lose the only sentence
- * that says what to change.
- *
- * `hint` is not decoration. A gate that merely fails is useless in somebody
- * else's pipeline: they get a red build and no idea why.
- */
-export type PublishProblem = {
-  code: string;
-  message: string;
-  hint?: string;
-  keys?: string[];
-};

package/src/publish/protocol.ts

@@ -1,174 +0,0 @@
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import { ContentPublishApi, PublishProblem, PublishState } from "./contentApi";
-
-/**
- * Reading what content answers.
- *
- * Every type here comes from `contentApi.ts`, which is a copy of the
- * service's own `Api.ts` - so the shapes are not re-derived from what this end
- * wishes it received, and a copy brought up to date fails to compile wherever
- * this CLI has not caught up.
- *
- * The schemas are the runtime half, and they are needed as well as the types:
- * what arrives is JSON over HTTP from a service that versions separately, so a
- * type alone asserts a shape rather than checking one. Each schema is
- * annotated with the copied type it must produce (`z.ZodType<DeclareResponse>`
- * and so on), which is what ties the two halves together - a schema that drifts
- * from the copy does not compile, and an answer that drifts from the schema
- * does not parse. `ValOpsHttp` in `@valbuild/server` reads every other content
- * route the same way.
- *
- * Nothing here is laxer than the copy. An optional field is optional because
- * the service says so; making a required one optional here would hide exactly
- * the drift this file exists to catch.
- */
-
-export type { PublishProblem, PublishState };
-
-export type DeclareBody = ContentPublishApi["/publish"]["POST"]["body"];
-export type DeclareResponse = ContentPublishApi["/publish"]["POST"]["res"];
-export type ArtifactsResponse =
-  ContentPublishApi["/publish/:publishId/artifacts"]["POST"]["res"];
-export type VerifyResponse =
-  ContentPublishApi["/publish/:publishId/verify"]["POST"]["res"];
-export type PromoteResponse =
-  ContentPublishApi["/publish/:publishId/promote"]["POST"]["res"];
-export type StatusResponse =
-  ContentPublishApi["/publish/:publishId"]["GET"]["res"];
-export type PublishTokenResponse =
-  ContentPublishApi["/publish-token"]["POST"]["res"];
-
-/** An artifact, as it is declared: by key, by hash, by size. */
-export type DeclaredArtifact = DeclareBody["artifacts"][number];
-/** Permission to write one artifact's bytes to object storage. */
-export type UploadSlot = DeclareResponse["uploads"][number];
-
-const publishState: z.ZodType<PublishState> = z.enum([
-  "awaiting-artifacts",
-  "ready",
-  "verified",
-  "live",
-  "failed",
-  "expired",
-]);
-
-const publishProblem: z.ZodType<PublishProblem> = z.object({
-  code: z.string(),
-  message: z.string(),
-  hint: z.string().optional(),
-  keys: z.array(z.string()).optional(),
-});
-
-const uploadSlot: z.ZodType<UploadSlot> = z.object({
-  key: z.string(),
-  url: z.string(),
-  method: z.literal("PUT"),
-  headers: z.record(z.string(), z.string()),
-  expiresAt: z.string(),
-});
-
-const declareResponse: z.ZodType<DeclareResponse> = z.object({
-  publishId: z.string(),
-  state: publishState,
-  project: z.object({
-    publicProjectId: z.string(),
-    siteUrl: z.string().nullable(),
-  }),
-  uploads: z.array(uploadSlot),
-  have: z.array(z.string()),
-});
-
-const artifactsResponse: z.ZodType<ArtifactsResponse> = z.object({
-  state: publishState,
-  problems: z.array(publishProblem),
-});
-
-const verifyResponse: z.ZodType<VerifyResponse> = z.object({
-  state: publishState,
-  ok: z.boolean(),
-  previewUrl: z.string().nullable(),
-  problems: z.array(publishProblem),
-});
-
-const promoteResponse: z.ZodType<PromoteResponse> = z.object({
-  state: publishState,
-  url: z.string().nullable(),
-  commit: z.string().nullable(),
-});
-
-const statusResponse: z.ZodType<StatusResponse> = z.object({
-  publishId: z.string(),
-  state: publishState,
-  buildHash: z.string(),
-  missing: z.array(z.string()),
-  problems: z.array(publishProblem),
-});
-
-const publishTokenResponse: z.ZodType<PublishTokenResponse> = z.object({
-  token: z.string(),
-  expiresAt: z.string().nullable(),
-  publicProjectId: z.string(),
-  productionUrl: z.string().nullable(),
-});
-
-/**
- * Content answered, and the answer was not one this CLI can act on.
- *
- * Separate from a refusal, which is content saying no in a sentence meant for
- * a person. This is two programs disagreeing - the copy in `contentApi.ts` and
- * the service that has moved on from it - and the two want opposite things
- * said about them.
- */
-export class PublishProtocolError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "PublishProtocolError";
-  }
-}
-
-export const parseDeclare = (body: unknown): DeclareResponse =>
-  parse(declareResponse, body, "POST /v1/publish");
-
-export const parseArtifacts = (body: unknown): ArtifactsResponse =>
-  parse(artifactsResponse, body, "POST /v1/publish/{id}/artifacts");
-
-export const parseVerify = (body: unknown): VerifyResponse =>
-  parse(verifyResponse, body, "POST /v1/publish/{id}/verify");
-
-export const parsePromote = (body: unknown): PromoteResponse =>
-  parse(promoteResponse, body, "POST /v1/publish/{id}/promote");
-
-export const parseStatus = (body: unknown): StatusResponse =>
-  parse(statusResponse, body, "GET /v1/publish/{id}");
-
-export const parsePublishToken = (
-  body: unknown,
-  call: string,
-): PublishTokenResponse => parse(publishTokenResponse, body, call);
-
-/**
- * The `details` of a refusal, when it carries a list of problems.
- *
- * Every non-2xx is `{ statusCode, message, details? }`, and the publish routes
- * put `PublishProblem[]` in `details` - a declaration is answered with EVERY
- * problem rather than the first, because finding them one round trip at a time
- * is how a publish takes six attempts. Anything else in there is somebody
- * else's `details` and is left to the caller's own message.
- */
-export function parseProblems(details: unknown): PublishProblem[] {
-  const parsed = z.array(publishProblem).safeParse(details);
-  return parsed.success ? parsed.data : [];
-}
-
-function parse<T>(schema: z.ZodType<T>, body: unknown, call: string): T {
-  const parsed = schema.safeParse(body);
-  if (!parsed.success) {
-    throw new PublishProtocolError(
-      `${call} answered with something this CLI cannot read: ${fromError(
-        parsed.error,
-      ).toString()}`,
-    );
-  }
-  return parsed.data;
-}