@valbuild/cli 0.144.12 → 0.145.1

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @valbuild/cli
 
+## 0.145.1
+
+### Patch Changes
+
+- [#860](https://github.com/valbuild/val/pull/860) [`a45f595`](https://github.com/valbuild/val/commit/a45f595a5e20b009d4110bbef8ebdc08b2d731d7) Thanks [@freekh](https://github.com/freekh)! - `val publish` now refuses to build a site whose installed TanStack disagrees with the platform's. A project's CI builds its dependency layer from its own `node_modules`, and a lockfile two patches away from the platform's `@tanstack/*` used to publish fine and then fail on the first request that reached the mismatched code — typically signing in — with "does not provide an export named …". The build now stops with a message naming the package, the version the project resolved and the version the platform carries, and the fix is to pin the package to that version (with `pnpm.overrides` for a transitive one) and reinstall.
+
+  The same build also checks every import a dependency takes from the platform's React and TanStack against what the platform says those modules export, which until now ran only in the platform's own checkout.
+
+  Both checks use what the platform reports about itself, so they run once the platform does; until then `val publish` builds as before and says in its output that the check was skipped. They run in the `@valbuild/tanstack-build` the project has installed, so upgrade it alongside `@valbuild/cli`.
+
+- [#860](https://github.com/valbuild/val/pull/860) [`a45f595`](https://github.com/valbuild/val/commit/a45f595a5e20b009d4110bbef8ebdc08b2d731d7) Thanks [@freekh](https://github.com/freekh)! - `val publish` and the Studio now tell Val Build which version of the platform's React and TanStack a build was made against. If the platform is updated while a build is running — a project's CI can take several minutes — that build is no longer published onto a platform it was never checked against: the publish stops with a message saying the platform was updated and to build again, and the next build is checked against what it will run on. A build published with `val publish --artifacts` was made elsewhere and does not say, and publishes as before.
+- Updated dependencies [[`a45f595`](https://github.com/valbuild/val/commit/a45f595a5e20b009d4110bbef8ebdc08b2d731d7), [`a45f595`](https://github.com/valbuild/val/commit/a45f595a5e20b009d4110bbef8ebdc08b2d731d7), [`a45f595`](https://github.com/valbuild/val/commit/a45f595a5e20b009d4110bbef8ebdc08b2d731d7)]:
+  - @valbuild/tanstack-build@0.145.1
+  - @valbuild/shared@0.145.1
+  - @valbuild/language-server@0.145.1
+  - @valbuild/server@0.145.1
+
+## 0.145.0
+
+### Patch Changes
+
+- Updated dependencies [[`b6cb939`](https://github.com/valbuild/val/commit/b6cb9395d8bdcd5182e9c6ba84f5284930de2fa5), [`f085be0`](https://github.com/valbuild/val/commit/f085be0eb5bdc195e9d8cdb15dd5f8acfdabe23c)]:
+  - @valbuild/core@0.145.0
+  - @valbuild/shared@0.145.0
+  - @valbuild/server@0.145.0
+  - @valbuild/language-server@0.145.0
+
 ## 0.144.12
 
 ### Patch Changes

package/cli/dist/valbuild-cli-cli.cjs.dev.js

@@ -2677,14 +2677,41 @@ async function buildArtifacts(options) {
     // published with the site under the names their `url()`s now use.
     const dependencyAssets = {};
     const css = await node.collectDependencyCss(root, node.cssSpecifiersOf(sources), dependencyAssets);
+    /*
+     * There is no platform checkout here, so nothing can be PINNED to the
+     * platform's copies and no built base layer can be read. What stands in
+     * for both is what the platform says about its base set -- `base.pins`,
+     * which refuses a layer carrying a pinned package at another version, and
+     * `base.exports`, which the export audit reads. A platform that predates
+     * them sends neither, and the layer builds unchecked, as it always did
+     * here; that is worth a line in the log rather than silence.
+     */
+    if (deps.length > 0 && !target.base.pins) {
+      warnings.push("The platform did not say which versions its base layer carries, so " + "this build could not check that the project's TanStack and React " + "agree with them.");
+    }
+    if (deps.length > 0 && !target.base.exports) {
+      warnings.push("The platform did not say what its base layer exports, so this build " + "could not check that the project's dependencies import only what it has.");
+    }
     const layer = await node.buildVendorLayer(root, deps, css, {
       base: target.base,
-      // A project on the platform layers its own copies; only the platform's
-      // own checkout carries pinned ones.
       resolvePlatformModule: () => null,
-      // No built base layer here: the export audit is skipped, not failed.
       baseLayerDir: null
     });
+
+    /*
+     * What the layer left out, and why. A dependency the layer could not build
+     * is dropped rather than fatal -- a Vite plugin nobody imports, say -- and
+     * one the app DOES import then fails the site build naming only the
+     * specifier. The reason is what says whether to fix the import or the
+     * package: an export the base layer does not have, most of all, which is a
+     * version disagreement with the platform rather than a missing package.
+     */
+    for (const {
+      specifier,
+      reason
+    } of (layer === null || layer === void 0 ? void 0 : layer.skipped) ?? []) {
+      warnings.push(`${specifier} is not in the dependency layer: ${reason}`);
+    }
     log("Building the site");
     const fileBased = await node.isFileBased(root);
     const files = fileBased ? await node.generateRouteTree(root, sources) : sources;
@@ -2737,6 +2764,7 @@ async function buildArtifacts(options) {
       ...(layerRev !== undefined ? {
         layerRev
       } : {}),
+      baseRev: target.base.rev,
       warnings
     };
   } catch (e) {
@@ -3387,6 +3415,11 @@ async function runPublish(options) {
         commit: git.commit,
         branch: git.branch,
         layerRev: options.layerRev ?? layerRev,
+        // Only for a build made here: one handed over with `--artifacts` was
+        // built against a base layer this run never saw.
+        ...(built ? {
+          baseRev: built.baseRev
+        } : {}),
         linksOwnCss: options.linksOwnCss ?? ((_built2 = built) === null || _built2 === void 0 ? void 0 : _built2.linksOwnCss) ?? null,
         artifacts: collected.artifacts.map(({
           key,

package/cli/dist/valbuild-cli-cli.cjs.prod.js

@@ -2677,14 +2677,41 @@ async function buildArtifacts(options) {
     // published with the site under the names their `url()`s now use.
     const dependencyAssets = {};
     const css = await node.collectDependencyCss(root, node.cssSpecifiersOf(sources), dependencyAssets);
+    /*
+     * There is no platform checkout here, so nothing can be PINNED to the
+     * platform's copies and no built base layer can be read. What stands in
+     * for both is what the platform says about its base set -- `base.pins`,
+     * which refuses a layer carrying a pinned package at another version, and
+     * `base.exports`, which the export audit reads. A platform that predates
+     * them sends neither, and the layer builds unchecked, as it always did
+     * here; that is worth a line in the log rather than silence.
+     */
+    if (deps.length > 0 && !target.base.pins) {
+      warnings.push("The platform did not say which versions its base layer carries, so " + "this build could not check that the project's TanStack and React " + "agree with them.");
+    }
+    if (deps.length > 0 && !target.base.exports) {
+      warnings.push("The platform did not say what its base layer exports, so this build " + "could not check that the project's dependencies import only what it has.");
+    }
     const layer = await node.buildVendorLayer(root, deps, css, {
       base: target.base,
-      // A project on the platform layers its own copies; only the platform's
-      // own checkout carries pinned ones.
       resolvePlatformModule: () => null,
-      // No built base layer here: the export audit is skipped, not failed.
       baseLayerDir: null
     });
+
+    /*
+     * What the layer left out, and why. A dependency the layer could not build
+     * is dropped rather than fatal -- a Vite plugin nobody imports, say -- and
+     * one the app DOES import then fails the site build naming only the
+     * specifier. The reason is what says whether to fix the import or the
+     * package: an export the base layer does not have, most of all, which is a
+     * version disagreement with the platform rather than a missing package.
+     */
+    for (const {
+      specifier,
+      reason
+    } of (layer === null || layer === void 0 ? void 0 : layer.skipped) ?? []) {
+      warnings.push(`${specifier} is not in the dependency layer: ${reason}`);
+    }
     log("Building the site");
     const fileBased = await node.isFileBased(root);
     const files = fileBased ? await node.generateRouteTree(root, sources) : sources;
@@ -2737,6 +2764,7 @@ async function buildArtifacts(options) {
       ...(layerRev !== undefined ? {
         layerRev
       } : {}),
+      baseRev: target.base.rev,
       warnings
     };
   } catch (e) {
@@ -3387,6 +3415,11 @@ async function runPublish(options) {
         commit: git.commit,
         branch: git.branch,
         layerRev: options.layerRev ?? layerRev,
+        // Only for a build made here: one handed over with `--artifacts` was
+        // built against a base layer this run never saw.
+        ...(built ? {
+          baseRev: built.baseRev
+        } : {}),
         linksOwnCss: options.linksOwnCss ?? ((_built2 = built) === null || _built2 === void 0 ? void 0 : _built2.linksOwnCss) ?? null,
         artifacts: collected.artifacts.map(({
           key,

package/cli/dist/valbuild-cli-cli.esm.js

@@ -2642,14 +2642,41 @@ async function buildArtifacts(options) {
     // published with the site under the names their `url()`s now use.
     const dependencyAssets = {};
     const css = await node.collectDependencyCss(root, node.cssSpecifiersOf(sources), dependencyAssets);
+    /*
+     * There is no platform checkout here, so nothing can be PINNED to the
+     * platform's copies and no built base layer can be read. What stands in
+     * for both is what the platform says about its base set -- `base.pins`,
+     * which refuses a layer carrying a pinned package at another version, and
+     * `base.exports`, which the export audit reads. A platform that predates
+     * them sends neither, and the layer builds unchecked, as it always did
+     * here; that is worth a line in the log rather than silence.
+     */
+    if (deps.length > 0 && !target.base.pins) {
+      warnings.push("The platform did not say which versions its base layer carries, so " + "this build could not check that the project's TanStack and React " + "agree with them.");
+    }
+    if (deps.length > 0 && !target.base.exports) {
+      warnings.push("The platform did not say what its base layer exports, so this build " + "could not check that the project's dependencies import only what it has.");
+    }
     const layer = await node.buildVendorLayer(root, deps, css, {
       base: target.base,
-      // A project on the platform layers its own copies; only the platform's
-      // own checkout carries pinned ones.
       resolvePlatformModule: () => null,
-      // No built base layer here: the export audit is skipped, not failed.
       baseLayerDir: null
     });
+
+    /*
+     * What the layer left out, and why. A dependency the layer could not build
+     * is dropped rather than fatal -- a Vite plugin nobody imports, say -- and
+     * one the app DOES import then fails the site build naming only the
+     * specifier. The reason is what says whether to fix the import or the
+     * package: an export the base layer does not have, most of all, which is a
+     * version disagreement with the platform rather than a missing package.
+     */
+    for (const {
+      specifier,
+      reason
+    } of (layer === null || layer === void 0 ? void 0 : layer.skipped) ?? []) {
+      warnings.push(`${specifier} is not in the dependency layer: ${reason}`);
+    }
     log("Building the site");
     const fileBased = await node.isFileBased(root);
     const files = fileBased ? await node.generateRouteTree(root, sources) : sources;
@@ -2702,6 +2729,7 @@ async function buildArtifacts(options) {
       ...(layerRev !== undefined ? {
         layerRev
       } : {}),
+      baseRev: target.base.rev,
       warnings
     };
   } catch (e) {
@@ -3352,6 +3380,11 @@ async function runPublish(options) {
         commit: git.commit,
         branch: git.branch,
         layerRev: options.layerRev ?? layerRev,
+        // Only for a build made here: one handed over with `--artifacts` was
+        // built against a base layer this run never saw.
+        ...(built ? {
+          baseRev: built.baseRev
+        } : {}),
         linksOwnCss: options.linksOwnCss ?? ((_built2 = built) === null || _built2 === void 0 ? void 0 : _built2.linksOwnCss) ?? null,
         artifacts: collected.artifacts.map(({
           key,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@valbuild/cli",
   "private": false,
-  "version": "0.144.12",
+  "version": "0.145.1",
   "description": "Val CLI tools",
   "repository": {
     "type": "git",
@@ -26,11 +26,11 @@
     "picocolors": "^1.1.1",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.144.0",
+    "@valbuild/core": "0.145.0",
     "@valbuild/eslint-plugin": "0.125.0",
-    "@valbuild/language-server": "0.144.12",
-    "@valbuild/server": "0.144.12",
-    "@valbuild/shared": "0.144.9"
+    "@valbuild/language-server": "0.145.1",
+    "@valbuild/server": "0.145.1",
+    "@valbuild/shared": "0.145.1"
   },
   "peerDependencies": {
     "prettier": "*",
@@ -38,7 +38,7 @@
     "rolldown": ">=1.2.5",
     "@tanstack/router-generator": ">=1.167.0",
     "@tanstack/router-plugin": ">=1.168.0",
-    "@valbuild/tanstack-build": "^0.144.4"
+    "@valbuild/tanstack-build": "^0.145.1"
   },
   "peerDependenciesMeta": {
     "@valbuild/tanstack-build": {
@@ -70,7 +70,7 @@
     "prettier": "~3.8.5",
     "rolldown": "^1.2.5",
     "tsx": "^4.23.12",
-    "@valbuild/tanstack-build": "0.144.4"
+    "@valbuild/tanstack-build": "0.145.1"
   },
   "scripts": {
     "start": "tsx src/cli.ts --",

package/src/publish/__fixtures__/buildPublishProbe.ts

@@ -81,6 +81,7 @@ type Report = {
     commit: string | null;
     branch: string | null;
     layerRev: string | null;
+    baseRev: string | null;
     linksOwnCss: boolean | null;
     keys: string[];
   }>;
@@ -105,6 +106,8 @@ type Report = {
   wiredBranch: string | null;
   /** Whether the run warned that the checkout's branch is not the project's. */
   warnedAboutBranch: boolean;
+  /** Whether it said the platform sent no pins or exports -- which it did. */
+  warnedAboutPlatformFacts: boolean;
 };
 
 /** A 1x1 PNG: small enough to inline, so the page carries it as a data URI. */
@@ -166,6 +169,7 @@ async function publishOnce(
       commit: string | null;
       branch: string | null;
       layerRev: string | null;
+      baseRev?: string | null;
       linksOwnCss: boolean | null;
       artifacts: Array<{ key: string }>;
     };
@@ -174,6 +178,7 @@ async function publishOnce(
       commit: d.commit,
       branch: d.branch,
       layerRev: d.layerRev,
+      baseRev: d.baseRev ?? null,
       linksOwnCss: d.linksOwnCss,
       keys: d.artifacts.map((a) => a.key).sort(),
     };
@@ -218,6 +223,9 @@ async function publishOnce(
         : false),
     checkoutUntouched: JSON.stringify(listed(root)) === JSON.stringify(before),
     wiredBranch: source ? wiredBranchOf(source) : null,
+    warnedAboutPlatformFacts: logged.some((line) =>
+      /did not say (which versions|what its base layer exports)/.test(line),
+    ),
     warnedAboutBranch: logged.some(
       (line) => line.startsWith("warn:") && line.includes("publishes"),
     ),

package/src/publish/buildArtifacts.ts

@@ -38,6 +38,8 @@ export type BuiltArtifacts =
        * `undefined` when the layer artifact is in `dir`, which names it.
        */
       layerRev?: string | null;
+      /** The base layer this was built against: the build target's `base.rev`. */
+      baseRev: string;
       warnings: string[];
     }
   | { status: "error"; message: string };
@@ -287,15 +289,46 @@ export async function buildArtifacts(options: {
       node.cssSpecifiersOf(sources),
       dependencyAssets,
     );
+    /*
+     * There is no platform checkout here, so nothing can be PINNED to the
+     * platform's copies and no built base layer can be read. What stands in
+     * for both is what the platform says about its base set -- `base.pins`,
+     * which refuses a layer carrying a pinned package at another version, and
+     * `base.exports`, which the export audit reads. A platform that predates
+     * them sends neither, and the layer builds unchecked, as it always did
+     * here; that is worth a line in the log rather than silence.
+     */
+    if (deps.length > 0 && !target.base.pins) {
+      warnings.push(
+        "The platform did not say which versions its base layer carries, so " +
+          "this build could not check that the project's TanStack and React " +
+          "agree with them.",
+      );
+    }
+    if (deps.length > 0 && !target.base.exports) {
+      warnings.push(
+        "The platform did not say what its base layer exports, so this build " +
+          "could not check that the project's dependencies import only what it has.",
+      );
+    }
     const layer = await node.buildVendorLayer(root, deps, css, {
       base: target.base,
-      // A project on the platform layers its own copies; only the platform's
-      // own checkout carries pinned ones.
       resolvePlatformModule: () => null,
-      // No built base layer here: the export audit is skipped, not failed.
       baseLayerDir: null,
     });
 
+    /*
+     * What the layer left out, and why. A dependency the layer could not build
+     * is dropped rather than fatal -- a Vite plugin nobody imports, say -- and
+     * one the app DOES import then fails the site build naming only the
+     * specifier. The reason is what says whether to fix the import or the
+     * package: an export the base layer does not have, most of all, which is a
+     * version disagreement with the platform rather than a missing package.
+     */
+    for (const { specifier, reason } of layer?.skipped ?? []) {
+      warnings.push(`${specifier} is not in the dependency layer: ${reason}`);
+    }
+
     log("Building the site");
     const fileBased = await node.isFileBased(root);
     const files = fileBased
@@ -357,6 +390,7 @@ export async function buildArtifacts(options: {
       buildHash: built.hash,
       linksOwnCss: built.linksOwnCss,
       ...(layerRev !== undefined ? { layerRev } : {}),
+      baseRev: target.base.rev,
       warnings,
     };
   } catch (e) {

package/src/publish/buildPublish.test.ts

@@ -20,6 +20,7 @@ type Declared = {
   commit: string | null;
   branch: string | null;
   layerRev: string | null;
+  baseRev: string | null;
   linksOwnCss: boolean | null;
   keys: string[];
 };
@@ -37,6 +38,7 @@ type Run = {
   checkoutUntouched: boolean;
   wiredBranch: string | null;
   warnedAboutBranch: boolean;
+  warnedAboutPlatformFacts: boolean;
 };
 
 let probe: { fresh: Run; held: Run; elsewhere: Run };
@@ -101,6 +103,9 @@ test("a layer content does not hold is built and sent, and named by its own rev"
   expect(fresh.declared[0]!.keys).toContain("layer");
   expect(fresh.uploadedLayerRev).toEqual(expect.any(String));
   expect(fresh.declared[0]!.layerRev).toBe(fresh.uploadedLayerRev);
+  // The base layer it was built against -- the fake's build target says
+  // "base" -- so the platform can refuse it if it has been deployed since.
+  expect(fresh.declared[0]!.baseRev).toBe("base");
 });
 
 test("a layer content already holds is named, not sent again", () => {
@@ -124,6 +129,12 @@ test("a checkout on another branch is wired at the project's, and says so", () =
   expect(probe.fresh.warnedAboutBranch).toBe(false);
 });
 
+test("the platform's pins and exports reach the build through the client", () => {
+  // content sends them (FAKE_BUILD_TARGET); a parser that dropped them made
+  // every publish skip both checks and say the platform had not sent them.
+  expect(probe.fresh.warnedAboutPlatformFacts).toBe(false);
+});
+
 test("the checkout is left as it was found", () => {
   // The route tree is generated on disk and put back; the build is written
   // to a temporary directory, not into `.val/publish`.

package/src/publish/fakeContent.ts

@@ -92,6 +92,11 @@ export const FAKE_BUILD_TARGET: BuildTargetResponse = {
       flightServer: "@vitejs/plugin-rsc/vendor/react-server-dom/server.edge",
       serverFnBase: "/_serverFn/",
     },
+    // What the platform says its base layer carries (home's base-facts.ts).
+    // Empty: nothing in the probe's project is pinned or imports from a base
+    // chunk by name -- what matters is that they arrive at all.
+    pins: {},
+    exports: { worker: {}, browser: {} },
   },
   project: { rev: null, rsc: false, modules: {}, css: {}, workerOnly: [] },
 };

package/src/publish/runPublish.ts

@@ -261,6 +261,9 @@ export async function runPublish(
         commit: git.commit,
         branch: git.branch,
         layerRev: options.layerRev ?? layerRev,
+        // Only for a build made here: one handed over with `--artifacts` was
+        // built against a base layer this run never saw.
+        ...(built ? { baseRev: built.baseRev } : {}),
         linksOwnCss: options.linksOwnCss ?? built?.linksOwnCss ?? null,
         artifacts: collected.artifacts.map(({ key, sha256, bytes }) => ({
           key,