@valbuild/core 0.136.0 → 0.136.8

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @valbuild/core
 
+## 0.136.8
+
+### Patch Changes
+
+- [#737](https://github.com/valbuild/val/pull/737) [`35577be`](https://github.com/valbuild/val/commit/35577be50981fec35fc27ee9435a092a26909395) Thanks [@freekh](https://github.com/freekh)! - After a publish, the Studio no longer loses edits or applies a list reorder twice while the new build is rolling out.
+
+  The Studio shows the content built into the page it loaded, with the unpublished changes on top. Which changes those are comes from the server, and the server lists them relative to its own build. For a while after a publish the two can be different builds: a tab opened before the publish keeps its page, and a managed project's new build reaches each location up to a minute apart. The Studio then applied one build's list of changes to another build's content. Published edits went missing, or were applied a second time, which is invisible for a text replacement but reorders a list again, or removes the wrong item.
+
+  The server already says which build answered (`sourcesSha`), and the Studio now computes the same fingerprint for the content it holds. When the two differ, it fetches the answering build's content and puts it in place together with that build's list of changes, in one step, so nothing on screen shows a half-updated state. Going back to its own build needs no fetch. When they match, which is almost always, nothing extra is requested.
+
+## 0.136.1
+
+### Patch Changes
+
+- [#716](https://github.com/valbuild/val/pull/716) [`d2f385a`](https://github.com/valbuild/val/commit/d2f385a04978992a5036379235e447ba7775faef) Thanks [@freekh](https://github.com/freekh)! - The Studio works again when served from the published package, and a managed project's publish now puts the saved edit on the site.
+
+  - **The Studio did not start in 0.136.0.** Its main bundle imports sibling chunks by relative path, and the Studio is served at `/api/val/static/<version>/app`, so those imports resolved to paths the handler did not know and came back as the HTML fallback — which a browser refuses as a module script. Preview was gone with it. The handler now serves those chunks, and the package build follows every import the bundle makes before it lets a release through.
+  - **The in-browser builder could not load.** The Studio's bundle carried rolldown's Node WASI binding, which throws `process is not defined` in a tab. It now uses the browser binding, and the build refuses a bundle that contains the Node one.
+  - **A managed publish builds what was just saved.** `/save` returns the source files the commit wrote, the Studio builds with them laid over the project's stored source, and publishes that source back with the build — so the next edit starts from this one rather than undoing it. The save's commit is also passed through to the build, which previously ran as though no commit had been made.
+  - **The bundler's WebAssembly is served from `content.val.build/v1/static`** (`DEFAULT_STATIC_HOST`), still addressed by its SHA-256. `globalThis.__VAL_ROLLDOWN_WASM_URL__` still overrides it.
+  - The `val.server.ts` that `@valbuild/tanstack-build` generates no longer hands a save's files to the platform (`platform.internal/__api/source`). A managed project's Studio builds in its own tab, and the platform has closed that door. `isWired` recognises files wired either way.
+  - `@valbuild/tanstack-build/constants` exports the contract paths and the artifact key namespace from an entrypoint that imports nothing else, for callers that must not load the bundler. The namespace gains a `source` key.
+
 ## 0.136.0
 
 ### Minor Changes

package/dist/declarations/src/extractValModules.d.ts

@@ -70,6 +70,21 @@ export type ValModuleShas = {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+export declare function computeSourcesSha(entries: readonly {
+    path: string;
+    source: unknown;
+}[]): string;
 export declare function computeValModuleShas(config: ValModules["config"], entries: readonly ValModuleShaEntry[], moduleErrors: readonly ExtractedModuleError[]): ValModuleShas;
 /**
  * Extracts schemas and sources from a ValModules registry and computes the

package/dist/declarations/src/index.d.ts

@@ -1,6 +1,6 @@
 export { initVal, type ConfigDirectory } from "./initVal.js";
 export { modules, type ValModules } from "./modules.js";
-export { extractValModules, computeValModuleShas, type ExtractedValModules, type ValModuleShaEntry, type ValModuleShas, type ExtractedModuleError, } from "./extractValModules.js";
+export { extractValModules, computeValModuleShas, computeSourcesSha, type ExtractedValModules, type ValModuleShaEntry, type ValModuleShas, type ExtractedModuleError, } from "./extractValModules.js";
 export type { InitVal, ValConfig, ValConstructor, ContentConstructor, } from "./initVal.js";
 export { Schema, type SerializedSchema, type SelectorOfSchema } from "./schema/index.js";
 export { hasRemoteFileSchema, hasMediaSchema, } from "./schema/hasRemoteFileSchema.js";
@@ -87,7 +87,8 @@ export type FatalErrorType = (typeof FATAL_ERROR_TYPES)[number];
 export declare const DEFAULT_CONTENT_HOST = "https://content.val.build";
 export declare const DEFAULT_APP_HOST = "https://admin.val.build";
 /**
- * Where Val's own immutable build artifacts are served from.
+ * Where Val's own immutable build artifacts are served from: the content
+ * service's `/v1/static`.
  *
  * Only one kind of thing lives here so far: the WebAssembly binary of the
  * bundler the Studio builds a site with. It cannot travel with the Studio's
@@ -95,11 +96,23 @@ export declare const DEFAULT_APP_HOST = "https://admin.val.build";
  * TEXT inside the server bundle, which both corrupts it and would carry it
  * into every project that installs `@valbuild/ui`.
  *
- * Everything under this host is addressed by the SHA-256 of its own bytes, so
+ * Everything under this path is addressed by the SHA-256 of its own bytes, so
  * an upload is idempotent, a URL is immutable, and the artifact a build asks
  * for cannot be a different one than the build was made against.
+ *
+ * On content rather than a host of its own because a publish cannot happen
+ * without content anyway -- declare, upload, verify, promote, `/build-target`
+ * and `/project-source` all go through it -- so a separate host would add no
+ * availability and one more domain to every customer's egress allowlist.
+ *
+ * A FIXED LITERAL, and deliberately not derived from a project's configured
+ * content host (`VAL_CONTENT_URL`). Deriving it would make serving this binary
+ * an obligation of every content service anybody points Val at, self-hosted
+ * ones included. A deployment that must fetch it from somewhere else sets
+ * `globalThis.__VAL_ROLLDOWN_WASM_URL__` instead (see
+ * `packages/ui/build/rolldownWasm.ts`).
  */
-export declare const DEFAULT_STATIC_HOST = "https://static.val.build";
+export declare const DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 declare const Internal: {
     VERSION: {
         core: string;

package/dist/{index-e4035f4d.cjs.prod.js → index-2545d3b4.cjs.prod.js}

@@ -12611,9 +12611,41 @@ function collectObjectRecursive(item, collector) {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+function computeSourcesSha(entries) {
+  var sourcesSha = "";
+  var _iterator = result._createForOfIteratorHelper(entries),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _step.value,
+        path = _step$value.path,
+        source = _step$value.source;
+      sourcesSha = hash(sourcesSha + JSON.stringify({
+        path: path,
+        source: source
+      }));
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return sourcesSha;
+}
 function computeValModuleShas(config, entries, moduleErrors) {
   var configSha = hash(JSON.stringify(config));
-  var sourcesSha = "";
+  var sourcesSha = computeSourcesSha(entries);
   var baseSha = configSha;
   // NOTE: schemaSha is deliberately NOT seeded with configSha. It is compared
   // across bundles (the server extracts from the Node bundle, the editor SPA
@@ -12624,18 +12656,14 @@ function computeValModuleShas(config, entries, moduleErrors) {
   // server-only env vars and therefore `undefined` in the browser. Seeding with
   // them made the two sides disagree on every production load.
   var schemaSha = "";
-  var _iterator = result._createForOfIteratorHelper(entries),
-    _step;
+  var _iterator2 = result._createForOfIteratorHelper(entries),
+    _step2;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var entry = _step.value;
+    for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+      var entry = _step2.value;
       var path = entry.path,
         source = entry.source,
         serializedSchema = entry.serializedSchema;
-      sourcesSha = hash(sourcesSha + JSON.stringify({
-        path: path,
-        source: source
-      }));
       baseSha = hash(baseSha + JSON.stringify({
         path: path,
         schema: serializedSchema,
@@ -12653,9 +12681,9 @@ function computeValModuleShas(config, entries, moduleErrors) {
       }));
     }
   } catch (err) {
-    _iterator.e(err);
+    _iterator2.e(err);
   } finally {
-    _iterator.f();
+    _iterator2.f();
   }
   return {
     baseSha: baseSha,
@@ -12677,7 +12705,7 @@ function extractValModules(_x) {
 }
 function _extractValModules() {
   _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
-    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator2, _step2, error, _iterator3, _step3, _error, _t, _t2;
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator3, _step3, error, _iterator4, _step4, _error, _t, _t2;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
@@ -12824,10 +12852,10 @@ function _extractValModules() {
           // Appended AFTER the loop on purpose: each entry's `moduleErrorsAt` is the
           // error count at the time it was folded in, so the SHAs stay a function of
           // the modules themselves.
-          _iterator2 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
+          _iterator3 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
           try {
-            for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-              error = _step2.value;
+            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+              error = _step3.value;
               moduleErrors.push(error);
             }
             // Same kind of rule, same reason it is here: a view cycle is a property of the
@@ -12835,20 +12863,20 @@ function _extractValModules() {
             // catches it either — a view stores a pointer, not content, so there is no
             // data cycle for a source walk to trip over.
           } catch (err) {
-            _iterator2.e(err);
+            _iterator3.e(err);
           } finally {
-            _iterator2.f();
+            _iterator3.f();
           }
-          _iterator3 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
+          _iterator4 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
           try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              _error = _step3.value;
+            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+              _error = _step4.value;
               moduleErrors.push(_error);
             }
           } catch (err) {
-            _iterator3.e(err);
+            _iterator4.e(err);
           } finally {
-            _iterator3.f();
+            _iterator4.f();
           }
           return _context.a(2, _objectSpread2(_objectSpread2({
             sources: sources,
@@ -14167,7 +14195,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.0",
+	version: "0.136.8",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14226,7 +14254,8 @@ var FATAL_ERROR_TYPES = ["no-schema", "no-source", "invalid-id", "no-module", "i
 var DEFAULT_CONTENT_HOST = "https://content.val.build";
 var DEFAULT_APP_HOST = "https://admin.val.build";
 /**
- * Where Val's own immutable build artifacts are served from.
+ * Where Val's own immutable build artifacts are served from: the content
+ * service's `/v1/static`.
  *
  * Only one kind of thing lives here so far: the WebAssembly binary of the
  * bundler the Studio builds a site with. It cannot travel with the Studio's
@@ -14234,11 +14263,23 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  * TEXT inside the server bundle, which both corrupts it and would carry it
  * into every project that installs `@valbuild/ui`.
  *
- * Everything under this host is addressed by the SHA-256 of its own bytes, so
+ * Everything under this path is addressed by the SHA-256 of its own bytes, so
  * an upload is idempotent, a URL is immutable, and the artifact a build asks
  * for cannot be a different one than the build was made against.
+ *
+ * On content rather than a host of its own because a publish cannot happen
+ * without content anyway -- declare, upload, verify, promote, `/build-target`
+ * and `/project-source` all go through it -- so a separate host would add no
+ * availability and one more domain to every customer's egress allowlist.
+ *
+ * A FIXED LITERAL, and deliberately not derived from a project's configured
+ * content host (`VAL_CONTENT_URL`). Deriving it would make serving this binary
+ * an obligation of every content service anybody points Val at, self-hosted
+ * ones included. A deployment that must fetch it from somewhere else sets
+ * `globalThis.__VAL_ROLLDOWN_WASM_URL__` instead (see
+ * `packages/ui/build/rolldownWasm.ts`).
  */
-var DEFAULT_STATIC_HOST = "https://static.val.build";
+var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
   VERSION: {
     core: corePackageJson.version
@@ -14406,6 +14447,7 @@ exports._slicedToArray = _slicedToArray;
 exports._toConsumableArray = _toConsumableArray;
 exports._typeof = _typeof;
 exports.assistantAvailability = assistantAvailability;
+exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;

package/dist/{index-84fa4a70.esm.js → index-962a8ac3.esm.js}

@@ -12609,9 +12609,41 @@ function collectObjectRecursive(item, collector) {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+function computeSourcesSha(entries) {
+  var sourcesSha = "";
+  var _iterator = _createForOfIteratorHelper(entries),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _step.value,
+        path = _step$value.path,
+        source = _step$value.source;
+      sourcesSha = hash(sourcesSha + JSON.stringify({
+        path: path,
+        source: source
+      }));
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return sourcesSha;
+}
 function computeValModuleShas(config, entries, moduleErrors) {
   var configSha = hash(JSON.stringify(config));
-  var sourcesSha = "";
+  var sourcesSha = computeSourcesSha(entries);
   var baseSha = configSha;
   // NOTE: schemaSha is deliberately NOT seeded with configSha. It is compared
   // across bundles (the server extracts from the Node bundle, the editor SPA
@@ -12622,18 +12654,14 @@ function computeValModuleShas(config, entries, moduleErrors) {
   // server-only env vars and therefore `undefined` in the browser. Seeding with
   // them made the two sides disagree on every production load.
   var schemaSha = "";
-  var _iterator = _createForOfIteratorHelper(entries),
-    _step;
+  var _iterator2 = _createForOfIteratorHelper(entries),
+    _step2;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var entry = _step.value;
+    for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+      var entry = _step2.value;
       var path = entry.path,
         source = entry.source,
         serializedSchema = entry.serializedSchema;
-      sourcesSha = hash(sourcesSha + JSON.stringify({
-        path: path,
-        source: source
-      }));
       baseSha = hash(baseSha + JSON.stringify({
         path: path,
         schema: serializedSchema,
@@ -12651,9 +12679,9 @@ function computeValModuleShas(config, entries, moduleErrors) {
       }));
     }
   } catch (err) {
-    _iterator.e(err);
+    _iterator2.e(err);
   } finally {
-    _iterator.f();
+    _iterator2.f();
   }
   return {
     baseSha: baseSha,
@@ -12675,7 +12703,7 @@ function extractValModules(_x) {
 }
 function _extractValModules() {
   _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
-    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator2, _step2, error, _iterator3, _step3, _error, _t, _t2;
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator3, _step3, error, _iterator4, _step4, _error, _t, _t2;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
@@ -12822,10 +12850,10 @@ function _extractValModules() {
           // Appended AFTER the loop on purpose: each entry's `moduleErrorsAt` is the
           // error count at the time it was folded in, so the SHAs stay a function of
           // the modules themselves.
-          _iterator2 = _createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
+          _iterator3 = _createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
           try {
-            for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-              error = _step2.value;
+            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+              error = _step3.value;
               moduleErrors.push(error);
             }
             // Same kind of rule, same reason it is here: a view cycle is a property of the
@@ -12833,20 +12861,20 @@ function _extractValModules() {
             // catches it either — a view stores a pointer, not content, so there is no
             // data cycle for a source walk to trip over.
           } catch (err) {
-            _iterator2.e(err);
+            _iterator3.e(err);
           } finally {
-            _iterator2.f();
+            _iterator3.f();
           }
-          _iterator3 = _createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
+          _iterator4 = _createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
           try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              _error = _step3.value;
+            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+              _error = _step4.value;
               moduleErrors.push(_error);
             }
           } catch (err) {
-            _iterator3.e(err);
+            _iterator4.e(err);
           } finally {
-            _iterator3.f();
+            _iterator4.f();
           }
           return _context.a(2, _objectSpread2(_objectSpread2({
             sources: sources,
@@ -14165,7 +14193,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.0",
+	version: "0.136.8",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14224,7 +14252,8 @@ var FATAL_ERROR_TYPES = ["no-schema", "no-source", "invalid-id", "no-module", "i
 var DEFAULT_CONTENT_HOST = "https://content.val.build";
 var DEFAULT_APP_HOST = "https://admin.val.build";
 /**
- * Where Val's own immutable build artifacts are served from.
+ * Where Val's own immutable build artifacts are served from: the content
+ * service's `/v1/static`.
  *
  * Only one kind of thing lives here so far: the WebAssembly binary of the
  * bundler the Studio builds a site with. It cannot travel with the Studio's
@@ -14232,11 +14261,23 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  * TEXT inside the server bundle, which both corrupts it and would carry it
  * into every project that installs `@valbuild/ui`.
  *
- * Everything under this host is addressed by the SHA-256 of its own bytes, so
+ * Everything under this path is addressed by the SHA-256 of its own bytes, so
  * an upload is idempotent, a URL is immutable, and the artifact a build asks
  * for cannot be a different one than the build was made against.
+ *
+ * On content rather than a host of its own because a publish cannot happen
+ * without content anyway -- declare, upload, verify, promote, `/build-target`
+ * and `/project-source` all go through it -- so a separate host would add no
+ * availability and one more domain to every customer's egress allowlist.
+ *
+ * A FIXED LITERAL, and deliberately not derived from a project's configured
+ * content host (`VAL_CONTENT_URL`). Deriving it would make serving this binary
+ * an obligation of every content service anybody points Val at, self-hosted
+ * ones included. A deployment that must fetch it from somewhere else sets
+ * `globalThis.__VAL_ROLLDOWN_WASM_URL__` instead (see
+ * `packages/ui/build/rolldownWasm.ts`).
  */
-var DEFAULT_STATIC_HOST = "https://static.val.build";
+var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
   VERSION: {
     core: corePackageJson.version
@@ -14358,4 +14399,4 @@ function tryJsonParse(str) {
   }
 }
 
-export { DateTimeSchema as $, ArraySchema as A, BooleanSchema as B, resolveSettingsModule as C, DEFAULT_CONTENT_HOST as D, localeTagError as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeOfValue as H, Internal as I, declaredKeySetOf as J, missingDeclaredKeys as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, discriminatedUnionBranchOf as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, ColorSchema as U, VAL_EXTENSION as V, CodeSchema as W, CODE_LANGUAGES as X, COLOR_FORMATS as Y, DEFAULT_COLOR_FORMAT as Z, _typeof as _, _slicedToArray as a, KeyOfSchema as a0, ValViewSchema as a1, isValViewSource as a2, RouteSchema as a3, RichTextSchema as a4, DiscriminatedUnionSchema as a5, EnumSchema as a6, LiteralSchema as a7, deserializeSchema as a8, previewScope as a9, isInlineRender as aa, parseNextJsRoutePattern as ab, parseTanStackRoutePattern as ac, tanStackSegmentsOfRoutePath as ad, validateUrlAgainstPattern as ae, getSourcePathFromRoute as af, isPageRouter as ag, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, hasRemoteFileSchema as j, hasMediaSchema as k, DEFAULT_VAL_REMOTE_HOST as l, modules as m, derefPatch as n, StringSchema as o, ImageSchema as p, FileSchema as q, DateSchema as r, splitModuleFilePathAndModulePath as s, SettingsSchema as t, ASSISTANT_SETTINGS_MAX_LENGTH as u, THEME_RADIUS_STEPS as v, THEME_RADIUS_LENGTHS as w, assistantAvailability as x, SETTINGS_MODULE_CONVENTION as y, isRootModuleFilePath as z };
+export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };

package/dist/{index-8a6c2682.cjs.dev.js → index-afbcf0ca.cjs.dev.js}

@@ -12611,9 +12611,41 @@ function collectObjectRecursive(item, collector) {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+function computeSourcesSha(entries) {
+  var sourcesSha = "";
+  var _iterator = result._createForOfIteratorHelper(entries),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _step.value,
+        path = _step$value.path,
+        source = _step$value.source;
+      sourcesSha = hash(sourcesSha + JSON.stringify({
+        path: path,
+        source: source
+      }));
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return sourcesSha;
+}
 function computeValModuleShas(config, entries, moduleErrors) {
   var configSha = hash(JSON.stringify(config));
-  var sourcesSha = "";
+  var sourcesSha = computeSourcesSha(entries);
   var baseSha = configSha;
   // NOTE: schemaSha is deliberately NOT seeded with configSha. It is compared
   // across bundles (the server extracts from the Node bundle, the editor SPA
@@ -12624,18 +12656,14 @@ function computeValModuleShas(config, entries, moduleErrors) {
   // server-only env vars and therefore `undefined` in the browser. Seeding with
   // them made the two sides disagree on every production load.
   var schemaSha = "";
-  var _iterator = result._createForOfIteratorHelper(entries),
-    _step;
+  var _iterator2 = result._createForOfIteratorHelper(entries),
+    _step2;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var entry = _step.value;
+    for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+      var entry = _step2.value;
       var path = entry.path,
         source = entry.source,
         serializedSchema = entry.serializedSchema;
-      sourcesSha = hash(sourcesSha + JSON.stringify({
-        path: path,
-        source: source
-      }));
       baseSha = hash(baseSha + JSON.stringify({
         path: path,
         schema: serializedSchema,
@@ -12653,9 +12681,9 @@ function computeValModuleShas(config, entries, moduleErrors) {
       }));
     }
   } catch (err) {
-    _iterator.e(err);
+    _iterator2.e(err);
   } finally {
-    _iterator.f();
+    _iterator2.f();
   }
   return {
     baseSha: baseSha,
@@ -12677,7 +12705,7 @@ function extractValModules(_x) {
 }
 function _extractValModules() {
   _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
-    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator2, _step2, error, _iterator3, _step3, _error, _t, _t2;
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator3, _step3, error, _iterator4, _step4, _error, _t, _t2;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
@@ -12824,10 +12852,10 @@ function _extractValModules() {
           // Appended AFTER the loop on purpose: each entry's `moduleErrorsAt` is the
           // error count at the time it was folded in, so the SHAs stay a function of
           // the modules themselves.
-          _iterator2 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
+          _iterator3 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
           try {
-            for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-              error = _step2.value;
+            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+              error = _step3.value;
               moduleErrors.push(error);
             }
             // Same kind of rule, same reason it is here: a view cycle is a property of the
@@ -12835,20 +12863,20 @@ function _extractValModules() {
             // catches it either — a view stores a pointer, not content, so there is no
             // data cycle for a source walk to trip over.
           } catch (err) {
-            _iterator2.e(err);
+            _iterator3.e(err);
           } finally {
-            _iterator2.f();
+            _iterator3.f();
           }
-          _iterator3 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
+          _iterator4 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
           try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              _error = _step3.value;
+            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+              _error = _step4.value;
               moduleErrors.push(_error);
             }
           } catch (err) {
-            _iterator3.e(err);
+            _iterator4.e(err);
           } finally {
-            _iterator3.f();
+            _iterator4.f();
           }
           return _context.a(2, _objectSpread2(_objectSpread2({
             sources: sources,
@@ -14167,7 +14195,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.0",
+	version: "0.136.8",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14226,7 +14254,8 @@ var FATAL_ERROR_TYPES = ["no-schema", "no-source", "invalid-id", "no-module", "i
 var DEFAULT_CONTENT_HOST = "https://content.val.build";
 var DEFAULT_APP_HOST = "https://admin.val.build";
 /**
- * Where Val's own immutable build artifacts are served from.
+ * Where Val's own immutable build artifacts are served from: the content
+ * service's `/v1/static`.
  *
  * Only one kind of thing lives here so far: the WebAssembly binary of the
  * bundler the Studio builds a site with. It cannot travel with the Studio's
@@ -14234,11 +14263,23 @@ var DEFAULT_APP_HOST = "https://admin.val.build";
  * TEXT inside the server bundle, which both corrupts it and would carry it
  * into every project that installs `@valbuild/ui`.
  *
- * Everything under this host is addressed by the SHA-256 of its own bytes, so
+ * Everything under this path is addressed by the SHA-256 of its own bytes, so
  * an upload is idempotent, a URL is immutable, and the artifact a build asks
  * for cannot be a different one than the build was made against.
+ *
+ * On content rather than a host of its own because a publish cannot happen
+ * without content anyway -- declare, upload, verify, promote, `/build-target`
+ * and `/project-source` all go through it -- so a separate host would add no
+ * availability and one more domain to every customer's egress allowlist.
+ *
+ * A FIXED LITERAL, and deliberately not derived from a project's configured
+ * content host (`VAL_CONTENT_URL`). Deriving it would make serving this binary
+ * an obligation of every content service anybody points Val at, self-hosted
+ * ones included. A deployment that must fetch it from somewhere else sets
+ * `globalThis.__VAL_ROLLDOWN_WASM_URL__` instead (see
+ * `packages/ui/build/rolldownWasm.ts`).
  */
-var DEFAULT_STATIC_HOST = "https://static.val.build";
+var DEFAULT_STATIC_HOST = "https://content.val.build/v1/static";
 var Internal = {
   VERSION: {
     core: corePackageJson.version
@@ -14406,6 +14447,7 @@ exports._slicedToArray = _slicedToArray;
 exports._toConsumableArray = _toConsumableArray;
 exports._typeof = _typeof;
 exports.assistantAvailability = assistantAvailability;
+exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;

package/dist/valbuild-core.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-8a6c2682.cjs.dev.js');
+var dist_valbuildCore = require('./index-afbcf0ca.cjs.dev.js');
 require('./result-bb1f436e.cjs.dev.js');
 
 
@@ -47,6 +47,7 @@ exports.THEME_RADIUS_STEPS = dist_valbuildCore.THEME_RADIUS_STEPS;
 exports.VAL_EXTENSION = dist_valbuildCore.VAL_EXTENSION;
 exports.ValViewSchema = dist_valbuildCore.ValViewSchema;
 exports.assistantAvailability = dist_valbuildCore.assistantAvailability;
+exports.computeSourcesSha = dist_valbuildCore.computeSourcesSha;
 exports.computeValModuleShas = dist_valbuildCore.computeValModuleShas;
 exports.declaredKeySetOf = dist_valbuildCore.declaredKeySetOf;
 exports.derefPatch = dist_valbuildCore.derefPatch;

package/dist/valbuild-core.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-e4035f4d.cjs.prod.js');
+var dist_valbuildCore = require('./index-2545d3b4.cjs.prod.js');
 require('./result-787e35f6.cjs.prod.js');
 
 
@@ -47,6 +47,7 @@ exports.THEME_RADIUS_STEPS = dist_valbuildCore.THEME_RADIUS_STEPS;
 exports.VAL_EXTENSION = dist_valbuildCore.VAL_EXTENSION;
 exports.ValViewSchema = dist_valbuildCore.ValViewSchema;
 exports.assistantAvailability = dist_valbuildCore.assistantAvailability;
+exports.computeSourcesSha = dist_valbuildCore.computeSourcesSha;
 exports.computeValModuleShas = dist_valbuildCore.computeValModuleShas;
 exports.declaredKeySetOf = dist_valbuildCore.declaredKeySetOf;
 exports.derefPatch = dist_valbuildCore.derefPatch;

package/dist/valbuild-core.esm.js

@@ -1,2 +1,2 @@
-export { u as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, X as CODE_LANGUAGES, Y as COLOR_FORMATS, W as CodeSchema, U as ColorSchema, e as DEFAULT_APP_HOST, Z as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, l as DEFAULT_VAL_REMOTE_HOST, r as DateSchema, $ as DateTimeSchema, a5 as DiscriminatedUnionSchema, a6 as EnumSchema, F as FATAL_ERROR_TYPES, q as FileSchema, G as GenericSelector, p as ImageSchema, I as Internal, a0 as KeyOfSchema, a7 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a4 as RichTextSchema, a3 as RouteSchema, y as SETTINGS_MODULE_CONVENTION, S as Schema, t as SettingsSchema, o as StringSchema, T as THEME_LOGO_DIRECTORY, w as THEME_RADIUS_LENGTHS, v as THEME_RADIUS_STEPS, V as VAL_EXTENSION, a1 as ValViewSchema, x as assistantAvailability, h as computeValModuleShas, J as declaredKeySetOf, n as derefPatch, a8 as deserializeSchema, Q as discriminatedUnionBranchOf, g as extractValModules, af as getSourcePathFromRoute, k as hasMediaSchema, j as hasRemoteFileSchema, i as initVal, aa as isInlineRender, ag as isPageRouter, z as isRootModuleFilePath, a2 as isValViewSource, H as localeOfValue, E as localeTagError, K as missingDeclaredKeys, m as modules, ab as parseNextJsRoutePattern, ac as parseTanStackRoutePattern, a9 as previewScope, C as resolveSettingsModule, ad as tanStackSegmentsOfRoutePath, ae as validateUrlAgainstPattern } from './index-84fa4a70.esm.js';
+export { v as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, Y as CODE_LANGUAGES, Z as COLOR_FORMATS, X as CodeSchema, W as ColorSchema, e as DEFAULT_APP_HOST, $ as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, n as DEFAULT_VAL_REMOTE_HOST, t as DateSchema, a0 as DateTimeSchema, a6 as DiscriminatedUnionSchema, a7 as EnumSchema, F as FATAL_ERROR_TYPES, r as FileSchema, G as GenericSelector, q as ImageSchema, I as Internal, a1 as KeyOfSchema, a8 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a5 as RichTextSchema, a4 as RouteSchema, z as SETTINGS_MODULE_CONVENTION, S as Schema, u as SettingsSchema, p as StringSchema, T as THEME_LOGO_DIRECTORY, x as THEME_RADIUS_LENGTHS, w as THEME_RADIUS_STEPS, V as VAL_EXTENSION, a2 as ValViewSchema, y as assistantAvailability, j as computeSourcesSha, h as computeValModuleShas, K as declaredKeySetOf, o as derefPatch, a9 as deserializeSchema, U as discriminatedUnionBranchOf, g as extractValModules, ag as getSourcePathFromRoute, l as hasMediaSchema, k as hasRemoteFileSchema, i as initVal, ab as isInlineRender, ah as isPageRouter, C as isRootModuleFilePath, a3 as isValViewSource, J as localeOfValue, H as localeTagError, Q as missingDeclaredKeys, m as modules, ac as parseNextJsRoutePattern, ad as parseTanStackRoutePattern, aa as previewScope, E as resolveSettingsModule, ae as tanStackSegmentsOfRoutePath, af as validateUrlAgainstPattern } from './index-962a8ac3.esm.js';
 import './result-daff1cae.esm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/core",
-  "version": "0.136.0",
+  "version": "0.136.8",
   "private": false,
   "description": "Val - supercharged hard-coded content",
   "repository": {

package/patch/dist/valbuild-core-patch.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-8a6c2682.cjs.dev.js');
+var dist_valbuildCore = require('../../dist/index-afbcf0ca.cjs.dev.js');
 var result = require('../../dist/result-bb1f436e.cjs.dev.js');
 var util = require('../../dist/util-b213092b.cjs.dev.js');
 

package/patch/dist/valbuild-core-patch.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-e4035f4d.cjs.prod.js');
+var dist_valbuildCore = require('../../dist/index-2545d3b4.cjs.prod.js');
 var result = require('../../dist/result-787e35f6.cjs.prod.js');
 var util = require('../../dist/util-030d8a1f.cjs.prod.js');
 

package/patch/dist/valbuild-core-patch.esm.js

@@ -1,5 +1,5 @@
-import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-84fa4a70.esm.js';
-export { P as PatchError } from '../../dist/index-84fa4a70.esm.js';
+import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-962a8ac3.esm.js';
+export { P as PatchError } from '../../dist/index-962a8ac3.esm.js';
 import { f as isNonEmpty, e as err, o as ok, m as map, g as flatMap, i as isErr, h as flatMapReduce, j as filterOrElse, k as mapErr, l as map$1, n as all, p as flatten, q as allT } from '../../dist/result-daff1cae.esm.js';
 import { p as pipe } from '../../dist/util-18613e99.esm.js';