@valbuild/server 0.138.3 → 0.138.5

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @valbuild/server
 
+## 0.138.5
+
+### Patch Changes
+
+- Updated dependencies [[`c532afc`](https://github.com/valbuild/val/commit/c532afc1818ee0249ad227a7da029c3e8d06baa8)]:
+  - @valbuild/ui@0.138.5
+
+## 0.138.4
+
+### Patch Changes
+
+- [#771](https://github.com/valbuild/val/pull/771) [`63bff05`](https://github.com/valbuild/val/commit/63bff0589b6df42efaa63ec606688d20a9670439) Thanks [@freekh](https://github.com/freekh)! - Changes that are already published no longer briefly vanish from the Studio, or show up twice, right after a publish in app mode.
+
+  A build the Studio makes in the browser now records which publish it was made for, so Val knows exactly which changes the running site already has. Before this, Val worked that out from whichever build was live, and was wrong for a moment while a publish was going live. A reload in that moment could hide changes that were not on the site yet, or apply ones that were a second time. Projects set up before this release need no changes.
+
+- [#770](https://github.com/valbuild/val/pull/770) [`0a885b1`](https://github.com/valbuild/val/commit/0a885b1f0304517b167b959958464066194732d0) Thanks [@freekh](https://github.com/freekh)! - Publishing a Git-connected app-mode project now puts your changes on the site in seconds, instead of waiting for CI.
+
+  - The Studio builds the site in the browser, the same way it does for a managed project. Val pushes the commit to your repository as before. When nothing but content has changed since the build the site is serving, the browser's build goes live right away. If a developer has pushed code in between, the site waits for CI's build, so their code is never taken off the site.
+  - If the browser cannot build, the publish still goes through and CI delivers it. This happens when the page is not cross-origin isolated, or when the build keeps failing. Your changes stay visible in the Studio until the site serves a build that has them.
+  - Content that would break a page is caught before anything is pushed to your repository.
+
+- [#771](https://github.com/valbuild/val/pull/771) [`58d13a2`](https://github.com/valbuild/val/commit/58d13a2a534421b341b1bf71d02f0a2290fc0d61) Thanks [@freekh](https://github.com/freekh)! - A project created on val.build with a GitHub repository can publish right away. Before, the first publish was refused with "this deployment was not built from one" until the repository's first CI build had finished.
+
+  While that first build runs, the site is served the template's build. When you publish from it, Val now checks that its content files are exactly the same as the files in your repository. If they are, the publish goes ahead and is pushed to your repository straight away. Your changes stay visible in the Studio until the site serves CI's build of them. If the files differ, the publish is refused, as before.
+
+- Updated dependencies [[`63bff05`](https://github.com/valbuild/val/commit/63bff0589b6df42efaa63ec606688d20a9670439), [`0a885b1`](https://github.com/valbuild/val/commit/0a885b1f0304517b167b959958464066194732d0), [`8b1e47e`](https://github.com/valbuild/val/commit/8b1e47e50f9556d8469358af93ba32a084e2e131), [`58d13a2`](https://github.com/valbuild/val/commit/58d13a2a534421b341b1bf71d02f0a2290fc0d61), [`4268beb`](https://github.com/valbuild/val/commit/4268beb4beec53cb52584f59f9bbd5ffdcc9095d), [`e79451f`](https://github.com/valbuild/val/commit/e79451faab37f46e2039d681a19eea06d537dc44)]:
+  - @valbuild/ui@0.138.4
+  - @valbuild/shared@0.138.4
+
 ## 0.138.3
 
 ### Patch Changes

package/dist/declarations/src/ValOpsHttp.d.ts

@@ -72,8 +72,22 @@ export declare class ValOpsHttp extends ValOps {
      * file read for one with "no GitHub repo".
      */
     private readonly projectSource;
+    /** See `publishJob` on {@link ValApiOptions}; sent only with no commit. */
+    private readonly publishJob;
     /** Did the host hand over the running build's source? See `projectSource`. */
     embedsSource(): boolean;
+    /**
+     * The Val source this build embeds, as git blob shas by path from the
+     * project root: every module and `val.modules.*`. `null` when it embeds no
+     * source.
+     *
+     * For a build of no commit -- the template's, which a project `/new` made
+     * with a repository is served until CI's first build -- so the content
+     * service can compare it with the branch file by file, having no commit to
+     * compare from. A git blob sha is `sha1("blob <bytes>\0" + content)`, which is
+     * what makes it comparable with the branch's tree without reading a file.
+     */
+    embeddedValSourceShas(): Promise<Record<string, string> | null>;
     /**
      * What the content service last said this project expects of its publisher.
      *
@@ -126,6 +140,8 @@ export declare class ValOpsHttp extends ValOps {
         root?: string;
         /** See `projectSource` on {@link ValApiOptions}. */
         projectSource?: Record<string, string>;
+        /** See `publishJob` on {@link ValApiOptions}. */
+        publishJob?: string;
     });
     /**
      * A deployment that cannot mirror a project which expects to be mirrored.
@@ -250,6 +266,10 @@ export declare class ValOpsHttp extends ValOps {
         modules: PreparedCommit["moduleVersions"];
         /** Connected: the git commit this deployment was built from. */
         gitCommit?: string;
+        /** Connected: the tab can build this job (the deployment embeds its source). */
+        tabBuilds?: true;
+        /** Connected, a build of no commit: its Val source. See `embeddedValSourceShas`. */
+        deploymentFiles?: Record<string, string>;
     }): Promise<{
         status: number;
         body: string;

package/dist/declarations/src/ValRouter.d.ts

@@ -140,6 +140,13 @@ type ValServerOverrides = Partial<{
      * itself embeds its source in the build and hands it over here.
      */
     projectSource?: Record<string, string>;
+    /**
+     * The publish job the RUNNING build was made for, when a Studio built it in
+     * a tab. Such a build has no commit to name its place in the content
+     * service's chain with, so it names its job, and the service places it by
+     * that rather than at whichever build is live.
+     */
+    publishJob?: string;
     /**
      * The base url of Val.
      *

package/dist/declarations/src/ValServer.d.ts

@@ -141,6 +141,8 @@ export type ValServerConfig = ValServerOptions & ({
     root?: string;
     /** See `projectSource` on {@link ValApiOptions}. */
     projectSource?: Record<string, string>;
+    /** See `publishJob` on {@link ValApiOptions}. */
+    publishJob?: string;
     config: ValConfig;
 }
 /**

package/dist/valbuild-server.cjs.dev.js

@@ -8638,11 +8638,43 @@ class ValOpsHttp extends ValOps {
    * file read for one with "no GitHub repo".
    */
   projectSource;
+  /** See `publishJob` on {@link ValApiOptions}; sent only with no commit. */
+  publishJob;
 
   /** Did the host hand over the running build's source? See `projectSource`. */
   embedsSource() {
     return this.projectSource !== null;
   }
+
+  /**
+   * The Val source this build embeds, as git blob shas by path from the
+   * project root: every module and `val.modules.*`. `null` when it embeds no
+   * source.
+   *
+   * For a build of no commit -- the template's, which a project `/new` made
+   * with a repository is served until CI's first build -- so the content
+   * service can compare it with the branch file by file, having no commit to
+   * compare from. A git blob sha is `sha1("blob <bytes>\0" + content)`, which is
+   * what makes it comparable with the branch's tree without reading a file.
+   */
+  async embeddedValSourceShas() {
+    if (this.projectSource === null) return null;
+    const encoder = new TextEncoder();
+    const shas = {};
+    for (const [path, content] of Object.entries(this.projectSource)) {
+      const base = path.slice(path.lastIndexOf("/") + 1);
+      const isValSource = path.endsWith(".val.ts") || path.endsWith(".val.js") || path.endsWith(".val.json") || base === "val.modules.ts" || base === "val.modules.js";
+      if (!isValSource) continue;
+      const body = encoder.encode(content);
+      const header = encoder.encode(`blob ${body.byteLength}\0`);
+      const bytes = new Uint8Array(header.byteLength + body.byteLength);
+      bytes.set(header, 0);
+      bytes.set(body, header.byteLength);
+      const digest = await crypto.subtle.digest("SHA-1", bytes);
+      shas[path.replace(/^\/+/, "")] = Array.from(new Uint8Array(digest)).map(byte => byte.toString(16).padStart(2, "0")).join("");
+    }
+    return shas;
+  }
   /**
    * What the content service last said this project expects of its publisher.
    *
@@ -8691,6 +8723,7 @@ class ValOpsHttp extends ValOps {
     };
     this.root = (options === null || options === void 0 ? void 0 : options.root) ?? "";
     this.projectSource = (options === null || options === void 0 ? void 0 : options.projectSource) ?? null;
+    this.publishJob = (options === null || options === void 0 ? void 0 : options.publishJob) ?? null;
     this.mirrorsSourceFiles = git !== null || this.projectSource !== null;
   }
   /**
@@ -8720,6 +8753,15 @@ class ValOpsHttp extends ValOps {
     if (this.git !== null) {
       return null;
     }
+    /*
+     * Content runs this project's publishes as jobs, and its prepare decides
+     * what the push goes on top of -- including for a site that was never
+     * built from a commit (a project `/new` made, before its first CI build).
+     * Refusing here would refuse what content can answer.
+     */
+    if (this.publishesAsJobs()) {
+      return null;
+    }
     if (((_this$projectExpectat = this.projectExpectation) === null || _this$projectExpectat === void 0 ? void 0 : _this$projectExpectat.sourceMode) !== "connected") {
       return null;
     }
@@ -9210,6 +9252,8 @@ class ValOpsHttp extends ValOps {
         ...(this.git ? {
           branch: this.git.branch,
           commitSha: this.git.commit
+        } : this.publishJob !== null ? {
+          job: this.publishJob
         } : {})
       }),
       headers: {
@@ -9391,6 +9435,9 @@ class ValOpsHttp extends ValOps {
     if (this.git) {
       params.push(["branch", this.git.branch]);
       params.push(["commit", this.git.commit]);
+    } else if (this.publishJob !== null) {
+      // A build a tab made has no commit, and says which job it was made for.
+      params.push(["job", this.publishJob]);
     }
     if (filters.patchIds) {
       for (const patchId of filters.patchIds) {
@@ -12128,6 +12175,9 @@ async function initHandlerOptions(route, opts, config) {
       ...(opts.projectSource !== undefined ? {
         projectSource: opts.projectSource
       } : {}),
+      ...(opts.publishJob !== undefined ? {
+        publishJob: opts.publishJob
+      } : {}),
       project: maybeValProject,
       valEnableRedirectUrl,
       valDisableRedirectUrl,
@@ -12197,6 +12247,9 @@ function createValOps(valModules, options) {
       config: options.config,
       ...(options.projectSource !== undefined ? {
         projectSource: options.projectSource
+      } : {}),
+      ...(options.publishJob !== undefined ? {
+        publishJob: options.publishJob
       } : {})
     });
   }
@@ -14295,8 +14348,12 @@ const ValServer = (valModules, options, callbacks) => {
         /*
          * CONNECTED: the job's sources are what `/save` would commit -- its
          * own changes, applied as `/save` applies them -- and content pushes
-         * them at the seal. Nothing is built here: CI builds after the push,
-         * so the answer carries the job and no sources.
+         * them at the seal. The tab ALSO builds the job, as a managed one is
+         * built (docs/app-mode.md, "Since changed: connected builds in the
+         * tab"): from this deployment's embedded source, the commits since it
+         * and the job's changes. A deployment that embeds no source answers
+         * `buildable: false`, and the tab reports "no build": CI builds the
+         * push either way.
          */
         if (serverOps.sourceMode() === "connected") {
           var _options$config$files;
@@ -14342,90 +14399,54 @@ const ValServer = (valModules, options, callbacks) => {
             withJob: prepared,
             jobPatchIds: patchIds
           });
+          const build = serverOps.embedsSource() ? await buildSourcesOf(serverOps, patchIds, commit) : null;
+          if (build !== null && "status" in build) return build;
+          /*
+           * A build of no commit says what Val source it holds instead, so
+           * the content service can compare it with the branch -- the
+           * template's build a `/new` project is served before CI's first.
+           */
+          const deploymentFiles = commit === undefined ? await serverOps.embeddedValSourceShas() : null;
           const sent = await serverOps.prepareJob(jobId, {
             tab,
             filesDirectory: ((_options$config$files = options.config.files) === null || _options$config$files === void 0 ? void 0 : _options$config$files.directory) || "/public/val",
             ...split.archive,
             ...(commit !== undefined ? {
               gitCommit: commit
+            } : {}),
+            ...(deploymentFiles !== null ? {
+              deploymentFiles
+            } : {}),
+            // Said, so content waits for this tab's build. A server that does
+            // not say it gets CI's: what Val servers before this one get.
+            ...(build !== null ? {
+              tabBuilds: true
             } : {})
           });
           return jobPrepareAnswer(sent, {
-            sourceFiles: {},
-            binaryFiles: {},
-            binaryFilesUnread: [],
-            branch: serverOps.projectBranch()
+            sourceFiles: (build === null || build === void 0 ? void 0 : build.sourceFiles) ?? {},
+            binaryFiles: (build === null || build === void 0 ? void 0 : build.binaryFiles) ?? {},
+            binaryFilesUnread: (build === null || build === void 0 ? void 0 : build.binaryFilesUnread) ?? [],
+            branch: serverOps.projectBranch(),
+            buildable: build !== null
           });
         }
-        const chain = await serverOps.fetchPatches({
-          patchIds: undefined,
-          excludePatchOps: false
-        });
-        if (chain.error) {
-          return {
-            status: 500,
-            json: {
-              message: chain.error.message
-            }
-          };
-        }
-        /*
-         * The job's content, in two steps from this build's embedded source.
-         *
-         * The commits since this build, as though pending, are the branch's
-         * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
-         * out of its own changes (docs/app-mode.md, "Publishing is a queued
-         * job"), and were that ever not so, the seal would restart the job
-         * rather than publish it. Chain order, both times.
-         */
-        const job = new Set(patchIds);
-        const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
-          ...patch,
-          appliedAt: null
-        }));
-        const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
-        const known = new Set(chain.patches.map(patch => patch.patchId));
-        const gone = patchIds.filter(id => !known.has(id));
-        if (gone.length > 0) {
-          return {
-            status: 409,
-            json: {
-              message: `This publish's changes are no longer all there (${gone.length} discarded).`
-            }
-          };
-        }
-        const prepareOf = patches => serverOps.prepare({
-          ...serverOps.analyzePatches(patches, chain.commits, commit),
-          ...chain,
-          patches
-        });
-        const chainOnly = await prepareOf(committed);
-        const withJob = await prepareOf([...committed, ...pending]);
-        if (chainOnly.hasErrors || withJob.hasErrors) {
-          return {
-            status: 500,
-            json: {
-              message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
-            }
-          };
-        }
-        const split = splitJobPrepare({
-          chainOnly,
-          withJob,
-          jobPatchIds: patchIds
-        });
-        // Read now, while the job's changes still hold their files.
-        const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+        const built = await buildSourcesOf(serverOps, patchIds, commit);
+        if ("status" in built) return built;
+        const {
+          split
+        } = built;
         const sent = await serverOps.prepareJob(jobId, {
           tab,
           filesDirectory: ((_options$config$files2 = options.config.files) === null || _options$config$files2 === void 0 ? void 0 : _options$config$files2.directory) || "/public/val",
           ...split.archive
         });
         return jobPrepareAnswer(sent, {
-          sourceFiles: split.buildSourceFiles,
-          binaryFiles: binaries.files,
-          binaryFilesUnread: binaries.unread,
-          branch: serverOps.projectBranch()
+          sourceFiles: built.sourceFiles,
+          binaryFiles: built.binaryFiles,
+          binaryFilesUnread: built.binaryFilesUnread,
+          branch: serverOps.projectBranch(),
+          buildable: true
         });
       }
     },
@@ -16536,6 +16557,82 @@ function getIsRemoteRequired(schemas) {
   return false;
 }
 
+/**
+ * What a tab builds a job from: this deployment's embedded source, the
+ * commits since it (as though pending: together they are the branch's head),
+ * and the job's own pending changes on top. Managed and connected alike.
+ *
+ * `split.archive` is the managed job's archive; a connected job's archive is
+ * the push's, made from its own changes alone, by the caller.
+ */
+async function buildSourcesOf(serverOps, patchIds, commit) {
+  const chain = await serverOps.fetchPatches({
+    patchIds: undefined,
+    excludePatchOps: false
+  });
+  if (chain.error) {
+    return {
+      status: 500,
+      json: {
+        message: chain.error.message
+      }
+    };
+  }
+  /*
+   * The job's content, in two steps from this build's embedded source.
+   *
+   * The commits since this build, as though pending, are the branch's
+   * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
+   * out of its own changes (docs/app-mode.md, "Publishing is a queued
+   * job"), and were that ever not so, the seal would restart the job
+   * rather than publish it. Chain order, both times.
+   */
+  const job = new Set(patchIds);
+  const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
+    ...patch,
+    appliedAt: null
+  }));
+  const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
+  const known = new Set(chain.patches.map(patch => patch.patchId));
+  const gone = patchIds.filter(id => !known.has(id));
+  if (gone.length > 0) {
+    return {
+      status: 409,
+      json: {
+        message: `This publish's changes are no longer all there (${gone.length} discarded).`
+      }
+    };
+  }
+  const prepareOf = patches => serverOps.prepare({
+    ...serverOps.analyzePatches(patches, chain.commits, commit),
+    ...chain,
+    patches
+  });
+  const chainOnly = await prepareOf(committed);
+  const withJob = await prepareOf([...committed, ...pending]);
+  if (chainOnly.hasErrors || withJob.hasErrors) {
+    return {
+      status: 500,
+      json: {
+        message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
+      }
+    };
+  }
+  const split = splitJobPrepare({
+    chainOnly,
+    withJob,
+    jobPatchIds: patchIds
+  });
+  // Read now, while the job's changes still hold their files.
+  const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+  return {
+    split,
+    sourceFiles: split.buildSourceFiles,
+    binaryFiles: binaries.files,
+    binaryFilesUnread: binaries.unread
+  };
+}
+
 /**
  * `/publish-job-prepare`'s answer from content's: the job as content has it
  * now, and what the tab builds from. Content's refusal is passed on -- 409

package/dist/valbuild-server.cjs.prod.js

@@ -8638,11 +8638,43 @@ class ValOpsHttp extends ValOps {
    * file read for one with "no GitHub repo".
    */
   projectSource;
+  /** See `publishJob` on {@link ValApiOptions}; sent only with no commit. */
+  publishJob;
 
   /** Did the host hand over the running build's source? See `projectSource`. */
   embedsSource() {
     return this.projectSource !== null;
   }
+
+  /**
+   * The Val source this build embeds, as git blob shas by path from the
+   * project root: every module and `val.modules.*`. `null` when it embeds no
+   * source.
+   *
+   * For a build of no commit -- the template's, which a project `/new` made
+   * with a repository is served until CI's first build -- so the content
+   * service can compare it with the branch file by file, having no commit to
+   * compare from. A git blob sha is `sha1("blob <bytes>\0" + content)`, which is
+   * what makes it comparable with the branch's tree without reading a file.
+   */
+  async embeddedValSourceShas() {
+    if (this.projectSource === null) return null;
+    const encoder = new TextEncoder();
+    const shas = {};
+    for (const [path, content] of Object.entries(this.projectSource)) {
+      const base = path.slice(path.lastIndexOf("/") + 1);
+      const isValSource = path.endsWith(".val.ts") || path.endsWith(".val.js") || path.endsWith(".val.json") || base === "val.modules.ts" || base === "val.modules.js";
+      if (!isValSource) continue;
+      const body = encoder.encode(content);
+      const header = encoder.encode(`blob ${body.byteLength}\0`);
+      const bytes = new Uint8Array(header.byteLength + body.byteLength);
+      bytes.set(header, 0);
+      bytes.set(body, header.byteLength);
+      const digest = await crypto.subtle.digest("SHA-1", bytes);
+      shas[path.replace(/^\/+/, "")] = Array.from(new Uint8Array(digest)).map(byte => byte.toString(16).padStart(2, "0")).join("");
+    }
+    return shas;
+  }
   /**
    * What the content service last said this project expects of its publisher.
    *
@@ -8691,6 +8723,7 @@ class ValOpsHttp extends ValOps {
     };
     this.root = (options === null || options === void 0 ? void 0 : options.root) ?? "";
     this.projectSource = (options === null || options === void 0 ? void 0 : options.projectSource) ?? null;
+    this.publishJob = (options === null || options === void 0 ? void 0 : options.publishJob) ?? null;
     this.mirrorsSourceFiles = git !== null || this.projectSource !== null;
   }
   /**
@@ -8720,6 +8753,15 @@ class ValOpsHttp extends ValOps {
     if (this.git !== null) {
       return null;
     }
+    /*
+     * Content runs this project's publishes as jobs, and its prepare decides
+     * what the push goes on top of -- including for a site that was never
+     * built from a commit (a project `/new` made, before its first CI build).
+     * Refusing here would refuse what content can answer.
+     */
+    if (this.publishesAsJobs()) {
+      return null;
+    }
     if (((_this$projectExpectat = this.projectExpectation) === null || _this$projectExpectat === void 0 ? void 0 : _this$projectExpectat.sourceMode) !== "connected") {
       return null;
     }
@@ -9210,6 +9252,8 @@ class ValOpsHttp extends ValOps {
         ...(this.git ? {
           branch: this.git.branch,
           commitSha: this.git.commit
+        } : this.publishJob !== null ? {
+          job: this.publishJob
         } : {})
       }),
       headers: {
@@ -9391,6 +9435,9 @@ class ValOpsHttp extends ValOps {
     if (this.git) {
       params.push(["branch", this.git.branch]);
       params.push(["commit", this.git.commit]);
+    } else if (this.publishJob !== null) {
+      // A build a tab made has no commit, and says which job it was made for.
+      params.push(["job", this.publishJob]);
     }
     if (filters.patchIds) {
       for (const patchId of filters.patchIds) {
@@ -12128,6 +12175,9 @@ async function initHandlerOptions(route, opts, config) {
       ...(opts.projectSource !== undefined ? {
         projectSource: opts.projectSource
       } : {}),
+      ...(opts.publishJob !== undefined ? {
+        publishJob: opts.publishJob
+      } : {}),
       project: maybeValProject,
       valEnableRedirectUrl,
       valDisableRedirectUrl,
@@ -12197,6 +12247,9 @@ function createValOps(valModules, options) {
       config: options.config,
       ...(options.projectSource !== undefined ? {
         projectSource: options.projectSource
+      } : {}),
+      ...(options.publishJob !== undefined ? {
+        publishJob: options.publishJob
       } : {})
     });
   }
@@ -14295,8 +14348,12 @@ const ValServer = (valModules, options, callbacks) => {
         /*
          * CONNECTED: the job's sources are what `/save` would commit -- its
          * own changes, applied as `/save` applies them -- and content pushes
-         * them at the seal. Nothing is built here: CI builds after the push,
-         * so the answer carries the job and no sources.
+         * them at the seal. The tab ALSO builds the job, as a managed one is
+         * built (docs/app-mode.md, "Since changed: connected builds in the
+         * tab"): from this deployment's embedded source, the commits since it
+         * and the job's changes. A deployment that embeds no source answers
+         * `buildable: false`, and the tab reports "no build": CI builds the
+         * push either way.
          */
         if (serverOps.sourceMode() === "connected") {
           var _options$config$files;
@@ -14342,90 +14399,54 @@ const ValServer = (valModules, options, callbacks) => {
             withJob: prepared,
             jobPatchIds: patchIds
           });
+          const build = serverOps.embedsSource() ? await buildSourcesOf(serverOps, patchIds, commit) : null;
+          if (build !== null && "status" in build) return build;
+          /*
+           * A build of no commit says what Val source it holds instead, so
+           * the content service can compare it with the branch -- the
+           * template's build a `/new` project is served before CI's first.
+           */
+          const deploymentFiles = commit === undefined ? await serverOps.embeddedValSourceShas() : null;
           const sent = await serverOps.prepareJob(jobId, {
             tab,
             filesDirectory: ((_options$config$files = options.config.files) === null || _options$config$files === void 0 ? void 0 : _options$config$files.directory) || "/public/val",
             ...split.archive,
             ...(commit !== undefined ? {
               gitCommit: commit
+            } : {}),
+            ...(deploymentFiles !== null ? {
+              deploymentFiles
+            } : {}),
+            // Said, so content waits for this tab's build. A server that does
+            // not say it gets CI's: what Val servers before this one get.
+            ...(build !== null ? {
+              tabBuilds: true
             } : {})
           });
           return jobPrepareAnswer(sent, {
-            sourceFiles: {},
-            binaryFiles: {},
-            binaryFilesUnread: [],
-            branch: serverOps.projectBranch()
+            sourceFiles: (build === null || build === void 0 ? void 0 : build.sourceFiles) ?? {},
+            binaryFiles: (build === null || build === void 0 ? void 0 : build.binaryFiles) ?? {},
+            binaryFilesUnread: (build === null || build === void 0 ? void 0 : build.binaryFilesUnread) ?? [],
+            branch: serverOps.projectBranch(),
+            buildable: build !== null
           });
         }
-        const chain = await serverOps.fetchPatches({
-          patchIds: undefined,
-          excludePatchOps: false
-        });
-        if (chain.error) {
-          return {
-            status: 500,
-            json: {
-              message: chain.error.message
-            }
-          };
-        }
-        /*
-         * The job's content, in two steps from this build's embedded source.
-         *
-         * The commits since this build, as though pending, are the branch's
-         * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
-         * out of its own changes (docs/app-mode.md, "Publishing is a queued
-         * job"), and were that ever not so, the seal would restart the job
-         * rather than publish it. Chain order, both times.
-         */
-        const job = new Set(patchIds);
-        const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
-          ...patch,
-          appliedAt: null
-        }));
-        const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
-        const known = new Set(chain.patches.map(patch => patch.patchId));
-        const gone = patchIds.filter(id => !known.has(id));
-        if (gone.length > 0) {
-          return {
-            status: 409,
-            json: {
-              message: `This publish's changes are no longer all there (${gone.length} discarded).`
-            }
-          };
-        }
-        const prepareOf = patches => serverOps.prepare({
-          ...serverOps.analyzePatches(patches, chain.commits, commit),
-          ...chain,
-          patches
-        });
-        const chainOnly = await prepareOf(committed);
-        const withJob = await prepareOf([...committed, ...pending]);
-        if (chainOnly.hasErrors || withJob.hasErrors) {
-          return {
-            status: 500,
-            json: {
-              message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
-            }
-          };
-        }
-        const split = splitJobPrepare({
-          chainOnly,
-          withJob,
-          jobPatchIds: patchIds
-        });
-        // Read now, while the job's changes still hold their files.
-        const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+        const built = await buildSourcesOf(serverOps, patchIds, commit);
+        if ("status" in built) return built;
+        const {
+          split
+        } = built;
         const sent = await serverOps.prepareJob(jobId, {
           tab,
           filesDirectory: ((_options$config$files2 = options.config.files) === null || _options$config$files2 === void 0 ? void 0 : _options$config$files2.directory) || "/public/val",
           ...split.archive
         });
         return jobPrepareAnswer(sent, {
-          sourceFiles: split.buildSourceFiles,
-          binaryFiles: binaries.files,
-          binaryFilesUnread: binaries.unread,
-          branch: serverOps.projectBranch()
+          sourceFiles: built.sourceFiles,
+          binaryFiles: built.binaryFiles,
+          binaryFilesUnread: built.binaryFilesUnread,
+          branch: serverOps.projectBranch(),
+          buildable: true
         });
       }
     },
@@ -16536,6 +16557,82 @@ function getIsRemoteRequired(schemas) {
   return false;
 }
 
+/**
+ * What a tab builds a job from: this deployment's embedded source, the
+ * commits since it (as though pending: together they are the branch's head),
+ * and the job's own pending changes on top. Managed and connected alike.
+ *
+ * `split.archive` is the managed job's archive; a connected job's archive is
+ * the push's, made from its own changes alone, by the caller.
+ */
+async function buildSourcesOf(serverOps, patchIds, commit) {
+  const chain = await serverOps.fetchPatches({
+    patchIds: undefined,
+    excludePatchOps: false
+  });
+  if (chain.error) {
+    return {
+      status: 500,
+      json: {
+        message: chain.error.message
+      }
+    };
+  }
+  /*
+   * The job's content, in two steps from this build's embedded source.
+   *
+   * The commits since this build, as though pending, are the branch's
+   * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
+   * out of its own changes (docs/app-mode.md, "Publishing is a queued
+   * job"), and were that ever not so, the seal would restart the job
+   * rather than publish it. Chain order, both times.
+   */
+  const job = new Set(patchIds);
+  const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
+    ...patch,
+    appliedAt: null
+  }));
+  const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
+  const known = new Set(chain.patches.map(patch => patch.patchId));
+  const gone = patchIds.filter(id => !known.has(id));
+  if (gone.length > 0) {
+    return {
+      status: 409,
+      json: {
+        message: `This publish's changes are no longer all there (${gone.length} discarded).`
+      }
+    };
+  }
+  const prepareOf = patches => serverOps.prepare({
+    ...serverOps.analyzePatches(patches, chain.commits, commit),
+    ...chain,
+    patches
+  });
+  const chainOnly = await prepareOf(committed);
+  const withJob = await prepareOf([...committed, ...pending]);
+  if (chainOnly.hasErrors || withJob.hasErrors) {
+    return {
+      status: 500,
+      json: {
+        message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
+      }
+    };
+  }
+  const split = splitJobPrepare({
+    chainOnly,
+    withJob,
+    jobPatchIds: patchIds
+  });
+  // Read now, while the job's changes still hold their files.
+  const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+  return {
+    split,
+    sourceFiles: split.buildSourceFiles,
+    binaryFiles: binaries.files,
+    binaryFilesUnread: binaries.unread
+  };
+}
+
 /**
  * `/publish-job-prepare`'s answer from content's: the job as content has it
  * now, and what the tab builds from. Content's refusal is passed on -- 409

package/dist/valbuild-server.esm.js

@@ -8601,11 +8601,43 @@ class ValOpsHttp extends ValOps {
    * file read for one with "no GitHub repo".
    */
   projectSource;
+  /** See `publishJob` on {@link ValApiOptions}; sent only with no commit. */
+  publishJob;
 
   /** Did the host hand over the running build's source? See `projectSource`. */
   embedsSource() {
     return this.projectSource !== null;
   }
+
+  /**
+   * The Val source this build embeds, as git blob shas by path from the
+   * project root: every module and `val.modules.*`. `null` when it embeds no
+   * source.
+   *
+   * For a build of no commit -- the template's, which a project `/new` made
+   * with a repository is served until CI's first build -- so the content
+   * service can compare it with the branch file by file, having no commit to
+   * compare from. A git blob sha is `sha1("blob <bytes>\0" + content)`, which is
+   * what makes it comparable with the branch's tree without reading a file.
+   */
+  async embeddedValSourceShas() {
+    if (this.projectSource === null) return null;
+    const encoder = new TextEncoder();
+    const shas = {};
+    for (const [path, content] of Object.entries(this.projectSource)) {
+      const base = path.slice(path.lastIndexOf("/") + 1);
+      const isValSource = path.endsWith(".val.ts") || path.endsWith(".val.js") || path.endsWith(".val.json") || base === "val.modules.ts" || base === "val.modules.js";
+      if (!isValSource) continue;
+      const body = encoder.encode(content);
+      const header = encoder.encode(`blob ${body.byteLength}\0`);
+      const bytes = new Uint8Array(header.byteLength + body.byteLength);
+      bytes.set(header, 0);
+      bytes.set(body, header.byteLength);
+      const digest = await crypto.subtle.digest("SHA-1", bytes);
+      shas[path.replace(/^\/+/, "")] = Array.from(new Uint8Array(digest)).map(byte => byte.toString(16).padStart(2, "0")).join("");
+    }
+    return shas;
+  }
   /**
    * What the content service last said this project expects of its publisher.
    *
@@ -8654,6 +8686,7 @@ class ValOpsHttp extends ValOps {
     };
     this.root = (options === null || options === void 0 ? void 0 : options.root) ?? "";
     this.projectSource = (options === null || options === void 0 ? void 0 : options.projectSource) ?? null;
+    this.publishJob = (options === null || options === void 0 ? void 0 : options.publishJob) ?? null;
     this.mirrorsSourceFiles = git !== null || this.projectSource !== null;
   }
   /**
@@ -8683,6 +8716,15 @@ class ValOpsHttp extends ValOps {
     if (this.git !== null) {
       return null;
     }
+    /*
+     * Content runs this project's publishes as jobs, and its prepare decides
+     * what the push goes on top of -- including for a site that was never
+     * built from a commit (a project `/new` made, before its first CI build).
+     * Refusing here would refuse what content can answer.
+     */
+    if (this.publishesAsJobs()) {
+      return null;
+    }
     if (((_this$projectExpectat = this.projectExpectation) === null || _this$projectExpectat === void 0 ? void 0 : _this$projectExpectat.sourceMode) !== "connected") {
       return null;
     }
@@ -9173,6 +9215,8 @@ class ValOpsHttp extends ValOps {
         ...(this.git ? {
           branch: this.git.branch,
           commitSha: this.git.commit
+        } : this.publishJob !== null ? {
+          job: this.publishJob
         } : {})
       }),
       headers: {
@@ -9354,6 +9398,9 @@ class ValOpsHttp extends ValOps {
     if (this.git) {
       params.push(["branch", this.git.branch]);
       params.push(["commit", this.git.commit]);
+    } else if (this.publishJob !== null) {
+      // A build a tab made has no commit, and says which job it was made for.
+      params.push(["job", this.publishJob]);
     }
     if (filters.patchIds) {
       for (const patchId of filters.patchIds) {
@@ -12091,6 +12138,9 @@ async function initHandlerOptions(route, opts, config) {
       ...(opts.projectSource !== undefined ? {
         projectSource: opts.projectSource
       } : {}),
+      ...(opts.publishJob !== undefined ? {
+        publishJob: opts.publishJob
+      } : {}),
       project: maybeValProject,
       valEnableRedirectUrl,
       valDisableRedirectUrl,
@@ -12160,6 +12210,9 @@ function createValOps(valModules, options) {
       config: options.config,
       ...(options.projectSource !== undefined ? {
         projectSource: options.projectSource
+      } : {}),
+      ...(options.publishJob !== undefined ? {
+        publishJob: options.publishJob
       } : {})
     });
   }
@@ -14258,8 +14311,12 @@ const ValServer = (valModules, options, callbacks) => {
         /*
          * CONNECTED: the job's sources are what `/save` would commit -- its
          * own changes, applied as `/save` applies them -- and content pushes
-         * them at the seal. Nothing is built here: CI builds after the push,
-         * so the answer carries the job and no sources.
+         * them at the seal. The tab ALSO builds the job, as a managed one is
+         * built (docs/app-mode.md, "Since changed: connected builds in the
+         * tab"): from this deployment's embedded source, the commits since it
+         * and the job's changes. A deployment that embeds no source answers
+         * `buildable: false`, and the tab reports "no build": CI builds the
+         * push either way.
          */
         if (serverOps.sourceMode() === "connected") {
           var _options$config$files;
@@ -14305,90 +14362,54 @@ const ValServer = (valModules, options, callbacks) => {
             withJob: prepared,
             jobPatchIds: patchIds
           });
+          const build = serverOps.embedsSource() ? await buildSourcesOf(serverOps, patchIds, commit) : null;
+          if (build !== null && "status" in build) return build;
+          /*
+           * A build of no commit says what Val source it holds instead, so
+           * the content service can compare it with the branch -- the
+           * template's build a `/new` project is served before CI's first.
+           */
+          const deploymentFiles = commit === undefined ? await serverOps.embeddedValSourceShas() : null;
           const sent = await serverOps.prepareJob(jobId, {
             tab,
             filesDirectory: ((_options$config$files = options.config.files) === null || _options$config$files === void 0 ? void 0 : _options$config$files.directory) || "/public/val",
             ...split.archive,
             ...(commit !== undefined ? {
               gitCommit: commit
+            } : {}),
+            ...(deploymentFiles !== null ? {
+              deploymentFiles
+            } : {}),
+            // Said, so content waits for this tab's build. A server that does
+            // not say it gets CI's: what Val servers before this one get.
+            ...(build !== null ? {
+              tabBuilds: true
             } : {})
           });
           return jobPrepareAnswer(sent, {
-            sourceFiles: {},
-            binaryFiles: {},
-            binaryFilesUnread: [],
-            branch: serverOps.projectBranch()
+            sourceFiles: (build === null || build === void 0 ? void 0 : build.sourceFiles) ?? {},
+            binaryFiles: (build === null || build === void 0 ? void 0 : build.binaryFiles) ?? {},
+            binaryFilesUnread: (build === null || build === void 0 ? void 0 : build.binaryFilesUnread) ?? [],
+            branch: serverOps.projectBranch(),
+            buildable: build !== null
           });
         }
-        const chain = await serverOps.fetchPatches({
-          patchIds: undefined,
-          excludePatchOps: false
-        });
-        if (chain.error) {
-          return {
-            status: 500,
-            json: {
-              message: chain.error.message
-            }
-          };
-        }
-        /*
-         * The job's content, in two steps from this build's embedded source.
-         *
-         * The commits since this build, as though pending, are the branch's
-         * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
-         * out of its own changes (docs/app-mode.md, "Publishing is a queued
-         * job"), and were that ever not so, the seal would restart the job
-         * rather than publish it. Chain order, both times.
-         */
-        const job = new Set(patchIds);
-        const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
-          ...patch,
-          appliedAt: null
-        }));
-        const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
-        const known = new Set(chain.patches.map(patch => patch.patchId));
-        const gone = patchIds.filter(id => !known.has(id));
-        if (gone.length > 0) {
-          return {
-            status: 409,
-            json: {
-              message: `This publish's changes are no longer all there (${gone.length} discarded).`
-            }
-          };
-        }
-        const prepareOf = patches => serverOps.prepare({
-          ...serverOps.analyzePatches(patches, chain.commits, commit),
-          ...chain,
-          patches
-        });
-        const chainOnly = await prepareOf(committed);
-        const withJob = await prepareOf([...committed, ...pending]);
-        if (chainOnly.hasErrors || withJob.hasErrors) {
-          return {
-            status: 500,
-            json: {
-              message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
-            }
-          };
-        }
-        const split = splitJobPrepare({
-          chainOnly,
-          withJob,
-          jobPatchIds: patchIds
-        });
-        // Read now, while the job's changes still hold their files.
-        const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+        const built = await buildSourcesOf(serverOps, patchIds, commit);
+        if ("status" in built) return built;
+        const {
+          split
+        } = built;
         const sent = await serverOps.prepareJob(jobId, {
           tab,
           filesDirectory: ((_options$config$files2 = options.config.files) === null || _options$config$files2 === void 0 ? void 0 : _options$config$files2.directory) || "/public/val",
           ...split.archive
         });
         return jobPrepareAnswer(sent, {
-          sourceFiles: split.buildSourceFiles,
-          binaryFiles: binaries.files,
-          binaryFilesUnread: binaries.unread,
-          branch: serverOps.projectBranch()
+          sourceFiles: built.sourceFiles,
+          binaryFiles: built.binaryFiles,
+          binaryFilesUnread: built.binaryFilesUnread,
+          branch: serverOps.projectBranch(),
+          buildable: true
         });
       }
     },
@@ -16499,6 +16520,82 @@ function getIsRemoteRequired(schemas) {
   return false;
 }
 
+/**
+ * What a tab builds a job from: this deployment's embedded source, the
+ * commits since it (as though pending: together they are the branch's head),
+ * and the job's own pending changes on top. Managed and connected alike.
+ *
+ * `split.archive` is the managed job's archive; a connected job's archive is
+ * the push's, made from its own changes alone, by the caller.
+ */
+async function buildSourcesOf(serverOps, patchIds, commit) {
+  const chain = await serverOps.fetchPatches({
+    patchIds: undefined,
+    excludePatchOps: false
+  });
+  if (chain.error) {
+    return {
+      status: 500,
+      json: {
+        message: chain.error.message
+      }
+    };
+  }
+  /*
+   * The job's content, in two steps from this build's embedded source.
+   *
+   * The commits since this build, as though pending, are the branch's
+   * head. The job's pending changes on top of them are its content: whatever was applied since the job started came
+   * out of its own changes (docs/app-mode.md, "Publishing is a queued
+   * job"), and were that ever not so, the seal would restart the job
+   * rather than publish it. Chain order, both times.
+   */
+  const job = new Set(patchIds);
+  const committed = chain.patches.filter(patch => patch.appliedAt !== null).map(patch => ({
+    ...patch,
+    appliedAt: null
+  }));
+  const pending = chain.patches.filter(patch => patch.appliedAt === null && job.has(patch.patchId));
+  const known = new Set(chain.patches.map(patch => patch.patchId));
+  const gone = patchIds.filter(id => !known.has(id));
+  if (gone.length > 0) {
+    return {
+      status: 409,
+      json: {
+        message: `This publish's changes are no longer all there (${gone.length} discarded).`
+      }
+    };
+  }
+  const prepareOf = patches => serverOps.prepare({
+    ...serverOps.analyzePatches(patches, chain.commits, commit),
+    ...chain,
+    patches
+  });
+  const chainOnly = await prepareOf(committed);
+  const withJob = await prepareOf([...committed, ...pending]);
+  if (chainOnly.hasErrors || withJob.hasErrors) {
+    return {
+      status: 500,
+      json: {
+        message: "This publish's changes could not be rendered into source: " + JSON.stringify((withJob.hasErrors ? withJob : chainOnly).sourceFilePatchErrors).slice(0, 500)
+      }
+    };
+  }
+  const split = splitJobPrepare({
+    chainOnly,
+    withJob,
+    jobPatchIds: patchIds
+  });
+  // Read now, while the job's changes still hold their files.
+  const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+  return {
+    split,
+    sourceFiles: split.buildSourceFiles,
+    binaryFiles: binaries.files,
+    binaryFilesUnread: binaries.unread
+  };
+}
+
 /**
  * `/publish-job-prepare`'s answer from content's: the job as content has it
  * now, and what the tab builds from. Content's refusal is passed on -- 409

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.138.3",
+  "version": "0.138.5",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -31,8 +31,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "@valbuild/core": "0.138.2",
-    "@valbuild/shared": "0.138.2",
-    "@valbuild/ui": "0.138.3"
+    "@valbuild/shared": "0.138.4",
+    "@valbuild/ui": "0.138.5"
   },
   "engines": {
     "node": "^20.19.0 || >=22"