@valbuild/server 0.144.11 → 0.145.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @valbuild/server
 
+## 0.145.0
+
+### Minor Changes
+
+- [#859](https://github.com/valbuild/val/pull/859) [`f085be0`](https://github.com/valbuild/val/commit/f085be0eb5bdc195e9d8cdb15dd5f8acfdabe23c) Thanks [@freekh](https://github.com/freekh)! - An edit Val Build refuses to save because of the project's plan — the Free plan's 1,000 changes a week are used, or a Hosted trial has ended — is now kept in the Studio instead of being reverted.
+
+  - `PUT /patches` answers such a save with a `403` of type `plan-refused`, carrying Val Build's reason and fix as data and which patches of the request it did save. It used to answer `400 patch-error`, which the Studio reads as a bad patch and drops.
+  - The Studio keeps the refused edits and any made after them, shows the plan notice with **Upgrade** or **Add a card** beside it, and saves them by itself once the plan allows it: as soon as Val Build says editing is open again (an owner added a card, the week moved on), and otherwise by trying again now and then. A publish or a restore that meets held edits says why, in Val Build's words, instead of suggesting the connection.
+  - The MCP write tools answer a refused write as `forbidden`, with Val Build's sentence, instead of `internal`.
+
+### Patch Changes
+
+- Updated dependencies [[`b6cb939`](https://github.com/valbuild/val/commit/b6cb9395d8bdcd5182e9c6ba84f5284930de2fa5), [`f085be0`](https://github.com/valbuild/val/commit/f085be0eb5bdc195e9d8cdb15dd5f8acfdabe23c), [`dda5c52`](https://github.com/valbuild/val/commit/dda5c523698395c6dfb96ae8e39dae04307ec332), [`ac0bb7c`](https://github.com/valbuild/val/commit/ac0bb7cb5a99df022b198326a5f8a0cf61e45388)]:
+  - @valbuild/core@0.145.0
+  - @valbuild/shared@0.145.0
+  - @valbuild/ui@0.145.0
+
+## 0.144.12
+
+### Patch Changes
+
+- Updated dependencies [[`2193e3a`](https://github.com/valbuild/val/commit/2193e3ae133cd05dd73d0937dde7c15c88417f71)]:
+  - @valbuild/ui@0.144.12
+
 ## 0.144.11
 
 ### Patch Changes

package/dist/declarations/src/ValOps.d.ts

@@ -2,7 +2,7 @@ import { MediaSource, FileMetadata, FileSource, ImageMetadata, ModuleFilePath, P
 import { result } from "@valbuild/core/fp";
 import { JSONValue, ParentRef, Patch, PatchError } from "@valbuild/core/patch";
 import type { HistoryError } from "./history/HistoryError.js";
-import type { PatchGroupT } from "@valbuild/shared/internal";
+import type { PatchGroupT, PlanRefusalErrorT } from "@valbuild/shared/internal";
 import type { AffectedFile, StoredModuleVersion, CommitPage, CommitPatch, HistoricalCommit } from "./history/types.js";
 import { ValSyntaxError, ValSyntaxErrorTree } from "./patch/ts/syntax.js";
 import { ParentPatchId } from "@valbuild/core";
@@ -456,7 +456,7 @@ export declare abstract class ValOps {
         error: GenericErrorMessage;
     } | {
         errorType: "patch-head-conflict";
-    }>>;
+    } | PlanRefusedError>>;
     /**
      * Why a publish cannot happen here, or `null` when one can.
      *
@@ -789,7 +789,21 @@ export type SaveSourceFilePatchResult = result.Result<{
     errorType: "other";
 } & GenericErrorMessage) | {
     errorType: "patch-head-conflict";
-}>;
+} | PlanRefusedError>;
+/**
+ * The content API refused a write for the project's plan (a 403 that says why
+ * as data), as opposed to refusing the patch.
+ *
+ * Its own error rather than an `other`: an `other` becomes a 400, and the
+ * Studio drops a patch it is told is bad. This one is good, and is saved once
+ * the plan allows it. `error` has the same shape as `other`'s so a caller that
+ * only wants a sentence reads it the same way.
+ */
+export type PlanRefusedError = {
+    errorType: "plan-refused";
+    error: GenericErrorMessage;
+    refusal: PlanRefusalErrorT;
+};
 export type PatchAnalysis = {
     patchesByModule: {
         [path: ModuleFilePath]: {

package/dist/valbuild-server.cjs.dev.js

@@ -5639,6 +5639,11 @@ class ValOps {
   patchGroup) {
     const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId, patchGroup);
     if (fp.result.isErr(saveRes)) {
+      if (saveRes.error.errorType === "plan-refused") {
+        // The project's plan, not a failure: the Studio keeps the edit and
+        // sends it again later, so an error line here would be one a minute.
+        return fp.result.err(saveRes.error);
+      }
       console.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
       if (saveRes.error.errorType === "patch-head-conflict") {
         return fp.result.err({
@@ -5965,6 +5970,16 @@ function isFileSource(value) {
  * after the fact.
  */
 
+/**
+ * The content API refused a write for the project's plan (a 403 that says why
+ * as data), as opposed to refusing the patch.
+ *
+ * Its own error rather than an `other`: an `other` becomes a 400, and the
+ * Studio drops a patch it is told is bad. This one is good, and is saved once
+ * the plan allows it. `error` has the same shape as `other`'s so a caller that
+ * only wants a sentence reads it the same way.
+ */
+
 function formatPatchSourceError(error) {
   if ("message" in error) {
     return error.message;
@@ -9371,6 +9386,11 @@ function isJsonValue(value) {
 }
 
 const textEncoder$2 = new TextEncoder();
+
+/** The body of the content API's 403 for a write the project's plan refuses. */
+const PlanRefusedBody = z.z.object({
+  error: internal.PlanRefusalError
+});
 const PatchId = z.z.string().refine(s => !!s); // TODO: validate
 const CommitSha = z.z.string().refine(s => !!s); // TODO: validate
 z.z.string().refine(s => !!s); // TODO: validate
@@ -11395,6 +11415,22 @@ class ValOpsHttp extends ValOps {
       if ((_res$headers$get2 = res.headers.get("Content-Type")) !== null && _res$headers$get2 !== void 0 && _res$headers$get2.includes("application/json")) {
         const json = await res.json();
         const message = internal.getErrorMessageFromUnknownJson(json, "Unknown error");
+        /*
+         * Refused for the plan: the patch is fine, and the reason comes as
+         * data. Kept apart from every other error, which the Studio is told
+         * is a bad patch and drops. A 403 without a refusal in it (a
+         * credential missing the write scope) is still one of those.
+         */
+        const refusal = res.status === 403 ? PlanRefusedBody.safeParse(json) : null;
+        if (refusal !== null && refusal !== void 0 && refusal.success) {
+          return fp.result.err({
+            errorType: "plan-refused",
+            error: {
+              message
+            },
+            refusal: refusal.data.error
+          });
+        }
         return fp.result.err({
           errorType: "other",
           message
@@ -15541,6 +15577,24 @@ const ValServer = (valModules, options, callbacks) => {
          * `fs` mode and from an older content API.
          */
         let headVersion;
+        /*
+         * What this request has saved so far: the whole answer to a save, and
+         * the saved part of one refused for the plan. One builder for both, so
+         * the client records a partly saved batch exactly as a saved one.
+         */
+        const savedSoFar = () => ({
+          newPatchIds,
+          parentRef,
+          // Absent rather than null where there are no groups: `fs` mode and
+          // a content API that predates them both answer without one, and the
+          // client reads absence as "staging is not available here".
+          ...(patchGroupIdFromStore !== undefined ? {
+            patchGroupId: patchGroupIdFromStore
+          } : {}),
+          ...(headVersion !== undefined ? {
+            headVersion
+          } : {})
+        });
         for (const patch of patches) {
           const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId, patchGroup);
           if (fp.result.isErr(createPatchRes)) {
@@ -15552,6 +15606,23 @@ const ValServer = (valModules, options, callbacks) => {
                   message: "The change was written against a different starting point than the server has."
                 }
               };
+            } else if (createPatchRes.error.errorType === "plan-refused") {
+              /*
+               * Val Build refused it for the plan. Passed on as its 403 rather
+               * than a patch error: the patch is fine and the Studio keeps it,
+               * and the reason travels as data so the fix can sit beside it.
+               * The patches before this one in the batch ARE saved, and are
+               * reported as a 200 would report them.
+               */
+              return {
+                status: 403,
+                json: {
+                  type: "plan-refused",
+                  message: createPatchRes.error.error.message,
+                  error: createPatchRes.error.refusal,
+                  ...savedSoFar()
+                }
+              };
             } else {
               return {
                 status: 400,
@@ -15582,19 +15653,7 @@ const ValServer = (valModules, options, callbacks) => {
         }
         return {
           status: 200,
-          json: {
-            newPatchIds,
-            parentRef,
-            // Absent rather than null where there are no groups: `fs` mode and
-            // a content API that predates them both answer without one, and the
-            // client reads absence as "staging is not available here".
-            ...(patchGroupIdFromStore !== undefined ? {
-              patchGroupId: patchGroupIdFromStore
-            } : {}),
-            ...(headVersion !== undefined ? {
-              headVersion
-            } : {})
-          }
+          json: savedSoFar()
         };
       },
       GET: async req => {

package/dist/valbuild-server.cjs.prod.js

@@ -5639,6 +5639,11 @@ class ValOps {
   patchGroup) {
     const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId, patchGroup);
     if (fp.result.isErr(saveRes)) {
+      if (saveRes.error.errorType === "plan-refused") {
+        // The project's plan, not a failure: the Studio keeps the edit and
+        // sends it again later, so an error line here would be one a minute.
+        return fp.result.err(saveRes.error);
+      }
       console.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
       if (saveRes.error.errorType === "patch-head-conflict") {
         return fp.result.err({
@@ -5965,6 +5970,16 @@ function isFileSource(value) {
  * after the fact.
  */
 
+/**
+ * The content API refused a write for the project's plan (a 403 that says why
+ * as data), as opposed to refusing the patch.
+ *
+ * Its own error rather than an `other`: an `other` becomes a 400, and the
+ * Studio drops a patch it is told is bad. This one is good, and is saved once
+ * the plan allows it. `error` has the same shape as `other`'s so a caller that
+ * only wants a sentence reads it the same way.
+ */
+
 function formatPatchSourceError(error) {
   if ("message" in error) {
     return error.message;
@@ -9371,6 +9386,11 @@ function isJsonValue(value) {
 }
 
 const textEncoder$2 = new TextEncoder();
+
+/** The body of the content API's 403 for a write the project's plan refuses. */
+const PlanRefusedBody = z.z.object({
+  error: internal.PlanRefusalError
+});
 const PatchId = z.z.string().refine(s => !!s); // TODO: validate
 const CommitSha = z.z.string().refine(s => !!s); // TODO: validate
 z.z.string().refine(s => !!s); // TODO: validate
@@ -11395,6 +11415,22 @@ class ValOpsHttp extends ValOps {
       if ((_res$headers$get2 = res.headers.get("Content-Type")) !== null && _res$headers$get2 !== void 0 && _res$headers$get2.includes("application/json")) {
         const json = await res.json();
         const message = internal.getErrorMessageFromUnknownJson(json, "Unknown error");
+        /*
+         * Refused for the plan: the patch is fine, and the reason comes as
+         * data. Kept apart from every other error, which the Studio is told
+         * is a bad patch and drops. A 403 without a refusal in it (a
+         * credential missing the write scope) is still one of those.
+         */
+        const refusal = res.status === 403 ? PlanRefusedBody.safeParse(json) : null;
+        if (refusal !== null && refusal !== void 0 && refusal.success) {
+          return fp.result.err({
+            errorType: "plan-refused",
+            error: {
+              message
+            },
+            refusal: refusal.data.error
+          });
+        }
         return fp.result.err({
           errorType: "other",
           message
@@ -15541,6 +15577,24 @@ const ValServer = (valModules, options, callbacks) => {
          * `fs` mode and from an older content API.
          */
         let headVersion;
+        /*
+         * What this request has saved so far: the whole answer to a save, and
+         * the saved part of one refused for the plan. One builder for both, so
+         * the client records a partly saved batch exactly as a saved one.
+         */
+        const savedSoFar = () => ({
+          newPatchIds,
+          parentRef,
+          // Absent rather than null where there are no groups: `fs` mode and
+          // a content API that predates them both answer without one, and the
+          // client reads absence as "staging is not available here".
+          ...(patchGroupIdFromStore !== undefined ? {
+            patchGroupId: patchGroupIdFromStore
+          } : {}),
+          ...(headVersion !== undefined ? {
+            headVersion
+          } : {})
+        });
         for (const patch of patches) {
           const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId, patchGroup);
           if (fp.result.isErr(createPatchRes)) {
@@ -15552,6 +15606,23 @@ const ValServer = (valModules, options, callbacks) => {
                   message: "The change was written against a different starting point than the server has."
                 }
               };
+            } else if (createPatchRes.error.errorType === "plan-refused") {
+              /*
+               * Val Build refused it for the plan. Passed on as its 403 rather
+               * than a patch error: the patch is fine and the Studio keeps it,
+               * and the reason travels as data so the fix can sit beside it.
+               * The patches before this one in the batch ARE saved, and are
+               * reported as a 200 would report them.
+               */
+              return {
+                status: 403,
+                json: {
+                  type: "plan-refused",
+                  message: createPatchRes.error.error.message,
+                  error: createPatchRes.error.refusal,
+                  ...savedSoFar()
+                }
+              };
             } else {
               return {
                 status: 400,
@@ -15582,19 +15653,7 @@ const ValServer = (valModules, options, callbacks) => {
         }
         return {
           status: 200,
-          json: {
-            newPatchIds,
-            parentRef,
-            // Absent rather than null where there are no groups: `fs` mode and
-            // a content API that predates them both answer without one, and the
-            // client reads absence as "staging is not available here".
-            ...(patchGroupIdFromStore !== undefined ? {
-              patchGroupId: patchGroupIdFromStore
-            } : {}),
-            ...(headVersion !== undefined ? {
-              headVersion
-            } : {})
-          }
+          json: savedSoFar()
         };
       },
       GET: async req => {

package/dist/valbuild-server.esm.js

@@ -8,7 +8,7 @@ import path__default from 'path';
 import fs from 'fs';
 import vm from 'node:vm';
 import { Module } from 'node:module';
-import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, PatchId as PatchId$1, JSONValue, PatchGroup, newestCommitSha, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
+import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, PlanRefusalError, PatchId as PatchId$1, JSONValue, PatchGroup, newestCommitSha, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
 import crypto$1 from 'crypto';
 import z$1, { z } from 'zod';
@@ -5602,6 +5602,11 @@ class ValOps {
   patchGroup) {
     const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId, patchGroup);
     if (result.isErr(saveRes)) {
+      if (saveRes.error.errorType === "plan-refused") {
+        // The project's plan, not a failure: the Studio keeps the edit and
+        // sends it again later, so an error line here would be one a minute.
+        return result.err(saveRes.error);
+      }
       console.error(`Could not save source patch at path: '${path}'. Error: ${saveRes.error.errorType === "other" ? saveRes.error.message : saveRes.error.errorType}`);
       if (saveRes.error.errorType === "patch-head-conflict") {
         return result.err({
@@ -5928,6 +5933,16 @@ function isFileSource(value) {
  * after the fact.
  */
 
+/**
+ * The content API refused a write for the project's plan (a 403 that says why
+ * as data), as opposed to refusing the patch.
+ *
+ * Its own error rather than an `other`: an `other` becomes a 400, and the
+ * Studio drops a patch it is told is bad. This one is good, and is saved once
+ * the plan allows it. `error` has the same shape as `other`'s so a caller that
+ * only wants a sentence reads it the same way.
+ */
+
 function formatPatchSourceError(error) {
   if ("message" in error) {
     return error.message;
@@ -9334,6 +9349,11 @@ function isJsonValue(value) {
 }
 
 const textEncoder$2 = new TextEncoder();
+
+/** The body of the content API's 403 for a write the project's plan refuses. */
+const PlanRefusedBody = z.object({
+  error: PlanRefusalError
+});
 const PatchId = z.string().refine(s => !!s); // TODO: validate
 const CommitSha = z.string().refine(s => !!s); // TODO: validate
 z.string().refine(s => !!s); // TODO: validate
@@ -11358,6 +11378,22 @@ class ValOpsHttp extends ValOps {
       if ((_res$headers$get2 = res.headers.get("Content-Type")) !== null && _res$headers$get2 !== void 0 && _res$headers$get2.includes("application/json")) {
         const json = await res.json();
         const message = getErrorMessageFromUnknownJson(json, "Unknown error");
+        /*
+         * Refused for the plan: the patch is fine, and the reason comes as
+         * data. Kept apart from every other error, which the Studio is told
+         * is a bad patch and drops. A 403 without a refusal in it (a
+         * credential missing the write scope) is still one of those.
+         */
+        const refusal = res.status === 403 ? PlanRefusedBody.safeParse(json) : null;
+        if (refusal !== null && refusal !== void 0 && refusal.success) {
+          return result.err({
+            errorType: "plan-refused",
+            error: {
+              message
+            },
+            refusal: refusal.data.error
+          });
+        }
         return result.err({
           errorType: "other",
           message
@@ -15504,6 +15540,24 @@ const ValServer = (valModules, options, callbacks) => {
          * `fs` mode and from an older content API.
          */
         let headVersion;
+        /*
+         * What this request has saved so far: the whole answer to a save, and
+         * the saved part of one refused for the plan. One builder for both, so
+         * the client records a partly saved batch exactly as a saved one.
+         */
+        const savedSoFar = () => ({
+          newPatchIds,
+          parentRef,
+          // Absent rather than null where there are no groups: `fs` mode and
+          // a content API that predates them both answer without one, and the
+          // client reads absence as "staging is not available here".
+          ...(patchGroupIdFromStore !== undefined ? {
+            patchGroupId: patchGroupIdFromStore
+          } : {}),
+          ...(headVersion !== undefined ? {
+            headVersion
+          } : {})
+        });
         for (const patch of patches) {
           const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId, patchGroup);
           if (result.isErr(createPatchRes)) {
@@ -15515,6 +15569,23 @@ const ValServer = (valModules, options, callbacks) => {
                   message: "The change was written against a different starting point than the server has."
                 }
               };
+            } else if (createPatchRes.error.errorType === "plan-refused") {
+              /*
+               * Val Build refused it for the plan. Passed on as its 403 rather
+               * than a patch error: the patch is fine and the Studio keeps it,
+               * and the reason travels as data so the fix can sit beside it.
+               * The patches before this one in the batch ARE saved, and are
+               * reported as a 200 would report them.
+               */
+              return {
+                status: 403,
+                json: {
+                  type: "plan-refused",
+                  message: createPatchRes.error.error.message,
+                  error: createPatchRes.error.refusal,
+                  ...savedSoFar()
+                }
+              };
             } else {
               return {
                 status: 400,
@@ -15545,19 +15616,7 @@ const ValServer = (valModules, options, callbacks) => {
         }
         return {
           status: 200,
-          json: {
-            newPatchIds,
-            parentRef,
-            // Absent rather than null where there are no groups: `fs` mode and
-            // a content API that predates them both answer without one, and the
-            // client reads absence as "staging is not available here".
-            ...(patchGroupIdFromStore !== undefined ? {
-              patchGroupId: patchGroupIdFromStore
-            } : {}),
-            ...(headVersion !== undefined ? {
-              headVersion
-            } : {})
-          }
+          json: savedSoFar()
         };
       },
       GET: async req => {

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.144.11",
+  "version": "0.145.0",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -30,9 +30,9 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/ui": "0.144.11",
-    "@valbuild/core": "0.144.0",
-    "@valbuild/shared": "0.144.9"
+    "@valbuild/core": "0.145.0",
+    "@valbuild/shared": "0.145.0",
+    "@valbuild/ui": "0.145.0"
   },
   "engines": {
     "node": "^20.19.0 || >=22"