@valbuild/server 0.144.6 → 0.144.7

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @valbuild/server
 
+## 0.144.7
+
+### Patch Changes
+
+- [#842](https://github.com/valbuild/val/pull/842) [`45ee083`](https://github.com/valbuild/val/commit/45ee0831393345dab08093575d4ed652e20e1229) Thanks [@freekh](https://github.com/freekh)! - In a proposal on a hosted project, the Studio's assistant can now change the project's code, not only its content:
+
+  - `list_files` and `read_file` read the project's code. In a proposal they read the proposal's version of it.
+  - `write_files` stages whole files in the proposal, or deletes them.
+  - `build_proposal` builds those files in the tab, so the proposal's preview shows them. Nothing is published: the site changes only when the proposal is published.
+
+  The top bar shows **Build required** while staged code is not in the preview yet, and the same button builds it. A failed build says why on the button, and pressing it again builds again.
+
+  On the site itself, code is never changed directly. A code change asked for there is refused, and New proposal opens so the change can be made in one.
+
+- Updated dependencies [[`45ee083`](https://github.com/valbuild/val/commit/45ee0831393345dab08093575d4ed652e20e1229)]:
+  - @valbuild/ui@0.144.7
+
 ## 0.144.6
 
 ### Patch Changes

package/dist/declarations/src/ValOpsHttp.d.ts

@@ -293,6 +293,15 @@ export declare class ValOpsHttp extends ValOps {
      * changes into a proposal and has no screen yet.
      */
     private static proposalsApiAllowed;
+    /**
+     * A write to a proposal's FILES -- staging code, or serving a build of it
+     * (valbuild/home `docs/hosted-publishing.md`, step 7) -- is made by the
+     * proposal's own server and nobody else's: the file tools act on the
+     * proposal the Studio is open in (P11), and the site's files change only
+     * when a proposal is merged. The proposal it names, or `null` when this
+     * path is not such a write.
+     */
+    private static proposalFilesWrite;
     /**
      * What a proposal's address may reach of the publish API: building ITS OWN
      * merge, and nothing that publishes the site's changes. The merge's prepare

package/dist/valbuild-server.cjs.dev.js

@@ -10129,8 +10129,22 @@ class ValOpsHttp extends ValOps {
     if (path === "") return method === "GET" || method === "POST";
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
-    if (method === "GET") return /^\/[0-9a-f]{20}\/merge-checks$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge)$/.test(path);
+    if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build)$/.test(path);
+  }
+
+  /**
+   * A write to a proposal's FILES -- staging code, or serving a build of it
+   * (valbuild/home `docs/hosted-publishing.md`, step 7) -- is made by the
+   * proposal's own server and nobody else's: the file tools act on the
+   * proposal the Studio is open in (P11), and the site's files change only
+   * when a proposal is merged. The proposal it names, or `null` when this
+   * path is not such a write.
+   */
+  static proposalFilesWrite(method, path) {
+    var _exec;
+    if (method !== "POST") return null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|build)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -10151,6 +10165,7 @@ class ValOpsHttp extends ValOps {
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);
   }
   async proposalsApi(path, init, profileId) {
+    var _this$proposal;
     const json = "application/json";
     if (!ValOpsHttp.proposalsApiAllowed(init.method, path)) {
       return {
@@ -10161,6 +10176,16 @@ class ValOpsHttp extends ValOps {
         })
       };
     }
+    const writes = ValOpsHttp.proposalFilesWrite(init.method, path);
+    if (writes !== null && writes !== ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.name)) {
+      return {
+        status: 403,
+        contentType: json,
+        body: JSON.stringify({
+          message: this.proposal === null ? "The site's files are changed in a proposal: open one, and change them there." : "Files are changed in the proposal this Studio is open in, not in another."
+        })
+      };
+    }
     const res = await fetch(`${this.contentUrl}/v1/${this.project}/proposals${path}`, {
       method: init.method,
       headers: {
@@ -10540,8 +10565,8 @@ class ValOpsHttp extends ValOps {
 
   /** The branch this server's patches are on, where it knows it. */
   ownBranch() {
-    var _this$proposal, _this$git;
-    return ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
+    var _this$proposal2, _this$git;
+    return ((_this$proposal2 = this.proposal) === null || _this$proposal2 === void 0 ? void 0 : _this$proposal2.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
   }
   async getWebSocketNonce(profileId) {
     return fetch(`${this.contentUrl}/v1/${this.project}/websocket/nonces`, {

package/dist/valbuild-server.cjs.prod.js

@@ -10129,8 +10129,22 @@ class ValOpsHttp extends ValOps {
     if (path === "") return method === "GET" || method === "POST";
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
-    if (method === "GET") return /^\/[0-9a-f]{20}\/merge-checks$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge)$/.test(path);
+    if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build)$/.test(path);
+  }
+
+  /**
+   * A write to a proposal's FILES -- staging code, or serving a build of it
+   * (valbuild/home `docs/hosted-publishing.md`, step 7) -- is made by the
+   * proposal's own server and nobody else's: the file tools act on the
+   * proposal the Studio is open in (P11), and the site's files change only
+   * when a proposal is merged. The proposal it names, or `null` when this
+   * path is not such a write.
+   */
+  static proposalFilesWrite(method, path) {
+    var _exec;
+    if (method !== "POST") return null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|build)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -10151,6 +10165,7 @@ class ValOpsHttp extends ValOps {
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);
   }
   async proposalsApi(path, init, profileId) {
+    var _this$proposal;
     const json = "application/json";
     if (!ValOpsHttp.proposalsApiAllowed(init.method, path)) {
       return {
@@ -10161,6 +10176,16 @@ class ValOpsHttp extends ValOps {
         })
       };
     }
+    const writes = ValOpsHttp.proposalFilesWrite(init.method, path);
+    if (writes !== null && writes !== ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.name)) {
+      return {
+        status: 403,
+        contentType: json,
+        body: JSON.stringify({
+          message: this.proposal === null ? "The site's files are changed in a proposal: open one, and change them there." : "Files are changed in the proposal this Studio is open in, not in another."
+        })
+      };
+    }
     const res = await fetch(`${this.contentUrl}/v1/${this.project}/proposals${path}`, {
       method: init.method,
       headers: {
@@ -10540,8 +10565,8 @@ class ValOpsHttp extends ValOps {
 
   /** The branch this server's patches are on, where it knows it. */
   ownBranch() {
-    var _this$proposal, _this$git;
-    return ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
+    var _this$proposal2, _this$git;
+    return ((_this$proposal2 = this.proposal) === null || _this$proposal2 === void 0 ? void 0 : _this$proposal2.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
   }
   async getWebSocketNonce(profileId) {
     return fetch(`${this.contentUrl}/v1/${this.project}/websocket/nonces`, {

package/dist/valbuild-server.esm.js

@@ -10092,8 +10092,22 @@ class ValOpsHttp extends ValOps {
     if (path === "") return method === "GET" || method === "POST";
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
-    if (method === "GET") return /^\/[0-9a-f]{20}\/merge-checks$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge)$/.test(path);
+    if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build)$/.test(path);
+  }
+
+  /**
+   * A write to a proposal's FILES -- staging code, or serving a build of it
+   * (valbuild/home `docs/hosted-publishing.md`, step 7) -- is made by the
+   * proposal's own server and nobody else's: the file tools act on the
+   * proposal the Studio is open in (P11), and the site's files change only
+   * when a proposal is merged. The proposal it names, or `null` when this
+   * path is not such a write.
+   */
+  static proposalFilesWrite(method, path) {
+    var _exec;
+    if (method !== "POST") return null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|build)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -10114,6 +10128,7 @@ class ValOpsHttp extends ValOps {
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);
   }
   async proposalsApi(path, init, profileId) {
+    var _this$proposal;
     const json = "application/json";
     if (!ValOpsHttp.proposalsApiAllowed(init.method, path)) {
       return {
@@ -10124,6 +10139,16 @@ class ValOpsHttp extends ValOps {
         })
       };
     }
+    const writes = ValOpsHttp.proposalFilesWrite(init.method, path);
+    if (writes !== null && writes !== ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.name)) {
+      return {
+        status: 403,
+        contentType: json,
+        body: JSON.stringify({
+          message: this.proposal === null ? "The site's files are changed in a proposal: open one, and change them there." : "Files are changed in the proposal this Studio is open in, not in another."
+        })
+      };
+    }
     const res = await fetch(`${this.contentUrl}/v1/${this.project}/proposals${path}`, {
       method: init.method,
       headers: {
@@ -10503,8 +10528,8 @@ class ValOpsHttp extends ValOps {
 
   /** The branch this server's patches are on, where it knows it. */
   ownBranch() {
-    var _this$proposal, _this$git;
-    return ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
+    var _this$proposal2, _this$git;
+    return ((_this$proposal2 = this.proposal) === null || _this$proposal2 === void 0 ? void 0 : _this$proposal2.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
   }
   async getWebSocketNonce(profileId) {
     return fetch(`${this.contentUrl}/v1/${this.project}/websocket/nonces`, {

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.144.6",
+  "version": "0.144.7",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -30,9 +30,9 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
+    "@valbuild/core": "0.144.0",
     "@valbuild/shared": "0.144.5",
-    "@valbuild/ui": "0.144.6",
-    "@valbuild/core": "0.144.0"
+    "@valbuild/ui": "0.144.7"
   },
   "engines": {
     "node": "^20.19.0 || >=22"