@valbuild/server 0.145.1 → 0.146.0

package/dist/valbuild-server.esm.js

@@ -1,16 +1,16 @@
 import ts from 'typescript';
 import { pipe, result, array } from '@valbuild/core/fp';
 import { PatchError, deepEqual, parseAndValidateArrayIndex, isNotRoot, applyPatch, JSONOps, deepClone, sourceToPatchPath } from '@valbuild/core/patch';
-import { derefPatch, Internal, VAL_EXTENSION, extractValModules, computeValModuleShas, ImageSchema, DEFAULT_CONTENT_HOST, hasRemoteFileSchema } from '@valbuild/core';
+import { derefPatch, Internal, VAL_EXTENSION, extractValModules, computeValModuleShas, ImageSchema, deserializeSchema, DEFAULT_CONTENT_HOST, hasRemoteFileSchema } from '@valbuild/core';
 export { hasRemoteFileSchema } from '@valbuild/core';
 import * as path from 'path';
 import path__default from 'path';
 import fs from 'fs';
 import vm from 'node:vm';
 import { Module } from 'node:module';
-import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, PlanRefusalError, PatchId as PatchId$1, JSONValue, PatchGroup, newestCommitSha, SerializedSchema, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
+import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, schemaErrorsOf, schemaTypesOfPath, sideFiles, sideSource, PlanRefusalError, PatchId as PatchId$1, JSONValue, SerializedSchema, newestCommitSha, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
-import crypto$1 from 'crypto';
+import crypto$1, { createHash } from 'crypto';
 import z$1, { z } from 'zod';
 import http from 'node:http';
 import https from 'node:https';
@@ -3534,7 +3534,7 @@ const jsonOps = new JSONOps();
  * host.
  */
 const JSON_ENTRY_READ_CONCURRENCY = 8;
-const tsOps = new TSOps(document => {
+const tsOps$1 = new TSOps(document => {
   return pipe(analyzeValModule(document), result.map(({
     source
   }) => source));
@@ -4040,7 +4040,7 @@ class ValOps {
           message: `Could not fetch patches: ${JSON.stringify(patchOps.errors)}`
         };
       }
-      modulePatches = scopedModulePatches(patchOps.patches, moduleFilePath, opts === null || opts === void 0 ? void 0 : opts.patchIds, patchOps.commits).map(p => ({
+      modulePatches = draftModulePatches(patchOps.patches, moduleFilePath, patchOps.commits).map(p => ({
         patchId: p.patchId,
         patch: p.patch
       }));
@@ -5147,7 +5147,7 @@ class ValOps {
               kind: "normal"
             };
             if (cls.kind === "normal" && fromCls.kind === "normal") {
-              const patchRes = applyPatch(tsSourceFile, tsOps, [op]);
+              const patchRes = applyPatch(tsSourceFile, tsOps$1, [op]);
               if (result.isErr(patchRes)) {
                 collectPatchError(patchRes.error, patchId, op);
                 patchHadError = true;
@@ -5586,21 +5586,8 @@ class ValOps {
   }
 
   // #region createPatch
-  async createPatch(path, patch, patchId, parentRef, sessionId, authorId,
-  /**
-   * Which patch group this patch joins, recorded in the SAME request.
-   *
-   * Atomic on purpose. The content API runs every refusal before its insert,
-   * so an invalid closure is a 400 with nothing written. Recording membership
-   * in a second call would let a patch exist outside its author's group if
-   * that call failed — and a patch outside your own group is one you cannot
-   * publish until a repair puts it back.
-   *
-   * Optional: `fs` mode has no groups, and a client that predates them sends
-   * nothing.
-   */
-  patchGroup) {
-    const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId, patchGroup);
+  async createPatch(path, patch, patchId, parentRef, sessionId, authorId) {
+    const saveRes = await this.saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId);
     if (result.isErr(saveRes)) {
       if (saveRes.error.errorType === "plan-refused") {
         // The project's plan, not a failure: the Studio keeps the edit and
@@ -5621,11 +5608,6 @@ class ValOps {
     return result.ok({
       patchId,
       createdAt: new Date().toISOString(),
-      // Spread rather than assigned: absent has to stay distinguishable from a
-      // group whose id is undefined, all the way to the client.
-      ...(saveRes.value.patchGroupId !== undefined ? {
-        patchGroupId: saveRes.value.patchGroupId
-      } : {}),
       ...(saveRes.value.headVersion !== undefined ? {
         headVersion: saveRes.value.headVersion
       } : {})
@@ -5783,8 +5765,8 @@ class ValOps {
    * Almost everything the routes branch on comes from this one fact, which is
    * why it is a named property rather than an `instanceof`. If this server owns
    * the store then there is no content service to authenticate to (so an absent
-   * or unverifiable session is anonymous rather than a 401), no shared store for
-   * a patch group to separate authors in, no deployments to report, and a
+   * or unverifiable session is anonymous rather than a 401), no deployments to
+   * report, and a
    * "publish" writes what the host does with it rather than pushing a commit. If
    * it does not, every one of those is the content service's and this server is
    * relaying.
@@ -5919,20 +5901,6 @@ function isFileSource(value) {
   return typeof value === "object" && value !== null && "path" in value && typeof value.path === "string";
 }
 
-/**
- * The patch group a newly created patch joins.
- *
- * `withPatchIds` is the CLOSURE the client computed — the patches that share
- * a patch set with this one and must move with it. It is not derived here and
- * must not be: the closure needs the content schema, and the service that
- * stores groups does not have it. One implementation of that rule, on the side
- * that can actually compute it.
- *
- * Membership rows are stamped with `coreVersion` on the content side, the same
- * stamp the patch row itself carries, so which client wrote a row stays legible
- * after the fact.
- */
-
 /**
  * The content API refused a write for the project's plan (a 403 that says why
  * as data), as opposed to refusing the patch.
@@ -5964,34 +5932,16 @@ function formatPatchSourceError(error) {
  */
 
 /**
- * The patches a json entry render should apply, out of the whole chain.
- *
- * Three rules, and the second is the one that was missing. A draft page renders
- * `jsonValues` entries beside module content, and only the modules were scoped
- * — so one screen showed the caller's own view for its modules and base plus
- * EVERY pending patch on the branch for the entries beside them, including
- * another author's half-finished edit rendered as though it were live.
+ * The patches a json entry render should apply, out of the whole chain:
  *
  * 1. this module's, since the chain is branch-wide;
- * 2. this caller's, when they asked to be scoped. `undefined` is "everything",
- *    which is what every unscoped caller gets and must keep getting;
- * 3. a patch published after this build is kept whatever the scope: it is
- *    nobody's to hold back, and this build does not have it. One already in
- *    the build is dropped. `draftOverlay` decides which is which, from
- *    `commits`.
- *
- * Filtered here rather than by asking `fetchPatches` for a list, and that is
- * load-bearing: both implementations read an empty `patchIds` as "no filter"
- * and return the whole chain. That is the right default for a caller that
- * cannot mean "none", and the most dangerous possible reading of a group that
- * is genuinely empty — it would render every unpublished patch on the branch
- * instead of base. It costs no round trip either: the whole chain is what the
- * unscoped path fetches anyway.
- */
-function scopedModulePatches(patches, moduleFilePath, patchIds, /** The commits content says came after this build: see `draftOverlay`. */
+ * 2. a patch published after this build is kept: this build does not have it.
+ *    One already in the build is dropped. `draftOverlay` decides which is
+ *    which, from `commits`.
+ */
+function draftModulePatches(patches, moduleFilePath, /** The commits content says came after this build: see `draftOverlay`. */
 commits) {
-  const scope = patchIds && new Set(patchIds);
-  return draftOverlay(patches.filter(patch => patch.path === moduleFilePath && (patch.appliedAt !== null || scope === undefined || scope.has(patch.patchId))), commits);
+  return draftOverlay(patches.filter(patch => patch.path === moduleFilePath), commits);
 }
 
 /**
@@ -8083,17 +8033,7 @@ class ValOpsFS extends ValOps {
       };
     }
   }
-  async saveSourceFilePatch(path, patch, patchId, _parentRef, authorId, sessionId,
-  /*
-   * Named and ignored, rather than omitted from the signature.
-   *
-   * `fs` mode has no shared store and exactly one author, so there is nothing
-   * for a group to separate — every pending patch is already this person's.
-   * Declaring it makes that a decision a reader can see: TypeScript lets an
-   * implementation take fewer parameters than the abstract, so leaving it off
-   * would drop group membership silently and look identical to handling it.
-   */
-  _patchGroup) {
+  async saveSourceFilePatch(path, patch, patchId, _parentRef, authorId, sessionId) {
     const patchesDir = this.getPatchesDir();
     const record = {
       patch,
@@ -9006,13 +8946,13 @@ function proposalFromEnv(env) {
       });
     }
   }
-  if (!isObject$1(parsed)) {
+  if (!isObject$2(parsed)) {
     throw new Error(`Val: proposal ${name}: VAL_OVERLAY is not an object`);
   }
   const modulesIn = parsed["modules"] ?? {};
   const filesIn = parsed["files"] ?? {};
   const commit = parsed["commit"] ?? null;
-  if (!isObject$1(modulesIn) || !isObject$1(filesIn)) {
+  if (!isObject$2(modulesIn) || !isObject$2(filesIn)) {
     throw new Error(`Val: proposal ${name}: VAL_OVERLAY's modules and files must be objects`);
   }
   if (commit !== null && typeof commit !== "string") {
@@ -9075,7 +9015,7 @@ function contentFromEnv(env) {
       cause: err
     });
   }
-  if (!isObject$1(parsed) || Array.isArray(parsed)) {
+  if (!isObject$2(parsed) || Array.isArray(parsed)) {
     throw new Error("Val: VAL_CONTENT is not an object");
   }
   const id = parsed["id"];
@@ -9092,7 +9032,7 @@ function contentFromEnv(env) {
   }
   const modulesIn = parsed["modules"] ?? {};
   const filesIn = parsed["files"] ?? {};
-  if (!isObject$1(modulesIn) || Array.isArray(modulesIn) || !isObject$1(filesIn) || Array.isArray(filesIn)) {
+  if (!isObject$2(modulesIn) || Array.isArray(modulesIn) || !isObject$2(filesIn) || Array.isArray(filesIn)) {
     throw new Error(`Val: content version ${id}: modules and files must be objects`);
   }
   const files = {};
@@ -9105,7 +9045,7 @@ function contentFromEnv(env) {
     ...modulesIn
   };
   const refs = parsed["refs"] ?? {};
-  if (!isObject$1(refs) || Array.isArray(refs)) {
+  if (!isObject$2(refs) || Array.isArray(refs)) {
     throw new Error(`Val: content version ${id}: refs must be an object`);
   }
   const read = (kind, path, ref) => {
@@ -9132,7 +9072,7 @@ function contentFromEnv(env) {
   };
   const refModules = refs["modules"] ?? {};
   const refFiles = refs["files"] ?? {};
-  if (!isObject$1(refModules) || Array.isArray(refModules) || !isObject$1(refFiles) || Array.isArray(refFiles)) {
+  if (!isObject$2(refModules) || Array.isArray(refModules) || !isObject$2(refFiles) || Array.isArray(refFiles)) {
     throw new Error(`Val: content version ${id}: refs.modules and refs.files must be objects`);
   }
   for (const [path, ref] of Object.entries(refModules)) {
@@ -9277,7 +9217,7 @@ function proposalSnapshotForReaders(proposal, projectSource) {
   const snapshot = proposalSnapshot(proposal);
   for (const [moduleFilePath, entries] of proposalJsonEntries(proposal, projectSource)) {
     const source = snapshot[moduleFilePath];
-    if (!isObject$1(source)) continue;
+    if (!isObject$2(source)) continue;
     const filled = {};
     for (const [key, value] of Object.entries(source)) {
       if (isJsonValue(value)) filled[key] = value;
@@ -9295,7 +9235,7 @@ function proposalSnapshotForReaders(proposal, projectSource) {
 
 /** A record of `.jsonValues()` markers (`{ _type: "json" }`), at least one. */
 function holdsJsonMarkers(source) {
-  return isObject$1(source) && Object.values(source).some(value => isObject$1(value) && value["_type"] === "json");
+  return isObject$2(source) && Object.values(source).some(value => isObject$2(value) && value["_type"] === "json");
 }
 
 /** Each entry key's import path, from a `.jsonValues()` module's text. */
@@ -9331,9 +9271,9 @@ function isMutableJsonValue(value) {
   if (Array.isArray(value)) {
     return value.every(isMutableJsonValue);
   }
-  return isObject$1(value) && Object.values(value).every(isMutableJsonValue);
+  return isObject$2(value) && Object.values(value).every(isMutableJsonValue);
 }
-function isObject$1(value) {
+function isObject$2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -9345,267 +9285,1025 @@ function isJsonValue(value) {
   if (Array.isArray(value)) {
     return value.every(isJsonValue);
   }
-  return isObject$1(value) && Object.values(value).every(isJsonValue);
+  return isObject$2(value) && Object.values(value).every(isJsonValue);
 }
 
-const textEncoder$2 = new TextEncoder();
+/** What a schema reports about this content: see `schemaErrorsOf`. */
+const validateWith = (schema, moduleFilePath, source) => schemaErrorsOf(schema, moduleFilePath, source);
 
-/** The body of the content API's 403 for a write the project's plan refuses. */
-const PlanRefusedBody = z.object({
-  error: PlanRefusalError
-});
-const PatchId = z.string().refine(s => !!s); // TODO: validate
-const CommitSha = z.string().refine(s => !!s); // TODO: validate
-z.string().refine(s => !!s); // TODO: validate
-z.string().refine(s => !!s); // TODO: validate
-const ModuleFilePath = z.string().refine(s => !!s); // TODO: validate
-const Metadata = z.union([z.object({
-  mimeType: z.string(),
-  width: z.number(),
-  height: z.number()
-}), z.object({
-  mimeType: z.string()
-})]);
-const MetadataRes = z.object({
-  filePath: ModuleFilePath,
-  metadata: Metadata,
-  type: z.union([z.literal("file"), z.literal("image")]).nullable()
-});
-const GetApplicablePatches = z.object({
-  patches: z.array(z.object({
-    path: z.string(),
-    patch: Patch.nullable(),
-    patchId: z.string(),
-    authorId: z.string().nullable(),
-    baseSha: z.string(),
-    createdAt: z.string(),
-    applied: z.object({
-      commitSha: z.string()
-    }).nullable(),
-    /**
-     * The groups this patch is a member of. Read in the SAME transaction as
-     * the list and its `headVersion`, which is the point: see
-     * `OrderedPatches.patchGroups`. Optional for an older content service.
-     */
-    patchGroupIds: z.array(z.string()).optional()
-  })),
-  /**
-   * The groups on the branch, without their members — those are on the
-   * patches above. Optional for a content service that predates groups.
-   */
-  patchGroups: z.array(z.object({
-    patchGroupId: z.string(),
-    authorId: z.string().nullable(),
-    createdAt: z.string(),
-    publishedAt: z.string().nullable()
-  })).optional(),
-  /**
-   * The head of the chain. See `OrderedPatches.headPatchId`. Optional because
-   * a content service that predates it sends nothing.
-   */
-  headPatchId: PatchId$1.nullable().optional(),
-  /**
-   * The chain version of that head. See `OrderedPatches.headVersion`.
-   * Optional for the same reason.
-   */
-  headVersion: z.number().optional(),
-  /** Of `patches`, the ones a running publish holds. See `OrderedPatches.publishingPatches`. */
-  publishingPatches: z.array(PatchId$1).optional(),
-  /** Of `patches`, the ones a failed publish holds back. See `OrderedPatches.heldBackPatches`. */
-  heldBackPatches: z.array(PatchId$1).optional(),
-  commits: z.array(z.object({
-    commitSha: z.string(),
-    /*
-     * Nullable since the content service mints its own commit shas: a
-     * root commit has no parent, and a publisher that did not say where
-     * it was has no client sha. Parsed rather than trusted, so a service
-     * that sends null gets null here instead of failing the whole poll.
-     */
-    clientCommitSha: z.string().nullable(),
-    parentCommitSha: z.string().nullable(),
-    commitMessage: z.string().nullable(),
-    branch: z.string(),
-    creator: z.string(),
-    createdAt: z.string()
-  })).optional(),
-  deployments: z.array(z.object({
-    deploymentId: z.string(),
-    commitSha: z.string(),
-    deploymentState: z.string(),
-    createdAt: z.string(),
-    updatedAt: z.string(),
-    // The git message, where the content service knows it. See
-    // `ValDeployment`: this is the only source for a deployment that Val
-    // did not publish, and zod would otherwise strip it here.
-    commitMessage: z.string().nullable().optional()
-  })).optional(),
-  /**
-   * What the project EXPECTS of whoever publishes it.
-   *
-   * Optional because a content service that predates it sends nothing, and
-   * absent means "not reported" -- never "managed". The difference decides
-   * whether a publish is refused, so guessing either way would be worse than
-   * not checking: guessing `managed` would let a deployment publish a
-   * connected project it cannot mirror, and guessing `connected` would refuse
-   * every publish against an older service.
-   */
-  project: z.object({
-    sourceMode: z.union([z.literal("managed"), z.literal("connected")]),
-    branch: z.string(),
-    /**
-     * Whether a press of Publish is a publish JOB. Absent from a content
-     * service that predates connected jobs: then managed projects publish
-     * as jobs, and connected ones by commit, as they did.
-     */
-    publishJobs: z.boolean().optional()
-  }).optional()
-});
-const FilesResponse = z.object({
-  files: z.array(z.union([z.object({
-    filePath: z.string(),
-    location: z.literal("patch"),
-    patchId: PatchId,
-    value: z.string(),
-    remote: z.boolean()
-  }), z.object({
-    filePath: z.string(),
-    location: z.literal("repo"),
-    commitSha: CommitSha,
-    value: z.string()
-  })])),
-  errors: z.array(z.union([z.object({
-    filePath: z.string(),
-    location: z.literal("patch"),
-    patchId: PatchId,
-    message: z.string(),
-    remote: z.boolean()
-  }), z.object({
-    filePath: z.string(),
-    location: z.literal("repo"),
-    commitSha: CommitSha,
-    message: z.string()
-  })])).optional()
-});
-const SavePatchResponse = z.object({
-  patchId: PatchId,
-  /**
-   * Which group the content API put this patch in.
-   *
-   * Optional: a content API that predates patch groups does not send one, and
-   * absence has to keep meaning "no groups here" rather than failing the save.
-   */
-  patchGroupId: z.string().optional(),
-  /**
-   * The chain version this write made, comparable with `headVersion` on the
-   * listing. Optional: a content service that predates it sends nothing.
-   */
-  headVersion: z.number().optional()
-});
-const DeletePatchesResponse = z.object({
-  deleted: z.array(PatchId),
-  errors: z.array(z.object({
-    message: z.string(),
-    patchId: PatchId,
-    /** The publish job holding it, when that is why it was not deleted. */
-    publishJobId: z.string().optional()
-  })).optional(),
-  /**
-   * The chain version each branch the delete changed is now at, keyed by
-   * branch. Optional: a content service that predates it sends none.
-   */
-  headVersions: z.record(z.string(), z.number()).optional()
-});
 /**
- * This client's own branch's entry in a per-branch version map.
- *
- * A delete can span branches, so the content service answers per branch. With
- * no branch of its own (a build with no repository, where the service resolves
- * it), the only entry is ours when there is exactly one; with several, none can
- * be picked, and a wrong one would floor this client at another chain's count.
+ * A module's errors for this content: its own `validate` where the schema was
+ * evaluated, custom rules and all; otherwise what its serialized schema says,
+ * which is every rule but a custom `.validate(...)` (a closure does not
+ * serialize).
  */
-function ownBranchVersion(headVersions, branch) {
-  if (headVersions === undefined) return undefined;
-  if (branch !== undefined) return headVersions[branch];
-  const versions = Object.values(headVersions);
-  return versions.length === 1 ? versions[0] : undefined;
+function validateModule(moduleFilePath, module, source) {
+  if (module.validate) return module.validate(source);
+  return validateWith(deserializeSchema(module.schema), moduleFilePath, source);
+}
+
+/** The errors of a module's own Source: as evaluated where they were, else found here. */
+function errorsOfSource(moduleFilePath, module) {
+  return module.errors ?? validateModule(moduleFilePath, module, module.source);
 }
-const SavePatchFileResponse = z.object({
-  patchId: PatchId,
-  filePath: ModuleFilePath
-});
-const CommitResponse = z.object({
-  updatedFiles: z.array(z.string()),
-  commit: CommitSha,
-  /*
-   * Optional because a content service that predates them sends neither, and
-   * this client talks to whichever one the project is on. Absent means NOT
-   * REPORTED: `parent: undefined` is not "a root commit", and a caller that
-   * reads it as one would conclude the history starts here.
-   *
-   * Unbranded strings deliberately -- see `CommitResult.parent`. They arrive
-   * from a service that versions separately and are passed through as what it
-   * said, not as something this end vouched for.
-   */
-  parent: z.string().optional(),
-  tree: z.string().optional(),
-  branch: z.string(),
-  /** The chain version the publish moved the branch to; absent if it applied nothing. */
-  headVersion: z.number().optional()
-});
-// #region history wire schemas
-//
-// Validated on arrival rather than trusted: these come from a service that
-// versions separately, and a silently mis-shaped commit record reads as "this
-// commit changed nothing", which is indistinguishable from a real answer.
-const HistoricalCommitResponse = z.object({
-  commitSha: z.string(),
-  /** `null` for a root commit; see the note on the applicable-patches schema. */
-  parentCommitSha: z.string().nullable(),
-  /** `null` when the publisher did not say where it was. */
-  clientCommitSha: z.string().nullable(),
-  branch: z.string(),
-  createdBranch: z.string().nullable(),
-  creator: z.string().nullable(),
-  message: z.string().nullable(),
-  createdAt: z.string(),
-  seqNum: z.string(),
-  patchCount: z.number(),
-  hasArchive: z.boolean()
-});
-const ListCommitsResponse = z.object({
-  commits: z.array(HistoricalCommitResponse),
-  nextCursor: z.string().nullable()
-});
-const CommitPatchesResponse = z.object({
-  commitSha: z.string(),
-  commit: z.object({
-    commitSha: z.string(),
-    parentCommitSha: z.string().nullable(),
-    clientCommitSha: z.string().nullable(),
-    branch: z.string(),
-    createdBranch: z.string().nullable(),
-    creator: z.string().nullable(),
-    message: z.string().nullable(),
-    createdAt: z.string(),
-    seqNum: z.string(),
-    hasArchive: z.boolean()
-  }),
-  patches: z.array(z.object({
-    patchId: z.string(),
-    path: z.string(),
-    patch: z.unknown(),
-    authorId: z.string().nullable(),
-    createdAt: z.string(),
-    baseSha: z.string(),
-    coreVersion: z.string()
-  }))
-});
 
 /**
- * `home` — `Api["/commits/:commitSha/modules"]["GET"]["res"]`.
- *
- * `schema` stays `unknown` here on purpose. The content service stores it
- * opaquely and cannot vouch for it, so validating it at the transport boundary
+ * A `.jsonValues()` record's entry files, by key, read out of its `.val.ts`
+ * (the loaded marker does not carry the path). `null` when it has none.
+ */
+function entryFilesOf(moduleFilePath, text) {
+  const analysis = valModuleOf(moduleFilePath, text);
+  if (analysis === null) return null;
+  const entries = analyzeJsonValuesEntries(analysis.source);
+  if (entries.size === 0) return null;
+  const dir = path__default.posix.dirname(moduleFilePath.slice(1));
+  return Object.fromEntries([...entries].map(([key, {
+    importPath
+  }]) => [key, path__default.posix.join(dir, importPath)]));
+}
+
+// --- code and content ------------------------------------------------------------
+
+/**
+ * A file's code: for a `.val.ts`, everything but `c.define`'s content
+ * argument, which Val reads at request time (step 2) and so is no part of a
+ * build; a `.val.json` entry is no code at all. Every other file is code
+ * whole.
+ */
+function codeOf(file, text) {
+  // A `.jsonValues()` entry is content, read at request time like the rest.
+  if (file.endsWith(".val.json")) return "";
+  if (!file.endsWith(".val.ts")) return text;
+  const analysis = valModuleOf(file, text);
+  if (analysis === null) return text;
+  const {
+    source
+  } = analysis;
+  return text.slice(0, source.getStart()) + "/* content */" + text.slice(source.end);
+}
+
+/**
+ * A `.val.ts`'s `c.define(...)`, or `null` when it has none: a file of schemas
+ * that pages share (`export const heroSchema = s.object(...)`) is named like a
+ * module and is code. `analyzeValModule` throws for one; this does not.
+ */
+function valModuleOf(file, text) {
+  const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.ES2015, true);
+  if (!sourceFile.statements.some(node => ts.isExportAssignment(node))) {
+    return null;
+  }
+  const analysis = analyzeValModule(sourceFile);
+  return result.isErr(analysis) ? null : analysis.value;
+}
+
+/**
+ * The three-way merge of a module's content: where both sides started
+ * (`base`), and each side's version. Pure JSON -- the schema decides nothing
+ * here, and is checked afterwards (the schema check in `merge.ts`).
+ *
+ * The rules (valbuild/home `docs/hosted-publishing.md` step 8.2):
+ *
+ * - Changed on one side: that side's.
+ * - Changed on both: a conflict -- even to the same value, which is an easy
+ *   conflict to resolve but still one somebody decides.
+ * - An object (a page, a record) merges key by key, so two keys changed on
+ *   two sides combine.
+ * - A list merges item by item only when neither side changed its shape: no
+ *   item added, removed or moved. Otherwise positions mean different items on
+ *   the two sides, and the whole list is the conflict.
+ */
+
+function isObject$1(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function same(a, b) {
+  if (a === undefined || b === undefined) return a === b;
+  return deepEqual(a, b);
+}
+
+/**
+ * Did this side add, remove or move an item? Lengths differ, or an item now
+ * sits where it was not, while it is still what used to be somewhere else.
+ */
+function reshaped(base, side) {
+  if (base.length !== side.length) return true;
+  return side.some((item, at) => !same(item, base[at]) && base.some((was, from) => from !== at && same(item, was)));
+}
+
+/**
+ * Where a value is one value, though it is an object: a media value (its path
+ * and what describes that file) or rich text. The schema says; see `merge.ts`.
+ */
+
+function mergeValues(base, site, proposal, atomic = () => false, path = []) {
+  if (same(site, base)) return {
+    value: proposal,
+    conflicts: []
+  };
+  if (same(proposal, base)) return {
+    value: site,
+    conflicts: []
+  };
+  if (atomic(path)) {
+    return {
+      value: site,
+      conflicts: [{
+        path,
+        base,
+        site,
+        proposal
+      }]
+    };
+  }
+  if (isObject$1(base) && isObject$1(site) && isObject$1(proposal)) {
+    const keys = [...new Set([...Object.keys(site), ...Object.keys(proposal), ...Object.keys(base)])];
+    const value = {};
+    const conflicts = [];
+    for (const key of keys) {
+      const merged = mergeValues(base[key], site[key], proposal[key], atomic, [...path, key]);
+      if (merged.value !== undefined) value[key] = merged.value;
+      conflicts.push(...merged.conflicts);
+    }
+    return {
+      value,
+      conflicts
+    };
+  }
+  if (Array.isArray(base) && Array.isArray(site) && Array.isArray(proposal) && !reshaped(base, site) && !reshaped(base, proposal)) {
+    const value = [];
+    const conflicts = [];
+    base.forEach((item, at) => {
+      const merged = mergeValues(item, site[at], proposal[at], atomic, [...path, String(at)]);
+      // Neither side removed an item, so every position holds one.
+      value.push(merged.value ?? null);
+      conflicts.push(...merged.conflicts);
+    });
+    return {
+      value,
+      conflicts
+    };
+  }
+  return {
+    value: site,
+    conflicts: [{
+      path,
+      base,
+      site,
+      proposal
+    }]
+  };
+}
+
+/** `doc` with `value` at `path`; `undefined` removes it. `doc` is not changed. */
+function setAt(doc, path, value) {
+  if (path.length === 0) return value;
+  const [head, ...rest] = path;
+  if (Array.isArray(doc)) {
+    const copy = [...doc];
+    const at = Number(head);
+    const next = setAt(copy[at], rest, value);
+    if (next === undefined) copy.splice(at, 1);else copy[at] = next;
+    return copy;
+  }
+  const copy = isObject$1(doc) ? {
+    ...doc
+  } : {};
+  const next = setAt(copy[head], rest, value);
+  if (next === undefined) delete copy[head];else copy[head] = next;
+  return copy;
+}
+function valueAt(doc, path) {
+  let current = doc;
+  for (const key of path) {
+    if (Array.isArray(current)) current = current[Number(key)];else if (isObject$1(current)) current = current[key];else return undefined;
+  }
+  return current;
+}
+
+/**
+ * The Val patch that turns `from` into `to`, as small as it can be: what
+ * writes a merge into a `.val.ts` without rewriting what did not change.
+ */
+function diffOps(from, to, path = []) {
+  if (same(from, to)) return [];
+  if (isObject$1(from) && isObject$1(to)) {
+    const ops = [];
+    for (const key of Object.keys(from)) {
+      if (!(key in to)) ops.push({
+        op: "remove",
+        path: below(path, key)
+      });
+    }
+    for (const [key, value] of Object.entries(to)) {
+      ops.push(...(key in from ? diffOps(from[key], value, [...path, key]) : [add([...path, key], value)]));
+    }
+    return ops;
+  }
+  if (Array.isArray(from) && Array.isArray(to) && from.length === to.length) {
+    return from.flatMap((item, at) => diffOps(item, to[at], [...path, String(at)]));
+  }
+  return [{
+    op: "replace",
+    path,
+    value: to ?? null
+  }];
+}
+function add(path, value) {
+  return {
+    op: "add",
+    path,
+    value
+  };
+}
+function below(path, key) {
+  return path.length === 0 ? [key] : [path[0], ...path.slice(1), key];
+}
+
+/**
+ * Publishing a proposal as a pull request is merged: valbuild/home
+ * `docs/hosted-publishing.md`, step 8.2.
+ *
+ * Val's half: the two answers that need a schema. Content gets them as files
+ * and change ids and carries them out, never looking at a field, a list or a
+ * patch set.
+ *
+ * - {@link mergeFromSite} -- Update from the site: the merge commit `M`.
+ * - {@link changesToMove} -- which of the site's pending changes leave the
+ *   site when a proposal is merged.
+ *
+ * `mergeScenarios.test.ts` is their specification.
+ */
+
+/** A field both sides changed since the proposal started. */
+
+/**
+ * Code both sides changed: a component, `val.modules.ts`, or the schema of a
+ * `.val.ts` (its code -- everything but `c.define`'s content argument, whose
+ * fields merge on their own).
+ */
+
+/**
+ * The schema check: content that merged cleanly and is not valid under the
+ * schema the merge ends with -- an entry the site added, say, under a field
+ * whose type the proposal changed.
+ */
+
+/** How a conflict is resolved: keep one side, or write it -- as AI or a developer does. */
+
+/**
+ * Update from the site: a three-way merge of where the proposal started
+ * (`base`), the site's head and the proposal's last save, written whole.
+ * Every conflict needs a resolution, or nothing is merged.
+ *
+ * File by file. A file that is not a `.val.ts` is code, and merges as a
+ * file: changed on one side, that side's; on both, a conflict. A `.val.ts`
+ * is code (everything but `c.define`'s content argument) and content, and the
+ * two merge apart: the code as a file, the content field by field
+ * (`mergeValues`). So a schema the proposal changed and a field the site
+ * published in the same file do not conflict. A code conflict in a `.val.ts`
+ * is resolved by keeping a side's code -- the content still merges -- or by
+ * writing the whole file.
+ *
+ * Not here: the schema check ({@link schemaCheck}). It needs the merged
+ * files' schemas, so whoever can evaluate them -- Val's loader, the builder
+ * tab -- runs it on `files` before the merge is committed.
+ */
+function mergeFromSite(input) {
+  const {
+    base,
+    site,
+    proposal,
+    resolutions
+  } = input;
+  const files = {};
+  const modules = {};
+  const conflicts = [];
+  const paths = [...new Set([...Object.keys(base.files), ...Object.keys(site.files), ...Object.keys(proposal.files)])].sort();
+  // A `.jsonValues()` entry is written with its module, never on its own.
+  const entryFiles = new Set([base, site, proposal].flatMap(side => Object.values(side.modules).flatMap(module => Object.values(module.entries ?? {}))));
+  for (const file of paths) {
+    var _moduleOf3, _moduleOf4, _moduleOf5, _moduleOf6;
+    if (entryFiles.has(file)) continue;
+    const b = base.files[file] ?? null;
+    const s = site.files[file] ?? null;
+    const p = proposal.files[file] ?? null;
+    const resolution = fileResolution(resolutions, file);
+    const codeConflict = () => ({
+      kind: "code",
+      file,
+      base: b,
+      site: s,
+      proposal: p
+    });
+
+    // A file named like a module that no side defines as one -- schemas the
+    // pages share -- is code.
+    const moduleFilePath = `/${file}`;
+    const isModule = [base, site, proposal].some(side => side.modules[moduleFilePath] !== undefined);
+    if (!file.endsWith(".val.ts") || !isModule) {
+      if (s === b) files[file] = p;else if (p === b) files[file] = s;else if (resolution) files[file] = resolvedText(resolution, s, p);else {
+        conflicts.push(codeConflict());
+        files[file] = s;
+      }
+      continue;
+    }
+
+    // A .val.ts: whose code, then the content under it.
+    const code = text => text === null ? null : codeOf(file, text);
+    let side;
+    if (code(s) === code(b)) side = "proposal";else if (code(p) === code(b)) side = "site";else if (resolution && "text" in resolution) {
+      files[file] = resolution.text;
+      continue;
+    } else if (resolution) side = resolution.keep;else {
+      conflicts.push(codeConflict());
+      files[file] = s;
+      continue;
+    }
+    const moduleOf = project => project.modules[moduleFilePath];
+    const sourceOf = project => {
+      var _moduleOf;
+      return (_moduleOf = moduleOf(project)) === null || _moduleOf === void 0 ? void 0 : _moduleOf.source;
+    };
+    const chosen = side === "site" ? site : proposal;
+    const text = side === "site" ? s : p;
+    if (text === null) {
+      // That side deleted the file. Content the other side changed would go
+      // with it: that is for a person to decide -- unless they have.
+      const other = side === "site" ? p : s;
+      if (!resolution && other !== b) {
+        conflicts.push(codeConflict());
+      }
+      files[file] = null;
+      for (const project of [base, site, proposal]) {
+        for (const entry of Object.values(((_moduleOf2 = moduleOf(project)) === null || _moduleOf2 === void 0 ? void 0 : _moduleOf2.entries) ?? {})) {
+          var _moduleOf2;
+          files[entry] = null;
+        }
+      }
+      continue;
+    }
+    // What the chosen text holds, which the merge is written over.
+    const from = ((_moduleOf3 = moduleOf(chosen)) === null || _moduleOf3 === void 0 ? void 0 : _moduleOf3.written) ?? ((_moduleOf4 = moduleOf(chosen)) === null || _moduleOf4 === void 0 ? void 0 : _moduleOf4.source);
+    const merged = mergeValues(sourceOf(base), sourceOf(site), sourceOf(proposal), atomicFor((_moduleOf5 = moduleOf(chosen)) === null || _moduleOf5 === void 0 ? void 0 : _moduleOf5.schema));
+    const resolved = resolveContent(moduleFilePath, merged, resolutions);
+    conflicts.push(...resolved.unresolved);
+    const content = resolved.content;
+    modules[moduleFilePath] = content;
+    const entries = (_moduleOf6 = moduleOf(chosen)) === null || _moduleOf6 === void 0 ? void 0 : _moduleOf6.entries;
+    if (entries) {
+      var _moduleOf7, _moduleOf8;
+      Object.assign(files, writeEntries(file, text, chosen.files, entries, from, content, [(_moduleOf7 = moduleOf(site)) === null || _moduleOf7 === void 0 ? void 0 : _moduleOf7.entries, (_moduleOf8 = moduleOf(proposal)) === null || _moduleOf8 === void 0 ? void 0 : _moduleOf8.entries]));
+    } else {
+      files[file] = writeContent(file, text, from, content);
+    }
+  }
+  if (conflicts.length > 0) return {
+    status: "conflicts",
+    conflicts
+  };
+  return {
+    status: "merged",
+    files,
+    modules,
+    code: Object.keys(files).filter(file => {
+      const text = files[file];
+      const before = site.files[file] ?? null;
+      if (text === null || before === null) return text !== before;
+      return codeOf(file, text) !== codeOf(file, before);
+    })
+  };
+}
+
+// --- the pieces --------------------------------------------------------------
+
+/**
+ * A module's merged content with the resolutions written in: each field
+ * conflict that has one, and any value written for the schema check (or
+ * anywhere else) as given. What is left is what still needs a person.
+ */
+function resolveContent(moduleFilePath, merged, resolutions) {
+  let content = merged.value;
+  const unresolved = [];
+  for (const conflict of merged.conflicts) {
+    const resolved = fieldResolution(resolutions, moduleFilePath, conflict);
+    if (resolved === null) {
+      unresolved.push({
+        kind: "field",
+        moduleFilePath,
+        ...conflict
+      });
+    } else {
+      content = setAt(content, conflict.path, resolved.value);
+    }
+  }
+  for (const resolution of resolutions) {
+    if ("moduleFilePath" in resolution && resolution.moduleFilePath === moduleFilePath && "value" in resolution && !merged.conflicts.some(c => samePath(c.path, resolution.path))) {
+      content = setAt(content, resolution.path, resolution.value);
+    }
+  }
+  return {
+    content,
+    unresolved
+  };
+}
+
+/**
+ * The schema check of a merge: content in `merged` -- the project
+ * {@link mergeFromSite} wrote, with its schemas evaluated -- that is invalid
+ * under the schema it ends with, leaving out what was already invalid on a
+ * side. A conflict, each; a resolution with a value for one is written into
+ * the content by the merge, and so is checked here.
+ */
+function schemaCheck(merged, sides) {
+  const conflicts = [];
+  for (const [path, module] of Object.entries(merged.modules)) {
+    const moduleFilePath = path;
+    const known = new Set(sides.flatMap(side => {
+      const there = side.modules[moduleFilePath];
+      return there ? errorsOfSource(moduleFilePath, there).map(e => e.path.join("/")) : [];
+    }));
+    for (const error of errorsOfSource(moduleFilePath, module)) {
+      if (known.has(error.path.join("/"))) continue;
+      conflicts.push({
+        kind: "invalid",
+        moduleFilePath,
+        path: error.path,
+        value: valueAt(module.source, error.path),
+        message: error.message
+      });
+    }
+  }
+  return conflicts;
+}
+
+/**
+ * The values that merge whole, though they are objects: media (an image's
+ * alt text describes that image, not another) and rich text.
+ */
+const ATOMIC = new Set(["image", "file", "video", "font", "richtext"]);
+
+/** See {@link ATOMIC}: where this schema holds a value that merges whole. */
+function atomicFor(schema) {
+  if (!schema) return () => false;
+  return path => {
+    const types = schemaTypesOfPath(schema, path);
+    return [...types].some(type => ATOMIC.has(type));
+  };
+}
+const tsOps = new TSOps(document => pipe(analyzeValModule(document), result.map(({
+  source
+}) => source)));
+
+/**
+ * `content` written into the `.val.ts` `text`, whose content is `from`: as
+ * the smallest patch, through the same AST operations a save uses, so what
+ * did not change is left exactly as it was.
+ */
+function writeContent(file, text, from, content) {
+  const ops = diffOps(from, content);
+  if (ops.length === 0) return text;
+  const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.ES2015, true);
+  return printed(unwrap(file, applyPatch(sourceFile, tsOps, ops)));
+}
+
+/**
+ * A `.jsonValues()` module, written as its files: the `.val.ts` names the
+ * entries -- one added gets a `c.json(...)` line, as a save writes it, one
+ * removed loses its line -- and each entry is its own `.val.json`. An entry
+ * whose content did not change keeps its file's text exactly.
+ */
+function writeEntries(file, text, chosenFiles, entries, from, content, others) {
+  const written = {};
+  const before = isRecord$4(from) ? from : {};
+  const after = isRecord$4(content) ? content : {};
+  const moduleDir = path__default.posix.dirname(file);
+  let sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.ES2015, true);
+  for (const key of Object.keys(before)) {
+    if (key in after) continue;
+    sourceFile = unwrap(file, removeValJsonEntry(sourceFile, [], key));
+    written[entries[key]] = null;
+  }
+  for (const [key, value] of Object.entries(after)) {
+    const entryFile = entries[key] ?? others.map(other => other === null || other === void 0 ? void 0 : other[key]).find(f => f !== undefined) ?? path__default.posix.join(moduleDir, path__default.posix.basename(file, ".val.ts"), `${key}.val.json`);
+    if (!(key in before)) {
+      const importPath = `./${path__default.posix.relative(moduleDir, entryFile)}`;
+      sourceFile = unwrap(file, insertValJsonEntry(sourceFile, [], key, importPath));
+    }
+    const kept = chosenFiles[entryFile];
+    written[entryFile] = key in before && diffOps(before[key], value).length === 0 && kept ? kept : JSON.stringify(value, null, 2);
+  }
+  written[file] = printed(sourceFile);
+  return written;
+}
+function isRecord$4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrap(file, written) {
+  if (result.isErr(written)) {
+    throw new Error(`could not write the merge into ${file}: ${String(written.error)}`);
+  }
+  return written.value;
+}
+
+/** As `prepare` prints: TypeScript escapes non-ASCII as \\u sequences. */
+function printed(sourceFile) {
+  return unescape(sourceFile.getText(sourceFile).replace(/\\u/g, "%u"));
+}
+function fileResolution(resolutions, file) {
+  for (const resolution of resolutions) {
+    if ("file" in resolution && resolution.file === file) return resolution;
+  }
+  return null;
+}
+function resolvedText(resolution, site, proposal) {
+  if ("text" in resolution) return resolution.text;
+  return resolution.keep === "site" ? site : proposal;
+}
+
+/** A field conflict's resolution, as the value it leaves; `null` when it has none. */
+function fieldResolution(resolutions, moduleFilePath, conflict) {
+  for (const resolution of resolutions) {
+    if (!("moduleFilePath" in resolution) || resolution.moduleFilePath !== moduleFilePath || !samePath(resolution.path, conflict.path)) {
+      continue;
+    }
+    if ("value" in resolution) return {
+      value: resolution.value
+    };
+    return {
+      value: resolution.keep === "site" ? conflict.site : conflict.proposal
+    };
+  }
+  return null;
+}
+function samePath(a, b) {
+  return a.length === b.length && a.every((key, at) => key === b[at]);
+}
+
+/**
+ * Update from the site when only content changed (valbuild/home
+ * `docs/hosted-publishing.md` step 8.2, slice 1a): the proposal staged no code
+ * and the site still serves the build the proposal stands on. Then all three
+ * sides share one schema -- the running build's -- so the merge needs no
+ * project loaded, which is what lets Val's server at a proposal's address run
+ * it (it cannot evaluate a `.val.ts`).
+ *
+ * The same rules as {@link mergeFromSite}, module by module: field by field,
+ * the same value on both sides a conflict, media and rich text whole. Content
+ * hands over each module the proposal saved, as it was where the proposal
+ * started, as the site has it, and as the proposal saved it; the merge is
+ * written into the proposal's own `.val.ts` text with the same AST operations
+ * a save uses.
+ *
+ * Not here: a `.jsonValues()` record the site changed. Its Source in content's
+ * index holds only the entries a commit touched, so it cannot be merged from
+ * the index, and its entries are `.val.json` files the `.val.ts` only names,
+ * which writing into the `.val.ts` cannot change. That waits for the full
+ * merge (`writeEntries`), and is answered as such -- with or without a
+ * conflict, since a clean merge still has the site's entries to write.
+ */
+
+function mergeContent(input) {
+  const conflicts = [];
+  const files = {};
+  const modules = {};
+  const needsFullMerge = [];
+  for (const path of Object.keys(input.modules).sort()) {
+    const moduleFilePath = path;
+    const {
+      base,
+      site,
+      proposal,
+      text
+    } = input.modules[moduleFilePath];
+    const schema = input.schemas[moduleFilePath];
+    if (!schema) {
+      // The build has no such module: its code changed, so this is not a
+      // content-only update.
+      needsFullMerge.push(moduleFilePath);
+      continue;
+    }
+    const serialized = schema["executeSerialize"]();
+    const orUndefined = value => value ?? undefined;
+    const merged = mergeValues(orUndefined(base), orUndefined(site), orUndefined(proposal), atomicFor(serialized));
+    if (serialized.type === "record" && serialized.jsonValues && (merged.conflicts.length > 0 || diffOps(orUndefined(proposal), merged.value).length > 0)) {
+      needsFullMerge.push(moduleFilePath);
+      continue;
+    }
+    const resolved = resolveContent(moduleFilePath, merged, input.resolutions);
+    conflicts.push(...resolved.unresolved);
+    if (resolved.unresolved.length > 0) continue;
+
+    // The schema check, under the one schema there is: what was already
+    // invalid on a side is not the merge's doing. A value written as a
+    // resolution is already in `content`, and checked like the rest -- as
+    // `schemaCheck` does for the full merge.
+    const known = new Set([site, proposal].flatMap(side => validateWith(schema, moduleFilePath, orUndefined(side)).map(e => e.path.join("/"))));
+    const content = resolved.content;
+    for (const error of validateWith(schema, moduleFilePath, content)) {
+      if (known.has(error.path.join("/"))) continue;
+      conflicts.push({
+        kind: "invalid",
+        moduleFilePath,
+        path: error.path,
+        value: valueAt(content, error.path),
+        message: error.message
+      });
+    }
+    const file = moduleFilePath.slice(1);
+    files[file] = writeContent(file, text, orUndefined(proposal), content);
+    modules[moduleFilePath] = {
+      source: content ?? null,
+      schema: serialized
+    };
+  }
+  if (needsFullMerge.length > 0) {
+    return {
+      status: "needs-full-merge",
+      modules: needsFullMerge
+    };
+  }
+  if (conflicts.length > 0) return {
+    status: "conflicts",
+    conflicts
+  };
+  return {
+    status: "merged",
+    files,
+    modules
+  };
+}
+
+/**
+ * Update from the site, for a proposal with code (valbuild/home
+ * `docs/hosted-publishing.md` step 8.2, slice 1b): Val's server's half.
+ *
+ * Nothing here runs project code. Content hands over the three trees and each
+ * module's Source in each (`merge-trees`); the builder tab evaluates each
+ * tree's `val.modules.ts` -- the site's own dependencies, from its vendor
+ * layer -- and sends what that gave: each module's schema, the content its
+ * text holds, and the errors of its Source under that schema. This does the
+ * text, with the TypeScript Val's server already has.
+ *
+ * In two calls, because the schema check needs the merged tree evaluated too:
+ *
+ * 1. Without `merged`: the merge `M`, as the files it changes over the site
+ *    and each module's content -- for the tab to evaluate -- under an `id`.
+ *    Or the conflicts, for a person.
+ * 2. With `merged`, the tab's evaluation of that `id`: the schema check, then
+ *    what content commits. The merge is made again rather than taken from the
+ *    tab, and must come out as the same `id`.
+ */
+
+function updateWithCode(input) {
+  const {
+    trees,
+    evaluated,
+    resolutions
+  } = input;
+  const projectOf = side => {
+    const files = sideFiles(trees, side);
+    return {
+      files,
+      modules: modulesOf(files, evaluated[side], path => sideSource(trees, side, path))
+    };
+  };
+  const base = projectOf("base");
+  const site = projectOf("site");
+  const proposal = projectOf("proposal");
+  const result = mergeFromSite({
+    base,
+    site,
+    proposal,
+    resolutions
+  });
+  if (result.status === "conflicts") return result;
+  const changes = {};
+  for (const [path, text] of Object.entries(result.files)) {
+    if (text !== (site.files[path] ?? null)) changes[path] = text;
+  }
+  const id = mergeId(changes, result.modules);
+  if (input.merged === undefined) {
+    const sources = {};
+    for (const [path, content] of Object.entries(result.modules)) {
+      sources[path] = content ?? null;
+    }
+    return {
+      status: "evaluate",
+      id,
+      files: changes,
+      sources
+    };
+  }
+  if (input.merged.id !== id) return {
+    status: "stale"
+  };
+  const mergedFiles = {
+    ...site.files,
+    ...changes
+  };
+  const mergedProject = {
+    files: mergedFiles,
+    modules: modulesOf(Object.fromEntries(Object.entries(mergedFiles).filter(entry => entry[1] !== null)), input.merged.evaluated, path => result.modules[path] ?? null)
+  };
+  const invalid = schemaCheck(mergedProject, [site, proposal]);
+  if (invalid.length > 0) return {
+    status: "conflicts",
+    conflicts: invalid
+  };
+
+  // The paths the proposal held go back to what the merge left -- the site's,
+  // often -- so nothing it held before is left standing over the new base.
+  const files = {
+    ...changes
+  };
+  for (const path of Object.keys(trees.trees.proposal)) {
+    if (!(path in files)) files[path] = mergedFiles[path] ?? null;
+  }
+  const modules = {};
+  for (const [path, module] of Object.entries(mergedProject.modules)) {
+    var _trees$modules$module, _trees$modules$module2;
+    const moduleFilePath = path;
+    const onSite = site.modules[moduleFilePath];
+    const touched = ((_trees$modules$module = trees.modules[moduleFilePath]) === null || _trees$modules$module === void 0 ? void 0 : _trees$modules$module.proposal) !== ((_trees$modules$module2 = trees.modules[moduleFilePath]) === null || _trees$modules$module2 === void 0 ? void 0 : _trees$modules$module2.base);
+    if (touched || onSite === undefined || !sameJson(onSite.source, module.source) || !sameJson(onSite.schema, module.schema)) {
+      modules[moduleFilePath] = {
+        source: module.source,
+        schema: module.schema
+      };
+    }
+  }
+  return {
+    status: "merged",
+    files,
+    staged: result.code.filter(path => path in files),
+    modules
+  };
+}
+function modulesOf(files, evaluated, sourceOf) {
+  const modules = {};
+  for (const [path, module] of Object.entries(evaluated)) {
+    const moduleFilePath = path;
+    const text = files[moduleFilePath.slice(1)];
+    modules[moduleFilePath] = {
+      // A module the index has no Source for is one this tree's code adds:
+      // its text is all there is.
+      source: sourceOf(moduleFilePath) ?? module.written,
+      written: module.written,
+      schema: module.schema,
+      entries: text === undefined ? null : entryFilesOf(moduleFilePath, text),
+      errors: module.errors
+    };
+  }
+  return modules;
+}
+
+/** The merge, named by what it is: the files it changes and the content it writes. */
+function mergeId(files, modules) {
+  const sorted = record => Object.keys(record).sort().map(key => [key, record[key] ?? null]);
+  return createHash("sha256").update("val.update-with-code.v1\n").update(JSON.stringify({
+    files: sorted(files),
+    modules: sorted(modules)
+  })).digest("hex");
+}
+function sameJson(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+const textEncoder$2 = new TextEncoder();
+
+/** The body of the content API's 403 for a write the project's plan refuses. */
+const PlanRefusedBody = z.object({
+  error: PlanRefusalError
+});
+const PatchId = z.string().refine(s => !!s); // TODO: validate
+const CommitSha = z.string().refine(s => !!s); // TODO: validate
+z.string().refine(s => !!s); // TODO: validate
+z.string().refine(s => !!s); // TODO: validate
+const ModuleFilePath = z.string().refine(s => !!s); // TODO: validate
+const Metadata = z.union([z.object({
+  mimeType: z.string(),
+  width: z.number(),
+  height: z.number()
+}), z.object({
+  mimeType: z.string()
+})]);
+const MetadataRes = z.object({
+  filePath: ModuleFilePath,
+  metadata: Metadata,
+  type: z.union([z.literal("file"), z.literal("image")]).nullable()
+});
+const GetApplicablePatches = z.object({
+  patches: z.array(z.object({
+    path: z.string(),
+    patch: Patch.nullable(),
+    patchId: z.string(),
+    authorId: z.string().nullable(),
+    baseSha: z.string(),
+    createdAt: z.string(),
+    applied: z.object({
+      commitSha: z.string()
+    }).nullable()
+  })),
+  /**
+   * The head of the chain. See `OrderedPatches.headPatchId`. Optional because
+   * a content service that predates it sends nothing.
+   */
+  headPatchId: PatchId$1.nullable().optional(),
+  /**
+   * The chain version of that head. See `OrderedPatches.headVersion`.
+   * Optional for the same reason.
+   */
+  headVersion: z.number().optional(),
+  /** Of `patches`, the ones a running publish holds. See `OrderedPatches.publishingPatches`. */
+  publishingPatches: z.array(PatchId$1).optional(),
+  /** Of `patches`, the ones a failed publish holds back. See `OrderedPatches.heldBackPatches`. */
+  heldBackPatches: z.array(PatchId$1).optional(),
+  commits: z.array(z.object({
+    commitSha: z.string(),
+    /*
+     * Nullable since the content service mints its own commit shas: a
+     * root commit has no parent, and a publisher that did not say where
+     * it was has no client sha. Parsed rather than trusted, so a service
+     * that sends null gets null here instead of failing the whole poll.
+     */
+    clientCommitSha: z.string().nullable(),
+    parentCommitSha: z.string().nullable(),
+    commitMessage: z.string().nullable(),
+    branch: z.string(),
+    creator: z.string(),
+    createdAt: z.string()
+  })).optional(),
+  deployments: z.array(z.object({
+    deploymentId: z.string(),
+    commitSha: z.string(),
+    deploymentState: z.string(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    // The git message, where the content service knows it. See
+    // `ValDeployment`: this is the only source for a deployment that Val
+    // did not publish, and zod would otherwise strip it here.
+    commitMessage: z.string().nullable().optional()
+  })).optional(),
+  /**
+   * What the project EXPECTS of whoever publishes it.
+   *
+   * Optional because a content service that predates it sends nothing, and
+   * absent means "not reported" -- never "managed". The difference decides
+   * whether a publish is refused, so guessing either way would be worse than
+   * not checking: guessing `managed` would let a deployment publish a
+   * connected project it cannot mirror, and guessing `connected` would refuse
+   * every publish against an older service.
+   */
+  project: z.object({
+    sourceMode: z.union([z.literal("managed"), z.literal("connected")]),
+    branch: z.string(),
+    /**
+     * Whether a press of Publish is a publish JOB. Absent from a content
+     * service that predates connected jobs: then managed projects publish
+     * as jobs, and connected ones by commit, as they did.
+     */
+    publishJobs: z.boolean().optional()
+  }).optional()
+});
+const FilesResponse = z.object({
+  files: z.array(z.union([z.object({
+    filePath: z.string(),
+    location: z.literal("patch"),
+    patchId: PatchId,
+    value: z.string(),
+    remote: z.boolean()
+  }), z.object({
+    filePath: z.string(),
+    location: z.literal("repo"),
+    commitSha: CommitSha,
+    value: z.string()
+  })])),
+  errors: z.array(z.union([z.object({
+    filePath: z.string(),
+    location: z.literal("patch"),
+    patchId: PatchId,
+    message: z.string(),
+    remote: z.boolean()
+  }), z.object({
+    filePath: z.string(),
+    location: z.literal("repo"),
+    commitSha: CommitSha,
+    message: z.string()
+  })])).optional()
+});
+const SavePatchResponse = z.object({
+  patchId: PatchId,
+  /**
+   * The chain version this write made, comparable with `headVersion` on the
+   * listing. Optional: a content service that predates it sends nothing.
+   */
+  headVersion: z.number().optional()
+});
+const DeletePatchesResponse = z.object({
+  deleted: z.array(PatchId),
+  errors: z.array(z.object({
+    message: z.string(),
+    patchId: PatchId,
+    /** The publish job holding it, when that is why it was not deleted. */
+    publishJobId: z.string().optional()
+  })).optional(),
+  /**
+   * The chain version each branch the delete changed is now at, keyed by
+   * branch. Optional: a content service that predates it sends none.
+   */
+  headVersions: z.record(z.string(), z.number()).optional()
+});
+/**
+ * This client's own branch's entry in a per-branch version map.
+ *
+ * A delete can span branches, so the content service answers per branch. With
+ * no branch of its own (a build with no repository, where the service resolves
+ * it), the only entry is ours when there is exactly one; with several, none can
+ * be picked, and a wrong one would floor this client at another chain's count.
+ */
+function ownBranchVersion(headVersions, branch) {
+  if (headVersions === undefined) return undefined;
+  if (branch !== undefined) return headVersions[branch];
+  const versions = Object.values(headVersions);
+  return versions.length === 1 ? versions[0] : undefined;
+}
+const SavePatchFileResponse = z.object({
+  patchId: PatchId,
+  filePath: ModuleFilePath
+});
+const CommitResponse = z.object({
+  updatedFiles: z.array(z.string()),
+  commit: CommitSha,
+  /*
+   * Optional because a content service that predates them sends neither, and
+   * this client talks to whichever one the project is on. Absent means NOT
+   * REPORTED: `parent: undefined` is not "a root commit", and a caller that
+   * reads it as one would conclude the history starts here.
+   *
+   * Unbranded strings deliberately -- see `CommitResult.parent`. They arrive
+   * from a service that versions separately and are passed through as what it
+   * said, not as something this end vouched for.
+   */
+  parent: z.string().optional(),
+  tree: z.string().optional(),
+  branch: z.string(),
+  /** The chain version the publish moved the branch to; absent if it applied nothing. */
+  headVersion: z.number().optional()
+});
+// #region history wire schemas
+//
+// Validated on arrival rather than trusted: these come from a service that
+// versions separately, and a silently mis-shaped commit record reads as "this
+// commit changed nothing", which is indistinguishable from a real answer.
+const HistoricalCommitResponse = z.object({
+  commitSha: z.string(),
+  /** `null` for a root commit; see the note on the applicable-patches schema. */
+  parentCommitSha: z.string().nullable(),
+  /** `null` when the publisher did not say where it was. */
+  clientCommitSha: z.string().nullable(),
+  branch: z.string(),
+  createdBranch: z.string().nullable(),
+  creator: z.string().nullable(),
+  message: z.string().nullable(),
+  createdAt: z.string(),
+  seqNum: z.string(),
+  patchCount: z.number(),
+  hasArchive: z.boolean()
+});
+const ListCommitsResponse = z.object({
+  commits: z.array(HistoricalCommitResponse),
+  nextCursor: z.string().nullable()
+});
+const CommitPatchesResponse = z.object({
+  commitSha: z.string(),
+  commit: z.object({
+    commitSha: z.string(),
+    parentCommitSha: z.string().nullable(),
+    clientCommitSha: z.string().nullable(),
+    branch: z.string(),
+    createdBranch: z.string().nullable(),
+    creator: z.string().nullable(),
+    message: z.string().nullable(),
+    createdAt: z.string(),
+    seqNum: z.string(),
+    hasArchive: z.boolean()
+  }),
+  patches: z.array(z.object({
+    patchId: z.string(),
+    path: z.string(),
+    patch: z.unknown(),
+    authorId: z.string().nullable(),
+    createdAt: z.string(),
+    baseSha: z.string(),
+    coreVersion: z.string()
+  }))
+});
+
+/**
+ * `home` — `Api["/commits/:commitSha/modules"]["GET"]["res"]`.
+ *
+ * `schema` stays `unknown` here on purpose. The content service stores it
+ * opaquely and cannot vouch for it, so validating it at the transport boundary
  * would turn "a schema written by a different version of Val" into a failed
  * REQUEST rather than one module that cannot be shown. It is checked in
  * `getHistoricalPatchSet`, per module, where a failure degrades that module and
@@ -9648,39 +10346,10 @@ const CommitAffectedFilesResponse = z.object({
 });
 // #endregion history wire schemas
 
-/*
- * The shared schema, not a copy of it.
- *
- * This re-declared `PatchGroup` field for field while the file already imported
- * `PatchGroupT` from the same module — so a field added on one side and not the
- * other would have `getPatchGroups()` return a `PatchGroupT[]` silently missing
- * it, with no type error anywhere.
- */
-const PatchGroupsResponse = z.object({
-  patchGroups: z.array(PatchGroup)
-});
-const PatchGroupMutationResponse = z.object({
-  /** `null` for an unstage of `~` when the caller has no open group. */
-  patchGroupId: z.string().nullable(),
-  patchIds: z.array(PatchId),
-  /** The chain version the change committed at. Absent from an older `home`. */
-  headVersion: z.number().optional()
-});
 const NonceResponse = z.object({
   nonce: z.string(),
   url: z.string()
 });
-
-/**
- * How long a patch-group lookup is reused. See `ValOpsHttp.patchGroupsCache`.
- *
- * Sized to cover one server render, not to be a cache: several `fetchVal` calls
- * in one request share an answer, and the next request asks again.
- */
-const PATCH_GROUPS_CACHE_MS = 1000;
-
-/** The content API's id for "the caller's open group on the branch". */
-const OWN_OPEN_GROUP = "~";
 class ValOpsHttp extends ValOps {
   authHeaders;
   root;
@@ -10128,7 +10797,7 @@ class ValOpsHttp extends ValOps {
     if (path === "") return method === "GET" || method === "POST";
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
-    if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files)$/.test(path);
+    if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files|merge-trees)$/.test(path);
     return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build|update-from-site|restore-code)$/.test(path);
   }
 
@@ -10165,8 +10834,16 @@ class ValOpsHttp extends ValOps {
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);
   }
   async proposalsApi(path, init, profileId) {
-    var _this$proposal;
+    var _exec2, _exec3, _this$proposal;
     const json = "application/json";
+    const updating = (_exec2 = /^\/([0-9a-f]{20})\/update-content$/.exec(path)) === null || _exec2 === void 0 ? void 0 : _exec2[1];
+    if (updating !== undefined && init.method === "POST") {
+      return this.updateContentFromSite(updating, init.body, profileId);
+    }
+    const withCode = (_exec3 = /^\/([0-9a-f]{20})\/update-code$/.exec(path)) === null || _exec3 === void 0 ? void 0 : _exec3[1];
+    if (withCode !== undefined && init.method === "POST") {
+      return this.updateCodeFromSite(withCode, init.body, profileId);
+    }
     if (!ValOpsHttp.proposalsApiAllowed(init.method, path)) {
       return {
         status: 403,
@@ -10176,41 +10853,305 @@ class ValOpsHttp extends ValOps {
         })
       };
     }
-    const writes = ValOpsHttp.proposalFilesWrite(init.method, path);
-    if (writes !== null && writes !== ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.name)) {
+    const writes = ValOpsHttp.proposalFilesWrite(init.method, path);
+    if (writes !== null && writes !== ((_this$proposal = this.proposal) === null || _this$proposal === void 0 ? void 0 : _this$proposal.name)) {
+      return {
+        status: 403,
+        contentType: json,
+        body: JSON.stringify({
+          message: this.proposal === null ? "The site's files are changed in a proposal: open one, and change them there." : "Files are changed in the proposal this Studio is open in, not in another."
+        })
+      };
+    }
+    const res = await fetch(`${this.contentUrl}/v1/${this.project}/proposals${path}`, {
+      method: init.method,
+      headers: {
+        ...this.authHeaders,
+        /*
+         * WHO is asking, as for a commit: the app's key names the project,
+         * and a proposal is opened, renamed and closed by a person -- content
+         * refuses those writes from a credential that names nobody.
+         */
+        ...(profileId !== null ? {
+          "x-val-profile-id": profileId
+        } : {}),
+        ...(init.body === undefined ? {} : {
+          "Content-Type": json
+        })
+      },
+      ...(init.body === undefined ? {} : {
+        body: init.body
+      })
+    });
+    return {
+      status: res.status,
+      body: await res.text(),
+      contentType: res.headers.get("Content-Type") ?? json
+    };
+  }
+
+  /**
+   * Update from the site, for a proposal that changes only content
+   * (valbuild/home `docs/hosted-publishing.md`, step 8.2, slice 1a): content
+   * hands over the three versions of every module the proposal saved, this
+   * server merges them under its own build's schemas -- the same on all
+   * three sides, which is what "content only" means -- and content commits
+   * the merge on the proposal's branch.
+   *
+   * Answered here rather than forwarded, at `POST /<name>/update-content`, and
+   * only by the proposal's own server: the schemas it merges under are this
+   * build's. A conflict comes back for a person to resolve, and the same call
+   * with their `resolutions` merges.
+   */
+  async updateContentFromSite(name, body, profileId) {
+    var _this$proposal2;
+    const json = "application/json";
+    const answer = (status, value) => ({
+      status,
+      contentType: json,
+      body: JSON.stringify(value)
+    });
+    if (((_this$proposal2 = this.proposal) === null || _this$proposal2 === void 0 ? void 0 : _this$proposal2.name) !== name) {
+      return answer(403, {
+        message: "A proposal is updated from the site at its own address, where its build is."
+      });
+    }
+    let parsedBody;
+    try {
+      parsedBody = body === undefined || body === "" ? {} : JSON.parse(body);
+    } catch {
+      return answer(400, {
+        message: "The update's body is not JSON."
+      });
+    }
+    const request = UpdateContentBody.safeParse(parsedBody);
+    if (!request.success) {
+      return answer(400, {
+        message: `Invalid update: ${fromError(request.error).toString()}`
+      });
+    }
+    const content = (path, init = {}) => fetch(`${this.contentUrl}/v1/${this.project}/proposals/${name}${path}`, {
+      ...init,
+      headers: {
+        ...this.authHeaders,
+        ...(profileId !== null ? {
+          "x-val-profile-id": profileId
+        } : {}),
+        ...(init.body === undefined ? {} : {
+          "Content-Type": json
+        })
+      }
+    });
+    const read = await content("/merge-inputs");
+    if (!read.ok) {
+      return {
+        status: read.status,
+        contentType: json,
+        body: await read.text()
+      };
+    }
+    const inputs = MergeInputs.safeParse(await read.json());
+    if (!inputs.success) {
+      return answer(502, {
+        message: `Content answered the merge's inputs in a shape this Val does not read: ${fromError(inputs.error).toString()}`
+      });
+    }
+    if (inputs.data.upToDate) return answer(200, {
+      status: "up-to-date"
+    });
+    if (!inputs.data.contentOnly.ok || inputs.data.siteHead === null) {
+      return answer(409, {
+        status: "needs-build",
+        message: inputs.data.contentOnly.ok ? "The site has no commit to update from." : inputs.data.contentOnly.reason
+      });
+    }
+    const modules = {};
+    const withoutText = [];
+    for (const [path, module] of Object.entries(inputs.data.modules)) {
+      const moduleFilePath = path;
+      if (module.text === null) {
+        withoutText.push(moduleFilePath);
+        continue;
+      }
+      modules[moduleFilePath] = {
+        base: module.base,
+        site: module.site,
+        proposal: module.proposal,
+        text: module.text
+      };
+    }
+    // Decisions are about the values a person was shown. When the site or
+    // the proposal moved since, they would settle values nobody saw, so the
+    // merge is done again without them: what still conflicts is shown again.
+    const {
+      siteHead,
+      proposalHead
+    } = request.data;
+    const decidedHere = siteHead === undefined || siteHead === inputs.data.siteHead && proposalHead === inputs.data.proposalHead;
+    const merged = withoutText.length > 0 ? {
+      status: "needs-full-merge",
+      modules: withoutText
+    } : mergeContent({
+      modules,
+      schemas: await this.getSchemas(),
+      resolutions: decidedHere ? request.data.resolutions : []
+    });
+    if (merged.status === "conflicts") {
+      return answer(200, {
+        status: "conflicts",
+        conflicts: merged.conflicts,
+        siteHead: inputs.data.siteHead,
+        proposalHead: inputs.data.proposalHead
+      });
+    }
+    if (merged.status === "needs-full-merge") {
+      return answer(409, {
+        status: "needs-full-merge",
+        modules: merged.modules,
+        message: `${merged.modules.join(", ")} changed both here and on the site in a way this version cannot merge yet.`
+      });
+    }
+    const written = await content("/merge-from-site", {
+      method: "POST",
+      body: JSON.stringify({
+        siteHead: inputs.data.siteHead,
+        proposalHead: inputs.data.proposalHead,
+        files: merged.files,
+        modules: merged.modules
+      })
+    });
+    const text = await written.text();
+    if (!written.ok) {
       return {
-        status: 403,
+        status: written.status,
         contentType: json,
-        body: JSON.stringify({
-          message: this.proposal === null ? "The site's files are changed in a proposal: open one, and change them there." : "Files are changed in the proposal this Studio is open in, not in another."
-        })
+        body: text
       };
     }
-    const res = await fetch(`${this.contentUrl}/v1/${this.project}/proposals${path}`, {
-      method: init.method,
+    return updatedAnswer(text);
+  }
+
+  /**
+   * Update from the site, for a proposal with code (valbuild/home
+   * `docs/hosted-publishing.md`, step 8.2, slice 1b), at
+   * `POST /<name>/update-code`. The builder tab has read content's trees
+   * (`GET /<name>/merge-trees`, forwarded) and evaluated them; this reads the
+   * trees again -- the tab's evaluation is of the trees content has, or it is
+   * of nothing -- and does the text (`updateWithCode`). The first call
+   * answers the merge for the tab to evaluate; the second, with that
+   * evaluation, commits it on the proposal's branch, staging its code.
+   *
+   * Only at the proposal's own address, as every write to its files is.
+   */
+  async updateCodeFromSite(name, body, profileId) {
+    var _this$proposal3;
+    const json = "application/json";
+    const answer = (status, value) => ({
+      status,
+      contentType: json,
+      body: JSON.stringify(value)
+    });
+    if (((_this$proposal3 = this.proposal) === null || _this$proposal3 === void 0 ? void 0 : _this$proposal3.name) !== name) {
+      return answer(403, {
+        message: "A proposal is updated from the site at its own address, where its files are written."
+      });
+    }
+    let parsedBody;
+    try {
+      parsedBody = body === undefined || body === "" ? {} : JSON.parse(body);
+    } catch {
+      return answer(400, {
+        message: "The update's body is not JSON."
+      });
+    }
+    const request = UpdateCodeBody.safeParse(parsedBody);
+    if (!request.success) {
+      return answer(400, {
+        message: `Invalid update: ${fromError(request.error).toString()}`
+      });
+    }
+    const content = (path, init = {}) => fetch(`${this.contentUrl}/v1/${this.project}/proposals/${name}${path}`, {
+      ...init,
       headers: {
         ...this.authHeaders,
-        /*
-         * WHO is asking, as for a commit: the app's key names the project,
-         * and a proposal is opened, renamed and closed by a person -- content
-         * refuses those writes from a credential that names nobody.
-         */
         ...(profileId !== null ? {
           "x-val-profile-id": profileId
         } : {}),
         ...(init.body === undefined ? {} : {
           "Content-Type": json
         })
-      },
-      ...(init.body === undefined ? {} : {
-        body: init.body
+      }
+    });
+    const read = await content("/merge-trees");
+    if (!read.ok) {
+      return {
+        status: read.status,
+        contentType: json,
+        body: await read.text()
+      };
+    }
+    const trees = MergeTrees.safeParse(await read.json());
+    if (!trees.success) {
+      return answer(502, {
+        message: `Content answered the merge's trees in a shape this Val does not read: ${fromError(trees.error).toString()}`
+      });
+    }
+    const {
+      siteHead,
+      proposalHead,
+      builds
+    } = request.data;
+    if (trees.data.siteHead !== siteHead || trees.data.proposalHead !== proposalHead || trees.data.builds.base !== builds.base || trees.data.builds.site !== builds.site) {
+      return answer(409, {
+        status: "moved",
+        message: "The site or this proposal changed while this update was being made. Update from the site again."
+      });
+    }
+    if (trees.data.upToDate) return answer(200, {
+      status: "up-to-date"
+    });
+    if (siteHead === null) {
+      return answer(409, {
+        message: "The site has no commit to update from."
+      });
+    }
+    const merged = updateWithCode({
+      trees: trees.data,
+      evaluated: request.data.evaluated,
+      resolutions: request.data.resolutions,
+      ...(request.data.merged ? {
+        merged: request.data.merged
+      } : {})
+    });
+    if (merged.status === "stale") {
+      return answer(409, {
+        status: "stale",
+        message: "What was checked is not this update any more. Update from the site again."
+      });
+    }
+    if (merged.status !== "merged") return answer(200, merged);
+    const written = await content("/merge-from-site", {
+      method: "POST",
+      body: JSON.stringify({
+        siteHead,
+        proposalHead,
+        files: merged.files,
+        modules: merged.modules,
+        code: {
+          build: builds.site,
+          staged: merged.staged
+        }
       })
     });
-    return {
-      status: res.status,
-      body: await res.text(),
-      contentType: res.headers.get("Content-Type") ?? json
-    };
+    const text = await written.text();
+    if (!written.ok) {
+      return {
+        status: written.status,
+        contentType: json,
+        body: text
+      };
+    }
+    return updatedAnswer(text);
   }
 
   /**
@@ -10488,15 +11429,6 @@ class ValOpsHttp extends ValOps {
       ...(allPatchData.headVersion !== undefined ? {
         headVersion: allPatchData.headVersion
       } : {}),
-      /*
-       * Who holds what, read with the list and its version. On every stat, so
-       * a Studio's view of the groups is never older than its view of the
-       * chain — which is what lets a stage made in another browser show here
-       * without a reload. See `OrderedPatches.patchGroups`.
-       */
-      ...(allPatchData.patchGroups !== undefined ? {
-        patchGroups: allPatchData.patchGroups
-      } : {}),
       /*
        * The PUBLISH head, which is not `commitSha`.
        *
@@ -10565,8 +11497,8 @@ class ValOpsHttp extends ValOps {
 
   /** The branch this server's patches are on, where it knows it. */
   ownBranch() {
-    var _this$proposal2, _this$git;
-    return ((_this$proposal2 = this.proposal) === null || _this$proposal2 === void 0 ? void 0 : _this$proposal2.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
+    var _this$proposal4, _this$git;
+    return ((_this$proposal4 = this.proposal) === null || _this$proposal4 === void 0 ? void 0 : _this$proposal4.branch) ?? ((_this$git = this.git) === null || _this$git === void 0 ? void 0 : _this$git.branch);
   }
   async getWebSocketNonce(profileId) {
     return fetch(`${this.contentUrl}/v1/${this.project}/websocket/nonces`, {
@@ -10863,437 +11795,62 @@ class ValOpsHttp extends ValOps {
                 updatedAt: deployment.updatedAt,
                 commitMessage: deployment.commitMessage
               });
-            }
-          }
-          /*
-           * Membership, folded from the per-patch annotation onto the groups.
-           *
-           * From THIS response and not from `GET /patch-groups`, because only
-           * this one is consistent with the list and the version beside it:
-           * the content service reads all three in one transaction. A group
-           * list fetched separately can be older or newer than the chain it is
-           * shown with — and the Studio decides what an editor sees, and what
-           * a publish ships, from the pair.
-           *
-           * A group holding none of the listed patches is still listed, with
-           * no members: "groups exist and you hold nothing here" is a real
-           * answer, and different from "this content service has no groups".
-           */
-          let patchGroups;
-          if (data.patchGroups !== undefined) {
-            const members = new Map();
-            for (const patch of data.patches) {
-              for (const groupId of patch.patchGroupIds ?? []) {
-                const list = members.get(groupId) ?? [];
-                list.push(patch.patchId);
-                members.set(groupId, list);
-              }
-            }
-            patchGroups = data.patchGroups.map(group => ({
-              ...group,
-              patchIds: members.get(group.patchGroupId) ?? []
-            }));
-          }
-          return {
-            commits,
-            deployments,
-            patches,
-            errors,
-            ...(patchGroups !== undefined ? {
-              patchGroups
-            } : {}),
-            ...(data.headPatchId !== undefined ? {
-              headPatchId: data.headPatchId
-            } : {}),
-            ...(data.headVersion !== undefined ? {
-              headVersion: data.headVersion
-            } : {}),
-            ...(data.publishingPatches !== undefined ? {
-              publishingPatches: data.publishingPatches
-            } : {}),
-            ...(data.heldBackPatches !== undefined ? {
-              heldBackPatches: data.heldBackPatches
-            } : {})
-          };
-        }
-        console.error("Could not parse patches response. Error: " + fromError(parsed.error));
-        return {
-          patches,
-          error: {
-            message: `The response that Val got from the server was not in the expected format. This might be a transient error or a configuration issue. Please try again later.`
-          }
-        };
-      }
-      console.error("Could not get patches. HTTP error: " + patchesRes.status + " " + patchesRes.statusText);
-      if (patchesRes.status === 401) {
-        return {
-          patches,
-          error: {
-            message: "Although your user is authorized, the application has authorization issues. Contact the developers on your team and ask them to verify the api keys."
-          }
-        };
-      }
-      return {
-        patches,
-        error: {
-          message: "Could not get your changes. It is most likely due to a network issue. Check your network connection and please try again."
-        }
-      };
-    } catch (err) {
-      console.error("Could not get patches (connection error):", err instanceof Error ? err.message : JSON.stringify(err));
-      return {
-        patches: [],
-        networkError: true,
-        error: {
-          message: `Error: ${err instanceof Error ? err.message : JSON.stringify(err)}`
-        }
-      };
-    }
-  }
-
-  // #region patch groups
-  /**
-   * Add patches to a patch group.
-   *
-   * The set arrives closed by the client — `withPatchIds` is the prefix closure
-   * over the patch sets the staged patches belong to. We forward it and do not
-   * second-guess it: deriving the closure needs the content schema, which this
-   * process does have but content.val.build does not, and having two
-   * implementations of the rule would be worse than having one.
-   *
-   * Membership rows are stamped with `coreVersion` on the content side — the
-   * same stamp the patch row carries — so which client wrote a row stays
-   * legible after the fact.
-   */
-  async stagePatches(
-  /**
-   * The group to stage into, or `undefined` for the caller's open group on
-   * this branch — `~` on the content API, which creates it if there is none.
-   */
-  patchGroupId, /** What the user asked to stage. */
-  patchIds,
-  /**
-   * What has to come with it, because the staged patches are written on top
-   * of it.
-   *
-   * The content API stores each membership row as `explicit` or `dependency`
-   * and treats what it is not told about as a dependency. Folding the two
-   * halves into `patchIds` therefore files the patch somebody clicked as one
-   * the closure dragged in — the exact opposite of what happened, and the
-   * only record anywhere of what the author chose.
-   */
-  withPatchIds,
-  /**
-   * WHO is asking, so the content API can refuse a group that is not theirs.
-   *
-   * Every call from this class carries the app's API key, which says which
-   * PROJECT is calling and nothing about which editor. Without this the
-   * content API cannot tell one of a project's editors from another, so the
-   * only check on stage and unstage is the one in `ValServer` — and anything
-   * reaching the content API by another route (an API key, a PAT) has none at
-   * all.
-   *
-   * `null` where there is no session. The content API refuses rather than
-   * treating that as a match: a group written by an api key has a null author
-   * too, and `null === null` must not read as ownership.
-   */
-  authorId) {
-    return this.mutatePatchGroup("POST",
-    // Encoded: patchGroupId arrives in a request body, so an unencoded value
-    // like "../../commit" would reach a different endpoint carrying this
-    // project's auth headers.
-    `patch-groups/${encodeURIComponent(patchGroupId ?? OWN_OPEN_GROUP)}/patches`, {
-      patchIds,
-      withPatchIds,
-      coreVersion: Internal.VERSION.core,
-      ...this.ownGroupBranch()
-    }, authorId);
-  }
-
-  /**
-   * Remove patches from a patch group.
-   *
-   * The set arrives closed FORWARDS by the client: unstaging a patch also
-   * unstages everything built on top of it within its patch sets, and that is
-   * what `withPatchIds` carries.
-   */
-  async unstagePatches(/** See {@link stagePatches}. With no open group, there is nothing to remove. */
-  patchGroupId, /** What the user asked to unstage. */
-  patchIds, /** What has to go with it: everything built on top of it. */
-  withPatchIds, /** See {@link stagePatches} — the content API's half of the ownership check. */
-  authorId) {
-    return this.mutatePatchGroup("DELETE", `patch-groups/${encodeURIComponent(patchGroupId ?? OWN_OPEN_GROUP)}/patches`, {
-      patchIds,
-      withPatchIds,
-      ...this.ownGroupBranch()
-    }, authorId);
-  }
-
-  /**
-   * Every patch group on this branch, with what each holds.
-   *
-   * Read rather than mutated, and used to answer "which pending patches is THIS
-   * person allowed to see". A draft render that skips this shows base + every
-   * pending patch on the branch, including work other people have not
-   * published — which is what independent publish exists to prevent.
-   *
-   * A failure is an empty list rather than a throw, and the caller decides what
-   * that means. For a draft render the honest fallback is "show nothing
-   * pending" rather than "show everything": being shown your own committed
-   * content when the group lookup is down is a worse experience than being
-   * shown somebody else's unpublished draft is a bug.
-   */
-  /**
-   * The last group lookup, and when it was made.
-   *
-   * A draft render calls `getPatchGroups` once per `fetchVal`, in series with
-   * the whole-chain fetch, and a page that calls `fetchVal` several times pays
-   * the round trip several times. Groups are per branch and change rarely, so a
-   * short window removes the multiplier without letting a stage go unseen for
-   * meaningfully longer than one render.
-   *
-   * Deliberately short. This is a read whose staleness decides whose draft
-   * content someone sees, so it is a per-request de-duplication rather than a
-   * cache: a second render a second later asks again.
-   */
-  patchGroupsCache = null;
-
-  /**
-   * Forget the remembered group list, after a write through this server.
-   *
-   * A write changes membership -- a save joins its author's group, a delete or
-   * an unstage leaves it -- and the window above is long enough for the next
-   * render to be served the list from before it: an editor who saved and
-   * reloaded inside a second was shown their draft without the change they had
-   * just made. Called once the write has answered, so a read that started
-   * while it was in flight cannot leave the old list behind it.
-   *
-   * Only this instance's writes. Another instance's write is still seen at
-   * most one window late, which is what the window is for.
-   */
-  forgetPatchGroups() {
-    this.patchGroupsCache = null;
-  }
-  async getPatchGroups(options) {
-    const now = Date.now();
-    if ((options === null || options === void 0 ? void 0 : options.fresh) !== true && this.patchGroupsCache !== null && now - this.patchGroupsCache.at < PATCH_GROUPS_CACHE_MS) {
-      return this.patchGroupsCache.res;
-    }
-    const res = await this.fetchPatchGroups();
-    /*
-     * ANSWERS are cached; failures are not.
-     *
-     * A transient failure held for a second is replayed to every caller in it,
-     * and the callers are not equivalent: `refuseUnlessOwn` turns it into a 500
-     * that refuses the stage, a scoped draft render falls back to base and
-     * drops every pending patch on the page, and `GET /patches` omits the
-     * annotation. One flaky request became a second of all three. The point of
-     * this cache is to collapse the several `fetchVal` calls in one render into
-     * one round trip, and an error is exactly the case worth retrying inside
-     * that window rather than the case worth remembering.
-     *
-     * `unsupported` is cached with `ok` deliberately: it is a real answer about
-     * the deployment — this content API predates patch groups — and it will not
-     * change between two renders.
-     */
-    if (res.status === "ok" || res.status === "unsupported") {
-      this.patchGroupsCache = {
-        at: now,
-        res
-      };
-    }
-    return res;
-  }
-  async fetchPatchGroups() {
-    /*
-     * A proposal has no patch groups: its changes are one unit, saved
-     * together, and the content service answers 404 for groups on its branch.
-     * "Unsupported" is exactly that answer, and it is what makes a draft in a
-     * proposal show all of the proposal's changes rather than one person's.
-     */
-    if (this.proposal !== null) {
-      return {
-        status: "unsupported"
-      };
-    }
-    try {
-      /*
-       * `branch` is REQUIRED by the endpoint, which answers 400 without it.
-       *
-       * Same two params every other read here sends (`fetchPatchesInternal`,
-       * `saveSourceFilePatch`): groups are per branch, so a request without one
-       * is not merely under-specified, it is rejected.
-       */
-      const branch = this.ownBranch();
-      const params = new URLSearchParams(branch !== undefined ? [["branch", branch]] : []);
-      const res = await fetch(`${this.contentUrl}/v1/${this.project}/patch-groups?${params}`, {
-        headers: this.authHeaders
-      });
-      if (res.status === 404) {
-        /*
-         * The endpoint is not there, which is a content API that PREDATES patch
-         * groups — not a failure.
-         *
-         * The distinction decides what a draft render shows, and collapsing it
-         * into "error" is not a small mistake: a caller that reads an error as
-         * "could not ask" renders BASE, so every existing http deployment would
-         * silently drop all pending content from every draft preview. "There
-         * are no groups here" has to mean unscoped, which is exactly the
-         * behaviour those projects have today.
-         */
-        return {
-          status: "unsupported"
-        };
-      }
-      if (!res.ok) {
-        return {
-          status: "error",
-          message: res.status === 401 ? "Could not read patch groups: unauthorized. Verify that the val api keys are correct." : `Could not read patch groups. HTTP error: ${res.status} ${res.statusText}`
-        };
-      }
-      const parsed = PatchGroupsResponse.safeParse(await res.json());
-      if (!parsed.success) {
-        return {
-          status: "error",
-          message: `Could not parse patch groups response. Error: ${fromError(parsed.error)}`
-        };
-      }
-      return {
-        status: "ok",
-        patchGroups: parsed.data.patchGroups
-      };
-    } catch (err) {
-      return {
-        status: "error",
-        message: `Could not read patch groups. Error: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-  }
-
-  /**
-   * Which branch `~` means, where this build knows: the branch it reads
-   * `applicable/patches` on, so the group staged into is the group listed.
-   * Without one the content API uses the project's own, as it does for reads.
-   */
-  ownGroupBranch() {
-    const branch = this.ownBranch();
-    return branch !== undefined ? {
-      branch
-    } : {};
-  }
-  async mutatePatchGroup(method, path, body,
-  /**
-   * WHO is asking. Sent as `x-val-profile-id`, which is what the content API
-   * reads to decide whether this group is the caller's.
-   *
-   * `this.authHeaders` is the app's API key, and that names the PROJECT, not
-   * the person — so without this the content API cannot resolve a profile
-   * and refuses every stage and unstage with
-   * "Cannot resolve the caller's profile". The group endpoints are the only
-   * ones here that need it, because they are the only ones whose answer
-   * depends on which of a project's editors is calling.
-   *
-   * Omitted when there is no session rather than sent empty: the content API
-   * treats an unidentified caller as a refusal, which is what we want, and an
-   * empty header would be a different and less obvious way to say it.
-   *
-   * A PAT already identifies a person, so `authHeaders` carries the identity
-   * on its own there and this adds nothing.
-   */
-  authorId) {
-    if (this.proposal !== null) {
-      return {
-        status: 409,
-        patchIds: [],
-        error: {
-          message: "A proposal's changes are saved together, so there is nothing to stage or unstage in one."
-        }
-      };
-    }
-    try {
-      return await this.mutatePatchGroupRequest(method, path, body, authorId);
-    } finally {
-      this.forgetPatchGroups();
-    }
-  }
-  async mutatePatchGroupRequest(method, path, body, authorId) {
-    try {
-      const res = await fetch(`${this.contentUrl}/v1/${this.project}/${path}`, {
-        method,
-        headers: {
-          ...this.authHeaders,
-          ...(authorId !== null ? {
-            "x-val-profile-id": authorId
-          } : {}),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
-      if (res.ok) {
-        const parsed = PatchGroupMutationResponse.safeParse(await res.json());
-        if (parsed.success) {
+            }
+          }
           return {
-            patchIds: parsed.data.patchIds,
-            patchGroupId: parsed.data.patchGroupId,
-            ...(parsed.data.headVersion !== undefined ? {
-              headVersion: parsed.data.headVersion
+            commits,
+            deployments,
+            patches,
+            errors,
+            ...(data.headPatchId !== undefined ? {
+              headPatchId: data.headPatchId
+            } : {}),
+            ...(data.headVersion !== undefined ? {
+              headVersion: data.headVersion
+            } : {}),
+            ...(data.publishingPatches !== undefined ? {
+              publishingPatches: data.publishingPatches
+            } : {}),
+            ...(data.heldBackPatches !== undefined ? {
+              heldBackPatches: data.heldBackPatches
             } : {})
           };
         }
+        console.error("Could not parse patches response. Error: " + fromError(parsed.error));
         return {
-          status: 500,
-          patchIds: [],
-          error: {
-            message: `Could not parse patch group response. Error: ${fromError(parsed.error)}`
-          }
-        };
-      }
-      // 403 (not your group) and 409 (already published) are meaningful to the
-      // client, so they are passed through rather than flattened to a 500.
-      if (res.status === 403 || res.status === 409) {
-        // `home` answers these with a JSON body, so `res.text()` put the literal
-        // `{"message":"..."}` in front of the user. Every other branch in this
-        // class unwraps it; this one now does too.
-        return {
-          status: res.status,
-          patchIds: [],
+          patches,
           error: {
-            message: getErrorMessageFromUnknownJson(await res.json().catch(() => undefined), `Could not update patch group. HTTP error: ${res.status} ${res.statusText}`)
+            message: `The response that Val got from the server was not in the expected format. This might be a transient error or a configuration issue. Please try again later.`
           }
         };
       }
-      // A 401 here is the app's own credentials failing, not the user's, so it gets
-      // the same wording as every other call in this class rather than an opaque
-      // 500 that sends the user looking at their own session.
-      if (res.status === 401) {
+      console.error("Could not get patches. HTTP error: " + patchesRes.status + " " + patchesRes.statusText);
+      if (patchesRes.status === 401) {
         return {
-          status: 500,
-          patchIds: [],
+          patches,
           error: {
             message: "Although your user is authorized, the application has authorization issues. Contact the developers on your team and ask them to verify the api keys."
           }
         };
       }
       return {
-        status: 500,
-        patchIds: [],
+        patches,
         error: {
-          message: `Could not update patch group. HTTP error: ${res.status} ${res.statusText}`
+          message: "Could not get your changes. It is most likely due to a network issue. Check your network connection and please try again."
         }
       };
     } catch (err) {
+      console.error("Could not get patches (connection error):", err instanceof Error ? err.message : JSON.stringify(err));
       return {
-        status: 500,
-        patchIds: [],
+        patches: [],
+        networkError: true,
         error: {
-          message: `Could not update patch group (connection error?): ${err instanceof Error ? err.message : JSON.stringify(err)}`
+          message: `Error: ${err instanceof Error ? err.message : JSON.stringify(err)}`
         }
       };
     }
   }
-  // #endregion
-
-  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId, patchGroup) {
+  async saveSourceFilePatch(path, patch, patchId, parentRef, authorId, sessionId) {
     const baseSha = await this.getBaseSha();
     return fetch(`${this.contentUrl}/v1/${this.project}/patches`, {
       method: "POST",
@@ -11319,24 +11876,7 @@ class ValOpsHttp extends ValOps {
           commit: this.git.commit,
           branch: this.git.branch
         } : {}),
-        coreVersion: Internal.VERSION.core,
-        /*
-         * Group membership in the SAME request as the patch.
-         *
-         * The content API runs every refusal before its insert, so an invalid
-         * closure is a 400 with nothing written. Spread rather than sent as
-         * nulls: a client with no group omits the fields entirely, which is
-         * what an older content API expects to see.
-         */
-        ...(patchGroup ? {
-          // Only when the caller named one. Omitted, the content API
-          // resolves this author's open group and creates it if absent,
-          // which is what every write wants.
-          ...(patchGroup.patchGroupId !== undefined ? {
-            patchGroupId: patchGroup.patchGroupId
-          } : {}),
-          withPatchIds: patchGroup.withPatchIds
-        } : {})
+        coreVersion: Internal.VERSION.core
       })
     }).then(async res => {
       var _res$headers$get2;
@@ -11345,20 +11885,6 @@ class ValOpsHttp extends ValOps {
         if (parsed.success) {
           return result.ok({
             patchId: parsed.data.patchId,
-            /*
-             * Passed back to the client, which cannot learn it any other way.
-             *
-             * A write names no group — the content API resolves this author's
-             * open group and CREATES it if absent — so on a fresh branch the
-             * group comes into existence here and nowhere else. The chain
-             * annotation is only re-read when a fetch has missing ids to ask
-             * for, and a patch this client made is never missing, so without
-             * this the tab that bootstrapped the group would never learn its
-             * id and every stage would be a no-op.
-             */
-            ...(parsed.data.patchGroupId !== undefined ? {
-              patchGroupId: parsed.data.patchGroupId
-            } : {}),
             ...(parsed.data.headVersion !== undefined ? {
               headVersion: parsed.data.headVersion
             } : {})
@@ -11408,7 +11934,7 @@ class ValOpsHttp extends ValOps {
         errorType: "other",
         message: `Could save source file patch (connection error?): ${e instanceof Error ? e.message : e.toString()}`
       });
-    }).finally(() => this.forgetPatchGroups());
+    });
   }
 
   /**
@@ -11673,17 +12199,7 @@ class ValOpsHttp extends ValOps {
       }]
     };
   }
-  async deletePatches(patchIds,
-  /**
-   * Patches that are NOT deleted but must lose their group membership.
-   *
-   * Deleting a patch out of the middle of a patch set leaves every group
-   * still holding the rest with a non-prefix intersection — the patches after
-   * the hole were written against a view that had it. The content API cannot
-   * work out which those are (it has no schema), so the client sends the
-   * forward closure and it drops those memberships without deleting anything.
-   */
-  unstagePatchIds) {
+  async deletePatches(patchIds) {
     return fetch(`${this.contentUrl}/v1/${this.project}/patches`, {
       method: "DELETE",
       headers: {
@@ -11691,10 +12207,7 @@ class ValOpsHttp extends ValOps {
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
-        patchIds,
-        ...(unstagePatchIds !== undefined && unstagePatchIds.length > 0 ? {
-          unstagePatchIds
-        } : {})
+        patchIds
       })
     }).then(async res => {
       if (res.ok) {
@@ -11737,24 +12250,9 @@ class ValOpsHttp extends ValOps {
           message: `Could not delete patches (connection error?): ${e instanceof Error ? e.message : e.toString()}`
         }
       };
-    }).finally(() => this.forgetPatchGroups());
+    });
   }
-  async commit(prepared, message, committer, filesDirectory, newBranch,
-  /**
-   * The patch group this commit EMPTIES, if it empties one.
-   *
-   * The content API closes the group it is given — and closes it WITHOUT
-   * checking that the commit shipped all of it, so a caller that names a
-   * group still holding work takes those patches out of every group and
-   * leaves their author unable to publish them. The client therefore sends it
-   * only when the publish accounts for everything the group still holds.
-   *
-   * Omitting it is not neutral: the commit still empties the group (the
-   * content API drops applied ids from every group), but `published_at` is
-   * never set, so the id is reused across publishes instead of a new group
-   * per publish and the "already published" refusal can never fire.
-   */
-  patchGroupId) {
+  async commit(prepared, message, committer, filesDirectory, newBranch) {
     try {
       var _res$headers$get3;
       /*
@@ -11768,23 +12266,10 @@ class ValOpsHttp extends ValOps {
         headers: {
           ...this.authHeaders,
           /*
-           * WHO is publishing — the same `x-val-profile-id` stage and unstage
-           * send, and for the same reason: `this.authHeaders` is the app's API
-           * key, which names the PROJECT and not the person.
-           *
-           * Closing a group is an ownership decision, so the content API
-           * refuses a commit that names a `patchGroupId` it cannot attribute:
-           * without this header `profileId` is `undefined` there and every
-           * group-closing publish is 403 "Cannot resolve the caller's profile".
-           * That is the NORMAL full publish, not an edge — `publish` names the
-           * group whenever the commit empties it.
-           *
-           * Sent on every commit rather than only when a group is named. The
-           * committer is a person either way, `committer` in the body already
-           * says so, and a header that appears only on some commits is one more
-           * conditional for a reader of either repo to reconstruct. It changes
-           * nothing else: the content API reads it as an identity claim beside
-           * the app's key and derives no scope from it.
+           * WHO is publishing: `this.authHeaders` is the app's API key, which
+           * names the PROJECT and not the person. The content API reads it as
+           * an identity claim beside the app's key and derives no scope from
+           * it; `committer` in the body says the same.
            */
           "x-val-profile-id": committer,
           "Content-Type": "application/json"
@@ -11829,10 +12314,7 @@ class ValOpsHttp extends ValOps {
           baseSha: await this.getBaseSha(),
           committer,
           message,
-          newBranch,
-          ...(patchGroupId !== undefined ? {
-            patchGroupId
-          } : {})
+          newBranch
         })
       });
       if (res.ok) {
@@ -12089,6 +12571,146 @@ class ValOpsHttp extends ValOps {
   // #endregion history
 }
 
+/**
+ * Content's answer to a merge it committed, as the Studio is answered: what
+ * content says, marked updated. Content has written the merge by then, so an
+ * answer that cannot be read says so rather than failing as though nothing
+ * happened.
+ */
+function updatedAnswer(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return {
+      status: 502,
+      contentType: "application/json",
+      body: JSON.stringify({
+        message: "The proposal was updated from the site, but content's answer could not be read. Reload to see the proposal as it is now."
+      })
+    };
+  }
+  return {
+    status: 200,
+    contentType: "application/json",
+    body: JSON.stringify({
+      status: "updated",
+      ...parsed
+    })
+  };
+}
+
+/** What the Studio sends to update a proposal from the site: its decisions. */
+const UpdateContentBody = z.object({
+  /**
+   * Where the site and the proposal were when the conflicts the
+   * `resolutions` decide were found: the conflicts answer says. Absent with
+   * no decisions.
+   */
+  siteHead: z.string().nullable().optional(),
+  proposalHead: z.string().nullable().optional(),
+  resolutions: z.array(z.union([z.object({
+    moduleFilePath: z.string().transform(p => p),
+    path: z.array(z.string()),
+    keep: z.enum(["site", "proposal"])
+  }), z.object({
+    moduleFilePath: z.string().transform(p => p),
+    path: z.array(z.string()),
+    value: JSONValue
+  })])).default([])
+});
+
+/** A module, as the builder tab's evaluation of its tree gave it. */
+const EvaluatedModules = z.record(z.string().transform(p => p), z.object({
+  schema: SerializedSchema,
+  written: JSONValue,
+  errors: z.array(z.object({
+    path: z.array(z.string()),
+    message: z.string()
+  }))
+}));
+
+/** What the builder tab sends to update a proposal with code from the site. */
+const UpdateCodeBody = z.object({
+  siteHead: z.string().nullable(),
+  proposalHead: z.string().nullable(),
+  builds: z.object({
+    base: z.string(),
+    site: z.string()
+  }),
+  evaluated: z.object({
+    base: EvaluatedModules,
+    site: EvaluatedModules,
+    proposal: EvaluatedModules
+  }),
+  resolutions: z.array(z.union([z.object({
+    moduleFilePath: z.string().transform(p => p),
+    path: z.array(z.string()),
+    keep: z.enum(["site", "proposal"])
+  }), z.object({
+    moduleFilePath: z.string().transform(p => p),
+    path: z.array(z.string()),
+    value: JSONValue
+  }), z.object({
+    file: z.string(),
+    keep: z.enum(["site", "proposal"])
+  }), z.object({
+    file: z.string(),
+    text: z.string()
+  })])).default([]),
+  /** The tab's evaluation of the merge the first call answered. */
+  merged: z.object({
+    id: z.string(),
+    evaluated: EvaluatedModules
+  }).optional()
+});
+
+/** Content's `GET /proposals/:name/merge-trees`. */
+const MergeTrees = z.object({
+  base: z.string().nullable(),
+  siteHead: z.string().nullable(),
+  proposalHead: z.string().nullable(),
+  upToDate: z.boolean(),
+  builds: z.object({
+    base: z.string(),
+    site: z.string()
+  }),
+  trees: z.object({
+    site: z.record(z.string(), z.string()),
+    base: z.record(z.string(), z.string().nullable()),
+    proposal: z.record(z.string(), z.string().nullable())
+  }),
+  modules: z.record(z.string(), z.object({
+    base: z.string().nullable(),
+    site: z.string().nullable(),
+    proposal: z.string().nullable()
+  })),
+  sources: z.record(z.string(), JSONValue)
+});
+
+/** Content's `GET /proposals/:name/merge-inputs`. */
+const MergeInputs = z.object({
+  base: z.string().nullable(),
+  siteHead: z.string().nullable(),
+  proposalHead: z.string().nullable(),
+  upToDate: z.boolean(),
+  contentOnly: z.union([z.object({
+    ok: z.literal(true)
+  }), z.object({
+    ok: z.literal(false),
+    reason: z.string()
+  })]),
+  modules: z.record(z.string(), z.object({
+    base: JSONValue.nullable(),
+    site: JSONValue.nullable(),
+    proposal: JSONValue.nullable(),
+    text: z.string().nullable()
+  }))
+});
+
 /**
  * One stored patch. Everything the ordered chain needs and nothing else.
  */
@@ -12378,8 +13000,7 @@ class ValOpsMemory extends ValOps {
   }
   async fetchPatches(filters) {
     // An empty `patchIds` means "no filter", not "none": both shipped
-    // implementations read it that way and callers rely on it. See
-    // `scopedModulePatches` in ValOps.ts, which says why at length.
+    // implementations read it that way and callers rely on it.
     const requested = filters.patchIds && filters.patchIds.length > 0 ? new Set(filters.patchIds) : null;
     const order = await this.store.list();
     const patches = [];
@@ -12425,12 +13046,7 @@ class ValOpsMemory extends ValOps {
    * point at nothing. A patch computed against a different state is caught
    * where it shows -- applying it -- rather than by refusing the write.
    */
-  _parentRef, authorId, _sessionId,
-  /* No shared store and no second author yet, so nothing for a group to
-   * separate. Named rather than omitted: TypeScript allows an implementation
-   * to take fewer parameters, so dropping it would look identical to
-   * handling it. */
-  _patchGroup) {
+  _parentRef, authorId, _sessionId) {
     await this.store.append({
       patchId,
       path,
@@ -15195,195 +15811,25 @@ const ValServer = (valModules, options, callbacks) => {
         /*
          * Every URL in the batch at once, and nothing beyond it.
          *
-         * The concurrency here is the batch size the route caps at, which is
-         * what keeps "check a thousand links" from becoming a thousand
-         * simultaneous outbound sockets: the client sends ten, waits, sends
-         * the next ten. Doing them in parallel WITHIN a batch is what makes a
-         * batch worth having — ten five-second timeouts in series is a minute.
-         */
-        const results = await Promise.all(req.body.urls.map(async url => [url, await probeUrl(url)]));
-        return {
-          status: 200,
-          json: {
-            results: Object.fromEntries(results)
-          }
-        };
-      }
-    },
-    "/direct-file-upload-settings": {
-      POST: async req => {
-        const cookies = req.cookies;
-        const auth = getAuth(cookies);
-        if (auth.error) {
-          return {
-            status: 401,
-            json: {
-              message: auth.error
-            }
-          };
-        }
-        if (serverOps.patchesAreLocal) {
-          // In FS mode patch-file uploads are buffered through this server (no remote round-trip),
-          // so baseUrl points at /api/val/upload. AI image uploads, however, go straight to the
-          // content host — we resolve a contentBaseUrl + a PAT-issued nonce here so the browser
-          // can POST directly without exposing the PAT.
-          const host = `/api/val`;
-          let contentBaseUrl = null;
-          let contentAuthNonce = null;
-          if (!options.project) {
-            console.warn("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
-          } else if (!(serverOps instanceof ValOpsFS)) {
-            /*
-             * Presigning needs a content host to presign AGAINST, and a local
-             * store does not necessarily have one configured: `fs` mode has the
-             * developer's `valContentUrl`, and a host holding its own source has
-             * no such setting.
-             *
-             * Warned and disabled, like the missing-project case above, rather
-             * than failing the request: everything else this route answers --
-             * the patch upload base url -- still works, and the only thing lost
-             * is the browser posting AI images straight to the content host.
-             */
-            console.warn("Direct content-host uploads (AI images) disabled: this store has no content host to presign against.");
-          } else {
-            const authDataRes = await getRemoteFileAuth();
-            if (authDataRes.status !== 200) {
-              console.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
-            } else {
-              const corsOrigin = "*"; // TODO: add cors origin
-              const presignedAuthNonce = await serverOps.getPresignedAuthNonce(options.project, corsOrigin, authDataRes.json.remoteFileAuth);
-              if (presignedAuthNonce.status === "success") {
-                contentBaseUrl = presignedAuthNonce.data.baseUrl;
-                contentAuthNonce = presignedAuthNonce.data.nonce;
-              } else {
-                console.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
-              }
-            }
-          }
-          return {
-            status: 200,
-            json: {
-              nonce: null,
-              baseUrl: `${host}/upload`,
-              // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
-              contentBaseUrl,
-              contentAuthNonce
-            }
-          };
-        }
-        const httpOps = serverOps;
-        const profileId = "id" in auth && auth.id ? auth.id : undefined;
-        if (!profileId) {
-          return {
-            status: 401,
-            json: {
-              message: "Unauthorized"
-            }
-          };
-        }
-        const corsOrigin = "*"; // TODO: add cors origin
-        const presignedAuthNonce = await httpOps.getPresignedAuthNonce(profileId, corsOrigin);
-        if (presignedAuthNonce.status === "error") {
-          return {
-            status: presignedAuthNonce.statusCode,
-            json: presignedAuthNonce.error
-          };
-        }
-        return {
-          status: 200,
-          json: {
-            nonce: presignedAuthNonce.data.nonce,
-            baseUrl: presignedAuthNonce.data.baseUrl,
-            contentBaseUrl: presignedAuthNonce.data.baseUrl,
-            contentAuthNonce: presignedAuthNonce.data.nonce
-          }
-        };
-      }
-    },
-    //#region patch groups
-    // Staging and unstaging patches. Both take an already-closed set of patch ids:
-    // the prefix closure (staging) or the forward closure (unstaging) is computed
-    // on the client, which is the only side that has the schema needed to derive
-    // patch sets. See `docs/independent-publish/PLAN.md`.
-    //
-    // In FS mode there is no shared store and exactly one author, so group
-    // membership lives in the client and these handlers simply acknowledge. The
-    // client already sends an explicit patch id list to `/save`, so a locally-held
-    // group is enough to publish a subset correctly.
-    "/patch-groups/~/patches": {
-      PUT: async req => {
-        const auth = getAuth(req.cookies);
-        if (auth.error) {
-          return {
-            status: 401,
-            json: {
-              message: auth.error
-            }
-          };
-        }
-        const {
-          patchGroupId,
-          patchIds
-        } = req.body;
-        const withPatchIds = req.body.withPatchIds ?? [];
-        if (serverOps.patchesAreLocal) {
-          return {
-            status: 200,
-            json: {
-              patchGroupId: patchGroupId ?? null,
-              patchIds: [...patchIds, ...withPatchIds]
-            }
-          };
-        }
-        if (!("id" in auth) || !auth.id) {
-          return {
-            status: 401,
-            json: {
-              message: "Unauthorized"
-            }
-          };
-        }
-        // A named group is checked here as well as by the content API. No name
-        // is the caller's own open group, which the content API resolves from
-        // the profile it is sent — there is nothing here to check it against.
-        if (patchGroupId !== undefined) {
-          const refusal = await refuseUnlessOwn(serverOps, patchGroupId, auth.id);
-          if (refusal !== null) {
-            return {
-              status: refusal.status,
-              json: {
-                message: refusal.message
-              }
-            };
-          }
-        }
-        const res = await serverOps.stagePatches(patchGroupId, patchIds, withPatchIds,
-        // Forwarded so the content API can refuse independently. This server
-        // has already refused a group that is not the caller's; sending the
-        // author means the check also holds for anything reaching the content
-        // API without coming through here.
-        auth.id);
-        if (res.error) {
-          return {
-            status: res.status,
-            json: {
-              message: res.error.message
-            }
-          };
-        }
+         * The concurrency here is the batch size the route caps at, which is
+         * what keeps "check a thousand links" from becoming a thousand
+         * simultaneous outbound sockets: the client sends ten, waits, sends
+         * the next ten. Doing them in parallel WITHIN a batch is what makes a
+         * batch worth having — ten five-second timeouts in series is a minute.
+         */
+        const results = await Promise.all(req.body.urls.map(async url => [url, await probeUrl(url)]));
         return {
           status: 200,
           json: {
-            patchGroupId: res.patchGroupId,
-            patchIds: res.patchIds,
-            ...(res.headVersion !== undefined ? {
-              headVersion: res.headVersion
-            } : {})
+            results: Object.fromEntries(results)
           }
         };
-      },
-      DELETE: async req => {
-        const auth = getAuth(req.cookies);
+      }
+    },
+    "/direct-file-upload-settings": {
+      POST: async req => {
+        const cookies = req.cookies;
+        const auth = getAuth(cookies);
         if (auth.error) {
           return {
             status: 401,
@@ -15392,21 +15838,58 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        const {
-          patchGroupId,
-          patchIds
-        } = req.body;
-        const withPatchIds = req.body.withPatchIds ?? [];
         if (serverOps.patchesAreLocal) {
+          // In FS mode patch-file uploads are buffered through this server (no remote round-trip),
+          // so baseUrl points at /api/val/upload. AI image uploads, however, go straight to the
+          // content host — we resolve a contentBaseUrl + a PAT-issued nonce here so the browser
+          // can POST directly without exposing the PAT.
+          const host = `/api/val`;
+          let contentBaseUrl = null;
+          let contentAuthNonce = null;
+          if (!options.project) {
+            console.warn("Direct content-host uploads (AI images) disabled: no `project` set in val.config (and VAL_PROJECT env var is not set).");
+          } else if (!(serverOps instanceof ValOpsFS)) {
+            /*
+             * Presigning needs a content host to presign AGAINST, and a local
+             * store does not necessarily have one configured: `fs` mode has the
+             * developer's `valContentUrl`, and a host holding its own source has
+             * no such setting.
+             *
+             * Warned and disabled, like the missing-project case above, rather
+             * than failing the request: everything else this route answers --
+             * the patch upload base url -- still works, and the only thing lost
+             * is the browser posting AI images straight to the content host.
+             */
+            console.warn("Direct content-host uploads (AI images) disabled: this store has no content host to presign against.");
+          } else {
+            const authDataRes = await getRemoteFileAuth();
+            if (authDataRes.status !== 200) {
+              console.warn("Direct content-host uploads (AI images) disabled: " + authDataRes.json.message);
+            } else {
+              const corsOrigin = "*"; // TODO: add cors origin
+              const presignedAuthNonce = await serverOps.getPresignedAuthNonce(options.project, corsOrigin, authDataRes.json.remoteFileAuth);
+              if (presignedAuthNonce.status === "success") {
+                contentBaseUrl = presignedAuthNonce.data.baseUrl;
+                contentAuthNonce = presignedAuthNonce.data.nonce;
+              } else {
+                console.warn("Direct content-host uploads (AI images) disabled: " + presignedAuthNonce.error.message);
+              }
+            }
+          }
           return {
             status: 200,
             json: {
-              patchGroupId: patchGroupId ?? null,
-              patchIds: [...patchIds, ...withPatchIds]
+              nonce: null,
+              baseUrl: `${host}/upload`,
+              // NOTE: this is the /upload/patches endpoint - the client will add /patches/:patchId/files to this and post to it
+              contentBaseUrl,
+              contentAuthNonce
             }
           };
         }
-        if (!("id" in auth) || !auth.id) {
+        const httpOps = serverOps;
+        const profileId = "id" in auth && auth.id ? auth.id : undefined;
+        if (!profileId) {
           return {
             status: 401,
             json: {
@@ -15414,37 +15897,21 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        // A named group is checked here as well as by the content API. No name
-        // is the caller's own open group, which the content API resolves from
-        // the profile it is sent — there is nothing here to check it against.
-        if (patchGroupId !== undefined) {
-          const refusal = await refuseUnlessOwn(serverOps, patchGroupId, auth.id);
-          if (refusal !== null) {
-            return {
-              status: refusal.status,
-              json: {
-                message: refusal.message
-              }
-            };
-          }
-        }
-        const res = await serverOps.unstagePatches(patchGroupId, patchIds, withPatchIds, auth.id);
-        if (res.error) {
+        const corsOrigin = "*"; // TODO: add cors origin
+        const presignedAuthNonce = await httpOps.getPresignedAuthNonce(profileId, corsOrigin);
+        if (presignedAuthNonce.status === "error") {
           return {
-            status: res.status,
-            json: {
-              message: res.error.message
-            }
+            status: presignedAuthNonce.statusCode,
+            json: presignedAuthNonce.error
           };
         }
         return {
           status: 200,
           json: {
-            patchGroupId: res.patchGroupId,
-            patchIds: res.patchIds,
-            ...(res.headVersion !== undefined ? {
-              headVersion: res.headVersion
-            } : {})
+            nonce: presignedAuthNonce.data.nonce,
+            baseUrl: presignedAuthNonce.data.baseUrl,
+            contentBaseUrl: presignedAuthNonce.data.baseUrl,
+            contentAuthNonce: presignedAuthNonce.data.nonce
           }
         };
       }
@@ -15453,53 +15920,6 @@ const ValServer = (valModules, options, callbacks) => {
     "/patches": {
       PUT: async req => {
         const cookies = req.cookies;
-
-        /**
-         * Group membership travels WITH the patch, in one request.
-         *
-         * Atomic on purpose: the content API runs every refusal before its
-         * insert, so an invalid closure is a 400 with nothing written. Recording
-         * membership in a second call would let a patch exist outside its
-         * author's group whenever that call failed — and a patch outside your
-         * own group is one you cannot publish until a repair puts it back.
-         *
-         */
-        /*
-         * A membership is present if EITHER field is.
-         *
-         * The common case names no group: the content API resolves the author's
-         * open group, creating it if absent, so the client never has to hold an
-         * id across publishes. It still sends the closure, which is the part it
-         * alone can compute.
-         *
-         * `patchGroupId` is nullable, so an explicit `null` means "no group
-         * named" exactly as omitting it does — it is passed through as
-         * `undefined` rather than becoming a membership keyed by null.
-         */
-        const requestedPatchGroupId = req.body.patchGroupId ?? undefined;
-        const requestedWith = req.body.withPatchIds;
-        const patchGroup = requestedPatchGroupId !== undefined || requestedWith !== undefined ? {
-          ...(requestedPatchGroupId !== undefined ? {
-            patchGroupId: requestedPatchGroupId
-          } : {}),
-          withPatchIds: requestedWith ?? []
-        } : undefined;
-        if (patchGroup !== undefined && serverOps.patchesAreLocal) {
-          /*
-           * `fs` has no shared store and one author, so there is no group to
-           * join. Refused rather than acknowledged: answering 200 would tell the
-           * client its membership was recorded when it was dropped, and the
-           * client would then believe a publish is scoped when it is not.
-           */
-          return {
-            status: 400,
-            json: {
-              type: "patch-error",
-              message: "Patch groups are not available in fs mode. Omit the patch group fields.",
-              errors: {}
-            }
-          };
-        }
         const auth = getAuth(cookies);
         if (auth.error) {
           return {
@@ -15522,17 +15942,6 @@ const ValServer = (valModules, options, callbacks) => {
         const sessionId = req.body.sessionId ?? null;
         const authorId = "id" in auth ? auth.id : null;
         const newPatchIds = [];
-        /*
-         * The group the content API put these patches in.
-         *
-         * Every patch in one request has the same author and the same
-         * membership, so the last answer is the answer — they all land in the
-         * same group. Reported back because the client cannot learn it any
-         * other way: it names no group (the content API resolves the author's
-         * open one, creating it if absent), and the chain annotation is only
-         * re-read when a fetch has missing ids to ask for.
-         */
-        let patchGroupIdFromStore;
         /*
          * The chain version the LAST patch made — the head this batch leaves.
          * The client keeps the highest version it has seen, so a `/stat` read
@@ -15548,18 +15957,12 @@ const ValServer = (valModules, options, callbacks) => {
         const savedSoFar = () => ({
           newPatchIds,
           parentRef,
-          // Absent rather than null where there are no groups: `fs` mode and
-          // a content API that predates them both answer without one, and the
-          // client reads absence as "staging is not available here".
-          ...(patchGroupIdFromStore !== undefined ? {
-            patchGroupId: patchGroupIdFromStore
-          } : {}),
           ...(headVersion !== undefined ? {
             headVersion
           } : {})
         });
         for (const patch of patches) {
-          const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId, patchGroup);
+          const createPatchRes = await serverOps.createPatch(patch.path, patch.patch, patch.patchId, parentRef, sessionId, authorId);
           if (result.isErr(createPatchRes)) {
             if (createPatchRes.error.errorType === "patch-head-conflict") {
               return {
@@ -15608,9 +16011,6 @@ const ValServer = (valModules, options, callbacks) => {
               patchId: createPatchRes.value.patchId
             };
             newPatchIds.push(createPatchRes.value.patchId);
-            if (createPatchRes.value.patchGroupId !== undefined) {
-              patchGroupIdFromStore = createPatchRes.value.patchGroupId;
-            }
             headVersion = createPatchRes.value.headVersion;
           }
         }
@@ -15677,84 +16077,16 @@ const ValServer = (valModules, options, callbacks) => {
         }
         // TODO: we should sort by parentRef instead:
         patches.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-        /**
-         * Patch groups, ANNOTATED onto the chain rather than filtering it.
-         *
-         * The client computes a new patch's parent as the last id in this
-         * response, so a filtered chain would make every client name a parent
-         * that is not the real head and `POST /patches` would answer 409
-         * forever. Annotate, never filter.
-         *
-         * Absent — not empty — where there are no groups: `fs` mode, a content
-         * API that predates them, or a failed lookup. The client reads absence
-         * as "this deployment has no groups" and leaves staging off, which is
-         * the behaviour every project has today. An empty array would say
-         * "groups exist and hold nothing", which would turn the staging UI on
-         * with everything held.
-         */
-        let patchGroups;
-        if (query.include_patch_groups === true && serverOps instanceof ValOpsHttp) {
-          /*
-           * FRESH, because this answer makes a CLOSING decision.
-           *
-           * The client adopts this annotation as its group membership and
-           * `emptiesOwnPatchGroup` then decides from it whether a publish may
-           * name the group — and the content API closes what it is named
-           * without checking. A one-second-old list is enough to get that
-           * wrong: the same author writing in a second tab joins the open
-           * group, the websocket pushes the chain immediately, so this tab's
-           * fetch for the missing patch lands well inside the cache window and
-           * reads a membership that is one patch short. It then publishes,
-           * names the group, and closes it with the other tab's work still in
-           * it — which leaves that tab wedged on 409 until a reload.
-           *
-           * `resolveOwnPatchScope` keeps the cache deliberately: that read
-           * decides what a draft render SHOWS, it is repeated once per
-           * `fetchVal` in a single render, and being a second stale there costs
-           * a patch appearing late rather than a group closing early.
-           */
-          const groupsRes = await serverOps.getPatchGroups({
-            fresh: true
-          });
-          if (groupsRes.status === "ok" && groupsRes.patchGroups.length > 0) {
-            patchGroups = groupsRes.patchGroups;
-          } else if (groupsRes.status === "error") {
-            // Not fatal: the chain is what this endpoint is for, and staging
-            // simply stays off for this read rather than the whole review
-            // screen failing to load.
-            console.error("Val: could not read patch groups", groupsRes.message);
-          }
-        }
-        const groupIdsByPatchId = new Map();
-        for (const group of patchGroups ?? []) {
-          for (const patchId of group.patchIds) {
-            const existing = groupIdsByPatchId.get(patchId);
-            if (existing) {
-              existing.push(group.patchGroupId);
-            } else {
-              groupIdsByPatchId.set(patchId, [group.patchGroupId]);
-            }
-          }
-        }
         return {
           status: 200,
           json: {
-            patches: patches.map(patch => {
-              const patchGroupIds = groupIdsByPatchId.get(patch.patchId);
-              return patchGroupIds ? {
-                ...patch,
-                patchGroupIds
-              } : patch;
-            }),
-            ...(patchGroups ? {
-              patchGroups
-            } : {}),
+            patches,
             baseSha: await serverOps.getBaseSha()
           }
         };
       },
       DELETE: async req => {
-        var _req$body, _req$body2;
+        var _req$body;
         const query = req.query;
         const cookies = req.cookies;
         const auth = getAuth(cookies);
@@ -15775,25 +16107,7 @@ const ValServer = (valModules, options, callbacks) => {
           };
         }
         const ids = query.id;
-        /*
-         * Which OTHER patches lose their group membership because these are
-         * going. Only the client can COMPUTE it — that needs the patch sets,
-         * which need the schema — but it is bounded here rather than trusted,
-         * because the content API strips those memberships from every group
-         * without an ownership check. See `boundUnstageClosure`.
-         *
-         * Only in `http` mode: `ValOpsFS` has no groups and ignores it, and the
-         * client does not send it there.
-         */
-        let unstagePatchIds;
-        const requestedUnstage = (_req$body = req.body) === null || _req$body === void 0 ? void 0 : _req$body.unstagePatchIds;
-        if (serverOps instanceof ValOpsHttp && requestedUnstage !== undefined && requestedUnstage.length > 0) {
-          const chain = await serverOps.fetchPatches({
-            excludePatchOps: true
-          });
-          unstagePatchIds = boundUnstageClosure(chain.patches, ids, requestedUnstage);
-        }
-        const deleteRes = await serverOps.deletePatches(ids, unstagePatchIds);
+        const deleteRes = await serverOps.deletePatches(ids);
         if (deleteRes.errors && Object.keys(deleteRes.errors).length > 0) {
           console.error("Val: Failed to delete patches", deleteRes.errors);
           return {
@@ -15814,7 +16128,7 @@ const ValServer = (valModules, options, callbacks) => {
             }
           };
         }
-        if (((_req$body2 = req.body) === null || _req$body2 === void 0 ? void 0 : _req$body2.reportHeadVersion) === true) {
+        if (((_req$body = req.body) === null || _req$body === void 0 ? void 0 : _req$body.reportHeadVersion) === true) {
           return {
             status: 200,
             json: {
@@ -15925,22 +16239,6 @@ const ValServer = (valModules, options, callbacks) => {
         } = req.query;
         // Defaults to true, mirroring /sources/~. The Studio opts out.
         const applyPatches = req.query.apply_patches !== false;
-        /*
-         * Whose pending work this render may see.
-         *
-         * The same resolution `/sources/~` runs, through the same function: a
-         * draft page renders module content and `jsonValues` entries together,
-         * and this route used to apply every pending patch on the branch while
-         * the modules beside it were scoped — so one screen showed the caller's
-         * view and everybody's unpublished work at once.
-         */
-        const {
-          ownPatchIds
-        } = await resolveOwnPatchScope(serverOps, {
-          explicitPatchIds: undefined,
-          ownGroupsOnly: req.query.own_patch_groups_only === true,
-          authorId: "id" in auth && auth.id || undefined
-        });
         const isWindow = offset !== undefined || limit !== undefined;
         const shapes = [key !== undefined, keys !== undefined, isWindow].filter(Boolean).length;
         if (shapes !== 1) {
@@ -15961,8 +16259,7 @@ const ValServer = (valModules, options, callbacks) => {
         }
         if (key !== undefined) {
           const res = await serverOps.getJsonEntry(moduleFilePath, key, {
-            applyPatches,
-            patchIds: ownPatchIds
+            applyPatches
           });
           if (res.status === "unauthorized") {
             return {
@@ -16003,8 +16300,7 @@ const ValServer = (valModules, options, callbacks) => {
           offset: offset,
           limit: limit
         }, {
-          applyPatches,
-          patchIds: ownPatchIds
+          applyPatches
         });
         if (res.status === "unauthorized") {
           return {
@@ -16089,101 +16385,10 @@ const ValServer = (valModules, options, callbacks) => {
           patches: []
         };
         if (query.exclude_patches !== true) {
-          /**
-           * The caller's own groups, resolved from their session.
-           *
-           * A draft render cannot name its own group ids — it has no client
-           * state — so it asks for "mine" and the server works out which. Only
-           * when `patch_id` is absent: an explicit list is a caller that already
-           * knows what it wants.
-           *
-           * A group lookup that FAILS renders base rather than everything. Being
-           * shown only committed content while the content API is unreachable is
-           * a degraded preview; being shown another author's unpublished draft
-           * because a lookup failed is the bug this feature exists to prevent,
-           * and it would be silent.
-           */
-          const {
-            ownPatchIds,
-            scopeAlsoIncludesApplied
-          } = await resolveOwnPatchScope(serverOps, {
-            explicitPatchIds: query.patch_id,
-            ownGroupsOnly: query.own_patch_groups_only === true,
-            authorId: "id" in auth && auth.id || undefined
+          patchOps = await serverOps.fetchPatches({
+            patchIds: undefined,
+            excludePatchOps: false
           });
-          const requestedPatchIds = query.patch_id ?? ownPatchIds;
-          if (scopeAlsoIncludesApplied) {
-            /*
-             * Scoped to this caller's groups, PLUS everything already
-             * committed.
-             *
-             * Filtered here rather than through `patchIds`, because the set is
-             * not knowable before the fetch: `appliedAt` lives on the patch,
-             * not on the group. One request either way — the whole chain is
-             * what the unscoped path fetches too — so this costs a filter, not
-             * a round trip.
-             *
-             * This also subsumes the empty-group case below: a caller holding
-             * nothing, on a branch with nothing applied, filters down to no
-             * patches, which is base.
-             */
-            const all = await serverOps.fetchPatches({
-              patchIds: undefined,
-              excludePatchOps: false
-            });
-            /*
-             * Membership from THIS response when it carries one, not from the
-             * group list `resolveOwnPatchScope` read.
-             *
-             * That list is a separate request, remembered for a second
-             * (`ValOpsHttp.getPatchGroups`), so it can be older than the chain
-             * fetched here: an editor who saved and reloaded at once was
-             * rendered without the patch they had just written, because the
-             * list still had their group without it. The content service reads
-             * the chain and each patch's groups in one transaction, and
-             * `fetchPatches` folds that onto `patchGroups` -- so the patches
-             * and who owns them come from the same moment.
-             */
-            const own = ownPatchScopeFor(all, "id" in auth && auth.id || undefined, ownPatchIds);
-            patchOps = {
-              ...all,
-              patches: scopedPatches(all.patches, own)
-            };
-          } else if (requestedPatchIds !== undefined && requestedPatchIds.length === 0) {
-            /*
-             * A group that holds nothing renders base, and is handled HERE.
-             *
-             * `fetchPatches` cannot express it: both implementations read an
-             * empty `patchIds` as "no filter" and return the whole chain
-             * (`ValOpsFS`: `patchIds.length > 0 ? new Set(...) : null`;
-             * `ValOpsHttp`: an explicit `length === 0` branch that fetches all).
-             * That is the right default for every caller that has ever passed a
-             * list, since none of them can mean "none" — but it is the most
-             * dangerous possible reading of an EXPLICITLY empty group, which
-             * would render every unpublished patch on the branch instead of
-             * base.
-             *
-             * Answered before the call rather than by changing that shared
-             * default, which seven other call sites rely on.
-             */
-            patchOps = {
-              patches: []
-            };
-          } else {
-            patchOps = await serverOps.fetchPatches({
-              /*
-               * The caller's patch group, when it named one.
-               *
-               * `undefined` means every pending patch, which is what every
-               * existing caller gets and has to keep getting. A draft-mode
-               * render that names its group gets base + that group instead, so
-               * a server-rendered preview shows the same thing the person
-               * editing is looking at rather than everybody's unpublished work.
-               */
-              patchIds: requestedPatchIds,
-              excludePatchOps: false
-            });
-          }
         }
         // We check authorization here, because it is the first call to the backend
         if (patchOps.error && patchOps.unauthorized) {
@@ -16893,44 +17098,6 @@ const ValServer = (valModules, options, callbacks) => {
           };
         } else if (serverOps instanceof ValOpsHttp) {
           if (auth.error === undefined && auth.id) {
-            /*
-             * The group this commit CLOSES has to be the caller's.
-             *
-             * Stage and unstage go through `refuseUnlessOwn`; this route did
-             * not, and the content API's `postCommit` marks the group published
-             * on id alone with no author clause — so the id was trusted twice
-             * and checked nowhere. Any logged-in editor could name a colleague's
-             * open group and close it: their pending patches land in a closed
-             * group and in no open one, so a scoped draft render shows base for
-             * them, and their own tab still believes the group is open, so their
-             * next stage is refused with 409.
-             *
-             * Same hole as the stage/unstage one this branch already closed, one
-             * route over. The content API needs the same guard — this one is the
-             * convenience, that one is what actually holds.
-             */
-            if (body.patchGroupId !== undefined && body.patchGroupId !== null) {
-              const refusal = await refuseUnlessOwn(serverOps, body.patchGroupId, auth.id);
-              if (refusal !== null) {
-                return {
-                  status: refusal.status,
-                  json: {
-                    message: refusal.message,
-                    /*
-                     * Flagged, because a bare 409 here reads as git refusing
-                     * the commit — which is retryable, and this is the
-                     * opposite. `refuseUnlessOwn` answers 409 for one reason
-                     * only: the group has already been published, so its id
-                     * will never be writable again and retrying reproduces
-                     * this forever. The client forgets the id instead.
-                     */
-                    ...(refusal.status === 409 ? {
-                      patchGroupPublished: true
-                    } : {})
-                  }
-                };
-              }
-            }
             const message = body.message || "Val CMS update (" + Object.keys(analysis.patchesByModule).length + " files changed)";
             /*
              * Before the commit, because after it the files are no longer the
@@ -16938,14 +17105,7 @@ const ValServer = (valModules, options, callbacks) => {
              */
             const managedBranch = serverOps.sourceMode() === "managed" ? serverOps.projectBranch() : null;
             const committedBinaries = serverOps.sourceMode() === "managed" ? await readCommittedBinaryFiles(serverOps, preparedCommit.patchedBinaryFilesDescriptors) : null;
-            const commitToGit = () => serverOps.commit(preparedCommit, message, auth.id, FILES_DIRECTORY, undefined,
-            /*
-             * Forwarded verbatim, and only the client can decide it: the
-             * content API closes the group it is named without checking
-             * that the commit shipped all of it, and whether it did needs
-             * the patch sets, which live in the browser.
-             */
-            body.patchGroupId);
+            const commitToGit = () => serverOps.commit(preparedCommit, message, auth.id, FILES_DIRECTORY, undefined);
             /*
              * A host may publish somewhere other than the repository.
              *
@@ -16958,7 +17118,6 @@ const ValServer = (valModules, options, callbacks) => {
               preparedCommit,
               message,
               authorId: auth.id,
-              patchGroupId: body.patchGroupId,
               commitToGit
             }) : await commitToGit();
             if (commitRes.error) {
@@ -18011,268 +18170,6 @@ const ValServer = (valModules, options, callbacks) => {
     }
   };
 };
-/**
- * Refuse to touch a group that is not the caller's.
- *
- * Exported for `patchGroupOwnership.test.ts`: this is the whole of the
- * authorization for stage and unstage, and nothing else in the process checks
- * it, so it is worth testing as a policy rather than only through a route.
- *
- * `getAuth` only proves a session EXISTS; it says nothing about whose
- * group this is. And the content API cannot decide either — every call
- * from here carries the app's API key, not the editor's identity — so if
- * this does not check, nothing does.
- *
- * `GET /patches?include_patch_groups=true` hands every editor the id and
- * author of every open group on the branch, so without this any logged-in
- * editor can unstage another author's patches (their next publish
- * silently ships less) or stage into their group (it silently ships
- * more). The 403 declared for this route in `ApiRoutes.ts` was
- * unreachable.
- *
- * Fails CLOSED: if the groups cannot be read, the mutation is refused
- * rather than allowed unverified.
- */
-
-/**
- * The patches a scoped draft render should apply: the caller's own group, plus
- * everything already committed.
- *
- * Scoping is about PENDING work. A published patch stays in the chain with
- * `appliedAt` set until the next deployment moves the base, and it is part of
- * everyone's view in that window — the unscoped path applies it. Dropping it
- * meant the moment somebody published, their own draft preview reverted the
- * field they had just shipped, and nobody else saw it either until the deploy
- * landed; anything written on top in that window is authored against content
- * already stale on `main`.
- *
- * Keyed on `appliedAt` rather than on the group's `publishedAt`, because a
- * PARTIAL publish leaves the group open with only some of its patches applied.
- * Those are committed too, and no flag on the group names them.
- *
- * `undefined` scope is unscoped and never reaches here; an EMPTY scope is a
- * caller holding nothing, and on a branch with nothing applied it correctly
- * filters down to no patches, which renders base.
- */
-function scopedPatches(patches, ownPatchIds) {
-  const own = new Set(ownPatchIds ?? []);
-  return patches.filter(patch => own.has(patch.patchId) || patch.appliedAt !== null);
-}
-
-/**
- * Which of the client's `unstagePatchIds` this server is willing to forward.
- *
- * The forward closure of a discard is the client's to compute — it needs the
- * patch sets, which need the schema — and it was being forwarded verbatim. But
- * the content API removes those memberships from EVERY group with no ownership
- * check, so any logged-in editor could strip arbitrary patches out of any other
- * author's group by attaching them to a delete of one of their own throwaway
- * patches. That is the outcome the 403 on `/patch-groups` exists to prevent,
- * reached by a different door: their next publish silently ships less.
- *
- * Neither server can compute the true closure, but this one can BOUND it. A
- * patch can only be invalidated by a delete if it was written after that delete
- * — its paths were chosen against a view that had it — and if it is in the same
- * module, since a patch set never spans two. Anything outside those bounds was
- * not in the closure whatever the client says, so it is dropped rather than
- * refused: the delete is still correct, and refusing the whole request over an
- * over-broad extra would turn a discard into an error the user cannot act on.
- *
- * Exported for the test. Pure, and given the chain rather than fetching it, so
- * the ordering it depends on is visible in the test rather than mocked.
- */
-function boundUnstageClosure(/** The pending chain, in chain order, as `fetchPatches` returns it. */
-chain, deleted, requested) {
-  if (requested.length === 0) {
-    return [];
-  }
-  const positionOf = new Map();
-  const moduleOf = new Map();
-  chain.forEach((entry, index) => {
-    positionOf.set(entry.patchId, index);
-    moduleOf.set(entry.patchId, entry.path);
-  });
-  const doomed = new Set(deleted);
-  return requested.filter(patchId => {
-    // A patch being deleted anyway does not need its membership stripped
-    // separately, and naming one is how an over-broad list hides.
-    if (doomed.has(patchId)) return false;
-    const position = positionOf.get(patchId);
-    const moduleFilePath = moduleOf.get(patchId);
-    if (position === undefined || moduleFilePath === undefined) return false;
-    return deleted.some(deletedId => {
-      const deletedPosition = positionOf.get(deletedId);
-      if (deletedPosition === undefined) return false;
-      return position > deletedPosition && moduleOf.get(deletedId) === moduleFilePath;
-    });
-  });
-}
-
-/**
- * Which pending patches this caller may see, when they asked for "only mine".
- *
- * Shared by `/sources/~` and `/json`, and it has to be: a draft page renders
- * both, so two answers to "whose work is this" put one person's half-finished
- * edit on another person's preview through whichever route was not scoped. That
- * is exactly what happened — `/json` applied every pending patch on the branch
- * while the module content beside it was scoped.
- *
- * `undefined` means "apply everything", which is what every caller that does
- * not ask for scoping gets and must keep getting.
- */
-/** The patches in this author's OPEN groups: what a scoped draft shows. */
-function ownPatchIdsIn(patchGroups, authorId) {
-  return patchGroups.filter(group => group.publishedAt === null && group.authorId === authorId).flatMap(group => group.patchIds);
-}
-
-/**
- * Whose pending patches a scoped draft shows, taken from the SAME response as
- * the patches when it says, and from the list read beforehand only when not.
- *
- * See the call in `/sources/~`: the list read beforehand can be older than the
- * chain, and the response's membership cannot be.
- */
-function ownPatchScopeFor(fetched, authorId, remembered) {
-  if (fetched.patchGroups === undefined || authorId === undefined) {
-    return remembered;
-  }
-  return ownPatchIdsIn(fetched.patchGroups, authorId);
-}
-async function resolveOwnPatchScope(
-/*
- * `ValOps`, not the two concrete stores: the one thing this needs is whether
- * a content service holds the groups, and it asks that below with an
- * `instanceof ValOpsHttp`. Naming the implementations here meant every new
- * store had to be added to a list to be allowed to call a function that does
- * not use it.
- */
-serverOps, opts) {
-  let ownPatchIds;
-  /** See where this is set: committed work is nobody's to hold back. */
-  let scopeAlsoIncludesApplied = false;
-  if (opts.explicitPatchIds === undefined && opts.ownGroupsOnly) {
-    if (serverOps instanceof ValOpsHttp && opts.authorId) {
-      const groupsRes = await serverOps.getPatchGroups();
-      if (groupsRes.status === "unsupported") {
-        /*
-         * A content API that PREDATES patch groups — the endpoint 404s.
-         *
-         * Unscoped, which is what those deployments do today and must
-         * keep doing. Reading this as a failure and rendering base
-         * would silently drop every pending patch from every draft
-         * preview on every existing http project — the exact opposite
-         * of "keeps working unchanged", and invisible to the reader.
-         */
-        ownPatchIds = undefined;
-      } else if (groupsRes.status === "error") {
-        /*
-         * We could not ask, and this deployment DOES have the endpoint.
-         * Render base rather than everything: a degraded preview is
-         * recoverable, showing another author's unpublished draft is
-         * not, and it would be silent.
-         */
-        ownPatchIds = [];
-      } else if (groupsRes.patchGroups.length === 0) {
-        /*
-         * The branch has no groups AT ALL, so this deployment is not
-         * using them — a content API that predates patch groups, or a
-         * project where nobody has staged anything since they existed.
-         *
-         * Unscoped, which is the behaviour every such project has
-         * today. Collapsing this into "your group is empty" would make
-         * every draft render base and silently drop all pending
-         * content, which is what happened before this branch: nothing
-         * writes a group yet, so EVERY project is in this state right
-         * now.
-         */
-        ownPatchIds = undefined;
-      } else {
-        /*
-         * Groups exist and none are this person's: they have staged
-         * nothing, and base is the honest answer. Distinct from the
-         * case above, which is why the two are not one expression.
-         */
-        ownPatchIds = ownPatchIdsIn(groupsRes.patchGroups, opts.authorId);
-        /*
-         * Scoping applies to PENDING work only. Anything already
-         * committed is part of everyone's view.
-         *
-         * A published patch stays in the chain with `appliedAt` set
-         * until the next deployment moves the base, and the unscoped
-         * path applies it. Filtering to open groups dropped it — so the
-         * moment someone published, their own draft preview reverted
-         * the field they had just shipped, and nobody else saw it
-         * either until the deploy landed. Anything written on top in
-         * that window is authored against content that is already
-         * stale on `main`.
-         *
-         * Unioned by `appliedAt` rather than by pulling in groups with
-         * a `publishedAt`, because a partial publish leaves the group
-         * OPEN with some of its patches applied — those are committed
-         * too, and no group flag names them.
-         */
-        scopeAlsoIncludesApplied = true;
-      }
-    } else {
-      /*
-       * fs mode, or a server with no groups: there is nothing to scope
-       * BY, and every pending patch is this one person's anyway. Left
-       * `undefined` so the existing "apply everything" path runs.
-       */
-      ownPatchIds = undefined;
-    }
-  }
-  return {
-    ownPatchIds,
-    scopeAlsoIncludesApplied
-  };
-}
-async function refuseUnlessOwn(ops, patchGroupId, authorId) {
-  /*
-   * Never from the cache. This answers "is this group yours", and a group is at
-   * its youngest exactly when the question is asked — the first write creates
-   * it and the shell flushes its queued stages the moment the save response
-   * names it. A cached list fetched a few hundred milliseconds earlier does not
-   * contain it, and every one of those stages was refused and dropped.
-   */
-  const groupsRes = await ops.getPatchGroups({
-    fresh: true
-  });
-  if (groupsRes.status !== "ok") {
-    return {
-      status: 500,
-      message: "Could not verify that this patch group is yours, so it was not changed."
-    };
-  }
-  const group = groupsRes.patchGroups.find(candidate => candidate.patchGroupId === patchGroupId);
-  if (group === undefined || group.authorId === null || group.authorId !== authorId) {
-    /*
-     * "Not found" and "not yours" are the SAME refusal on purpose: the route
-     * schema has no 404, and `GET /patches` already lists every group on the
-     * branch, so distinguishing them hides nothing and only adds a second
-     * message to keep consistent.
-     *
-     * A null author is a group written by an api key or a PAT. Nobody owns it,
-     * so nobody may stage into it — `null === null` must not read as a match.
-     */
-    return {
-      status: 403,
-      message: "You can only change your own patch group"
-    };
-  }
-  if (group.publishedAt !== null) {
-    /*
-     * Already shipped, so it can never be written again. The content API
-     * answers this too; refusing here saves the round trip and keeps the
-     * wording the same as every other refusal on this route.
-     */
-    return {
-      status: 409,
-      message: "Patch group is already published"
-    };
-  }
-  return null;
-}
 function verifyCallbackReq(stateCookie, queryParams) {
   if (typeof stateCookie !== "string") {
     return {