@valbuild/server 0.145.1 → 0.146.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @valbuild/server
 
+## 0.146.1
+
+### Patch Changes
+
+- Updated dependencies [[`2db91a5`](https://github.com/valbuild/val/commit/2db91a5d2a280727eb2b1064e853a03be283289f)]:
+  - @valbuild/ui@0.146.1
+
+## 0.146.0
+
+### Minor Changes
+
+- [#861](https://github.com/valbuild/val/pull/861) [`89b0fa8`](https://github.com/valbuild/val/commit/89b0fa82a3ae0d8ccd5d0282c1034f1f40cc4e26) Thanks [@freekh](https://github.com/freekh)! - Proposals can be brought up to date with the site, like a pull request.
+
+  - **Update from the site** merges what was published on the site since a proposal started into the proposal, field by field. Where the site and the proposal changed the same field, the Publish dialog shows both and asks which to keep.
+  - **With code:** a proposal that changes code, or a site whose code changed since the proposal started, is updated too. The Studio runs each version's schemas in the tab, and the merged code is built before it can be published.
+  - Publish offers **Update from the site** whenever the site has moved under the proposal.
+
+- [#864](https://github.com/valbuild/val/pull/864) [`f0c7d27`](https://github.com/valbuild/val/commit/f0c7d27846c21f81ff6ce79c579185150bc0d063) Thanks [@freekh](https://github.com/freekh)! - Patch groups are removed. **Publish** now publishes every pending change, and
+  the Review list shows everyone's pending changes in one list. To keep changes
+  out of a publish, move them to a proposal.
+
+  Draft reads no longer send `own_patch_groups_only`, `patch_id` or
+  `include_patch_groups`, and the server no longer has the patch-group routes or
+  fields. A content host that still sends them is fine: they are ignored.
+
+### Patch Changes
+
+- Updated dependencies [[`89b0fa8`](https://github.com/valbuild/val/commit/89b0fa82a3ae0d8ccd5d0282c1034f1f40cc4e26), [`f0c7d27`](https://github.com/valbuild/val/commit/f0c7d27846c21f81ff6ce79c579185150bc0d063)]:
+  - @valbuild/ui@0.146.0
+  - @valbuild/shared@0.146.0
+
 ## 0.145.1
 
 ### Patch Changes

package/dist/declarations/src/ValOps.d.ts

@@ -2,7 +2,7 @@ import { MediaSource, FileMetadata, FileSource, ImageMetadata, ModuleFilePath, P
 import { result } from "@valbuild/core/fp";
 import { JSONValue, ParentRef, Patch, PatchError } from "@valbuild/core/patch";
 import type { HistoryError } from "./history/HistoryError.js";
-import type { PatchGroupT, PlanRefusalErrorT } from "@valbuild/shared/internal";
+import type { PlanRefusalErrorT } from "@valbuild/shared/internal";
 import type { AffectedFile, StoredModuleVersion, CommitPage, CommitPatch, HistoricalCommit } from "./history/types.js";
 import { ValSyntaxError, ValSyntaxErrorTree } from "./patch/ts/syntax.js";
 import { ParentPatchId } from "@valbuild/core";
@@ -280,7 +280,6 @@ export declare abstract class ValOps {
     /** Passed straight through — see {@link getJsonEntries}. */
     opts?: {
         applyPatches?: boolean;
-        patchIds?: PatchId[];
     }): Promise<{
         status: "success";
         content: JSONValue | null;
@@ -319,15 +318,6 @@ export declare abstract class ValOps {
         limit: number;
     }, opts?: {
         applyPatches?: boolean;
-        /**
-         * Only these pending patches, or every one when `undefined`.
-         *
-         * A draft render is scoped to the caller's own groups, and a page renders
-         * `jsonValues` entries beside module content — so without this the two
-         * halves of one page disagreed about whose unpublished work they showed.
-         * `undefined` is what every other caller passes and must keep getting.
-         */
-        patchIds?: PatchId[];
     }): Promise<{
         status: "success";
         entries: {
@@ -430,25 +420,10 @@ export declare abstract class ValOps {
     readProjectFile(path: string): Promise<WithGenericError<{
         data: string;
     }>>;
-    createPatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, parentRef: ParentRef, sessionId: string | null, authorId: AuthorId | null, 
-    /**
-     * Which patch group this patch joins, recorded in the SAME request.
-     *
-     * Atomic on purpose. The content API runs every refusal before its insert,
-     * so an invalid closure is a 400 with nothing written. Recording membership
-     * in a second call would let a patch exist outside its author's group if
-     * that call failed — and a patch outside your own group is one you cannot
-     * publish until a repair puts it back.
-     *
-     * Optional: `fs` mode has no groups, and a client that predates them sends
-     * nothing.
-     */
-    patchGroup?: PatchGroupMembership): Promise<result.Result<{
+    createPatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, parentRef: ParentRef, sessionId: string | null, authorId: AuthorId | null): Promise<result.Result<{
         error?: undefined;
         patchId: PatchId;
         createdAt: string;
-        /** See {@link SaveSourceFilePatchResult} — absent where there are no groups. */
-        patchGroupId?: string;
         /** See {@link SaveSourceFilePatchResult}. */
         headVersion?: number;
     }, {
@@ -589,8 +564,8 @@ export declare abstract class ValOps {
      * Almost everything the routes branch on comes from this one fact, which is
      * why it is a named property rather than an `instanceof`. If this server owns
      * the store then there is no content service to authenticate to (so an absent
-     * or unverifiable session is anonymous rather than a 401), no shared store for
-     * a patch group to separate authors in, no deployments to report, and a
+     * or unverifiable session is anonymous rather than a 401), no deployments to
+     * report, and a
      * "publish" writes what the host does with it rather than pushing a commit. If
      * it does not, every one of those is the content service's and this server is
      * relaying.
@@ -628,7 +603,7 @@ export declare abstract class ValOps {
         patchIds?: PatchId[];
         excludePatchOps: ExcludePatchOps;
     }): Promise<ExcludePatchOps extends true ? OrderedPatchesMetadata : OrderedPatches>;
-    protected abstract saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, parentRef: ParentRef | null, authorId: AuthorId | null, sessionId: string | null, patchGroup?: PatchGroupMembership): Promise<SaveSourceFilePatchResult>;
+    protected abstract saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, parentRef: ParentRef | null, authorId: AuthorId | null, sessionId: string | null): Promise<SaveSourceFilePatchResult>;
     protected abstract getSourceFile(path: string): Promise<WithGenericError<{
         data: string;
     }>>;
@@ -748,37 +723,8 @@ export type GenericErrorMessage = {
     message: string;
     details?: unknown;
 };
-/**
- * The patch group a newly created patch joins.
- *
- * `withPatchIds` is the CLOSURE the client computed — the patches that share
- * a patch set with this one and must move with it. It is not derived here and
- * must not be: the closure needs the content schema, and the service that
- * stores groups does not have it. One implementation of that rule, on the side
- * that can actually compute it.
- *
- * Membership rows are stamped with `coreVersion` on the content side, the same
- * stamp the patch row itself carries, so which client wrote a row stays legible
- * after the fact.
- */
-export type PatchGroupMembership = {
-    /**
-     * Absent means "the author's open group, created if absent" — the content API
-     * resolves it. The client does not hold an id across publishes, because a
-     * published group is refused and the stale id would lose the write.
-     */
-    patchGroupId?: string;
-    withPatchIds: PatchId[];
-};
 export type SaveSourceFilePatchResult = result.Result<{
     patchId: PatchId;
-    /**
-     * The group the patch ended up in, where the store has groups at all.
-     *
-     * Absent in `fs` mode and against a content API that predates groups. The
-     * client uses it to learn the id of the group its own first write created.
-     */
-    patchGroupId?: string;
     /**
      * The chain version this write made — see
      * {@link OrderedPatches.headVersion}. Absent in `fs` mode and against a
@@ -928,37 +874,20 @@ export type PatchReadError = {
     message: string;
 };
 /**
- * The patches a json entry render should apply, out of the whole chain.
- *
- * Three rules, and the second is the one that was missing. A draft page renders
- * `jsonValues` entries beside module content, and only the modules were scoped
- * — so one screen showed the caller's own view for its modules and base plus
- * EVERY pending patch on the branch for the entries beside them, including
- * another author's half-finished edit rendered as though it were live.
+ * The patches a json entry render should apply, out of the whole chain:
  *
  * 1. this module's, since the chain is branch-wide;
- * 2. this caller's, when they asked to be scoped. `undefined` is "everything",
- *    which is what every unscoped caller gets and must keep getting;
- * 3. a patch published after this build is kept whatever the scope: it is
- *    nobody's to hold back, and this build does not have it. One already in
- *    the build is dropped. `draftOverlay` decides which is which, from
- *    `commits`.
- *
- * Filtered here rather than by asking `fetchPatches` for a list, and that is
- * load-bearing: both implementations read an empty `patchIds` as "no filter"
- * and return the whole chain. That is the right default for a caller that
- * cannot mean "none", and the most dangerous possible reading of a group that
- * is genuinely empty — it would render every unpublished patch on the branch
- * instead of base. It costs no round trip either: the whole chain is what the
- * unscoped path fetches anyway.
+ * 2. a patch published after this build is kept: this build does not have it.
+ *    One already in the build is dropped. `draftOverlay` decides which is
+ *    which, from `commits`.
  */
-export declare function scopedModulePatches<T extends {
+export declare function draftModulePatches<T extends {
     path: ModuleFilePath;
     patchId: PatchId;
     appliedAt: {
         commitSha: CommitSha;
     } | null;
-}>(patches: T[], moduleFilePath: ModuleFilePath, patchIds: PatchId[] | undefined, 
+}>(patches: T[], moduleFilePath: ModuleFilePath, 
 /** The commits content says came after this build: see `draftOverlay`. */
 commits?: Pick<ValCommit, "commitSha">[]): T[];
 /**
@@ -1027,14 +956,6 @@ export type OrderedPatches = {
      * reasons.
      */
     headVersion?: number;
-    /**
-     * Every group on the branch and which of these patches each holds, read in
-     * the same transaction as the list and {@link headVersion}.
-     *
-     * Absent where the content service has no groups, or predates sending them
-     * here. Only `ValOpsHttp` fills it.
-     */
-    patchGroups?: PatchGroupT[];
     /**
      * Of these patches, the ones a publish job that is still running holds. A
      * Studio does not offer Publish over them, on any tab or device. Reported
@@ -1065,8 +986,6 @@ export type OrderedPatchesMetadata = {
     headPatchId?: OrderedPatches["headPatchId"];
     /** See {@link OrderedPatches.headVersion}. */
     headVersion?: OrderedPatches["headVersion"];
-    /** See {@link OrderedPatches.patchGroups}. */
-    patchGroups?: OrderedPatches["patchGroups"];
     /** See {@link OrderedPatches.publishingPatches}. */
     publishingPatches?: OrderedPatches["publishingPatches"];
     /** See {@link OrderedPatches.heldBackPatches}. */

package/dist/declarations/src/ValOpsFS.d.ts

@@ -1,5 +1,5 @@
 import { PatchId, ModuleFilePath, ValModules } from "@valbuild/core";
-import { AuthorId, BaseSha, BinaryFileType, BinaryFileReader, GenericErrorMessage, MetadataOfType, OpsMetadata, PreparedCommit, ValOps, ValOpsOptions, WithGenericError, SaveSourceFilePatchResult, type PatchGroupMembership, SchemaSha, CommitSha, OrderedPatches, OrderedPatchesMetadata, SourcesSha } from "./ValOps.js";
+import { AuthorId, BaseSha, BinaryFileType, BinaryFileReader, GenericErrorMessage, MetadataOfType, OpsMetadata, PreparedCommit, ValOps, ValOpsOptions, WithGenericError, SaveSourceFilePatchResult, SchemaSha, CommitSha, OrderedPatches, OrderedPatchesMetadata, SourcesSha } from "./ValOps.js";
 import { Patch, ParentRef, ValCommit } from "@valbuild/shared/internal";
 import type { HistoryError } from "./history/HistoryError.js";
 import type { AffectedFile, StoredModuleVersion, CommitPage, CommitPatch, HistoricalCommit } from "./history/types.js";
@@ -112,7 +112,7 @@ export declare class ValOpsFS extends ValOps {
         excludePatchOps: ExcludePatchOps;
     }): Promise<ExcludePatchOps extends true ? OrderedPatchesMetadata : OrderedPatches>;
     private parseJsonFile;
-    protected saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, _parentRef: ParentRef, authorId: AuthorId | null, sessionId: string | null, _patchGroup?: PatchGroupMembership): Promise<SaveSourceFilePatchResult>;
+    protected saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, _parentRef: ParentRef, authorId: AuthorId | null, sessionId: string | null): Promise<SaveSourceFilePatchResult>;
     protected getSourceFile(path: string): Promise<WithGenericError<{
         data: string;
     }>>;

package/dist/declarations/src/ValOpsHttp.d.ts

@@ -1,11 +1,11 @@
 import { type ValContentVersion, type ValProposal } from "./proposal.js";
 import { type PatchId, type ModuleFilePath, ValModules } from "@valbuild/core";
 import type { Patch as PatchT, ParentRef as ParentRefT } from "@valbuild/core/patch";
-import { type AuthorId, type BaseSha, BinaryFileType, type CommitSha, GenericErrorMessage, MetadataOfType, OpsMetadata, PreparedCommit, ValOps, ValOpsOptions, WithGenericError, SaveSourceFilePatchResult, type PatchGroupMembership, SchemaSha, OrderedPatchesMetadata, OrderedPatches, SourcesSha, type PublishRefusal } from "./ValOps.js";
+import { type AuthorId, type BaseSha, BinaryFileType, type CommitSha, GenericErrorMessage, MetadataOfType, OpsMetadata, PreparedCommit, ValOps, ValOpsOptions, WithGenericError, SaveSourceFilePatchResult, SchemaSha, OrderedPatchesMetadata, OrderedPatches, SourcesSha, type PublishRefusal } from "./ValOps.js";
 import { z } from "zod";
 import type { HistoryError } from "./history/HistoryError.js";
 import type { AffectedFile, StoredModuleVersion, CommitPage, CommitPatch, HistoricalCommit } from "./history/types.js";
-import { ParentRef, ValCommit, ValDeployment, type PatchGroupT } from "@valbuild/shared/internal";
+import { ParentRef, ValCommit, ValDeployment } from "@valbuild/shared/internal";
 import { result } from "@valbuild/core/fp";
 declare const PatchId: z.ZodString & z.ZodType<PatchId, string, z.core.$ZodTypeInternals<PatchId, string>>;
 declare const CommitSha: z.ZodString & z.ZodType<CommitSha, string, z.core.$ZodTypeInternals<CommitSha, string>>;
@@ -21,17 +21,6 @@ declare const ModuleFilePath: z.ZodString & z.ZodType<ModuleFilePath, string, z.
  * be picked, and a wrong one would floor this client at another chain's count.
  */
 export declare function ownBranchVersion(headVersions: Record<string, number> | undefined, branch: string | undefined): number | undefined;
-export type PatchGroupMutationResult = {
-    patchIds: PatchId[];
-    patchGroupId: string | null;
-    headVersion?: number;
-    status?: undefined;
-    error?: undefined;
-} | {
-    patchIds: PatchId[];
-    status: 403 | 409 | 500;
-    error: GenericErrorMessage;
-};
 export declare class ValOpsHttp extends ValOps {
     private readonly contentUrl;
     private readonly project;
@@ -320,6 +309,33 @@ export declare class ValOpsHttp extends ValOps {
         body: string;
         contentType: string;
     }>;
+    /**
+     * Update from the site, for a proposal that changes only content
+     * (valbuild/home `docs/hosted-publishing.md`, step 8.2, slice 1a): content
+     * hands over the three versions of every module the proposal saved, this
+     * server merges them under its own build's schemas -- the same on all
+     * three sides, which is what "content only" means -- and content commits
+     * the merge on the proposal's branch.
+     *
+     * Answered here rather than forwarded, at `POST /<name>/update-content`, and
+     * only by the proposal's own server: the schemas it merges under are this
+     * build's. A conflict comes back for a person to resolve, and the same call
+     * with their `resolutions` merges.
+     */
+    private updateContentFromSite;
+    /**
+     * Update from the site, for a proposal with code (valbuild/home
+     * `docs/hosted-publishing.md`, step 8.2, slice 1b), at
+     * `POST /<name>/update-code`. The builder tab has read content's trees
+     * (`GET /<name>/merge-trees`, forwarded) and evaluated them; this reads the
+     * trees again -- the tab's evaluation is of the trees content has, or it is
+     * of nothing -- and does the text (`updateWithCode`). The first call
+     * answers the merge for the tab to evaluate; the second, with that
+     * evaluation, commits it on the proposal's branch, staging its code.
+     *
+     * Only at the proposal's own address, as every write to its files is.
+     */
+    private updateCodeFromSite;
     /**
      * A publish job's prepare, sent to content: the job's sources, archived
      * there before the job is built (valbuild/home, docs/app-mode.md, "The
@@ -391,8 +407,6 @@ export declare class ValOpsHttp extends ValOps {
         headVersion?: number;
         /** The newest commit, which is the publish head. */
         headCommitSha?: string;
-        /** Who holds what, at `headVersion`. See {@link OrderedPatches.patchGroups}. */
-        patchGroups?: PatchGroupT[];
     } | {
         type: "error";
         error: GenericErrorMessage;
@@ -430,148 +444,7 @@ export declare class ValOpsHttp extends ValOps {
         patchIds?: PatchId[];
         excludePatchOps: ExcludePatchOps;
     }): Promise<ExcludePatchOps extends true ? OrderedPatchesMetadata : OrderedPatches>;
-    /**
-     * Add patches to a patch group.
-     *
-     * The set arrives closed by the client — `withPatchIds` is the prefix closure
-     * over the patch sets the staged patches belong to. We forward it and do not
-     * second-guess it: deriving the closure needs the content schema, which this
-     * process does have but content.val.build does not, and having two
-     * implementations of the rule would be worse than having one.
-     *
-     * Membership rows are stamped with `coreVersion` on the content side — the
-     * same stamp the patch row carries — so which client wrote a row stays
-     * legible after the fact.
-     */
-    stagePatches(
-    /**
-     * The group to stage into, or `undefined` for the caller's open group on
-     * this branch — `~` on the content API, which creates it if there is none.
-     */
-    patchGroupId: string | undefined, 
-    /** What the user asked to stage. */
-    patchIds: PatchId[], 
-    /**
-     * What has to come with it, because the staged patches are written on top
-     * of it.
-     *
-     * The content API stores each membership row as `explicit` or `dependency`
-     * and treats what it is not told about as a dependency. Folding the two
-     * halves into `patchIds` therefore files the patch somebody clicked as one
-     * the closure dragged in — the exact opposite of what happened, and the
-     * only record anywhere of what the author chose.
-     */
-    withPatchIds: PatchId[], 
-    /**
-     * WHO is asking, so the content API can refuse a group that is not theirs.
-     *
-     * Every call from this class carries the app's API key, which says which
-     * PROJECT is calling and nothing about which editor. Without this the
-     * content API cannot tell one of a project's editors from another, so the
-     * only check on stage and unstage is the one in `ValServer` — and anything
-     * reaching the content API by another route (an API key, a PAT) has none at
-     * all.
-     *
-     * `null` where there is no session. The content API refuses rather than
-     * treating that as a match: a group written by an api key has a null author
-     * too, and `null === null` must not read as ownership.
-     */
-    authorId: AuthorId | null): Promise<PatchGroupMutationResult>;
-    /**
-     * Remove patches from a patch group.
-     *
-     * The set arrives closed FORWARDS by the client: unstaging a patch also
-     * unstages everything built on top of it within its patch sets, and that is
-     * what `withPatchIds` carries.
-     */
-    unstagePatches(
-    /** See {@link stagePatches}. With no open group, there is nothing to remove. */
-    patchGroupId: string | undefined, 
-    /** What the user asked to unstage. */
-    patchIds: PatchId[], 
-    /** What has to go with it: everything built on top of it. */
-    withPatchIds: PatchId[], 
-    /** See {@link stagePatches} — the content API's half of the ownership check. */
-    authorId: AuthorId | null): Promise<PatchGroupMutationResult>;
-    /**
-     * Every patch group on this branch, with what each holds.
-     *
-     * Read rather than mutated, and used to answer "which pending patches is THIS
-     * person allowed to see". A draft render that skips this shows base + every
-     * pending patch on the branch, including work other people have not
-     * published — which is what independent publish exists to prevent.
-     *
-     * A failure is an empty list rather than a throw, and the caller decides what
-     * that means. For a draft render the honest fallback is "show nothing
-     * pending" rather than "show everything": being shown your own committed
-     * content when the group lookup is down is a worse experience than being
-     * shown somebody else's unpublished draft is a bug.
-     */
-    /**
-     * The last group lookup, and when it was made.
-     *
-     * A draft render calls `getPatchGroups` once per `fetchVal`, in series with
-     * the whole-chain fetch, and a page that calls `fetchVal` several times pays
-     * the round trip several times. Groups are per branch and change rarely, so a
-     * short window removes the multiplier without letting a stage go unseen for
-     * meaningfully longer than one render.
-     *
-     * Deliberately short. This is a read whose staleness decides whose draft
-     * content someone sees, so it is a per-request de-duplication rather than a
-     * cache: a second render a second later asks again.
-     */
-    private patchGroupsCache;
-    /**
-     * Forget the remembered group list, after a write through this server.
-     *
-     * A write changes membership -- a save joins its author's group, a delete or
-     * an unstage leaves it -- and the window above is long enough for the next
-     * render to be served the list from before it: an editor who saved and
-     * reloaded inside a second was shown their draft without the change they had
-     * just made. Called once the write has answered, so a read that started
-     * while it was in flight cannot leave the old list behind it.
-     *
-     * Only this instance's writes. Another instance's write is still seen at
-     * most one window late, which is what the window is for.
-     */
-    private forgetPatchGroups;
-    getPatchGroups(options?: {
-        /**
-         * Ask the content API even if a recent answer is remembered.
-         *
-         * For the checks that DECIDE something rather than render something.
-         * `refuseUnlessOwn` reads this list to say whether a group is yours, and a
-         * group is at its youngest exactly when that matters: the first write
-         * creates it, the save response names it, and the shell flushes its queued
-         * stages immediately — well inside the cache window. Served from a list
-         * fetched before the group existed, every one of those was refused 403 and
-         * dropped, so the queue that exists to survive the post-publish window
-         * persisted nothing in the flow it was built for.
-         *
-         * Not solved by shortening the window: the cache sits on this instance,
-         * which outlives the request, so "recent" is recent for the whole server
-         * and not for one render.
-         */
-        fresh?: boolean;
-    }): Promise<{
-        status: "ok";
-        patchGroups: PatchGroupT[];
-    } | {
-        status: "unsupported";
-    } | {
-        status: "error";
-        message: string;
-    }>;
-    private fetchPatchGroups;
-    /**
-     * Which branch `~` means, where this build knows: the branch it reads
-     * `applicable/patches` on, so the group staged into is the group listed.
-     * Without one the content API uses the project's own, as it does for reads.
-     */
-    private ownGroupBranch;
-    private mutatePatchGroup;
-    private mutatePatchGroupRequest;
-    protected saveSourceFilePatch(path: ModuleFilePath, patch: PatchT, patchId: PatchId, parentRef: ParentRefT, authorId: AuthorId | null, sessionId: string | null, patchGroup?: PatchGroupMembership): Promise<SaveSourceFilePatchResult>;
+    protected saveSourceFilePatch(path: ModuleFilePath, patch: PatchT, patchId: PatchId, parentRef: ParentRefT, authorId: AuthorId | null, sessionId: string | null): Promise<SaveSourceFilePatchResult>;
     /**
      * @deprecated For HTTP ops use direct upload instead (i.e. client should upload the files directly) since hosting platforms (Vercel) might have low limits on the size of the request body.
      */
@@ -587,17 +460,7 @@ export declare class ValOpsHttp extends ValOps {
     getBase64EncodedBinaryFileFromPatch(filePath: string, patchId: PatchId, remote: boolean): Promise<Buffer | null>;
     protected getBase64EncodedBinaryFileMetadataFromPatch<T extends "file" | "image">(filePath: string, type: T, patchId: PatchId, remote: boolean): Promise<OpsMetadata<T>>;
     protected getBinaryFileMetadata<T extends "file" | "image">(filePath: string, type: T): Promise<OpsMetadata<T>>;
-    deletePatches(patchIds: PatchId[], 
-    /**
-     * Patches that are NOT deleted but must lose their group membership.
-     *
-     * Deleting a patch out of the middle of a patch set leaves every group
-     * still holding the rest with a non-prefix intersection — the patches after
-     * the hole were written against a view that had it. The content API cannot
-     * work out which those are (it has no schema), so the client sends the
-     * forward closure and it drops those memberships without deleting anything.
-     */
-    unstagePatchIds?: PatchId[]): Promise<{
+    deletePatches(patchIds: PatchId[]): Promise<{
         deleted: PatchId[];
         errors?: undefined;
         error?: undefined;
@@ -611,22 +474,7 @@ export declare class ValOpsHttp extends ValOps {
         errors?: undefined;
         deleted?: undefined;
     }>;
-    commit(prepared: PreparedCommit, message: string, committer: AuthorId, filesDirectory: string, newBranch?: string, 
-    /**
-     * The patch group this commit EMPTIES, if it empties one.
-     *
-     * The content API closes the group it is given — and closes it WITHOUT
-     * checking that the commit shipped all of it, so a caller that names a
-     * group still holding work takes those patches out of every group and
-     * leaves their author unable to publish them. The client therefore sends it
-     * only when the publish accounts for everything the group still holds.
-     *
-     * Omitting it is not neutral: the commit still empties the group (the
-     * content API drops applied ids from every group), but `published_at` is
-     * never set, so the id is reused across publishes instead of a new group
-     * per publish and the "already published" refusal can never fire.
-     */
-    patchGroupId?: string): Promise<{
+    commit(prepared: PreparedCommit, message: string, committer: AuthorId, filesDirectory: string, newBranch?: string): Promise<{
         isNotFastForward?: boolean;
         updatedFiles: string[];
         commit: CommitSha;

package/dist/declarations/src/ValOpsMemory.d.ts

@@ -1,6 +1,6 @@
 import type { ModuleFilePath, PatchId, ValModules } from "@valbuild/core";
 import type { Patch, ParentRef } from "@valbuild/shared/internal";
-import { ValOps, type AuthorId, type BaseSha, type GenericErrorMessage, type MetadataOfType, type OpsMetadata, type OrderedPatches, type OrderedPatchesMetadata, type PatchGroupMembership, type PreparedCommit, type SaveSourceFilePatchResult, type SchemaSha, type SourcesSha, type ValOpsOptions, type WithGenericError } from "./ValOps.js";
+import { ValOps, type AuthorId, type BaseSha, type GenericErrorMessage, type MetadataOfType, type OpsMetadata, type OrderedPatches, type OrderedPatchesMetadata, type PreparedCommit, type SaveSourceFilePatchResult, type SchemaSha, type SourcesSha, type ValOpsOptions, type WithGenericError } from "./ValOps.js";
 import type { HistoryError } from "./history/HistoryError.js";
 import type { AffectedFile, CommitPage, CommitPatch, HistoricalCommit, StoredModuleVersion } from "./history/types.js";
 import { result } from "@valbuild/core/fp";
@@ -230,7 +230,7 @@ export declare class ValOpsMemory extends ValOps {
         patchIds?: PatchId[];
         excludePatchOps: ExcludePatchOps;
     }): Promise<ExcludePatchOps extends true ? OrderedPatchesMetadata : OrderedPatches>;
-    protected saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, _parentRef: ParentRef | null, authorId: AuthorId | null, _sessionId: string | null, _patchGroup?: PatchGroupMembership): Promise<SaveSourceFilePatchResult>;
+    protected saveSourceFilePatch(path: ModuleFilePath, patch: Patch, patchId: PatchId, _parentRef: ParentRef | null, authorId: AuthorId | null, _sessionId: string | null): Promise<SaveSourceFilePatchResult>;
     /** One spelling for a path, whichever the caller used. See sourceFiles. */
     private static key;
     /**

package/dist/declarations/src/ValServer.d.ts

@@ -1,9 +1,8 @@
 import type { ValContentVersion, ValProposal } from "./proposal.js";
-import { ValModules, PatchId, ModuleFilePath, ValConfig } from "@valbuild/core";
-import { Api, ServerOf, type PatchGroupT } from "@valbuild/shared/internal";
+import { ValModules, ValConfig } from "@valbuild/core";
+import { Api, ServerOf } from "@valbuild/shared/internal";
 import { z } from "zod";
-import { AuthorId, CommitSha, ValOps, type GenericErrorMessage, type PreparedCommit } from "./ValOps.js";
-import { ValOpsHttp } from "./ValOpsHttp.js";
+import { AuthorId, CommitSha, type GenericErrorMessage, type PreparedCommit } from "./ValOps.js";
 import { type ValPatchStore } from "./ValOpsMemory.js";
 export type ValServerOptions = {
     route: string;
@@ -61,8 +60,6 @@ export type CommitContext = {
     preparedCommit: PreparedCommit;
     message: string;
     authorId: AuthorId;
-    /** The patch group this commit empties, if it empties one. */
-    patchGroupId?: string;
     /**
      * The default: a git commit through the content API.
      *
@@ -178,120 +175,6 @@ export type ValServerCallbacks = {
     onEnable: (success: boolean) => Promise<void>;
     onDisable: (success: boolean) => Promise<void>;
 };
-/**
- * Refuse to touch a group that is not the caller's.
- *
- * Exported for `patchGroupOwnership.test.ts`: this is the whole of the
- * authorization for stage and unstage, and nothing else in the process checks
- * it, so it is worth testing as a policy rather than only through a route.
- *
- * `getAuth` only proves a session EXISTS; it says nothing about whose
- * group this is. And the content API cannot decide either — every call
- * from here carries the app's API key, not the editor's identity — so if
- * this does not check, nothing does.
- *
- * `GET /patches?include_patch_groups=true` hands every editor the id and
- * author of every open group on the branch, so without this any logged-in
- * editor can unstage another author's patches (their next publish
- * silently ships less) or stage into their group (it silently ships
- * more). The 403 declared for this route in `ApiRoutes.ts` was
- * unreachable.
- *
- * Fails CLOSED: if the groups cannot be read, the mutation is refused
- * rather than allowed unverified.
- */
-/**
- * The patches a scoped draft render should apply: the caller's own group, plus
- * everything already committed.
- *
- * Scoping is about PENDING work. A published patch stays in the chain with
- * `appliedAt` set until the next deployment moves the base, and it is part of
- * everyone's view in that window — the unscoped path applies it. Dropping it
- * meant the moment somebody published, their own draft preview reverted the
- * field they had just shipped, and nobody else saw it either until the deploy
- * landed; anything written on top in that window is authored against content
- * already stale on `main`.
- *
- * Keyed on `appliedAt` rather than on the group's `publishedAt`, because a
- * PARTIAL publish leaves the group open with only some of its patches applied.
- * Those are committed too, and no flag on the group names them.
- *
- * `undefined` scope is unscoped and never reaches here; an EMPTY scope is a
- * caller holding nothing, and on a branch with nothing applied it correctly
- * filters down to no patches, which renders base.
- */
-export declare function scopedPatches<T extends {
-    patchId: PatchId;
-    appliedAt: {
-        commitSha: CommitSha;
-    } | null;
-}>(patches: T[], ownPatchIds: PatchId[] | undefined): T[];
-/**
- * Which of the client's `unstagePatchIds` this server is willing to forward.
- *
- * The forward closure of a discard is the client's to compute — it needs the
- * patch sets, which need the schema — and it was being forwarded verbatim. But
- * the content API removes those memberships from EVERY group with no ownership
- * check, so any logged-in editor could strip arbitrary patches out of any other
- * author's group by attaching them to a delete of one of their own throwaway
- * patches. That is the outcome the 403 on `/patch-groups` exists to prevent,
- * reached by a different door: their next publish silently ships less.
- *
- * Neither server can compute the true closure, but this one can BOUND it. A
- * patch can only be invalidated by a delete if it was written after that delete
- * — its paths were chosen against a view that had it — and if it is in the same
- * module, since a patch set never spans two. Anything outside those bounds was
- * not in the closure whatever the client says, so it is dropped rather than
- * refused: the delete is still correct, and refusing the whole request over an
- * over-broad extra would turn a discard into an error the user cannot act on.
- *
- * Exported for the test. Pure, and given the chain rather than fetching it, so
- * the ordering it depends on is visible in the test rather than mocked.
- */
-export declare function boundUnstageClosure(
-/** The pending chain, in chain order, as `fetchPatches` returns it. */
-chain: readonly {
-    patchId: PatchId;
-    path: ModuleFilePath;
-}[], deleted: readonly PatchId[], requested: readonly PatchId[]): PatchId[];
-/**
- * Which pending patches this caller may see, when they asked for "only mine".
- *
- * Shared by `/sources/~` and `/json`, and it has to be: a draft page renders
- * both, so two answers to "whose work is this" put one person's half-finished
- * edit on another person's preview through whichever route was not scoped. That
- * is exactly what happened — `/json` applied every pending patch on the branch
- * while the module content beside it was scoped.
- *
- * `undefined` means "apply everything", which is what every caller that does
- * not ask for scoping gets and must keep getting.
- */
-/** The patches in this author's OPEN groups: what a scoped draft shows. */
-export declare function ownPatchIdsIn(patchGroups: PatchGroupT[], authorId: string): PatchId[];
-/**
- * Whose pending patches a scoped draft shows, taken from the SAME response as
- * the patches when it says, and from the list read beforehand only when not.
- *
- * See the call in `/sources/~`: the list read beforehand can be older than the
- * chain, and the response's membership cannot be.
- */
-export declare function ownPatchScopeFor(fetched: {
-    patchGroups?: PatchGroupT[];
-}, authorId: string | undefined, remembered: PatchId[] | undefined): PatchId[] | undefined;
-export declare function resolveOwnPatchScope(serverOps: ValOps, opts: {
-    /** A caller that named a list already knows what it wants. */
-    explicitPatchIds: PatchId[] | undefined;
-    ownGroupsOnly: boolean;
-    /** `undefined` where there is no session to have one. */
-    authorId: string | undefined;
-}): Promise<{
-    ownPatchIds: PatchId[] | undefined;
-    scopeAlsoIncludesApplied: boolean;
-}>;
-export declare function refuseUnlessOwn(ops: ValOpsHttp, patchGroupId: string, authorId: string): Promise<{
-    status: 403 | 409 | 500;
-    message: string;
-} | null>;
 declare const IntegratedServerJwtPayload: z.ZodObject<{
     sub: z.ZodString;
     exp: z.ZodNumber;