@valbuild/server 0.146.1 → 0.146.4

package/dist/valbuild-server.esm.js

@@ -8,7 +8,7 @@ import path__default from 'path';
 import fs from 'fs';
 import vm from 'node:vm';
 import { Module } from 'node:module';
-import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, schemaErrorsOf, schemaTypesOfPath, sideFiles, sideSource, PlanRefusalError, PatchId as PatchId$1, JSONValue, SerializedSchema, newestCommitSha, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
+import { isSchemaSourceFixError, resolveSchemaSourceFixForError, Patch, getErrorMessageFromUnknownJson, schemaErrorsOf, PatchSets, joinSharedChanges, schemaTypesOfPath, sideFiles, sideSource, JSONValue, PlanRefusalError, PatchId as PatchId$1, SerializedSchema, newestCommitSha, VAL_ENABLE_COOKIE_NAME, VAL_STATE_COOKIE, VAL_SESSION_COOKIE, parseJob, VAL_STUDIO_HEADER, Api, traverseSchemaSource, richTextImageSchema, forEachRichTextImage } from '@valbuild/shared/internal';
 import { createUIRequestHandler } from '@valbuild/ui/server';
 import crypto$1, { createHash } from 'crypto';
 import z$1, { z } from 'zod';
@@ -9674,6 +9674,45 @@ function mergeFromSite(input) {
   };
 }
 
+/** A change pending on the site, in chain order. */
+
+/**
+ * The site's pending changes that conflict with going from `site` to
+ * `merged`, as whole patch sets: each inner list moves together, into a
+ * proposal of its own. Everything else stays pending.
+ *
+ * Patch sets are the Studio's own (`PatchSets`), from the schema the changes
+ * were written against; sets that share a change are one, because a change
+ * cannot be split. A set moves when, taken as the site's side of a three-way
+ * merge with the merged commit as the other, it conflicts (`mergeValues`, so
+ * the same value on both sides moves too); or when it no longer applies to
+ * the merged commit, or leaves it invalid under the merged schema.
+ */
+function changesToMove(input) {
+  const {
+    site,
+    merged,
+    pending
+  } = input;
+  const sets = new PatchSets();
+  for (const change of pending) {
+    var _site$modules$change$;
+    sets.insert(change.moduleFilePath, (_site$modules$change$ = site.modules[change.moduleFilePath]) === null || _site$modules$change$ === void 0 ? void 0 : _site$modules$change$.schema, change.patch, change.patchId, "", null);
+  }
+  const groups = joinSharedChanges(sets.serialize().map(set => set.patches.map(p => p.patchId)));
+  const moves = [];
+  for (const group of groups) {
+    const changes = pending.filter(change => group.has(change.patchId));
+    if (conflictsWithMerge(changes, site, merged)) {
+      moves.push(changes.map(change => change.patchId));
+    }
+  }
+  // In chain order, so the moved proposals are opened in the order the
+  // changes were written.
+  const order = ids => pending.findIndex(change => change.patchId === ids[0]);
+  return moves.sort((a, b) => order(a) - order(b));
+}
+
 // --- the pieces --------------------------------------------------------------
 
 /**
@@ -9706,6 +9745,39 @@ function resolveContent(moduleFilePath, merged, resolutions) {
     unresolved
   };
 }
+function conflictsWithMerge(changes, site, merged) {
+  const modules = [...new Set(changes.map(change => change.moduleFilePath))];
+  for (const moduleFilePath of modules) {
+    var _site$modules$moduleF;
+    const ops = changes.filter(change => change.moduleFilePath === moduleFilePath).flatMap(change => change.patch).filter(op => op.op !== "file");
+    const before = (_site$modules$moduleF = site.modules[moduleFilePath]) === null || _site$modules$moduleF === void 0 ? void 0 : _site$modules$moduleF.source;
+    const after = merged.modules[moduleFilePath];
+    if (before === undefined || after === undefined) return true;
+    const written = apply(before, ops);
+    if (written === undefined) return true;
+    const mergedSource = after.source;
+    const atomic = atomicFor(after.schema);
+    if (mergeValues(before, written, mergedSource, atomic).conflicts.length) {
+      return true;
+    }
+    // Over the merged commit: it applies, and is as valid as it was.
+    const over = apply(mergedSource, ops);
+    if (over === undefined) return true;
+    const known = new Set(errorPaths(moduleFilePath, after, mergedSource));
+    if (errorPaths(moduleFilePath, after, over).some(path => !known.has(path))) {
+      return true;
+    }
+  }
+  return false;
+}
+function apply(source, ops) {
+  if (source === undefined) return undefined;
+  const applied = applyPatch(deepClone(source), new JSONOps(), ops);
+  return result.isOk(applied) ? applied.value : undefined;
+}
+function errorPaths(moduleFilePath, module, source) {
+  return validateModule(moduleFilePath, module, source).map(error => error.path.join("/"));
+}
 
 /**
  * The schema check of a merge: content in `merged` -- the project
@@ -10069,6 +10141,105 @@ function sameJson(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 
+/**
+ * Which of the site's pending changes a merge of a proposal moves into
+ * proposals of their own (valbuild/home `docs/hosted-publishing.md`, step 8.2,
+ * decision 4), from what content hands over (`GET /proposals/:name/move-inputs`)
+ * and this server's schemas.
+ *
+ * The schemas are the ones this server runs: the proposal's own build at its
+ * address, which is the code the merge publishes. They stand in for the site's
+ * too, to group the site's changes into patch sets -- the same unless the
+ * proposal changed that module's schema, in which case a change written
+ * against the old one is checked against the new one, which is what the
+ * merge leaves it under anyway.
+ *
+ * A page this server has no schema for is moved whole: what cannot be checked
+ * is not left on the site to break.
+ */
+
+const PatchIdOf = z.string().refine(s => !!s);
+const ModuleFilePathOf = z.string().refine(s => s.startsWith("/"));
+
+/**
+ * Content's `move-inputs` answer, as it is parsed: the one definition, so the
+ * parser and what `movesAtMerge` reads cannot drift apart.
+ */
+const MoveInputs = z.object({
+  /** The proposal's last save; absent from a content service before it. */
+  save: z.string().nullable().optional(),
+  siteHead: z.string().nullable(),
+  pending: z.array(z.object({
+    patchId: PatchIdOf,
+    moduleFilePath: ModuleFilePathOf,
+    patch: Patch,
+    author: z.string().nullable(),
+    authorName: z.string().nullable()
+  })),
+  modules: z.record(z.string(), z.object({
+    site: JSONValue.nullable(),
+    merged: JSONValue.nullable()
+  }))
+});
+
+/** What the Publish press carries (`MergeBody.moves` in content), and who moves. */
+
+function movesAtMerge(inputs, schemas) {
+  const site = {
+    files: {},
+    modules: {}
+  };
+  const merged = {
+    files: {},
+    modules: {}
+  };
+  // The pages of the pending changes, which are the pages content answered.
+  for (const moduleFilePath of new Set(inputs.pending.map(change => change.moduleFilePath))) {
+    const page = inputs.modules[moduleFilePath];
+    if (page === undefined) continue;
+    const {
+      site: before,
+      merged: after
+    } = page;
+    const schema = schemas[moduleFilePath];
+    if (schema === undefined) continue;
+    const serialized = schema["executeSerialize"]();
+    const validate = source => validateWith(schema, moduleFilePath, source);
+    if (before !== null) {
+      site.modules[moduleFilePath] = {
+        source: before,
+        schema: serialized,
+        entries: null,
+        validate
+      };
+    }
+    if (after !== null) {
+      merged.modules[moduleFilePath] = {
+        source: after,
+        schema: serialized,
+        entries: null,
+        validate
+      };
+    }
+  }
+  const groups = changesToMove({
+    site,
+    merged,
+    pending: inputs.pending.map(change => ({
+      patchId: change.patchId,
+      moduleFilePath: change.moduleFilePath,
+      patch: change.patch
+    }))
+  });
+  const nameOf = new Map(inputs.pending.map(change => [change.patchId, change.authorName ?? "Someone"]));
+  return {
+    siteHead: inputs.siteHead,
+    considered: inputs.pending.map(change => change.patchId),
+    groups,
+    authors: groups.map(group => [...new Set(group.map(id => nameOf.get(id) ?? "Someone"))])
+  };
+}
+
 const textEncoder$2 = new TextEncoder();
 
 /** The body of the content API's 403 for a write the project's plan refuses. */
@@ -10114,6 +10285,8 @@ const GetApplicablePatches = z.object({
    * Optional for the same reason.
    */
   headVersion: z.number().optional(),
+  /** The branch's last commit. See `OrderedPatches.headCommitSha`. */
+  headCommitSha: z.string().nullable().optional(),
   /** Of `patches`, the ones a running publish holds. See `OrderedPatches.publishingPatches`. */
   publishingPatches: z.array(PatchId$1).optional(),
   /** Of `patches`, the ones a failed publish holds back. See `OrderedPatches.heldBackPatches`. */
@@ -10706,6 +10879,19 @@ class ValOpsHttp extends ValOps {
     };
   }
 
+  /**
+   * adept, through content: lockfiles, upgrades and type bundles, for the
+   * Studio's unlinked `/val/adept` page. A job is content's to scope to
+   * this project; a name and a version are matched, not passed, so nothing
+   * with a `..` reaches another of content's routes.
+   *
+   * Allowed at a proposal's address too: adept computes and publishes
+   * nothing, so there is nothing a proposal's Studio could move on the site.
+   */
+  static adeptPathAllowed(path) {
+    return /^\/adept\/(lockfile|upgrade|jobs\/\d{1,18}(\/result)?|compiler\/[0-9A-Za-z][0-9A-Za-z.+-]{0,63})$/.test(path) || /^\/adept\/types\/public\/(@[a-z0-9~-][a-z0-9._~-]{0,213}\/)?[a-z0-9~-][a-z0-9._~-]{0,213}@[0-9a-z][0-9a-z.+-]{0,63}$/i.test(path);
+  }
+
   /**
    * The content paths this may reach, and nothing else.
    *
@@ -10748,6 +10934,7 @@ class ValOpsHttp extends ValOps {
     if (/^\/publish-requests(\/[A-Za-z0-9_-]{1,100})?$/.test(path)) {
       return true;
     }
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     if (/^\/publish-jobs\/(next|[A-Za-z0-9_-]{1,100}\/(steps|renew|cancel|discard))$/.test(path)) {
       return true;
     }
@@ -10829,12 +11016,13 @@ class ValOpsHttp extends ValOps {
       return true;
     }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.
     if (method === "GET" && path !== "/publish-requests/try-again" && /^\/publish-requests\/[A-Za-z0-9_-]{1,100}$/.test(path)) return true;
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);
   }
   async proposalsApi(path, init, profileId) {
-    var _exec2, _exec3, _this$proposal;
+    var _exec2, _exec3, _exec4, _exec5, _this$proposal;
     const json = "application/json";
     const updating = (_exec2 = /^\/([0-9a-f]{20})\/update-content$/.exec(path)) === null || _exec2 === void 0 ? void 0 : _exec2[1];
     if (updating !== undefined && init.method === "POST") {
@@ -10844,6 +11032,20 @@ class ValOpsHttp extends ValOps {
     if (withCode !== undefined && init.method === "POST") {
       return this.updateCodeFromSite(withCode, init.body, profileId);
     }
+    /*
+     * Publish, and the checks before it, at the proposal's own address: Val
+     * says which of the site's pending changes the merge moves, from this
+     * build's schemas (step 8.2). Anywhere else they go to content as they
+     * are, and the site's pending changes block as they always did.
+     */
+    const checking = (_exec4 = /^\/([0-9a-f]{20})\/merge-checks$/.exec(path)) === null || _exec4 === void 0 ? void 0 : _exec4[1];
+    if (checking !== undefined && init.method === "GET" && (await this.answersMovesFor(checking, profileId))) {
+      return this.mergeChecksWithMoves(checking, profileId);
+    }
+    const pressing = (_exec5 = /^\/([0-9a-f]{20})\/merge$/.exec(path)) === null || _exec5 === void 0 ? void 0 : _exec5[1];
+    if (pressing !== undefined && init.method === "POST" && (await this.answersMovesFor(pressing, profileId))) {
+      return this.pressMergeWithMoves(pressing, init.body, profileId);
+    }
     if (!ValOpsHttp.proposalsApiAllowed(init.method, path)) {
       return {
         status: 403,
@@ -11031,6 +11233,143 @@ class ValOpsHttp extends ValOps {
     return updatedAnswer(text);
   }
 
+  /**
+   * Whether this server says what a merge of `name` moves: at the proposal's
+   * own address, whose schemas are the ones it publishes; and on the site, for
+   * Publish selected's proposal, which changes no code -- so the site's
+   * schemas are its own -- and has no address to be published from.
+   */
+  async answersMovesFor(name, profileId) {
+    if (this.proposal !== null) return this.proposal.name === name;
+    const read = await this.proposalContent(name, profileId)("");
+    if (!read.ok) return false;
+    const kind = ProposalKindAnswer.safeParse(await read.json().catch(() => null));
+    return kind.success && kind.data.proposal.kind === "publish";
+  }
+
+  /** Content's proposals API for one proposal, as the person asking. */
+  proposalContent(name, profileId) {
+    return (path, init = {}) => fetch(`${this.contentUrl}/v1/${this.project}/proposals/${name}${path}`, {
+      ...init,
+      headers: {
+        ...this.authHeaders,
+        ...(profileId !== null ? {
+          "x-val-profile-id": profileId
+        } : {}),
+        ...(init.body === undefined ? {} : {
+          "Content-Type": "application/json"
+        })
+      }
+    });
+  }
+
+  /**
+   * Which of the site's pending changes a merge of this proposal moves
+   * (`movesAtMerge`), or `null` when content could not say what is pending:
+   * then nothing is claimed, and the site's pending changes block the merge.
+   */
+  async mergeMovesOf(name, profileId) {
+    const read = await this.proposalContent(name, profileId)("/move-inputs");
+    if (!read.ok) return null;
+    const inputs = MoveInputs.safeParse(await read.json().catch(() => null));
+    if (!inputs.success) return null;
+    return {
+      ...movesAtMerge(inputs.data, await this.getSchemas()),
+      save: inputs.data.save
+    };
+  }
+
+  /**
+   * The merge checks, with `pending-on-site` answered by what the merge
+   * moves rather than by whether anything is pending: the conflicting
+   * changes move to a proposal of their own when it is published, and the
+   * rest stay, so neither blocks it.
+   */
+  async mergeChecksWithMoves(name, profileId) {
+    const json = "application/json";
+    const read = await this.proposalContent(name, profileId)("/merge-checks");
+    const text = await read.text();
+    const answer = {
+      status: read.status,
+      contentType: json,
+      body: text
+    };
+    if (!read.ok) return answer;
+    const parsed = MergeChecksAnswer.safeParse(parseJsonOrNull(text));
+    if (!parsed.success) return answer;
+    const pending = parsed.data.checks.find(check => check.id === "pending-on-site");
+    if (pending === undefined || pending.ok) return answer;
+    const moves = await this.mergeMovesOf(name, profileId);
+    if (moves === null) return answer;
+    const moving = moves.groups.flat().length;
+    const names = [...new Set(moves.authors.flat())];
+    const checks = parsed.data.checks.map(check => check.id !== "pending-on-site" ? check : {
+      ...check,
+      ok: true,
+      blockers: [],
+      message: moving === 0 ? "Unpublished changes on these pages do not conflict with this proposal, and stay unpublished" : `${moving === 1 ? "1 unpublished change" : `${moving} unpublished changes`} by ${namesOf(names)} ${moving === 1 ? "conflicts" : "conflict"} with this proposal, and ${moving === 1 ? "moves" : "move"} to ${moves.groups.length === 1 ? "a new proposal" : "new proposals"} when it is published`,
+      moves: moves.groups.map((group, at) => ({
+        patchIds: group,
+        authors: moves.authors[at] ?? []
+      }))
+    });
+    const othersOk = parsed.data.checks.every(check => check.ok || check.id === "pending-on-site");
+    return {
+      status: 200,
+      contentType: json,
+      body: JSON.stringify({
+        ...parsed.data,
+        checks,
+        canMerge: parsed.data.canMerge || othersOk
+      })
+    };
+  }
+
+  /** Publish in a proposal, carrying the moves (`MergeBody.moves` in content). */
+  async pressMergeWithMoves(name, body, profileId) {
+    const json = "application/json";
+    const content = this.proposalContent(name, profileId);
+    const forward = async sent => {
+      const res = await content("/merge", {
+        method: "POST",
+        ...(sent === undefined ? {} : {
+          body: sent
+        })
+      });
+      return {
+        status: res.status,
+        contentType: res.headers.get("Content-Type") ?? json,
+        body: await res.text()
+      };
+    };
+    let pressed;
+    try {
+      pressed = body === undefined || body === "" ? {} : JSON.parse(body);
+    } catch {
+      return forward(body);
+    }
+    if (typeof pressed !== "object" || pressed === null) return forward(body);
+    const moves = await this.mergeMovesOf(name, profileId);
+    if (moves === null) return forward(body);
+    return forward(JSON.stringify({
+      /*
+       * The save the moves were worked out against is the one this press
+       * publishes: named, so a change written after the press -- which the
+       * Studio lets an editor make at once -- continues in a new proposal
+       * rather than refusing it as unsaved.
+       */
+      ...(typeof moves.save === "string" ? {
+        save: moves.save
+      } : {}),
+      ...pressed,
+      moves: {
+        siteHead: moves.siteHead,
+        considered: moves.considered,
+        groups: moves.groups
+      }
+    }));
+  }
+
   /**
    * Update from the site, for a proposal with code (valbuild/home
    * `docs/hosted-publishing.md`, step 8.2, slice 1b), at
@@ -11808,6 +12147,9 @@ class ValOpsHttp extends ValOps {
             ...(data.headVersion !== undefined ? {
               headVersion: data.headVersion
             } : {}),
+            ...(data.headCommitSha !== undefined ? {
+              headCommitSha: data.headCommitSha
+            } : {}),
             ...(data.publishingPatches !== undefined ? {
               publishingPatches: data.publishingPatches
             } : {}),
@@ -12252,15 +12594,22 @@ class ValOpsHttp extends ValOps {
       };
     });
   }
-  async commit(prepared, message, committer, filesDirectory, newBranch) {
+  async commit(prepared, message, committer, filesDirectory, newBranch,
+  /**
+   * A save into this proposal rather than this server's own branch: the
+   * site's server saving Publish selected's proposal (`/publish-selected`),
+   * which has no address of its own to save from.
+   */
+  intoProposal) {
     try {
-      var _res$headers$get3;
+      var _this$proposal5, _res$headers$get3;
       /*
        * A save in a proposal is a commit on the proposal's branch, at its own
        * route: the site's `/commit` refuses a proposal's patches, which is
        * the line that keeps them off the site until a merge.
        */
-      const commitUrl = this.proposal !== null ? `${this.contentUrl}/v1/${this.project}/proposals/${this.proposal.name}/save` : `${this.contentUrl}/v1/${this.project}/commit`;
+      const proposalName = intoProposal ?? ((_this$proposal5 = this.proposal) === null || _this$proposal5 === void 0 ? void 0 : _this$proposal5.name);
+      const commitUrl = proposalName !== undefined ? `${this.contentUrl}/v1/${this.project}/proposals/${proposalName}/save` : `${this.contentUrl}/v1/${this.project}/commit`;
       const res = await fetch(commitUrl, {
         method: "POST",
         headers: {
@@ -12668,6 +13017,27 @@ const UpdateCodeBody = z.object({
   }).optional()
 });
 
+/** Content's `GET /proposals/:name/move-inputs`. */
+/** The one thing `answersMovesFor` reads from content's `GET /proposals/:name`. */
+const ProposalKindAnswer = z.object({
+  proposal: z.object({
+    kind: z.string()
+  })
+});
+/** Content's `GET /proposals/:name/merge-checks`, as far as it is changed here. */
+const MergeChecksAnswer = z.object({
+  checks: z.array(z.object({
+    id: z.string(),
+    ok: z.boolean()
+  }).passthrough()),
+  canMerge: z.boolean()
+}).passthrough();
+
+/** "Kari", "Kari and Bo", "Kari, Bo and 2 more". */
+function namesOf(names) {
+  return names.length <= 2 ? names.join(" and ") : `${names.slice(0, 2).join(", ")} and ${names.length - 2} more`;
+}
+
 /** Content's `GET /proposals/:name/merge-trees`. */
 const MergeTrees = z.object({
   base: z.string().nullable(),
@@ -12711,6 +13081,15 @@ const MergeInputs = z.object({
   }))
 });
 
+/** `JSON.parse`, or `null` for a body that is not JSON: an answer passed on as it came. */
+function parseJsonOrNull(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
 /**
  * One stored patch. Everything the ordered chain needs and nothing else.
  */
@@ -16659,6 +17038,142 @@ const ValServer = (valModules, options, callbacks) => {
         });
       }
     },
+    "/publish-selected": {
+      POST: async req => {
+        const auth = getAuth(req.cookies);
+        if (auth.error) {
+          return {
+            status: 401,
+            json: {
+              message: auth.error
+            }
+          };
+        }
+        const profileId = profileOf(auth);
+        if (profileId === null) {
+          return {
+            status: 401,
+            json: {
+              message: "Sign in to publish"
+            }
+          };
+        }
+        if (serverOps instanceof ValOpsHttp) {
+          await serverOps.learnProjectExpectation();
+        }
+        if (!(serverOps instanceof ValOpsHttp) || serverOps.sourceMode() !== "managed" || !serverOps.publishesAsJobs() || serverOps.currentProposal() !== null) {
+          return {
+            status: 409,
+            json: {
+              message: "Publish selected is for a site whose publishes are proposals: this deployment cannot."
+            }
+          };
+        }
+        const refusal = serverOps.publishRefusal();
+        if (refusal) {
+          return {
+            status: 409,
+            json: {
+              message: refusal.message
+            }
+          };
+        }
+        const {
+          patchIds,
+          displayName,
+          requestId
+        } = req.body;
+        /*
+         * The selection's content over the site's head, exactly as a publish
+         * job of it is prepared: this build's source, the commits since it,
+         * and the selection on top. Only what the selection touched is saved,
+         * so the proposal's save is the selection and nothing else.
+         */
+        const built = await buildSourcesOf(serverOps, patchIds, commit, {
+          binaries: false
+        });
+        if ("status" in built) return built;
+        if (built.headCommitSha === undefined) {
+          return {
+            status: 409,
+            json: {
+              message: "The content service does not say where the site's head is, which Publish selected needs: it is older than this Studio."
+            }
+          };
+        }
+        const selected = new Set(patchIds);
+        const prepared = {
+          ...built.withJob,
+          patchedSourceFiles: built.split.archive.patchedSourceFiles,
+          patchedBinaryFilesDescriptors: built.split.archive.patchedBinaryFilesDescriptors,
+          moduleVersions: built.split.archive.modules,
+          appliedPatches: Object.fromEntries(Object.entries(built.withJob.appliedPatches).map(([path, ids]) => [path, ids.filter(id => selected.has(id))]).filter(([, ids]) => ids.length > 0))
+        };
+        /*
+         * Moved and based in one transaction, on the head the selection was
+         * prepared over: content refuses the create when the site is no
+         * longer there, and nothing has moved.
+         */
+        const created = await serverOps.proposalsApi("", {
+          method: "POST",
+          body: JSON.stringify({
+            displayName,
+            kind: "publish",
+            patchIds,
+            requestId,
+            base: built.headCommitSha
+          })
+        }, profileId);
+        const createdBody = PublishProposalCreated.safeParse(safeJson(created.body));
+        const createdError = ContentError.safeParse(safeJson(created.body));
+        if (created.status === 409) {
+          /*
+           * Content refuses a base that is not the site's head -- a publish
+           * landed in between, and pressing again prepares over the new one.
+           * Any other refusal is content's to put in words, and again would
+           * be refused the same way.
+           */
+          const message = createdError.success ? createdError.data.message : "";
+          return /base is not the site's head/.test(message) ? {
+            status: 409,
+            json: {
+              message: "The site was published while this was being prepared. Nothing was published: publish them again.",
+              headMoved: true
+            }
+          } : {
+            status: 409,
+            json: {
+              message: message || "The changes could not be moved into a proposal to publish them."
+            }
+          };
+        }
+        if (created.status !== 200 || !createdBody.success) {
+          return {
+            status: 500,
+            json: {
+              message: `The changes could not be moved into a proposal to publish them (${created.status}): ${created.body.slice(0, 300)}`
+            }
+          };
+        }
+        const proposal = createdBody.data.proposal.name;
+        const saved = await serverOps.commit(prepared, `Publish selected: ${displayName}`, profileId, FILES_DIRECTORY, undefined, proposal);
+        if (saved.error) {
+          return {
+            status: 502,
+            json: {
+              message: `The changes are in a proposal, but could not be saved there: ${saved.error.message}`,
+              proposal
+            }
+          };
+        }
+        return {
+          status: 200,
+          json: {
+            proposal
+          }
+        };
+      }
+    },
     "/admin/status": {
       GET: async req => {
         const credential = await getValBuildCredential(req.cookies);
@@ -18554,7 +19069,14 @@ function getIsRemoteRequired(schemas) {
  * `split.archive` is the managed job's archive; a connected job's archive is
  * the push's, made from its own changes alone, by the caller.
  */
-async function buildSourcesOf(serverOps, patchIds, commit) {
+async function buildSourcesOf(serverOps, patchIds, commit,
+/**
+ * Read the job's binary files back for a build. Off for a caller that only
+ * commits what was prepared, which names the files rather than carrying them.
+ */
+options = {
+  binaries: true
+}) {
   const chain = await serverOps.fetchPatches({
     patchIds: undefined,
     excludePatchOps: false
@@ -18613,9 +19135,14 @@ async function buildSourcesOf(serverOps, patchIds, commit) {
     jobPatchIds: patchIds
   });
   // Read now, while the job's changes still hold their files.
-  const binaries = await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors);
+  const binaries = options.binaries ? await readCommittedBinaryFiles(serverOps, split.archive.patchedBinaryFilesDescriptors) : {
+    files: {},
+    unread: []
+  };
   return {
     split,
+    withJob,
+    headCommitSha: chain.headCommitSha,
     sourceFiles: split.buildSourceFiles,
     binaryFiles: binaries.files,
     binaryFilesUnread: binaries.unread
@@ -18665,6 +19192,24 @@ function jobPrepareAnswer(sent, build) {
   }
 }
 
+/** What `/publish-selected` reads from content's proposal create. */
+const PublishProposalCreated = z.object({
+  proposal: z.object({
+    name: z.string()
+  })
+});
+/** Content's refusal, in its words. */
+const ContentError = z.object({
+  message: z.string()
+});
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
 async function createValServer(valModules, route, opts, config, callbacks, formatter,
 /**
  * Called after a save has applied its patches. EXPERIMENTAL — see
@@ -23540,7 +24085,8 @@ async function handleExternalUpload() {
   };
 }
 
-// Fix handler registry. `keyof:check-keys`, `router:check-route`,
+// Fix handler registry. `keyof:check-keys`, the gallery markers
+// (`image:check-gallery` and the rest), `router:check-route`,
 // `locale:check-locale` and `record:fill-keys` are resolved upfront by the
 // shared resolveSchemaSourceFixes — they never reach this registry, so they're
 // excluded from the key set.