@valbuild/server 0.146.2 → 0.146.4

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @valbuild/server
 
+## 0.146.4
+
+### Patch Changes
+
+- [#877](https://github.com/valbuild/val/pull/877) [`c31f609`](https://github.com/valbuild/val/commit/c31f609fdeed79aa0e139fa4f652ba0684e96ea3) Thanks [@freekh](https://github.com/freekh)! - The Studio has an unlinked page, `/val/adept`, for trying out dependency
+  upgrades on a hosted project: it computes a lockfile for the live site's
+  `package.json`, previews each kind of upgrade from it, and fetches the type
+  declarations and TypeScript compiler a typecheck would load. It only shows
+  results; nothing on it is staged or published. Nothing links to it yet.
+
+  For it, the server now forwards Val Build's `/adept/*` routes for a signed-in
+  Studio session: lockfiles, upgrades, their jobs, type bundles and the
+  compiler. Like everything else the Studio asks Val Build for, they go with the
+  project's own credential, and they are open at a proposal's address too,
+  since they publish nothing.
+
+- Updated dependencies [[`81f2e80`](https://github.com/valbuild/val/commit/81f2e803c4cefdf58bbe6856c06e98ace95a8e0b), [`59ff6c3`](https://github.com/valbuild/val/commit/59ff6c367bc313b2bb7718b00c1641aaccab949d), [`c31f609`](https://github.com/valbuild/val/commit/c31f609fdeed79aa0e139fa4f652ba0684e96ea3)]:
+  - @valbuild/shared@0.146.4
+  - @valbuild/ui@0.146.4
+
 ## 0.146.2
 
 ### Patch Changes

package/dist/declarations/src/ValOpsHttp.d.ts

@@ -240,6 +240,16 @@ export declare class ValOpsHttp extends ValOps {
      * every artifact, and the upload is the slow one.
      */
     private currentPublishToken;
+    /**
+     * adept, through content: lockfiles, upgrades and type bundles, for the
+     * Studio's unlinked `/val/adept` page. A job is content's to scope to
+     * this project; a name and a version are matched, not passed, so nothing
+     * with a `..` reaches another of content's routes.
+     *
+     * Allowed at a proposal's address too: adept computes and publishes
+     * nothing, so there is nothing a proposal's Studio could move on the site.
+     */
+    private static adeptPathAllowed;
     /**
      * The content paths this may reach, and nothing else.
      *

package/dist/valbuild-server.cjs.dev.js

@@ -10916,6 +10916,19 @@ class ValOpsHttp extends ValOps {
     };
   }
 
+  /**
+   * adept, through content: lockfiles, upgrades and type bundles, for the
+   * Studio's unlinked `/val/adept` page. A job is content's to scope to
+   * this project; a name and a version are matched, not passed, so nothing
+   * with a `..` reaches another of content's routes.
+   *
+   * Allowed at a proposal's address too: adept computes and publishes
+   * nothing, so there is nothing a proposal's Studio could move on the site.
+   */
+  static adeptPathAllowed(path) {
+    return /^\/adept\/(lockfile|upgrade|jobs\/\d{1,18}(\/result)?|compiler\/[0-9A-Za-z][0-9A-Za-z.+-]{0,63})$/.test(path) || /^\/adept\/types\/public\/(@[a-z0-9~-][a-z0-9._~-]{0,213}\/)?[a-z0-9~-][a-z0-9._~-]{0,213}@[0-9a-z][0-9a-z.+-]{0,63}$/i.test(path);
+  }
+
   /**
    * The content paths this may reach, and nothing else.
    *
@@ -10958,6 +10971,7 @@ class ValOpsHttp extends ValOps {
     if (/^\/publish-requests(\/[A-Za-z0-9_-]{1,100})?$/.test(path)) {
       return true;
     }
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     if (/^\/publish-jobs\/(next|[A-Za-z0-9_-]{1,100}\/(steps|renew|cancel|discard))$/.test(path)) {
       return true;
     }
@@ -11039,6 +11053,7 @@ class ValOpsHttp extends ValOps {
       return true;
     }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.
     if (method === "GET" && path !== "/publish-requests/try-again" && /^\/publish-requests\/[A-Za-z0-9_-]{1,100}$/.test(path)) return true;
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);

package/dist/valbuild-server.cjs.prod.js

@@ -10916,6 +10916,19 @@ class ValOpsHttp extends ValOps {
     };
   }
 
+  /**
+   * adept, through content: lockfiles, upgrades and type bundles, for the
+   * Studio's unlinked `/val/adept` page. A job is content's to scope to
+   * this project; a name and a version are matched, not passed, so nothing
+   * with a `..` reaches another of content's routes.
+   *
+   * Allowed at a proposal's address too: adept computes and publishes
+   * nothing, so there is nothing a proposal's Studio could move on the site.
+   */
+  static adeptPathAllowed(path) {
+    return /^\/adept\/(lockfile|upgrade|jobs\/\d{1,18}(\/result)?|compiler\/[0-9A-Za-z][0-9A-Za-z.+-]{0,63})$/.test(path) || /^\/adept\/types\/public\/(@[a-z0-9~-][a-z0-9._~-]{0,213}\/)?[a-z0-9~-][a-z0-9._~-]{0,213}@[0-9a-z][0-9a-z.+-]{0,63}$/i.test(path);
+  }
+
   /**
    * The content paths this may reach, and nothing else.
    *
@@ -10958,6 +10971,7 @@ class ValOpsHttp extends ValOps {
     if (/^\/publish-requests(\/[A-Za-z0-9_-]{1,100})?$/.test(path)) {
       return true;
     }
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     if (/^\/publish-jobs\/(next|[A-Za-z0-9_-]{1,100}\/(steps|renew|cancel|discard))$/.test(path)) {
       return true;
     }
@@ -11039,6 +11053,7 @@ class ValOpsHttp extends ValOps {
       return true;
     }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.
     if (method === "GET" && path !== "/publish-requests/try-again" && /^\/publish-requests\/[A-Za-z0-9_-]{1,100}$/.test(path)) return true;
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);

package/dist/valbuild-server.esm.js

@@ -10879,6 +10879,19 @@ class ValOpsHttp extends ValOps {
     };
   }
 
+  /**
+   * adept, through content: lockfiles, upgrades and type bundles, for the
+   * Studio's unlinked `/val/adept` page. A job is content's to scope to
+   * this project; a name and a version are matched, not passed, so nothing
+   * with a `..` reaches another of content's routes.
+   *
+   * Allowed at a proposal's address too: adept computes and publishes
+   * nothing, so there is nothing a proposal's Studio could move on the site.
+   */
+  static adeptPathAllowed(path) {
+    return /^\/adept\/(lockfile|upgrade|jobs\/\d{1,18}(\/result)?|compiler\/[0-9A-Za-z][0-9A-Za-z.+-]{0,63})$/.test(path) || /^\/adept\/types\/public\/(@[a-z0-9~-][a-z0-9._~-]{0,213}\/)?[a-z0-9~-][a-z0-9._~-]{0,213}@[0-9a-z][0-9a-z.+-]{0,63}$/i.test(path);
+  }
+
   /**
    * The content paths this may reach, and nothing else.
    *
@@ -10921,6 +10934,7 @@ class ValOpsHttp extends ValOps {
     if (/^\/publish-requests(\/[A-Za-z0-9_-]{1,100})?$/.test(path)) {
       return true;
     }
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     if (/^\/publish-jobs\/(next|[A-Za-z0-9_-]{1,100}\/(steps|renew|cancel|discard))$/.test(path)) {
       return true;
     }
@@ -11002,6 +11016,7 @@ class ValOpsHttp extends ValOps {
       return true;
     }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
+    if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.
     if (method === "GET" && path !== "/publish-requests/try-again" && /^\/publish-requests\/[A-Za-z0-9_-]{1,100}$/.test(path)) return true;
     return /^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/(merge-prepare|steps|renew|cancel)$/.test(path);

package/package.json

@@ -16,7 +16,7 @@
     "./package.json": "./package.json"
   },
   "types": "dist/valbuild-server.cjs.d.ts",
-  "version": "0.146.2",
+  "version": "0.146.4",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -30,9 +30,9 @@
     "typescript": "^6.0.3",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/shared": "0.146.2",
-    "@valbuild/ui": "0.146.2",
-    "@valbuild/core": "0.146.2"
+    "@valbuild/core": "0.146.2",
+    "@valbuild/ui": "0.146.4",
+    "@valbuild/shared": "0.146.4"
   },
   "engines": {
     "node": "^20.19.0 || >=22"