@valbuild/server 0.148.7 → 0.149.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @valbuild/server
 
+## 0.149.0
+
+### Patch Changes
+
+- [#910](https://github.com/valbuild/val/pull/910) [`32b3210`](https://github.com/valbuild/val/commit/32b3210c11bbd526c1882177c1870aa0be1d3ca4) Thanks [@freekh](https://github.com/freekh)! - When a proposal changes its dependencies without a lockfile to match, its Build button now reads **Compute lockfile** and computes it. Afterwards, the button shows the proposal's dependencies being built, or says why they could not be built.
+
+- [#911](https://github.com/valbuild/val/pull/911) [`bf24bc0`](https://github.com/valbuild/val/commit/bf24bc00e8f8c2a08538d59218d9da005943ac03) Thanks [@freekh](https://github.com/freekh)! - **Upgrade your site's dependencies from the Studio.** When newer versions of your site's packages are available, an **Upgrade** button appears in the Studio's top bar (on a phone, in the account sheet). It is marked when the upgrade fixes a vulnerability.
+
+  - **Pick a kind:** fix vulnerabilities, move to the latest version within each major, or move to new major versions. For majors, you can untick any package to leave it out.
+  - **Upgrade in a proposal:** this opens a proposal with the upgrade in it, and the Studio follows it there:
+    - computing the upgrade;
+    - building the new dependencies;
+    - typechecking your code against them;
+    - building the proposal.
+  - **Publish:** offered once the upgrade adds no type errors and the proposal is built. If it adds type errors, they are listed by file and the proposal stays open, so you can fix them there.
+  - **Settings → Updates** offers the same choice. "Update site", which published the template's dependencies straight to the live site, is gone.
+
+  A proposal whose dependencies change is typechecked automatically, and it can't be published until the typecheck finds no new errors. The **Typecheck** check in the Publish dialog runs it on request.
+
+- Updated dependencies [[`32b3210`](https://github.com/valbuild/val/commit/32b3210c11bbd526c1882177c1870aa0be1d3ca4), [`bf24bc0`](https://github.com/valbuild/val/commit/bf24bc00e8f8c2a08538d59218d9da005943ac03)]:
+  - @valbuild/ui@0.149.0
+
+## 0.148.8
+
+### Patch Changes
+
+- Updated dependencies [[`213c6fc`](https://github.com/valbuild/val/commit/213c6fca9636f9b4bb54f15336a21d2ac4846a9b), [`1856a4a`](https://github.com/valbuild/val/commit/1856a4af7827794cbcd50d66a0800394bc386f87), [`1856a4a`](https://github.com/valbuild/val/commit/1856a4af7827794cbcd50d66a0800394bc386f87)]:
+  - @valbuild/ui@0.148.8
+
 ## 0.148.7
 
 ### Patch Changes

package/dist/declarations/src/ValOpsHttp.d.ts

@@ -257,9 +257,10 @@ export declare class ValOpsHttp extends ValOps {
      * An allow list rather than a prefix check, because this method holds a
      * credential and the browser chooses the path. `/publish/{id}` and its three
      * steps are the publish conversation; `/build-target` is what a build needs
-     * to know before it starts; `/project-source` is what it builds;
-     * `/update-target` is the same question as `/build-target` for a managed
-     * project moving onto its template's current dependencies.
+     * to know before it starts; `/project-source` is what it builds. Not
+     * `/update-target` any more: a managed project's dependencies are upgraded
+     * in a proposal (valbuild/home `docs/adept.md`, step 7), not by publishing
+     * its template's.
      *
      * `/project-source` is here rather than on a route of its own because it is
      * one of the three things a publish asks for and none of them are useful
@@ -294,7 +295,9 @@ export declare class ValOpsHttp extends ValOps {
      */
     private static proposalsApiAllowed;
     /**
-     * A write to a proposal's FILES -- staging code, serving a build of it
+     * A write to a proposal's FILES -- staging code, computing its lockfile
+     * (valbuild/home `docs/adept.md`, step 6), reporting the typecheck of
+     * them (step 7, decision 20), serving a build of it
      * (valbuild/home `docs/hosted-publishing.md`, step 7), or moving it onto the
      * site's code (step 8, "Update from the site") -- is made by the
      * proposal's own server and nobody else's: the file tools act on the

package/dist/valbuild-server.cjs.dev.js

@@ -5736,9 +5736,10 @@ class ValOpsHttp extends ValRouterCore.ValOps {
    * An allow list rather than a prefix check, because this method holds a
    * credential and the browser chooses the path. `/publish/{id}` and its three
    * steps are the publish conversation; `/build-target` is what a build needs
-   * to know before it starts; `/project-source` is what it builds;
-   * `/update-target` is the same question as `/build-target` for a managed
-   * project moving onto its template's current dependencies.
+   * to know before it starts; `/project-source` is what it builds. Not
+   * `/update-target` any more: a managed project's dependencies are upgraded
+   * in a proposal (valbuild/home `docs/adept.md`, step 7), not by publishing
+   * its template's.
    *
    * `/project-source` is here rather than on a route of its own because it is
    * one of the three things a publish asks for and none of them are useful
@@ -5756,10 +5757,14 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     if (/^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/merge-prepare$/.test(path)) {
       return true;
     }
-    if (path === "/build-target" || path === "/project-source" || path === "/update-target" || path === "/publish" ||
+    if (path === "/build-target" || path === "/project-source" || path === "/publish" ||
     // Where "View run" goes, for a connected build CI reported failed.
     // Read only: reporting a run is CI's, with its own token.
-    path === "/ci-runs/newest") {
+    path === "/ci-runs/newest" ||
+    // Whether there is anything to upgrade, and the site's lockfile the
+    // typecheck of an upgrade compares against (valbuild/home
+    // `docs/adept.md`, step 7). Both read only.
+    path === "/upgrades" || path === "/dependency-files") {
       return true;
     }
     /*
@@ -5823,11 +5828,13 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
     if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files|merge-trees|build-target)$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build|update-from-site|restore-code)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|lockfile|typecheck|build|update-from-site|restore-code)$/.test(path);
   }
 
   /**
-   * A write to a proposal's FILES -- staging code, serving a build of it
+   * A write to a proposal's FILES -- staging code, computing its lockfile
+   * (valbuild/home `docs/adept.md`, step 6), reporting the typecheck of
+   * them (step 7, decision 20), serving a build of it
    * (valbuild/home `docs/hosted-publishing.md`, step 7), or moving it onto the
    * site's code (step 8, "Update from the site") -- is made by the
    * proposal's own server and nobody else's: the file tools act on the
@@ -5838,7 +5845,7 @@ class ValOpsHttp extends ValRouterCore.ValOps {
   static proposalFilesWrite(method, path) {
     var _exec;
     if (method !== "POST") return null;
-    return ((_exec = /^\/([0-9a-f]{20})\/(files|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|lockfile|typecheck|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -5853,6 +5860,11 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     if (path === "/build-target" || path === "/project-source" || path === "/publish") {
       return true;
     }
+    // An upgrade proposal's typecheck compares against the site's lockfile,
+    // and its chrome asks whether there is anything to upgrade. Read only.
+    if (method === "GET" && (path === "/upgrades" || path === "/dependency-files")) {
+      return true;
+    }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
     if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.

package/dist/valbuild-server.cjs.prod.js

@@ -5736,9 +5736,10 @@ class ValOpsHttp extends ValRouterCore.ValOps {
    * An allow list rather than a prefix check, because this method holds a
    * credential and the browser chooses the path. `/publish/{id}` and its three
    * steps are the publish conversation; `/build-target` is what a build needs
-   * to know before it starts; `/project-source` is what it builds;
-   * `/update-target` is the same question as `/build-target` for a managed
-   * project moving onto its template's current dependencies.
+   * to know before it starts; `/project-source` is what it builds. Not
+   * `/update-target` any more: a managed project's dependencies are upgraded
+   * in a proposal (valbuild/home `docs/adept.md`, step 7), not by publishing
+   * its template's.
    *
    * `/project-source` is here rather than on a route of its own because it is
    * one of the three things a publish asks for and none of them are useful
@@ -5756,10 +5757,14 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     if (/^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/merge-prepare$/.test(path)) {
       return true;
     }
-    if (path === "/build-target" || path === "/project-source" || path === "/update-target" || path === "/publish" ||
+    if (path === "/build-target" || path === "/project-source" || path === "/publish" ||
     // Where "View run" goes, for a connected build CI reported failed.
     // Read only: reporting a run is CI's, with its own token.
-    path === "/ci-runs/newest") {
+    path === "/ci-runs/newest" ||
+    // Whether there is anything to upgrade, and the site's lockfile the
+    // typecheck of an upgrade compares against (valbuild/home
+    // `docs/adept.md`, step 7). Both read only.
+    path === "/upgrades" || path === "/dependency-files") {
       return true;
     }
     /*
@@ -5823,11 +5828,13 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
     if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files|merge-trees|build-target)$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build|update-from-site|restore-code)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|lockfile|typecheck|build|update-from-site|restore-code)$/.test(path);
   }
 
   /**
-   * A write to a proposal's FILES -- staging code, serving a build of it
+   * A write to a proposal's FILES -- staging code, computing its lockfile
+   * (valbuild/home `docs/adept.md`, step 6), reporting the typecheck of
+   * them (step 7, decision 20), serving a build of it
    * (valbuild/home `docs/hosted-publishing.md`, step 7), or moving it onto the
    * site's code (step 8, "Update from the site") -- is made by the
    * proposal's own server and nobody else's: the file tools act on the
@@ -5838,7 +5845,7 @@ class ValOpsHttp extends ValRouterCore.ValOps {
   static proposalFilesWrite(method, path) {
     var _exec;
     if (method !== "POST") return null;
-    return ((_exec = /^\/([0-9a-f]{20})\/(files|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|lockfile|typecheck|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -5853,6 +5860,11 @@ class ValOpsHttp extends ValRouterCore.ValOps {
     if (path === "/build-target" || path === "/project-source" || path === "/publish") {
       return true;
     }
+    // An upgrade proposal's typecheck compares against the site's lockfile,
+    // and its chrome asks whether there is anything to upgrade. Read only.
+    if (method === "GET" && (path === "/upgrades" || path === "/dependency-files")) {
+      return true;
+    }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
     if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.

package/dist/valbuild-server.esm.js

@@ -5700,9 +5700,10 @@ class ValOpsHttp extends ValOps {
    * An allow list rather than a prefix check, because this method holds a
    * credential and the browser chooses the path. `/publish/{id}` and its three
    * steps are the publish conversation; `/build-target` is what a build needs
-   * to know before it starts; `/project-source` is what it builds;
-   * `/update-target` is the same question as `/build-target` for a managed
-   * project moving onto its template's current dependencies.
+   * to know before it starts; `/project-source` is what it builds. Not
+   * `/update-target` any more: a managed project's dependencies are upgraded
+   * in a proposal (valbuild/home `docs/adept.md`, step 7), not by publishing
+   * its template's.
    *
    * `/project-source` is here rather than on a route of its own because it is
    * one of the three things a publish asks for and none of them are useful
@@ -5720,10 +5721,14 @@ class ValOpsHttp extends ValOps {
     if (/^\/publish-jobs\/[A-Za-z0-9_-]{1,100}\/merge-prepare$/.test(path)) {
       return true;
     }
-    if (path === "/build-target" || path === "/project-source" || path === "/update-target" || path === "/publish" ||
+    if (path === "/build-target" || path === "/project-source" || path === "/publish" ||
     // Where "View run" goes, for a connected build CI reported failed.
     // Read only: reporting a run is CI's, with its own token.
-    path === "/ci-runs/newest") {
+    path === "/ci-runs/newest" ||
+    // Whether there is anything to upgrade, and the site's lockfile the
+    // typecheck of an upgrade compares against (valbuild/home
+    // `docs/adept.md`, step 7). Both read only.
+    path === "/upgrades" || path === "/dependency-files") {
       return true;
     }
     /*
@@ -5787,11 +5792,13 @@ class ValOpsHttp extends ValOps {
     const one = /^\/[0-9a-f]{20}$/.test(path);
     if (one) return method === "GET" || method === "PATCH";
     if (method === "GET") return /^\/[0-9a-f]{20}\/(merge-checks|files|merge-trees|build-target)$/.test(path);
-    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|build|update-from-site|restore-code)$/.test(path);
+    return method === "POST" && /^\/[0-9a-f]{20}\/(close|reopen|setup\/retry|merge|files|lockfile|typecheck|build|update-from-site|restore-code)$/.test(path);
   }
 
   /**
-   * A write to a proposal's FILES -- staging code, serving a build of it
+   * A write to a proposal's FILES -- staging code, computing its lockfile
+   * (valbuild/home `docs/adept.md`, step 6), reporting the typecheck of
+   * them (step 7, decision 20), serving a build of it
    * (valbuild/home `docs/hosted-publishing.md`, step 7), or moving it onto the
    * site's code (step 8, "Update from the site") -- is made by the
    * proposal's own server and nobody else's: the file tools act on the
@@ -5802,7 +5809,7 @@ class ValOpsHttp extends ValOps {
   static proposalFilesWrite(method, path) {
     var _exec;
     if (method !== "POST") return null;
-    return ((_exec = /^\/([0-9a-f]{20})\/(files|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
+    return ((_exec = /^\/([0-9a-f]{20})\/(files|lockfile|typecheck|build|update-from-site|restore-code)$/.exec(path)) === null || _exec === void 0 ? void 0 : _exec[1]) ?? null;
   }
 
   /**
@@ -5817,6 +5824,11 @@ class ValOpsHttp extends ValOps {
     if (path === "/build-target" || path === "/project-source" || path === "/publish") {
       return true;
     }
+    // An upgrade proposal's typecheck compares against the site's lockfile,
+    // and its chrome asks whether there is anything to upgrade. Read only.
+    if (method === "GET" && (path === "/upgrades" || path === "/dependency-files")) {
+      return true;
+    }
     if (/^\/publish\/[A-Za-z0-9_-]+\/artifacts$/.test(path)) return true;
     if (ValOpsHttp.adeptPathAllowed(path)) return true;
     // Where its press is -- read only: a POST there is the site's Try again.

package/package.json

@@ -27,7 +27,7 @@
     ],
     "exports": true
   },
-  "version": "0.148.7",
+  "version": "0.149.0",
   "devDependencies": {
     "@prettier/sync": "^0.6.1",
     "@types/jest": "^30.0.0",
@@ -42,8 +42,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "@valbuild/core": "0.148.7",
-    "@valbuild/shared": "0.148.7",
-    "@valbuild/ui": "0.148.7"
+    "@valbuild/ui": "0.149.0",
+    "@valbuild/shared": "0.148.7"
   },
   "engines": {
     "node": "^20.19.0 || >=22"