@valbuild/shared 0.134.1 → 0.136.1

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # @valbuild/shared
 
+## 0.136.1
+
+### Patch Changes
+
+- [#716](https://github.com/valbuild/val/pull/716) [`e673b43`](https://github.com/valbuild/val/commit/e673b43feaf48b7f30881d6786c858a0cb6a44a2) Thanks [@freekh](https://github.com/freekh)! - The Studio can run a whole publish: read what to build and what to build it from, build it, and hand the result to the content service.
+
+  The two reads go through the same proxy and the same credential as the publish conversation, and both are validated rather than cast — an error page from a gateway in between would otherwise fail several layers down inside the bundler with a message about a module specifier.
+
+  Generating a route tree for a file-based project is a capability the deployment supplies, like `routeSplitter` and `loadCssModule` already are. Without one, such a project is refused by name rather than failing with `UNRESOLVED_ENTRY`.
+
+- [#697](https://github.com/valbuild/val/pull/697) [`5c82928`](https://github.com/valbuild/val/commit/5c82928992d29f133f81cf0704a273c0449b18f1) Thanks [@freekh](https://github.com/freekh)! - Read draft content once per request instead of once per `fetchVal`
+
+  In draft mode, `fetchVal` resolves its selector by asking the Val server for the
+  whole module tree. It did that on every call, so a page with three reads made
+  three requests for three identical answers — and `fetchValRouteUrl` added a
+  fourth by calling `fetchVal` again on top of the caller's own. The answer cannot
+  differ between reads in one request, so it is now read once and shared. On a
+  60-module project a three-read draft render goes from ~187ms to ~70ms.
+
+  The memo is scoped to the request and nothing wider, because the response it
+  holds contains the caller's own unpublished patches: React's `cache()` in a
+  Next RSC, a `WeakMap` keyed on the `Request` in TanStack Start, and no caching
+  at all where neither is available.
+
+  What this does **not** change:
+
+  - **Production is untouched.** With Val disabled the reader never calls the
+    server; it resolves against the statically imported module, as before.
+  - **What a draft shows is unchanged.** Same query, same patch scoping — a draft
+    still shows the caller's own staged work and nobody else's.
+  - **The client readers are untouched.** `useVal` already subscribed to exactly
+    the modules its selector names.
+  - **The server still evaluates every module per request.** Narrowing the
+    request's path was measured and does not help: `/sources/~` evaluates,
+    previews and validates everything and only then filters the response, so a
+    narrow path returns less for the same milliseconds. That remains open.
+
+- [#716](https://github.com/valbuild/val/pull/716) [`d2f385a`](https://github.com/valbuild/val/commit/d2f385a04978992a5036379235e447ba7775faef) Thanks [@freekh](https://github.com/freekh)! - The Studio works again when served from the published package, and a managed project's publish now puts the saved edit on the site.
+
+  - **The Studio did not start in 0.136.0.** Its main bundle imports sibling chunks by relative path, and the Studio is served at `/api/val/static/<version>/app`, so those imports resolved to paths the handler did not know and came back as the HTML fallback — which a browser refuses as a module script. Preview was gone with it. The handler now serves those chunks, and the package build follows every import the bundle makes before it lets a release through.
+  - **The in-browser builder could not load.** The Studio's bundle carried rolldown's Node WASI binding, which throws `process is not defined` in a tab. It now uses the browser binding, and the build refuses a bundle that contains the Node one.
+  - **A managed publish builds what was just saved.** `/save` returns the source files the commit wrote, the Studio builds with them laid over the project's stored source, and publishes that source back with the build — so the next edit starts from this one rather than undoing it. The save's commit is also passed through to the build, which previously ran as though no commit had been made.
+  - **The bundler's WebAssembly is served from `content.val.build/v1/static`** (`DEFAULT_STATIC_HOST`), still addressed by its SHA-256. `globalThis.__VAL_ROLLDOWN_WASM_URL__` still overrides it.
+  - The `val.server.ts` that `@valbuild/tanstack-build` generates no longer hands a save's files to the platform (`platform.internal/__api/source`). A managed project's Studio builds in its own tab, and the platform has closed that door. `isWired` recognises files wired either way.
+  - `@valbuild/tanstack-build/constants` exports the contract paths and the artifact key namespace from an entrypoint that imports nothing else, for callers that must not load the bundler. The namespace gains a `source` key.
+
+- Updated dependencies [[`d2f385a`](https://github.com/valbuild/val/commit/d2f385a04978992a5036379235e447ba7775faef)]:
+  - @valbuild/core@0.136.1
+
+## 0.136.0
+
+### Minor Changes
+
+- [#713](https://github.com/valbuild/val/pull/713) [`f3a4bb7`](https://github.com/valbuild/val/commit/f3a4bb7aea604943b92545c122243798c759715c) Thanks [@freekh](https://github.com/freekh)! - The Studio can load a bundler, and it stops telling a managed project that its
+  publish is on its way out.
+
+  **A managed project is one with no repository and no host watching one.** There
+  is nothing outside the browser to pick a commit up, so the Studio has been
+  showing it a story that belongs to a project with a repository: a `Building`
+  spinner, waiting for an event that can never arrive. It does not resolve on a
+  reload, on a retry, or tomorrow, and there is no way to tell it from a deploy
+  that is merely slow.
+
+  The content service now reports which kind of project this is, as `sourceMode`
+  on `/stat`, and the Studio narrates accordingly:
+
+  - a **connected** project keeps the deploy feed and keeps `Building`, because
+    there a host genuinely does pick the commit up;
+  - a **managed** one says `Saved, not yet live` instead — a durable condition,
+    not a phase, because nothing else will ever resolve it.
+
+  A server that reports no source mode keeps the behaviour it has today. Absence
+  means "not reported", never "managed": `fs` mode has no project to have a mode,
+  and neither does a content service that predates the field.
+
+  **The Studio also loads `@valbuild/tanstack-build` in the tab**, at mount and at
+  idle, for the managed projects that will need it — a browser that is the
+  deployer needs a bundler. This is the groundwork for browser-side publishing;
+  the publish path itself is unchanged in this release.
+
+  That bundler is `@rolldown/browser`, whose WebAssembly binary is 10.9 MB and is
+  **not** in the npm package. It is served from `static.val.build`, addressed by
+  the SHA-256 of its own bytes, so the build and the binary it needs cannot drift
+  apart. A deployment that must not reach that host — an air-gapped install, a
+  mirror — sets `globalThis.__VAL_ROLLDOWN_WASM_URL__` before the Studio loads and
+  needs no rebuild.
+
+  **Building in the browser requires a cross-origin isolated page.** Rolldown runs
+  WebAssembly on worker threads that share memory, and a browser will not hand a
+  `SharedArrayBuffer` to a worker otherwise. Without
+  `Cross-Origin-Opener-Policy: same-origin` and
+  `Cross-Origin-Embedder-Policy: require-corp` on the document Val is mounted in,
+  loading the bundler now fails with a message that says exactly that, instead of
+  a `DataCloneError` thrown from inside a worker. Nothing else in this release is
+  affected: a Studio that never builds in the browser never asks.
+
+### Patch Changes
+
+- Updated dependencies [[`f3a4bb7`](https://github.com/valbuild/val/commit/f3a4bb7aea604943b92545c122243798c759715c)]:
+  - @valbuild/core@0.136.0
+
 ## 0.134.1
 
 ### Patch Changes

package/client/dist/valbuild-shared-client.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var getSitemapTree = require('../../dist/getSitemapTree-99c97c62.cjs.dev.js');
+var getSitemapTree = require('../../dist/getSitemapTree-c732e09a.cjs.dev.js');
 require('@valbuild/core');
 
 

package/client/dist/valbuild-shared-client.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var getSitemapTree = require('../../dist/getSitemapTree-99839b02.cjs.prod.js');
+var getSitemapTree = require('../../dist/getSitemapTree-0ed3deac.cjs.prod.js');
 require('@valbuild/core');
 
 

package/client/dist/valbuild-shared-client.esm.js

@@ -1,2 +1,2 @@
-export { D as DEFAULT_CANVAS_SELECTION, e as DEFAULT_CANVAS_SELECTION_SOFT, b as VAL_AI_SESSION_STORAGE_KEY, d as VAL_CANVAS_MESSAGE, c as VAL_CANVAS_PARAM, V as VAL_CONFIG_SESSION_STORAGE_KEY, a as VAL_THEME_SESSION_STORAGE_KEY, h as getNextAppRouterSourceFolder, m as getPageRouterSitemapTree, k as getPageRouterSourceFolder, n as getPatternFromModuleFilePath, j as getTanStackRouterSourceFolder, l as isTanStackRoutesFolder, g as isValCanvasFrame, i as isValCanvasPageMessage, f as isValCanvasStudioMessage, p as parseRoutePattern, w as withValCanvasParam } from '../../dist/getSitemapTree-878d3888.esm.js';
+export { D as DEFAULT_CANVAS_SELECTION, e as DEFAULT_CANVAS_SELECTION_SOFT, b as VAL_AI_SESSION_STORAGE_KEY, d as VAL_CANVAS_MESSAGE, c as VAL_CANVAS_PARAM, V as VAL_CONFIG_SESSION_STORAGE_KEY, a as VAL_THEME_SESSION_STORAGE_KEY, h as getNextAppRouterSourceFolder, m as getPageRouterSitemapTree, k as getPageRouterSourceFolder, n as getPatternFromModuleFilePath, j as getTanStackRouterSourceFolder, l as isTanStackRoutesFolder, g as isValCanvasFrame, i as isValCanvasPageMessage, f as isValCanvasStudioMessage, p as parseRoutePattern, w as withValCanvasParam } from '../../dist/getSitemapTree-6fcdf745.esm.js';
 import '@valbuild/core';

package/dist/declarations/src/internal/ApiRoutes.d.ts

@@ -423,6 +423,7 @@ export declare const Api: {
                     profileId: z.ZodNullable<z.ZodString>;
                     mode: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"fs">]>;
                     jsonEntriesSha: z.ZodOptional<z.ZodString>;
+                    sourceMode: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"managed">, z.ZodLiteral<"connected">]>>;
                     publishRefusal: z.ZodOptional<z.ZodObject<{
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
@@ -466,6 +467,7 @@ export declare const Api: {
                     }, z.core.$strip>;
                     profileId: z.ZodNullable<z.ZodString>;
                     mode: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"fs">]>;
+                    sourceMode: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"managed">, z.ZodLiteral<"connected">]>>;
                     publishRefusal: z.ZodOptional<z.ZodObject<{
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
@@ -474,6 +476,63 @@ export declare const Api: {
             }, z.core.$strip>]>;
         };
     };
+    /**
+     * The content service's publish API, reached through this deployment.
+     *
+     * A managed project is built in the Studio's own tab -- there is no host
+     * watching a repository to pick a commit up -- and what it builds then has to
+     * be published. The browser cannot do that itself: it holds a session cookie
+     * for this origin and no credential content would accept. So the publish
+     * conversation goes through here, exactly as patches already do.
+     *
+     * ## Deliberately not typed past this point
+     *
+     * No `res`, and a body this does not describe. The shapes belong to content,
+     * and they are already written down twice -- once in content's own `Api.ts`
+     * and once in the copy `@valbuild/cli` keeps beside its parser so the two can
+     * be diffed by eye. A third copy here would be a third thing to keep in step,
+     * and this layer has no decision to make that would need one: it authenticates
+     * the caller, swaps the credential, and carries status and body back verbatim.
+     * The Studio parses the answer with the same module the CLI does.
+     *
+     * That means this route answers with statuses the generic result type does not
+     * model -- a 409 when a publish has already gone live, for one. `/save` has
+     * always done the same; the dispatch boundary erases the type and the adapter
+     * sends what it is given.
+     *
+     * ## What it may reach
+     *
+     * The sub-path is content's, minus `/v1`: `/publish`, `/publish/{id}` and its
+     * three steps, and `/build-target`. `ValOpsHttp.publishApi` holds the allow
+     * list, beside the credential, because the browser chooses this path.
+     */
+    "/publish-api": {
+        GET: {
+            req: {
+                path: z.ZodOptional<z.ZodString>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodObject<{
+                status: z.ZodNumber;
+                json: z.ZodUnknown;
+            }, z.core.$strip>;
+        };
+        POST: {
+            req: {
+                path: z.ZodOptional<z.ZodString>;
+                body: z.ZodOptional<z.ZodUnknown>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodObject<{
+                status: z.ZodNumber;
+                json: z.ZodUnknown;
+            }, z.core.$strip>;
+        };
+    };
     "/upload/patches": {
         POST: {
             req: {
@@ -1017,6 +1076,7 @@ export declare const Api: {
                 status: z.ZodLiteral<200>;
                 json: z.ZodObject<{
                     commitSha: z.ZodOptional<z.ZodString>;
+                    sourceFiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
                     removed: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         patchId: z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>;
                         moduleFilePath: z.ZodString & z.ZodType<ModuleFilePath, string, z.core.$ZodTypeInternals<ModuleFilePath, string>>;

package/dist/declarations/src/internal/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./richtext/conversion/index.js";
 export * from "./server/types.js";
+export * from "./server/requestScopedMemo.js";
 export * from "./ValClient.js";
 export * from "./ValUrls.js";
 export * from "./ApiRoutes.js";
@@ -32,3 +33,5 @@ export * from "./search/traverseSchemaSource.js";
 export * from "./search/getFilenameFromRef.js";
 export * from "./search/sourcePath.js";
 export * from "./theme/accentRamp.js";
+export * from "./publish/contentApi.js";
+export * from "./publish/protocol.js";

package/dist/declarations/src/internal/publish/contentApi.d.ts

@@ -0,0 +1,201 @@
+/**
+ * The publish API's types, COPIED from the service that serves them.
+ *
+ * Source: `content/src/handlers/Api.ts` in valbuild/home, branch
+ * `claude/new-project-studio-saves-0g9ksb`, commit `ecf3b8d`. The routes below
+ * are that file's `/publish*` entries and the two types they use, verbatim,
+ * comments included, so that the two can be diffed by eye.
+ *
+ * **Copied rather than imported, because it cannot be imported.** That file
+ * lives in a private repository which publishes nothing to npm, and its own
+ * header says this is how it is kept in step: "We have also used it (by just
+ * copying it in and setting the types there) in the @valbuild/server package to
+ * check that we are more or less in sync."
+ *
+ * **When home's `Api.ts` changes, change this with it.** Everything in
+ * `protocol.ts` is checked against these types, so a copy brought up to date
+ * fails to compile wherever this CLI has not caught up. That is the whole
+ * value: without it a wire change is a runtime 500 in somebody's CI, which is
+ * how `home` and `@valbuild/server` have already diverged three times - see
+ * `homeWireContract.test.ts` in `@valbuild/server` for the last one, and
+ * `publishWireContract.test.ts` here for the fixtures that go with these types.
+ *
+ * A copy is not a guarantee, only a tripwire: nothing checks it against the
+ * service, and the parsers in `protocol.ts` are what actually holds at runtime.
+ */
+export type ContentPublishApi = {
+    /**
+     * Publishing a build, as a resource with a lifecycle.
+     *
+     * ```
+     * POST /publish                  declare  -> an upload slot per MISSING artifact
+     * PUT  <presigned url>           upload   -> each artifact, straight to storage
+     * POST /publish/{id}/artifacts   confirm  -> the uploads are checked
+     * POST /publish/{id}/verify      render   -> a canary build, server side
+     * POST /publish/{id}/promote     go live  -> the pointer moves
+     * GET  /publish/{id}             status
+     * ```
+     *
+     * Four steps rather than one `POST /publish`, because they fail differently
+     * and one call cannot say "the bytes are fine but it did not render" -- which
+     * is the sentence a publisher most needs. `promote` is separate from `verify`
+     * so that a dry run is the absence of a call rather than a flag.
+     *
+     * Not keyed by a project, like `/publish-target` above and for the same
+     * reason: a project token names one. That is what lets a generated repository
+     * hold one secret and no variables at all.
+     *
+     * ## What is deliberately not here
+     *
+     * No loader URL, no `vendorRev`, no `x-platform-project`. This service holds
+     * the operator relationship with the build platform and calls it; a publisher
+     * talks to this API and nothing else. The one exception is the presigned
+     * upload URL, which points at object storage -- bytes do not travel through
+     * here.
+     *
+     * It is also what makes this publishable by a project token at all. The
+     * platform's own verify step publishes a canary to a throwaway project, and a
+     * throwaway has no secrets, so the loader has nothing to check a caller
+     * against and refuses with a 503 naming a project nobody has heard of. Behind
+     * this API the caller is never involved in that exchange.
+     */
+    "/publish": {
+        POST: {
+            body: {
+                /** The build's own hash. Repeating it returns the same publish. */
+                buildHash: string;
+                /** Null only for a seed publish. See `publishPlan.ts`. */
+                commit: string | null;
+                /** The branch content saves commit to. Required when `commit` is set. */
+                branch: string | null;
+                /** Which dependency layer this was built against, sent or not. */
+                layerRev: string | null;
+                /**
+                 * Whether the app links its own CSS.
+                 *
+                 * Build metadata the loader needs and no artifact carries, so it has to
+                 * be declared. Null is a third answer -- "this build did not say" --
+                 * and is not false.
+                 */
+                linksOwnCss: boolean | null;
+                artifacts: {
+                    /** See `publishPlan.ts` for the namespace. */
+                    key: string;
+                    sha256: string;
+                    bytes: number;
+                }[];
+            };
+            res: {
+                publishId: string;
+                state: PublishState;
+                project: {
+                    publicProjectId: string;
+                    /** Null when the project has no site yet -- reported, not refused. */
+                    siteUrl: string | null;
+                };
+                /**
+                 * One per artifact this project does not already hold, and nothing else.
+                 *
+                 * So this doubles as the answer to "what is missing": there is no
+                 * separate field to keep in step with it. Slots expire; a presigned PUT
+                 * that answers 403 means declare again, not that the publish failed.
+                 */
+                uploads: {
+                    key: string;
+                    url: string;
+                    method: "PUT";
+                    headers: Record<string, string>;
+                    /** ISO 8601. */
+                    expiresAt: string;
+                }[];
+                /** Keys already held, so a caller can see what it did not have to send. */
+                have: string[];
+            };
+        };
+    };
+    "/publish/:publishId": {
+        GET: {
+            res: {
+                publishId: string;
+                state: PublishState;
+                buildHash: string;
+                /** Artifact keys still not uploaded. */
+                missing: string[];
+                problems: PublishProblem[];
+            };
+        };
+    };
+    /** Everything asked for has been uploaded. The uploads are checked here. */
+    "/publish/:publishId/artifacts": {
+        POST: {
+            res: {
+                state: PublishState;
+                problems: PublishProblem[];
+            };
+        };
+    };
+    /** A canary build and render, on the build platform, with our credential. */
+    "/publish/:publishId/verify": {
+        POST: {
+            res: {
+                state: PublishState;
+                ok: boolean;
+                /** Where the canary can be looked at, when it rendered. */
+                previewUrl: string | null;
+                problems: PublishProblem[];
+            };
+        };
+    };
+    /**
+     * Move the project's pointer to this build.
+     *
+     * Refused when the commit is no longer the branch head -- which this service
+     * is the authority on (see `getGitHead`), so the rule is enforced where the
+     * data already is rather than a round trip away.
+     */
+    "/publish/:publishId/promote": {
+        POST: {
+            res: {
+                state: PublishState;
+                url: string | null;
+                commit: string | null;
+            };
+        };
+    };
+    /** Exchange a personal access token for a short-lived publish token. */
+    "/publish-token": {
+        POST: {
+            res: {
+                /** Shown once, here. Nothing can produce it again. */
+                token: string;
+                /** ISO 8601, because a `Date` does not survive JSON as one. */
+                expiresAt: string | null;
+                publicProjectId: string;
+                productionUrl: string | null;
+            };
+        };
+    };
+};
+/**
+ * Where a publish is. Mirrors `PublishState` in `utils/publishPlan.ts`, which
+ * owns the transition table; this is the wire spelling of it.
+ */
+export type PublishState = "awaiting-artifacts" | "ready" | "verified" | "live" | "failed" | "expired";
+/**
+ * Why a publish is not going anywhere.
+ *
+ * `code` is the stable half -- a pipeline gates on it -- and carries both this
+ * API's own codes (`ARTIFACT_MISMATCH`, `POINTER_STALE`, the declaration codes
+ * in `publishPlan.ts`) and the build platform's `PLATFORM*` codes passed
+ * through from a verify, because rewording those would lose the only sentence
+ * that says what to change.
+ *
+ * `hint` is not decoration. A gate that merely fails is useless in somebody
+ * else's pipeline: they get a red build and no idea why.
+ */
+export type PublishProblem = {
+    code: string;
+    message: string;
+    hint?: string;
+    keys?: string[];
+};

package/dist/declarations/src/internal/publish/protocol.d.ts

@@ -0,0 +1,123 @@
+import { z } from "zod";
+import { ContentPublishApi, PublishProblem, PublishState } from "./contentApi.js";
+/**
+ * Reading what content answers.
+ *
+ * Every type here comes from `contentApi.ts`, which is a copy of the
+ * service's own `Api.ts` - so the shapes are not re-derived from what this end
+ * wishes it received, and a copy brought up to date fails to compile wherever
+ * this CLI has not caught up.
+ *
+ * The schemas are the runtime half, and they are needed as well as the types:
+ * what arrives is JSON over HTTP from a service that versions separately, so a
+ * type alone asserts a shape rather than checking one. Each schema is
+ * annotated with the copied type it must produce (`z.ZodType<DeclareResponse>`
+ * and so on), which is what ties the two halves together - a schema that drifts
+ * from the copy does not compile, and an answer that drifts from the schema
+ * does not parse. `ValOpsHttp` in `@valbuild/server` reads every other content
+ * route the same way.
+ *
+ * Nothing here is laxer than the copy. An optional field is optional because
+ * the service says so; making a required one optional here would hide exactly
+ * the drift this file exists to catch.
+ */
+export type { PublishProblem, PublishState };
+export type DeclareBody = ContentPublishApi["/publish"]["POST"]["body"];
+export type DeclareResponse = ContentPublishApi["/publish"]["POST"]["res"];
+export type ArtifactsResponse = ContentPublishApi["/publish/:publishId/artifacts"]["POST"]["res"];
+export type VerifyResponse = ContentPublishApi["/publish/:publishId/verify"]["POST"]["res"];
+export type PromoteResponse = ContentPublishApi["/publish/:publishId/promote"]["POST"]["res"];
+export type StatusResponse = ContentPublishApi["/publish/:publishId"]["GET"]["res"];
+export type PublishTokenResponse = ContentPublishApi["/publish-token"]["POST"]["res"];
+/** An artifact, as it is declared: by key, by hash, by size. */
+export type DeclaredArtifact = DeclareBody["artifacts"][number];
+/** Permission to write one artifact's bytes to object storage. */
+export type UploadSlot = DeclareResponse["uploads"][number];
+/**
+ * Content answered, and the answer was not one this CLI can act on.
+ *
+ * Separate from a refusal, which is content saying no in a sentence meant for
+ * a person. This is two programs disagreeing - the copy in `contentApi.ts` and
+ * the service that has moved on from it - and the two want opposite things
+ * said about them.
+ */
+export declare class PublishProtocolError extends Error {
+    constructor(message: string);
+}
+export declare const parseDeclare: (body: unknown) => DeclareResponse;
+export declare const parseArtifacts: (body: unknown) => ArtifactsResponse;
+export declare const parseVerify: (body: unknown) => VerifyResponse;
+export declare const parsePromote: (body: unknown) => PromoteResponse;
+export declare const parseStatus: (body: unknown) => StatusResponse;
+export declare const parsePublishToken: (body: unknown, call: string) => PublishTokenResponse;
+/**
+ * What a build targets, and the project's files, as the Studio asks for them.
+ *
+ * Both are read through `/publish-api` rather than fetched from the loader,
+ * because a browser has neither the loader's address nor a credential it would
+ * accept. `fetchBuildTarget` in `@valbuild/tanstack-build` is the other half --
+ * same shape, a different caller, and it CASTS where this parses.
+ *
+ * Parsed rather than cast here because of what sits in between: a proxy, a
+ * gateway and a service boundary. An HTML error page cast to `BuildTarget`
+ * fails several layers down inside rolldown with a message about a module
+ * specifier, and the publish that follows would label a build against a layer
+ * that was never there.
+ *
+ * The TYPE is inferred from this schema instead of imported. `BuildTarget` is
+ * declared in `@valbuild/tanstack-build`, which has no zod and deliberately
+ * almost no dependencies -- it goes into a browser bundle -- and this package
+ * is imported by everything. The declarations are kept honest at the one place
+ * the value is used: it is passed straight into `buildUserApp({ target })`, so
+ * a drift between them is a compile error at that call rather than a runtime
+ * surprise.
+ */
+declare const buildTargetResponse: z.ZodObject<{
+    base: z.ZodObject<{
+        rev: z.ZodString;
+        shellRev: z.ZodString;
+        rscShellRev: z.ZodString;
+        modules: z.ZodRecord<z.ZodString, z.ZodString>;
+        rscModules: z.ZodRecord<z.ZodString, z.ZodString>;
+        paths: z.ZodObject<{
+            baseFromProject: z.ZodString;
+            projectVendorDir: z.ZodString;
+            rscVendorBase: z.ZodString;
+            rscRuntimeSpecifier: z.ZodString;
+            rscRuntimePath: z.ZodString;
+            flightServer: z.ZodString;
+            serverFnBase: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    project: z.ZodObject<{
+        rev: z.ZodNullable<z.ZodString>;
+        rsc: z.ZodBoolean;
+        modules: z.ZodRecord<z.ZodString, z.ZodString>;
+        css: z.ZodRecord<z.ZodString, z.ZodString>;
+        workerOnly: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type BuildTargetResponse = z.infer<typeof buildTargetResponse>;
+/**
+ * `null` files is a real answer: a project that has never published.
+ *
+ * Distinguished from an empty record, which would be a project that published
+ * nothing -- and which a build would take as "no entry point" rather than as
+ * "there is nothing here yet".
+ */
+declare const projectSourceResponse: z.ZodObject<{
+    files: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type ProjectSourceResponse = z.infer<typeof projectSourceResponse>;
+export declare const parseBuildTarget: (body: unknown) => BuildTargetResponse;
+export declare const parseProjectSource: (body: unknown) => ProjectSourceResponse;
+/**
+ * The `details` of a refusal, when it carries a list of problems.
+ *
+ * Every non-2xx is `{ statusCode, message, details? }`, and the publish routes
+ * put `PublishProblem[]` in `details` - a declaration is answered with EVERY
+ * problem rather than the first, because finding them one round trip at a time
+ * is how a publish takes six attempts. Anything else in there is somebody
+ * else's `details` and is left to the caller's own message.
+ */
+export declare function parseProblems(details: unknown): PublishProblem[];

package/dist/declarations/src/internal/server/requestScopedMemo.d.ts

@@ -0,0 +1,47 @@
+/**
+ * One value, computed once per REQUEST.
+ *
+ * `fetchVal` in draft mode reads the whole module tree out of `/sources/~`, and
+ * a page that calls it three times used to ask three times — the answer being
+ * byte-identical each time, because the query and the session are fixed for the
+ * length of a request. This is what makes the second and third call free.
+ *
+ * ## Why the scope is the REQUEST and can never be wider
+ *
+ * The memoised response is `own_patch_groups_only: true` — it contains the
+ * CALLER'S OWN unpublished work, resolved from their session cookie. A memo
+ * that outlived the request would serve one author's staged edits to the next
+ * visitor, which is the exact failure `own_patch_groups_only` exists to
+ * prevent, and it would be invisible: the draft would simply render somebody
+ * else's half-finished sentence.
+ *
+ * So this module holds NO state of its own. The caller supplies the box, and
+ * the box has to come from something the framework already scopes to the
+ * request — React's `cache()` in an RSC, a `WeakMap` keyed on the `Request` in
+ * TanStack Start. `null` means "no request scope available", and that is not an
+ * error: it falls back to computing every time, which is what the code did
+ * before this existed. Ineffective is a safe failure here; leaking is not.
+ *
+ * The `key` is the second half of that guarantee. It carries whatever the
+ * answer depends on — the session — so a box that somehow outlived its request,
+ * or is shared by two sessions, MISSES rather than serving the wrong draft.
+ *
+ * ## The promise is cached, not the value
+ *
+ * React renders siblings concurrently, so three `fetchVal` calls in one page
+ * are usually in flight at the same time rather than one after another.
+ * Caching the resolved value would dedupe none of them; caching the promise
+ * dedupes both orderings.
+ */
+export type RequestScopedMemo<T> = {
+    key?: string;
+    promise?: Promise<T>;
+};
+/**
+ * Returns the memoised promise for `key`, computing it only on a miss.
+ *
+ * A rejection is memoised along with everything else, on purpose: one failed
+ * read per request is the same answer for every caller in it, and retrying it
+ * two more times only makes a broken draft slower to render.
+ */
+export declare function memoizePerRequest<T>(box: RequestScopedMemo<T> | null, key: string, compute: () => Promise<T>): Promise<T>;

package/dist/{getSitemapTree-99839b02.cjs.prod.js → getSitemapTree-0ed3deac.cjs.prod.js}

@@ -488,6 +488,7 @@ exports._arrayLikeToArray = _arrayLikeToArray;
 exports._createForOfIteratorHelper = _createForOfIteratorHelper;
 exports._defineProperty = _defineProperty;
 exports._objectSpread2 = _objectSpread2;
+exports._toPropertyKey = _toPropertyKey;
 exports._typeof = _typeof;
 exports._unsupportedIterableToArray = _unsupportedIterableToArray;
 exports.getNextAppRouterSourceFolder = getNextAppRouterSourceFolder;

package/dist/{getSitemapTree-878d3888.esm.js → getSitemapTree-6fcdf745.esm.js}

@@ -475,4 +475,4 @@ function getPatternFromModuleFilePath(moduleFilePath, srcFolder) {
   .replace("/page.val.ts", "").replace("/page.val.js", "");
 }
 
-export { DEFAULT_CANVAS_SELECTION as D, VAL_CONFIG_SESSION_STORAGE_KEY as V, _createForOfIteratorHelper as _, VAL_THEME_SESSION_STORAGE_KEY as a, VAL_AI_SESSION_STORAGE_KEY as b, VAL_CANVAS_PARAM as c, VAL_CANVAS_MESSAGE as d, DEFAULT_CANVAS_SELECTION_SOFT as e, isValCanvasStudioMessage as f, isValCanvasFrame as g, getNextAppRouterSourceFolder as h, isValCanvasPageMessage as i, getTanStackRouterSourceFolder as j, getPageRouterSourceFolder as k, isTanStackRoutesFolder as l, getPageRouterSitemapTree as m, getPatternFromModuleFilePath as n, _objectSpread2 as o, parseRoutePattern as p, _arrayLikeToArray as q, _unsupportedIterableToArray as r, _typeof as s, _defineProperty as t, withValCanvasParam as w };
+export { DEFAULT_CANVAS_SELECTION as D, VAL_CONFIG_SESSION_STORAGE_KEY as V, _createForOfIteratorHelper as _, VAL_THEME_SESSION_STORAGE_KEY as a, VAL_AI_SESSION_STORAGE_KEY as b, VAL_CANVAS_PARAM as c, VAL_CANVAS_MESSAGE as d, DEFAULT_CANVAS_SELECTION_SOFT as e, isValCanvasStudioMessage as f, isValCanvasFrame as g, getNextAppRouterSourceFolder as h, isValCanvasPageMessage as i, getTanStackRouterSourceFolder as j, getPageRouterSourceFolder as k, isTanStackRoutesFolder as l, getPageRouterSitemapTree as m, getPatternFromModuleFilePath as n, _objectSpread2 as o, parseRoutePattern as p, _arrayLikeToArray as q, _unsupportedIterableToArray as r, _typeof as s, _defineProperty as t, _toPropertyKey as u, withValCanvasParam as w };

package/dist/{getSitemapTree-99c97c62.cjs.dev.js → getSitemapTree-c732e09a.cjs.dev.js}

@@ -488,6 +488,7 @@ exports._arrayLikeToArray = _arrayLikeToArray;
 exports._createForOfIteratorHelper = _createForOfIteratorHelper;
 exports._defineProperty = _defineProperty;
 exports._objectSpread2 = _objectSpread2;
+exports._toPropertyKey = _toPropertyKey;
 exports._typeof = _typeof;
 exports._unsupportedIterableToArray = _unsupportedIterableToArray;
 exports.getNextAppRouterSourceFolder = getNextAppRouterSourceFolder;