@valbuild/shared 0.136.10 → 0.138.0

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # @valbuild/shared
 
+## 0.138.0
+
+### Minor Changes
+
+- [#754](https://github.com/valbuild/val/pull/754) [`6216172`](https://github.com/valbuild/val/commit/62161729aa40f737590b0a8093c0394385fffd8d) Thanks [@freekh](https://github.com/freekh)! - Connected projects hosted on the Val platform publish as a queued job too.
+
+  For a project with a GitHub repository whose site runs on the Val platform, pressing **Publish** is now a request, just as it is for a managed project. The Studio sends the job's changes; the content service pushes them as one commit on top of whatever is on the branch at that moment, so a developer's code push in between is kept. CI then builds it. A developer's change to the site's content files that this deployment has not seen stops the publish before anything is pushed, and says so.
+
+  - A build that CI reports as failed shows "Published, not on the site yet", with **View run**. The next publish builds again.
+  - New CLI command, `val ci-report --status failed|succeeded`, for a workflow's last step. It reads the commit, the branch and the run's address from GitHub Actions, uses the same `VAL_PROJECT_TOKEN` as `val publish`, and never fails the job.
+
+  Connected projects on a host of their own (for example Vercel) publish exactly as before.
+
+- [#754](https://github.com/valbuild/val/pull/754) [`40e933d`](https://github.com/valbuild/val/commit/40e933da7fe01cfe1c3f4a43c156f0b2f8a11f62) Thanks [@freekh](https://github.com/freekh)! - Publishing a managed project is now a queued job, and a publish is either live or it did not happen.
+
+  Pressing **Publish** in a managed project no longer commits first and builds after. It asks the content service for a publish job and returns at once; the Studio tab that pressed builds the job and uploads it, and the content service checks the build renders and makes it live — recording the commit only then. So there is no longer a "Saved, not yet live" state to get stuck in, and no **Finish publishing** button to get out of it.
+
+  - A press made while another publish is going out is queued behind it, and built when its turn comes by whichever open Studio tab is free.
+  - A tab that closes after uploading costs nothing: the rest of the publish is the content service's.
+  - A publish that fails before it goes live says so, with **Try again** and **Discard changes**. Your changes are kept either way.
+  - Publishing from the site (a page that cannot build) still opens a Studio window to build it; the window now runs the publish job for the page.
+
+  Connected projects (with a repository) that are hosted on the Val platform publish as a queued job too — see the note on connected projects. Those hosted elsewhere, for example on Vercel, publish exactly as before.
+
+  For the Val server: the publish proxy now forwards the publish-job routes, `/api/val/publish-job-prepare` renders a job's sources and hands content its archive, and `/api/val/built-source` is removed.
+
+### Patch Changes
+
+- Updated dependencies [[`57af895`](https://github.com/valbuild/val/commit/57af8959cc46519a405b1ed7441623f8bf2e6d27), [`5876fe0`](https://github.com/valbuild/val/commit/5876fe075fdee1f76f1cdaa2488ac52c58c894a8)]:
+  - @valbuild/core@0.138.0
+
+## 0.137.0
+
+### Minor Changes
+
+- [#676](https://github.com/valbuild/val/pull/676) [`48ac9f0`](https://github.com/valbuild/val/commit/48ac9f06dd59a5b4ca60232b1ef198cf42f23aa6) Thanks [@freekh](https://github.com/freekh)! - A link-check endpoint, so the Studio can find out whether an external page is
+  still there.
+
+  `POST /external-urls/check` opens up to twenty URLs and reports what answered:
+  the final status after redirects, where it ended up, and how long it took. The
+  Studio's Check button in the external pages dialog is the only caller, and it
+  cannot do this itself — a cross-origin `fetch` from a browser cannot read a
+  response status without CORS headers no ordinary site sends.
+
+  It is an endpoint that makes outbound requests to addresses your content
+  supplies, so it is built as one:
+
+  - It is behind the same session check as every other authenticated route —
+    which, in fs mode, means the same anonymous access every other route allows
+    on a developer's own machine. It is not a new way in; it is the same door.
+  - It refuses to connect to anything that is not a public internet address —
+    loopback, link-local, the private ranges, the carrier-grade NAT range, and
+    the cloud metadata service that hands out instance credentials. The check is
+    on the RESOLVED address rather than the hostname, so a name that resolves to
+    `127.0.0.1` is refused, and it runs again at every redirect hop.
+  - It answers with one generic message for anything it refused, so the endpoint
+    cannot be used to find out what a hostname resolves to from inside your
+    network. The reason is logged on the server.
+  - `HEAD` first, `GET` only where a site answers 405 or 501 to it, and no
+    connection reuse between targets.
+
+- [#746](https://github.com/valbuild/val/pull/746) [`e2bfc0e`](https://github.com/valbuild/val/commit/e2bfc0e40383fe25d3ec0473d1032f6264a8939f) Thanks [@freekh](https://github.com/freekh)! - A site hosted on Val (a managed project, with no repository of its own) can now be updated from the Studio. **Settings → Updates** says whether a newer version of the software the site runs on is available, lists the packages that move and their versions, and offers **Update site**.
+
+  Updating rebuilds the site in the browser on the new versions and publishes it through the ordinary publish, so it is checked before it goes live: if the updated site does not render, nothing changes and the site keeps running the old versions. Unpublished changes are kept and are **not** published by an update. After it goes live, reload the Studio to use the new one.
+
+  In Safari, which cannot build the site in the Studio's own page, Update site opens a tab that builds and publishes it, the same way a publish does there, and the Studio follows its progress.
+
+  A Studio that was opened before the site was updated no longer publishes: pressing Publish asks you to reload first, and nothing is saved until you do. Your unpublished changes are kept. Without this, a Studio left open from before an update would have built the site with the previous version of itself.
+
+  The versions come from the template the project was made from, as the platform last built it. A project whose code lives in a repository is not offered this; its dependencies are updated there.
+
+  For hosts: `@valbuild/server` forwards `GET` and `POST /api/val/publish-api/update-target` to the content service, beside `/build-target` and `/project-source`.
+
+### Patch Changes
+
+- [#748](https://github.com/valbuild/val/pull/748) [`beda04b`](https://github.com/valbuild/val/commit/beda04bd326cbab18ed103e8d43917b16f43bd8c) Thanks [@freekh](https://github.com/freekh)! - A save is no longer refused once because an older answer from the server arrived after a newer one. The content service now reports a version of its list of changes, which goes up with every save, discard and publish. The Studio ignores any answer older than one it already has, including the answer to its own last save, discard or publish, so a discarded change can no longer briefly come back, and a published one can no longer briefly show as unpublished.
+- Updated dependencies [[`43b58f2`](https://github.com/valbuild/val/commit/43b58f2962840883badf91950da2c51b89d1c7cb)]:
+  - @valbuild/core@0.137.0
+
 ## 0.136.10
 
 ### Patch Changes

package/dist/declarations/src/internal/ApiRoutes.d.ts

@@ -424,6 +424,7 @@ export declare const Api: {
                     mode: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"fs">]>;
                     jsonEntriesSha: z.ZodOptional<z.ZodString>;
                     sourceMode: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"managed">, z.ZodLiteral<"connected">]>>;
+                    publishJobs: z.ZodOptional<z.ZodBoolean>;
                     publishRefusal: z.ZodOptional<z.ZodObject<{
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
@@ -440,6 +441,7 @@ export declare const Api: {
                     appliedPatches: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>>;
                     headCommitSha: z.ZodOptional<z.ZodString>;
                     headPatchId: z.ZodOptional<z.ZodNullable<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>>;
+                    headVersion: z.ZodOptional<z.ZodNumber>;
                     commits: z.ZodArray<z.ZodObject<{
                         commitSha: z.ZodString;
                         clientCommitSha: z.ZodNullable<z.ZodString>;
@@ -469,6 +471,7 @@ export declare const Api: {
                     profileId: z.ZodNullable<z.ZodString>;
                     mode: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"fs">]>;
                     sourceMode: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"managed">, z.ZodLiteral<"connected">]>>;
+                    publishJobs: z.ZodOptional<z.ZodBoolean>;
                     publishRefusal: z.ZodOptional<z.ZodObject<{
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
@@ -567,6 +570,55 @@ export declare const Api: {
             }, z.core.$strip>]>;
         };
     };
+    /**
+     * Open a batch of external URLs and report what answered.
+     *
+     * A batch rather than one URL because the client checks a list, and a POST
+     * rather than a GET because the list is the input and does not belong in a
+     * URL or a cache.
+     *
+     * The server makes outbound requests to addresses this body supplies, which
+     * is SSRF by construction - see `linkCheck/addressGuard.ts` for the deny
+     * list that makes it safe, and `docs/plans/external-page-link-checks.md` for
+     * why it is a deny list on the RESOLVED address.
+     */
+    "/external-urls/check": {
+        POST: {
+            req: {
+                body: z.ZodObject<{
+                    urls: z.ZodArray<z.ZodString>;
+                }, z.core.$strip>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodUnion<readonly [z.ZodObject<{
+                status: z.ZodLiteral<401>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<200>;
+                json: z.ZodObject<{
+                    results: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        kind: z.ZodLiteral<"answered">;
+                        code: z.ZodNumber;
+                        finalUrl: z.ZodString;
+                        ms: z.ZodNumber;
+                    }, z.core.$strip>, z.ZodObject<{
+                        kind: z.ZodLiteral<"unreachable">;
+                        message: z.ZodString;
+                    }, z.core.$strip>, z.ZodObject<{
+                        kind: z.ZodLiteral<"timeout">;
+                        ms: z.ZodNumber;
+                    }, z.core.$strip>, z.ZodObject<{
+                        kind: z.ZodLiteral<"skipped">;
+                        message: z.ZodString;
+                    }, z.core.$strip>]>>;
+                }, z.core.$strip>;
+            }, z.core.$strip>]>;
+        };
+    };
     "/direct-file-upload-settings": {
         POST: {
             req: {
@@ -608,6 +660,7 @@ export declare const Api: {
                 };
                 body: z.ZodOptional<z.ZodObject<{
                     unstagePatchIds: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>>;
+                    reportHeadVersion: z.ZodOptional<z.ZodLiteral<true>>;
                 }, z.core.$strip>>;
                 cookies: {
                     val_session: z.ZodOptional<z.ZodString>;
@@ -632,7 +685,10 @@ export declare const Api: {
                 }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 status: z.ZodLiteral<200>;
-                json: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
+                json: z.ZodUnion<readonly [z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>, z.ZodObject<{
+                    deleted: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
+                    headVersion: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>]>;
             }, z.core.$strip>]>;
         };
         PUT: {
@@ -692,6 +748,7 @@ export declare const Api: {
                         patchId: z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>;
                     }, z.core.$strip>]>;
                     patchGroupId: z.ZodOptional<z.ZodString>;
+                    headVersion: z.ZodOptional<z.ZodNumber>;
                 }, z.core.$strip>;
             }, z.core.$strip>]>;
         };
@@ -1023,24 +1080,14 @@ export declare const Api: {
             }, z.core.$strip>]>;
         };
     };
-    /**
-     * The `.val.ts` text of every module that changed since the RUNNING build,
-     * with every commit since it applied, for a build made in the browser.
-     *
-     * A Studio build starts from the source stored with the live build. A commit
-     * whose own publish failed -- or the first commit of a project that started
-     * as a copy of a template -- is in content and in no stored source, so a build
-     * that added only its own save's files shipped without it. Only this server
-     * can render those commits back into text: content keeps a managed project's
-     * content as Source, not as files.
-     *
-     * Committed patches only. A pending one is somebody's unpublished work, and
-     * is not this build's to ship. 409 where there is nothing to answer with: a
-     * project with a repository, or a build that did not embed its source.
-     */
-    "/built-source": {
-        GET: {
+    "/publish-job-prepare": {
+        POST: {
             req: {
+                body: z.ZodObject<{
+                    jobId: z.ZodString;
+                    tab: z.ZodString;
+                    patchIds: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
+                }, z.core.$strip>;
                 cookies: {
                     val_session: z.ZodOptional<z.ZodString>;
                 };
@@ -1050,6 +1097,11 @@ export declare const Api: {
                 json: z.ZodObject<{
                     message: z.ZodString;
                 }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<400>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 status: z.ZodLiteral<409>;
                 json: z.ZodObject<{
@@ -1060,10 +1112,28 @@ export declare const Api: {
                 json: z.ZodObject<{
                     message: z.ZodString;
                 }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<502>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 status: z.ZodLiteral<200>;
                 json: z.ZodObject<{
-                    files: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>;
+                    job: z.ZodNullable<z.ZodObject<{
+                        id: z.ZodString;
+                        step: z.ZodNullable<z.ZodEnum<{
+                            prepare: "prepare";
+                            build: "build";
+                            upload: "upload";
+                        }>>;
+                        base: z.ZodNullable<z.ZodString>;
+                        patches: z.ZodArray<z.ZodString>;
+                    }, z.core.$strip>>;
+                    sourceFiles: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>;
+                    binaryFiles: z.ZodRecord<z.ZodString, z.ZodString>;
+                    binaryFilesUnread: z.ZodArray<z.ZodString>;
+                    branch: z.ZodNullable<z.ZodString>;
                 }, z.core.$strip>;
             }, z.core.$strip>]>;
         };
@@ -1131,6 +1201,7 @@ export declare const Api: {
                         moduleFilePath: z.ZodString & z.ZodType<ModuleFilePath, string, z.core.$ZodTypeInternals<ModuleFilePath, string>>;
                         message: z.ZodString;
                     }, z.core.$strip>>>;
+                    headVersion: z.ZodOptional<z.ZodNumber>;
                 }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 status: z.ZodLiteral<403>;

package/dist/declarations/src/internal/publish/contentApi.d.ts

@@ -1,10 +1,12 @@
 /**
  * The publish API's types, COPIED from the service that serves them.
  *
- * Source: `content/src/handlers/Api.ts` in valbuild/home, branch
- * `claude/new-project-studio-saves-0g9ksb`, commit `ecf3b8d`. The routes below
- * are that file's `/publish*` entries and the two types they use, verbatim,
- * comments included, so that the two can be diffed by eye.
+ * Source: `content/src/handlers/Api.ts` in valbuild/home. The routes below
+ * are that file's `/publish*` entries and the types they use, verbatim,
+ * comments included, so that the two can be diffed by eye: the publish
+ * lifecycle from branch `claude/new-project-studio-saves-0g9ksb`, commit
+ * `ecf3b8d`; the publish-job routes (`/publish-requests`, `/publish-jobs`)
+ * and `PublishRequestStatus` / `PublishTabJob` from `main`, commit `acb4a49`, with `/ci-runs`.
  *
  * **Copied rather than imported, because it cannot be imported.** That file
  * lives in a private repository which publishes nothing to npm, and its own
@@ -23,6 +25,7 @@
  * A copy is not a guarantee, only a tripwire: nothing checks it against the
  * service, and the parsers in `protocol.ts` are what actually holds at runtime.
  */
+import type { Json } from "@valbuild/core";
 export type ContentPublishApi = {
     /**
      * Publishing a build, as a resource with a lifecycle.
@@ -175,6 +178,173 @@ export type ContentPublishApi = {
             };
         };
     };
+    /**
+     * Publishing as a queued job: a press of Publish is a REQUEST, and returns
+     * at once. A job takes every queued request and everything pending; the tab
+     * that pressed runs its prepare (through the Val server), build and upload,
+     * reporting each step; then content runs verify and the seal itself. See
+     * docs/app-mode.md, "Publishing is a queued job".
+     *
+     * ```
+     * POST /publish-requests             press    -> the request, and a job to build
+     * GET  /publish-requests/{id}        where it is: queued, publishing, live, failed
+     * POST /publish-requests/try-again   Try again: resume a paused queue, press anew
+     * POST /publish-jobs/next            a free tab asks for queued work
+     * POST /publish-jobs/{id}/prepare    the job's sources, archived (the Val server's)
+     * POST /publish-jobs/{id}/steps      the tab reports build and upload
+     * POST /publish-jobs/{id}/renew      the tab is still building
+     * POST /publish-jobs/{id}/cancel     Cancel, before the seal
+     * POST /publish-jobs/{id}/discard    Discard these changes, on a failed job
+     * ```
+     *
+     * Every id the Studio sends -- a request's, a tab's -- is its own, minted by
+     * it, `[A-Za-z0-9_-]{1,100}`. A press is idempotent on its request id; a step
+     * report names its step, so one retried after a lost answer does nothing
+     * twice.
+     */
+    /**
+     * CI's own report of how a build of a git commit went, sent by the
+     * connected workflow's last step with its project token. See `ciRuns.ts`.
+     */
+    "/ci-runs": {
+        POST: {
+            body: {
+                commit: string;
+                branch?: string;
+                status: "failed" | "succeeded";
+                url?: string;
+            };
+            res: {
+                recorded: true;
+            };
+        };
+    };
+    "/ci-runs/newest": {
+        GET: {
+            res: {
+                run: {
+                    commit: string;
+                    status: "failed" | "succeeded";
+                    url: string | null;
+                } | null;
+            };
+        };
+    };
+    "/publish-requests": {
+        POST: {
+            body: {
+                requestId: string;
+                tab: string;
+            };
+            res: {
+                request: PublishRequestStatus;
+                job: PublishTabJob | null;
+            };
+        };
+    };
+    "/publish-requests/try-again": {
+        POST: {
+            body: {
+                requestId: string;
+                tab: string;
+            };
+            res: {
+                request: PublishRequestStatus;
+                job: PublishTabJob | null;
+            };
+        };
+    };
+    "/publish-requests/:requestId": {
+        GET: {
+            res: {
+                request: PublishRequestStatus;
+            };
+        };
+    };
+    "/publish-jobs/next": {
+        POST: {
+            body: {
+                tab: string;
+            };
+            res: {
+                job: PublishTabJob | null;
+            };
+        };
+    };
+    "/publish-jobs/:jobId/prepare": {
+        POST: {
+            /**
+             * `/commit`'s body, less what names a commit: the job's commit is minted
+             * at the seal. `modules` is required here -- a managed commit's archive,
+             * written from it, is the only copy of what it published.
+             */
+            body: {
+                tab: string;
+                root: string;
+                filesDirectory?: string;
+                patchedSourceFiles: Record<string, string | null>;
+                patchedBinaryFilesDescriptors: Record<string, {
+                    patchId: string;
+                    remote?: boolean;
+                }>;
+                modules: Record<string, {
+                    source: Json;
+                    schema: Json;
+                }>;
+                /**
+                 * Connected: the git commit the Studio's deployment was built from. A
+                 * branch whose tip is that commit has nothing it has not seen.
+                 */
+                gitCommit?: string;
+            };
+            res: {
+                job: PublishTabJob | null;
+            };
+        };
+    };
+    "/publish-jobs/:jobId/steps": {
+        POST: {
+            body: {
+                tab: string;
+                step: "prepare" | "build" | "upload";
+                ok: boolean;
+                /** A finished build step: the id of the publish (`POST /publish`) it declared. */
+                build?: string;
+            };
+            res: {
+                job: PublishTabJob | null;
+            };
+        };
+    };
+    "/publish-jobs/:jobId/renew": {
+        POST: {
+            body: {
+                tab: string;
+            };
+            res: {
+                renewed: boolean;
+            };
+        };
+    };
+    "/publish-jobs/:jobId/cancel": {
+        POST: {
+            res: {
+                cancelled: boolean;
+            };
+        };
+    };
+    "/publish-jobs/:jobId/discard": {
+        POST: {
+            /** The forward closure, as `DELETE /patches` takes it. */
+            body: {
+                unstagePatchIds?: string[];
+            };
+            /** Changes it could not discard: another job in flight holds them. */
+            res: {
+                stillHeld: string[];
+            };
+        };
+    };
 };
 /**
  * Where a publish is. Mirrors `PublishState` in `utils/publishPlan.ts`, which
@@ -199,3 +369,36 @@ export type PublishProblem = {
     hint?: string;
     keys?: string[];
 };
+/**
+ * Where a press of Publish is. `live` names the commit that carries it -- its
+ * own, or a newer one that contains it; `failed` names what the editor can do.
+ * The same shape as `RequestStatus` in `utils/jobPlan.ts`, which decides it.
+ */
+export type PublishRequestStatus = {
+    kind: "queued";
+} | {
+    kind: "publishing";
+} | {
+    kind: "live";
+    commit: string;
+} | {
+    kind: "failed";
+    message: string;
+    actions: ("try-again" | "discard" | "re-run-build")[];
+    /** The job that failed: what Discard is pressed on. */
+    job: string;
+} | {
+    kind: "cancelled";
+} | {
+    kind: "nothing-to-publish";
+};
+/** What a tab needs to know about a job it is running. */
+export type PublishTabJob = {
+    id: string;
+    /** The step the tab is to run next; null once the job is content's. */
+    step: "prepare" | "build" | "upload" | null;
+    /** The recorded commit its build is based on. */
+    base: string | null;
+    /** The changes its build is to include, on top of `base`. */
+    patches: string[];
+};

package/dist/declarations/src/internal/publish/protocol.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ContentPublishApi, PublishProblem, PublishState } from "./contentApi.js";
+import { ContentPublishApi, PublishProblem, PublishRequestStatus, PublishState, PublishTabJob } from "./contentApi.js";
 /**
  * Reading what content answers.
  *
@@ -115,8 +115,105 @@ declare const projectSourceResponse: z.ZodObject<{
     publicPaths: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
 }, z.core.$strip>;
 export type ProjectSourceResponse = z.infer<typeof projectSourceResponse>;
+/**
+ * Whether a managed project can be updated onto its template's current seed,
+ * and -- when it is asked with `POST`, the press -- what to build against.
+ *
+ * An update rebuilds the site as it is on newer dependencies. The loader
+ * decides whether there is one; content adds whether the project is managed at
+ * all, and the branch head the rebuild is wired at, because an update
+ * publishes no content of its own.
+ *
+ * `target` is a `/build-target` answer whose project half is the SEED's
+ * dependency layer, already copied into the project so a publish can name it.
+ * Only a `POST` carries it.
+ */
+declare const dependencyChange: z.ZodObject<{
+    name: z.ZodString;
+    section: z.ZodEnum<{
+        dependencies: "dependencies";
+        devDependencies: "devDependencies";
+    }>;
+    from: z.ZodNullable<z.ZodString>;
+    to: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+declare const updateTargetResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"current">;
+    template: z.ZodString;
+    layerRev: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"available">;
+    template: z.ZodString;
+    changes: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        section: z.ZodEnum<{
+            dependencies: "dependencies";
+            devDependencies: "devDependencies";
+        }>;
+        from: z.ZodNullable<z.ZodString>;
+        to: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    layerRev: z.ZodObject<{
+        from: z.ZodNullable<z.ZodString>;
+        to: z.ZodString;
+    }, z.core.$strip>;
+    packageJson: z.ZodString;
+    commit: z.ZodNullable<z.ZodString>;
+    branch: z.ZodString;
+    target: z.ZodOptional<z.ZodObject<{
+        base: z.ZodObject<{
+            rev: z.ZodString;
+            shellRev: z.ZodString;
+            rscShellRev: z.ZodString;
+            modules: z.ZodRecord<z.ZodString, z.ZodString>;
+            rscModules: z.ZodRecord<z.ZodString, z.ZodString>;
+            paths: z.ZodObject<{
+                baseFromProject: z.ZodString;
+                projectVendorDir: z.ZodString;
+                rscVendorBase: z.ZodString;
+                rscRuntimeSpecifier: z.ZodString;
+                rscRuntimePath: z.ZodString;
+                flightServer: z.ZodString;
+                serverFnBase: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        project: z.ZodObject<{
+            rev: z.ZodNullable<z.ZodString>;
+            rsc: z.ZodBoolean;
+            modules: z.ZodRecord<z.ZodString, z.ZodString>;
+            css: z.ZodRecord<z.ZodString, z.ZodString>;
+            workerOnly: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"unavailable">;
+    reason: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>], "status">;
+export type UpdateTargetResponse = z.infer<typeof updateTargetResponse>;
+export type DependencyChange = z.infer<typeof dependencyChange>;
+export declare const parseUpdateTarget: (body: unknown) => UpdateTargetResponse;
 export declare const parseBuildTarget: (body: unknown) => BuildTargetResponse;
 export declare const parseProjectSource: (body: unknown) => ProjectSourceResponse;
+export type { PublishRequestStatus, PublishTabJob };
+export type PressResponse = ContentPublishApi["/publish-requests"]["POST"]["res"];
+export type RequestStatusResponse = ContentPublishApi["/publish-requests/:requestId"]["GET"]["res"];
+export type NextJobResponse = ContentPublishApi["/publish-jobs/next"]["POST"]["res"];
+export type JobPrepareBody = ContentPublishApi["/publish-jobs/:jobId/prepare"]["POST"]["body"];
+export type JobStepBody = ContentPublishApi["/publish-jobs/:jobId/steps"]["POST"]["body"];
+export type JobStepResponse = ContentPublishApi["/publish-jobs/:jobId/steps"]["POST"]["res"];
+export type JobRenewResponse = ContentPublishApi["/publish-jobs/:jobId/renew"]["POST"]["res"];
+export type JobCancelResponse = ContentPublishApi["/publish-jobs/:jobId/cancel"]["POST"]["res"];
+export type JobDiscardResponse = ContentPublishApi["/publish-jobs/:jobId/discard"]["POST"]["res"];
+export declare const parsePress: (body: unknown, call: string) => PressResponse;
+export declare const parseRequestStatus: (body: unknown) => RequestStatusResponse;
+export declare const parseJob: (body: unknown, call: string) => JobStepResponse;
+export declare const parseRenew: (body: unknown) => JobRenewResponse;
+export declare const parseCancel: (body: unknown) => JobCancelResponse;
+export declare const parseDiscard: (body: unknown) => JobDiscardResponse;
+export type CiRunReportBody = ContentPublishApi["/ci-runs"]["POST"]["body"];
+export type NewestCiRunResponse = ContentPublishApi["/ci-runs/newest"]["GET"]["res"];
+export declare const parseNewestCiRun: (body: unknown) => NewestCiRunResponse;
 /**
  * The `details` of a refusal, when it carries a list of problems.
  *