@valbuild/shared 0.141.0 → 0.143.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @valbuild/shared
 
+## 0.143.0
+
+### Patch Changes
+
+- Updated dependencies [[`f7c25bd`](https://github.com/valbuild/val/commit/f7c25bd4b44c288db8e5ab914e6d8a72c0216ba5), [`729c4ed`](https://github.com/valbuild/val/commit/729c4edfa28f5a2942c435ccf225e65858b080cc)]:
+  - @valbuild/core@0.143.0
+
+## 0.142.0
+
+### Patch Changes
+
+- [#805](https://github.com/valbuild/val/pull/805) [`3d2b9e8`](https://github.com/valbuild/val/commit/3d2b9e8c11aa6a4449527e2a1bbb363566797a14) Thanks [@freekh](https://github.com/freekh)! - Proposals in the Studio, for projects on the Val platform that have them turned on: a switcher in the top bar to move between the site and its proposals, New proposal, Rename, Close and All proposals (with Reopen), and — inside a proposal — Save where Publish is, in the proposal's colour. Nothing is shown for a project without proposals. At a proposal's address the server now refuses to publish to the site, so a Save there can never start a site build.
+
 ## 0.141.0
 
 ### Minor Changes

package/dist/declarations/src/internal/ApiRoutes.d.ts

@@ -436,6 +436,10 @@ export declare const Api: {
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
                     }, z.core.$strip>>;
+                    proposal: z.ZodOptional<z.ZodObject<{
+                        name: z.ZodString;
+                        branch: z.ZodString;
+                    }, z.core.$strip>>;
                 }, z.core.$strip>, z.ZodObject<{
                     type: z.ZodLiteral<"use-websocket">;
                     url: z.ZodString;
@@ -491,6 +495,10 @@ export declare const Api: {
                         code: z.ZodLiteral<"no-base">;
                         message: z.ZodString;
                     }, z.core.$strip>>;
+                    proposal: z.ZodOptional<z.ZodObject<{
+                        name: z.ZodString;
+                        branch: z.ZodString;
+                    }, z.core.$strip>>;
                 }, z.core.$strip>]>;
             }, z.core.$strip>]>;
         };
@@ -552,6 +560,60 @@ export declare const Api: {
             }, z.core.$strip>;
         };
     };
+    /**
+     * The content service's proposals API, reached through this deployment:
+     * list, open, read, rename, close, reopen and retry a setup
+     * (valbuild/home `docs/proposals.md`, Flow B).
+     *
+     * The same arrangement as `/publish-api`, for the same reasons: the browser
+     * holds a session for this origin and no credential content accepts, so
+     * this server checks the session, sends the project's key with the person's
+     * profile id beside it -- a proposal is opened, renamed and closed by
+     * somebody -- and carries content's status and body back unread. The sub-path
+     * is content's, after `/proposals`; `ValOpsHttp.proposalsApi` holds the
+     * allow list. A save is not here: it is `/save`, which a proposal's server
+     * sends to the proposal's own route.
+     */
+    "/proposals-api": {
+        GET: {
+            req: {
+                path: z.ZodOptional<z.ZodString>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodObject<{
+                status: z.ZodNumber;
+                json: z.ZodUnknown;
+            }, z.core.$strip>;
+        };
+        POST: {
+            req: {
+                path: z.ZodOptional<z.ZodString>;
+                body: z.ZodOptional<z.ZodUnknown>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodObject<{
+                status: z.ZodNumber;
+                json: z.ZodUnknown;
+            }, z.core.$strip>;
+        };
+        PATCH: {
+            req: {
+                path: z.ZodOptional<z.ZodString>;
+                body: z.ZodOptional<z.ZodUnknown>;
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodObject<{
+                status: z.ZodNumber;
+                json: z.ZodUnknown;
+            }, z.core.$strip>;
+        };
+    };
     "/upload/patches": {
         POST: {
             req: {
@@ -819,14 +881,14 @@ export declare const Api: {
                         patch: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                             op: z.ZodLiteral<"add">;
                             path: z.ZodArray<z.ZodString>;
-                            value: z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>;
+                            value: z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>;
                         }, z.core.$strict>, z.ZodObject<{
                             op: z.ZodLiteral<"remove">;
                             path: z.ZodTuple<[z.ZodString], z.ZodString>;
                         }, z.core.$strict>, z.ZodObject<{
                             op: z.ZodLiteral<"replace">;
                             path: z.ZodArray<z.ZodString>;
-                            value: z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>;
+                            value: z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>;
                         }, z.core.$strict>, z.ZodObject<{
                             op: z.ZodLiteral<"move">;
                             from: z.ZodTuple<[z.ZodString], z.ZodString>;
@@ -838,15 +900,15 @@ export declare const Api: {
                         }, z.core.$strict>, z.ZodObject<{
                             op: z.ZodLiteral<"test">;
                             path: z.ZodArray<z.ZodString>;
-                            value: z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>;
+                            value: z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>;
                         }, z.core.$strict>, z.ZodObject<{
                             op: z.ZodLiteral<"file">;
                             path: z.ZodArray<z.ZodString>;
                             filePath: z.ZodString;
-                            value: z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>;
+                            value: z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>;
                             remote: z.ZodBoolean;
                             nestedFilePath: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                            metadata: z.ZodOptional<z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>>;
+                            metadata: z.ZodOptional<z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>>;
                         }, z.core.$strict>], "op">>>;
                         patchId: z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>;
                         createdAt: z.ZodString;
@@ -989,7 +1051,7 @@ export declare const Api: {
                 status: z.ZodLiteral<200>;
                 json: z.ZodObject<{
                     schemaSha: z.ZodString;
-                    schemas: z.ZodRecord<z.ZodString & z.ZodType<ModuleFilePath, string, z.core.$ZodTypeInternals<ModuleFilePath, string>>, z.ZodType<import("@valbuild/core").SerializedSchema, unknown, z.core.$ZodTypeInternals<import("@valbuild/core").SerializedSchema, unknown>>>;
+                    schemas: z.ZodRecord<z.ZodString & z.ZodType<ModuleFilePath, string, z.core.$ZodTypeInternals<ModuleFilePath, string>>, z.ZodType<SerializedSchemaT, unknown, z.core.$ZodTypeInternals<SerializedSchemaT, unknown>>>;
                 }, z.core.$strip>;
             }, z.core.$strip>]>;
         };
@@ -1090,7 +1152,7 @@ export declare const Api: {
                             message: z.ZodString;
                             value: z.ZodOptional<z.ZodUnknown>;
                             fatal: z.ZodOptional<z.ZodBoolean>;
-                            fixes: z.ZodOptional<z.ZodArray<z.ZodType<"image:add-metadata" | "image:check-metadata" | "image:upload-remote" | "image:download-remote" | "image:check-remote" | "images:check-remote" | "images:upload-remote" | "file:add-metadata" | "file:check-metadata" | "file:upload-remote" | "file:download-remote" | "file:check-remote" | "files:check-remote" | "files:upload-remote" | "video:add-metadata" | "video:upload-remote" | "video:download-remote" | "videos:add-metadata" | "videos:check-remote" | "videos:upload-remote" | "keyof:check-keys" | "router:check-route" | "locale:check-locale" | "images:check-unique-folder" | "files:check-unique-folder" | "images:check-all-files" | "files:check-all-files" | "videos:check-unique-folder" | "videos:check-all-files" | "jsonValues:extract-entry" | "record:fill-keys" | "external:upload" | "view:check-module", unknown, z.core.$ZodTypeInternals<"image:add-metadata" | "image:check-metadata" | "image:upload-remote" | "image:download-remote" | "image:check-remote" | "images:check-remote" | "images:upload-remote" | "file:add-metadata" | "file:check-metadata" | "file:upload-remote" | "file:download-remote" | "file:check-remote" | "files:check-remote" | "files:upload-remote" | "video:add-metadata" | "video:upload-remote" | "video:download-remote" | "videos:add-metadata" | "videos:check-remote" | "videos:upload-remote" | "keyof:check-keys" | "router:check-route" | "locale:check-locale" | "images:check-unique-folder" | "files:check-unique-folder" | "images:check-all-files" | "files:check-all-files" | "videos:check-unique-folder" | "videos:check-all-files" | "jsonValues:extract-entry" | "record:fill-keys" | "external:upload" | "view:check-module", unknown>>>>;
+                            fixes: z.ZodOptional<z.ZodArray<z.ZodType<ValidationFix, unknown, z.core.$ZodTypeInternals<ValidationFix, unknown>>>>;
                         }, z.core.$strip>>>>;
                     }, z.core.$strip>>;
                 }, z.core.$strip>;
@@ -1156,6 +1218,38 @@ export declare const Api: {
             }, z.core.$strip>]>;
         };
     };
+    /**
+     * In a proposal: the SITE's Source for every module the proposal has saved,
+     * as the build it is based on has it. What Compare with the site diffs the
+     * proposal against -- saved and unsaved alike -- because the Studio's own
+     * base Source there is the proposal's last save. 404 anywhere that is not a
+     * proposal's address. valbuild/home `docs/proposals.md`.
+     */
+    "/proposal-site-sources": {
+        GET: {
+            req: {
+                cookies: {
+                    val_session: z.ZodOptional<z.ZodString>;
+                };
+            };
+            res: z.ZodUnion<readonly [z.ZodObject<{
+                status: z.ZodLiteral<401>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<404>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<200>;
+                json: z.ZodObject<{
+                    modules: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                }, z.core.$strip>;
+            }, z.core.$strip>]>;
+        };
+    };
     "/profiles": {
         GET: {
             req: {
@@ -1388,8 +1482,8 @@ export declare const Api: {
                         hasArchive: z.ZodBoolean;
                     }, z.core.$strip>;
                     modules: z.ZodRecord<z.ZodString, z.ZodObject<{
-                        source: z.ZodNullable<z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>>;
-                        schema: z.ZodNullable<z.ZodType<import("@valbuild/core").SerializedSchema, unknown, z.core.$ZodTypeInternals<import("@valbuild/core").SerializedSchema, unknown>>>;
+                        source: z.ZodNullable<z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>>;
+                        schema: z.ZodNullable<z.ZodType<SerializedSchemaT, unknown, z.core.$ZodTypeInternals<SerializedSchemaT, unknown>>>;
                         patchIds: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
                         changedPaths: z.ZodArray<z.ZodString>;
                         failures: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1508,8 +1602,8 @@ export declare const Api: {
                 json: z.ZodObject<{
                     moduleFilePath: z.ZodString;
                     module: z.ZodNullable<z.ZodObject<{
-                        source: z.ZodNullable<z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>>;
-                        schema: z.ZodNullable<z.ZodType<import("@valbuild/core").SerializedSchema, unknown, z.core.$ZodTypeInternals<import("@valbuild/core").SerializedSchema, unknown>>>;
+                        source: z.ZodNullable<z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>>;
+                        schema: z.ZodNullable<z.ZodType<SerializedSchemaT, unknown, z.core.$ZodTypeInternals<SerializedSchemaT, unknown>>>;
                         patchIds: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
                         changedPaths: z.ZodArray<z.ZodString>;
                         failures: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/declarations/src/internal/zod/History.d.ts

@@ -64,8 +64,8 @@ export declare const BinaryFileRef: z.ZodObject<{
 }, z.core.$strip>;
 export type BinaryFileRef = z.infer<typeof BinaryFileRef>;
 export declare const HistoricalModule: z.ZodObject<{
-    source: z.ZodNullable<z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>>;
-    schema: z.ZodNullable<z.ZodType<import("@valbuild/core").SerializedSchema, unknown, z.core.$ZodTypeInternals<import("@valbuild/core").SerializedSchema, unknown>>>;
+    source: z.ZodNullable<z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>>;
+    schema: z.ZodNullable<z.ZodType<SerializedSchemaT, unknown, z.core.$ZodTypeInternals<SerializedSchemaT, unknown>>>;
     patchIds: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
     changedPaths: z.ZodArray<z.ZodString>;
     failures: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -109,8 +109,8 @@ export declare const HistoricalPatchSet: z.ZodObject<{
         hasArchive: z.ZodBoolean;
     }, z.core.$strip>;
     modules: z.ZodRecord<z.ZodString, z.ZodObject<{
-        source: z.ZodNullable<z.ZodType<import("@valbuild/core/patch").JSONValue, unknown, z.core.$ZodTypeInternals<import("@valbuild/core/patch").JSONValue, unknown>>>;
-        schema: z.ZodNullable<z.ZodType<import("@valbuild/core").SerializedSchema, unknown, z.core.$ZodTypeInternals<import("@valbuild/core").SerializedSchema, unknown>>>;
+        source: z.ZodNullable<z.ZodType<JSONValueT, unknown, z.core.$ZodTypeInternals<JSONValueT, unknown>>>;
+        schema: z.ZodNullable<z.ZodType<SerializedSchemaT, unknown, z.core.$ZodTypeInternals<SerializedSchemaT, unknown>>>;
         patchIds: z.ZodArray<z.ZodString & z.ZodType<import("@valbuild/core").PatchId, string, z.core.$ZodTypeInternals<import("@valbuild/core").PatchId, string>>>;
         changedPaths: z.ZodArray<z.ZodString>;
         failures: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/declarations/src/internal/zod/SerializedSchema.d.ts

@@ -66,25 +66,7 @@ export declare const ColorOptions: z.ZodObject<{
 export declare const SerializedColorSchema: z.ZodType<SerializedColorSchemaT>;
 export declare const CodeOptions: z.ZodObject<{
     language: z.ZodOptional<z.ZodEnum<{
-        json: "json";
-        typescript: "typescript";
-        javascript: "javascript";
-        javascriptreact: "javascriptreact";
-        typescriptreact: "typescriptreact";
-        java: "java";
-        html: "html";
-        css: "css";
-        xml: "xml";
-        markdown: "markdown";
-        sql: "sql";
-        python: "python";
-        rust: "rust";
-        php: "php";
-        go: "go";
-        cpp: "cpp";
-        sass: "sass";
-        vue: "vue";
-        angular: "angular";
+        [x: string]: any;
     }>>;
 }, z.core.$strip>;
 export declare const SerializedCodeSchema: z.ZodType<SerializedCodeSchemaT>;

package/internal/dist/valbuild-shared-internal.cjs.dev.js

@@ -1602,6 +1602,14 @@ var PublishRefusal = zod.z.object({
   message: zod.z.string()
 });
 
+/** See `proposal` on `/stat`. */
+var StatProposal = zod.z.object({
+  /** Twenty hex characters, the hash of what it was made from. */
+  name: zod.z.string(),
+  /** `val/p/<name>`. */
+  branch: zod.z.string()
+});
+
 /**
  * A patch group: the set of patches one user has chosen to publish.
  *
@@ -2032,7 +2040,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: zod.z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         }), zod.z.object({
           type: zod.z.literal("use-websocket"),
           url: zod.z.string(),
@@ -2150,7 +2164,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: zod.z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         })])
       })])
     }
@@ -2236,6 +2256,60 @@ var Api = {
       })
     }
   },
+  /**
+   * The content service's proposals API, reached through this deployment:
+   * list, open, read, rename, close, reopen and retry a setup
+   * (valbuild/home `docs/proposals.md`, Flow B).
+   *
+   * The same arrangement as `/publish-api`, for the same reasons: the browser
+   * holds a session for this origin and no credential content accepts, so
+   * this server checks the session, sends the project's key with the person's
+   * profile id beside it -- a proposal is opened, renamed and closed by
+   * somebody -- and carries content's status and body back unread. The sub-path
+   * is content's, after `/proposals`; `ValOpsHttp.proposalsApi` holds the
+   * allow list. A save is not here: it is `/save`, which a proposal's server
+   * sends to the proposal's own route.
+   */
+  "/proposals-api": {
+    GET: {
+      req: {
+        path: zod.z.string().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    },
+    POST: {
+      req: {
+        path: zod.z.string().optional(),
+        body: zod.z.unknown().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    },
+    PATCH: {
+      req: {
+        path: zod.z.string().optional(),
+        body: zod.z.unknown().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    }
+  },
   "/upload/patches": {
     POST: {
       req: {
@@ -2765,6 +2839,32 @@ var Api = {
       })])
     }
   },
+  /**
+   * In a proposal: the SITE's Source for every module the proposal has saved,
+   * as the build it is based on has it. What Compare with the site diffs the
+   * proposal against -- saved and unsaved alike -- because the Studio's own
+   * base Source there is the proposal's last save. 404 anywhere that is not a
+   * proposal's address. valbuild/home `docs/proposals.md`.
+   */
+  "/proposal-site-sources": {
+    GET: {
+      req: {
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.union([unauthorizedResponse, zod.z.object({
+        status: zod.z.literal(404),
+        json: GenericError
+      }), zod.z.object({
+        status: zod.z.literal(200),
+        json: zod.z.object({
+          /** By module file path. A module absent here is the same in both. */
+          modules: zod.z.record(zod.z.string(), zod.z.unknown())
+        })
+      })])
+    }
+  },
   "/profiles": {
     GET: {
       req: {

package/internal/dist/valbuild-shared-internal.cjs.prod.js

@@ -1602,6 +1602,14 @@ var PublishRefusal = zod.z.object({
   message: zod.z.string()
 });
 
+/** See `proposal` on `/stat`. */
+var StatProposal = zod.z.object({
+  /** Twenty hex characters, the hash of what it was made from. */
+  name: zod.z.string(),
+  /** `val/p/<name>`. */
+  branch: zod.z.string()
+});
+
 /**
  * A patch group: the set of patches one user has chosen to publish.
  *
@@ -2032,7 +2040,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: zod.z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         }), zod.z.object({
           type: zod.z.literal("use-websocket"),
           url: zod.z.string(),
@@ -2150,7 +2164,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: zod.z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         })])
       })])
     }
@@ -2236,6 +2256,60 @@ var Api = {
       })
     }
   },
+  /**
+   * The content service's proposals API, reached through this deployment:
+   * list, open, read, rename, close, reopen and retry a setup
+   * (valbuild/home `docs/proposals.md`, Flow B).
+   *
+   * The same arrangement as `/publish-api`, for the same reasons: the browser
+   * holds a session for this origin and no credential content accepts, so
+   * this server checks the session, sends the project's key with the person's
+   * profile id beside it -- a proposal is opened, renamed and closed by
+   * somebody -- and carries content's status and body back unread. The sub-path
+   * is content's, after `/proposals`; `ValOpsHttp.proposalsApi` holds the
+   * allow list. A save is not here: it is `/save`, which a proposal's server
+   * sends to the proposal's own route.
+   */
+  "/proposals-api": {
+    GET: {
+      req: {
+        path: zod.z.string().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    },
+    POST: {
+      req: {
+        path: zod.z.string().optional(),
+        body: zod.z.unknown().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    },
+    PATCH: {
+      req: {
+        path: zod.z.string().optional(),
+        body: zod.z.unknown().optional(),
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.object({
+        status: zod.z.number(),
+        json: zod.z.unknown()
+      })
+    }
+  },
   "/upload/patches": {
     POST: {
       req: {
@@ -2765,6 +2839,32 @@ var Api = {
       })])
     }
   },
+  /**
+   * In a proposal: the SITE's Source for every module the proposal has saved,
+   * as the build it is based on has it. What Compare with the site diffs the
+   * proposal against -- saved and unsaved alike -- because the Studio's own
+   * base Source there is the proposal's last save. 404 anywhere that is not a
+   * proposal's address. valbuild/home `docs/proposals.md`.
+   */
+  "/proposal-site-sources": {
+    GET: {
+      req: {
+        cookies: {
+          val_session: zod.z.string().optional()
+        }
+      },
+      res: zod.z.union([unauthorizedResponse, zod.z.object({
+        status: zod.z.literal(404),
+        json: GenericError
+      }), zod.z.object({
+        status: zod.z.literal(200),
+        json: zod.z.object({
+          /** By module file path. A module absent here is the same in both. */
+          modules: zod.z.record(zod.z.string(), zod.z.unknown())
+        })
+      })])
+    }
+  },
   "/profiles": {
     GET: {
       req: {

package/internal/dist/valbuild-shared-internal.esm.js

@@ -1595,6 +1595,14 @@ var PublishRefusal = z.object({
   message: z.string()
 });
 
+/** See `proposal` on `/stat`. */
+var StatProposal = z.object({
+  /** Twenty hex characters, the hash of what it was made from. */
+  name: z.string(),
+  /** `val/p/<name>`. */
+  branch: z.string()
+});
+
 /**
  * A patch group: the set of patches one user has chosen to publish.
  *
@@ -2025,7 +2033,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         }), z.object({
           type: z.literal("use-websocket"),
           url: z.string(),
@@ -2143,7 +2157,13 @@ var Api = {
            * connected ones by commit.
            */
           publishJobs: z["boolean"]().optional(),
-          publishRefusal: PublishRefusal.optional()
+          publishRefusal: PublishRefusal.optional(),
+          /**
+           * The proposal this server runs at the address of, or absent
+           * on the site. What the Studio's switcher says it is in, and
+           * where its Save goes (valbuild/home `docs/proposals.md`).
+           */
+          proposal: StatProposal.optional()
         })])
       })])
     }
@@ -2229,6 +2249,60 @@ var Api = {
       })
     }
   },
+  /**
+   * The content service's proposals API, reached through this deployment:
+   * list, open, read, rename, close, reopen and retry a setup
+   * (valbuild/home `docs/proposals.md`, Flow B).
+   *
+   * The same arrangement as `/publish-api`, for the same reasons: the browser
+   * holds a session for this origin and no credential content accepts, so
+   * this server checks the session, sends the project's key with the person's
+   * profile id beside it -- a proposal is opened, renamed and closed by
+   * somebody -- and carries content's status and body back unread. The sub-path
+   * is content's, after `/proposals`; `ValOpsHttp.proposalsApi` holds the
+   * allow list. A save is not here: it is `/save`, which a proposal's server
+   * sends to the proposal's own route.
+   */
+  "/proposals-api": {
+    GET: {
+      req: {
+        path: z.string().optional(),
+        cookies: {
+          val_session: z.string().optional()
+        }
+      },
+      res: z.object({
+        status: z.number(),
+        json: z.unknown()
+      })
+    },
+    POST: {
+      req: {
+        path: z.string().optional(),
+        body: z.unknown().optional(),
+        cookies: {
+          val_session: z.string().optional()
+        }
+      },
+      res: z.object({
+        status: z.number(),
+        json: z.unknown()
+      })
+    },
+    PATCH: {
+      req: {
+        path: z.string().optional(),
+        body: z.unknown().optional(),
+        cookies: {
+          val_session: z.string().optional()
+        }
+      },
+      res: z.object({
+        status: z.number(),
+        json: z.unknown()
+      })
+    }
+  },
   "/upload/patches": {
     POST: {
       req: {
@@ -2758,6 +2832,32 @@ var Api = {
       })])
     }
   },
+  /**
+   * In a proposal: the SITE's Source for every module the proposal has saved,
+   * as the build it is based on has it. What Compare with the site diffs the
+   * proposal against -- saved and unsaved alike -- because the Studio's own
+   * base Source there is the proposal's last save. 404 anywhere that is not a
+   * proposal's address. valbuild/home `docs/proposals.md`.
+   */
+  "/proposal-site-sources": {
+    GET: {
+      req: {
+        cookies: {
+          val_session: z.string().optional()
+        }
+      },
+      res: z.union([unauthorizedResponse, z.object({
+        status: z.literal(404),
+        json: GenericError
+      }), z.object({
+        status: z.literal(200),
+        json: z.object({
+          /** By module file path. A module absent here is the same in both. */
+          modules: z.record(z.string(), z.unknown())
+        })
+      })])
+    }
+  },
   "/profiles": {
     GET: {
       req: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/shared",
-  "version": "0.141.0",
+  "version": "0.143.0",
   "private": false,
   "description": "Val shared types and utilities",
   "repository": {
@@ -37,7 +37,7 @@
     "flexsearch": "^0.8.212",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
-    "@valbuild/core": "0.141.0"
+    "@valbuild/core": "0.143.0"
   },
   "files": [
     "CHANGELOG.md",