@hozu/cli 0.25.0 → 0.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hozu/cli",
-  "version": "0.25.0",
+  "version": "0.26.1",
   "description": "The hozu command: check, map, why, show, get, browse, call, plan, add, build, export, gen, dev, serve, docs, migrate and skill (all with --json)",
   "keywords": [
     "hozu",
@@ -36,6 +36,7 @@
   },
   "files": [
     "bin",
+    "CHANGELOG.md",
     "dist",
     "schema",
     "skill",
@@ -48,14 +49,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@hozu/core": "0.25.0",
-    "@hozu/devtools": "0.25.0",
-    "@hozu/machine": "0.25.0",
-    "@hozu/compiler": "0.25.0",
-    "@hozu/transform": "0.25.0",
-    "@hozu/validator": "0.25.0"
+    "@hozu/core": "0.26.1",
+    "@hozu/validator": "0.26.1",
+    "@hozu/devtools": "0.26.1",
+    "@hozu/machine": "0.26.1",
+    "@hozu/compiler": "0.26.1",
+    "@hozu/transform": "0.26.1"
   },
   "devDependencies": {
-    "create-hozu": "0.25.0"
+    "create-hozu": "0.26.1"
   }
 }

package/schema/inspect.schema.json

@@ -1429,13 +1429,6 @@
         },
         "payload": {
           "$ref": "#/definitions/ValueExpr"
-        },
-        "keys": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "Only these key presses send it, and they do not reach the browser's own shortcuts (ADR 0072 B)."
         }
       },
       "required": [

package/schema/why.schema.json

@@ -224,6 +224,10 @@
           "items": {
             "type": "string"
           }
+        },
+        "decides": {
+          "type": "boolean",
+          "description": "Whether it decides, so a contract must cover it; otherwise the lock reviews it (ADR 0037)."
         }
       },
       "required": [
@@ -234,7 +238,8 @@
         "guard",
         "assign",
         "navigate",
-        "coveredBy"
+        "coveredBy",
+        "decides"
       ],
       "additionalProperties": false
     },

package/skill/example/features/bookmarks/views.ts

@@ -55,7 +55,9 @@ export const Board = ui.view({
             { name: 'kind', 'aria-label': 'Kind', class: 'rounded border px-2 py-2' },
             kinds.map((k) => ui.option({ value: k, selected: ctx.kind === k }, [k])),
           ),
-          ui.use(Button, { props: { type: 'submit', disabled: is(['adding']) } }, ['Add']),
+          ui.use(Button, { props: { type: 'submit', disabled: is(['adding']) }, keys: ['Mod+Enter'] }, [
+            'Add',
+          ]),
         ],
       ),
       ctx.error !== null && ui.p({ role: 'alert', class: 'text-rose-600' }, [ctx.error]),

package/skill/topics/components.md

@@ -20,8 +20,8 @@ export const Button = ui.component({
 ui.use(Button, { variant: { tone: 'ghost' }, props: { busy: ctx.saving }, slots: { icon: ui.span({}, ['+']) },
   on: { press: ui.send(Save, {}) }, class: 'w-full' }, ['Save'])           // in a view; its id is ui.Button
 ```
-- **`ui.use` keys** (all optional): `variant` (literals only, HZ071), `props` (anything that changes while the page
-  runs), `slots`, `on`, `class`; children only with `children: true`.
+- **`ui.use` keys** (all optional): `variant` (literals only, HZ071), `props` (what changes at run time), `slots`,
+  `on`, `class`, `keys` (a control root); children only with `children: true`.
 - **Render** reads only `props`, `slots`, `children`, `on` and `classes`; the caller passes sends, links and text
   in (HZ070).
 - **`class`** may only add classes that set none of the component's properties (`w-full`, `md:hidden`); to change

package/skill/topics/deploy.md

@@ -4,10 +4,9 @@
   `app({ resolvers, session?, components?, … })` from `@hozu/runtime-server`. `hozu serve`, `hozu check`, `hozu get`,
   `hozu browse` and `testApp(app)` all run it, so what the tools verify is what production serves.
 - **Which host:** nobody marks pages static. `npx hozu export` writes every page for a static host (GitHub Pages,
-  Netlify, Cloudflare Pages, Vercel) to `dist/` and exits 1 naming each page or effect that needs a server; then
-  use Node (`npm start`, a Docker image) or Cloudflare Workers.
-- **Node:** `npm start` is `hozu serve` (adapter-node on `PORT`, `HOST`). Docker: `node:22-slim`, `npm ci
-  --omit=dev`, `CMD ["npx", "hozu", "serve"]`.
+  Netlify, Cloudflare Pages) to `dist/` and exits 1 naming each page or effect that needs a server; then
+  `npx hozu build --target node | workers | vercel` writes what that platform deploys as is and lists what it needs.
+- **Node:** `npm start` is `hozu serve` (`PORT`, `HOST`); `--target node` writes its `Dockerfile`.
 - Set `SESSION_SECRET` when the app has sessions: `npm start` (`hozu serve`) runs as production unless `NODE_ENV` is set, and production refuses to start without it. `hozu dev`, `get`, `browse` and `call` do not need it.
 - Workers, several instances, sessions in KV, upgrading: see --more.
 
@@ -24,14 +23,16 @@
   `dist/public/`, `dist/manifest.json` and `dist/server/render.js`. It compresses answers as they stream (gzip),
   and framework files with brotli or gzip from the `.br` / `.gz` that `hozu build` writes. Live streams are not
   compressed. The edge handler leaves compression to the platform.
-- **Edge (Cloudflare Workers, Bun, Deno):** `hozu build --out build` (git-ignore `build/`), then bundle an entry with esbuild and
-  `hozuTransform()` from `@hozu/transform/esbuild` (it gives each app file its own `import.meta.url`, which a
-  Worker lacks). The entry creates the handler on the first request, when the platform's `env` is known:
-  `handler ??= createHandler(app, { manifest, render, env })` from `@hozu/runtime-server`, with
-  `import * as render from './build/server/render.js'`. Serve `build/public` as static assets (wrangler
-  `[assets] directory`) and let other requests reach the Worker (`/_hozu/f/…` fn modules come from the handler).
-  Build and bundle from the same source on every deploy: the manifest holds the fingerprints. Workers keep no memory
-  between requests: data goes in a database.
+- **Workers and Vercel:** `npx hozu build --target workers` writes `dist/workers/` (`worker.mjs`, `assets/`,
+  `wrangler.jsonc`; then `npx wrangler deploy` there); `--target vercel` writes `.vercel/output/` (an Edge Function;
+  then `npx vercel deploy --prebuilt`). Both need `@hozu/bundle`, bundle the app with its resolvers (a resolver that
+  imports Node-only code fails the build there) and print what the platform needs: env, `SESSION_SECRET`, a KV
+  namespace bound as `SESSIONS` on Workers, a shared session store on Vercel. Workers keep no memory between
+  requests: data goes in a database. Check the bundle before deploying: `npx hozu browse / --build dist/workers`
+  (env from your shell; `--session` signs in through its KV).
+- **Another edge (Bun, Deno):** `hozu build --out build`, then an entry that calls
+  `createHandler(app, { manifest, render, env })` with `import * as render from './build/server/render.js'`,
+  bundled with `hozuTransform()` from `@hozu/transform/esbuild` (the target's entry is the model).
 - **Static host:** `npx hozu export [--out dist]` (`@hozu/adapter-static`, in new apps) empties the folder, writes
   every page without per-request server data plus `.nojekyll`, and prints what it skipped. Pages whose data runs in
   the browser (`runs: 'browser'` / `'either'`) export completely; a page that calls a server effect is listed
@@ -75,3 +76,4 @@
 ## Upgrading Hozu
 `npx -p @hozu/cli@latest hozu migrate` (preview with `--dry-run`), then run the `next:` lines it prints: install, and
 `npx hozu migrate` again, which checks the IR is unchanged and runs `hozu check`. Never raise `@hozu/*` by hand.
+Each release's notes are in `node_modules/@hozu/cli/CHANGELOG.md`.

package/skill/topics/machine.md

@@ -71,8 +71,9 @@ export const m = machine({
 - **Across pages:** the calm state (the last state without `invoke`, with its context) is kept in `sessionStorage`
   and resumed on a page that shows the same machine view, or on the same address; a reload or a page without that
   view starts from `initialContext` (or `seed`).
-- `Unexpected`'s `message` is `Internal error (call <id>)` in production (the real one reaches `onError`): store a
-  code or a fixed text, never `e.message`.
+- `Unexpected`'s `message` is `Internal error (call <id>)` in production (the real one reaches `onError`). A page
+  for customers stores a code or a fixed text; a staff tool may show `e.message`, whose call id matches the server
+  log line.
 - **assign** values are event (`e`), result (`r`) or error fields, context, literals, operators and `fn()` calls.
 - **guard** conditions: a field (`() => ctx.auto`), comparisons, `&&`, `||`, `!`, or a boolean `fn()`.
 - **navigate** sends the browser to `ui.link(route, params, search?)` after the transition. It returns one link: to

package/skill/topics/testing.md

@@ -29,6 +29,7 @@
 
 <!-- more -->
 
+- `press Mod+s` (with `Mod`, `Ctrl`, `Meta`, `Alt`, `Shift`) presses the control whose `keys` match, as a person would; with `--js off` it reports that a shortcut needs JavaScript.
 - **Server errors:** what the app's `onError` receives (a resolver that threw, an invalid input) is listed under the
   step or the `get` request that caused it, `server error: <message> (<feature.effect>)`; `--json` `serverErrors`.
 - **A calm page:** a step that rebuilds elements unchanged says `N elements rebuilt unchanged (a flash: main > form >
@@ -83,7 +84,8 @@
 - **More checks in a step:**
   - A click that would land on another element fails the step: `the click would land on <h3>, which contains it, above
     <a href="/x">: a person cannot click it` (an overlay, a card covering its link).
-  - A navigation shows how it arrived: `→ /x (loaded, 32 ms)` or `(prerendered, 4 ms)`; with `--js both`, per mode.
+  - A navigation shows how it arrived: `→ /x (loaded, 32 ms)`; with `--js both`, per mode. Browse always shows
+    `loaded`: Chrome turns prerendering off under DevTools request interception, so this is the worst case.
   - `--select` prints each element's `class` too. An element moved to another parent is not a flash.
 - A server error that `get` or `browse` lists is noted once with `a production server shows "Internal error" here`:
   the visitor sees that text and the call id; `onError` gets the message.

package/skill/topics/views.md

@@ -55,10 +55,13 @@ export const Board = ui.view({
   `row(item)`; it is inlined, so the IR equals the inline form. A plain function that receives data is HZ059.
 - **Shared UI:** use the kit component, not a styled `ui.button` per page (`example/` uses a kit).
 - **More events:** any DOM event name plus `visible` (entered the viewport). Payload fields also:
-  `ui.dom.formAll('name')`, `ui.dom.checked`, `ui.dom.valueAsNumber`, `ui.dom.key`. Keyboard shortcuts:
-  `ui.window({ on: { keydown: ui.send(Open, {}, { keys: ['Mod+k', '/'] }) } })` sends only on those presses and
-  stops the browser's own (`Mod` is ⌘ on Apple, Ctrl elsewhere; also `Ctrl`, `Meta`, `Alt`, `Shift`); a printable
-  key without a modifier waits while the person types in a field (`Escape` does not). `ui.dom.value` / `ui.dom.form`
+  `ui.dom.formAll('name')`, `ui.dom.checked`, `ui.dom.valueAsNumber`, `ui.dom.key`. Keyboard shortcuts
+  belong to the control they press: `ui.input({ name: 'q', keys: ['/'] })` focuses the field, `ui.button({ type:
+  'submit', keys: ['Mod+s'] }, ['Save'])` clicks it (so the form submits; no machine needed); a kit control takes
+  them too: `ui.use(Button, { props, keys: ['Mod+Enter'] }, ['Add'])`. `Mod` is ⌘ on Apple,
+  Ctrl elsewhere; also `Ctrl`, `Meta`, `Alt`, `Shift`. A printable key without a modifier waits while the person types
+  in another field (`Escape` does not); inside an open modal only its controls count. The page loads a small module
+  for it and writes `aria-keyshortcuts`; two controls always shown together with one key is HZ014. `ui.dom.value` / `ui.dom.form`
   fill an enum field only from a `<select>`, radios or submit buttons whose literal values are all members (HZ033).
 - **Search in links:** the third argument of `ui.link` is optional and exists only when the route declares `search`:
   omitted means every default, and a search lists only the fields that differ: `ui.link(home, null, { show: 'done' })`.