@plitzi/cli 0.37.8 → 0.37.9

package/dist/index.js

@@ -9,12 +9,13 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import tls from "node:tls";
 import readline from "node:readline/promises";
-import { createRequire } from "node:module";
+import { builtinModules, createRequire } from "node:module";
 import { readFileSync, readdirSync, watch } from "node:fs";
-import { blankSpaceSource, elementTypeNames } from "@plitzi/sdk-authoring";
+import { actionSpecFromEntry, actionToSource, blankSpaceSource, elementTypeNames } from "@plitzi/sdk-authoring";
 import { pathToFileURL } from "node:url";
 import { build } from "esbuild";
 import { unzipSync, zipSync } from "fflate";
+import { gzipSync } from "node:zlib";
 /** `$XDG_CONFIG_HOME/plitzi`, `%APPDATA%\plitzi` on Windows, `~/.config/plitzi` otherwise. */
 var configDir = () => {
 	if (process.env.XDG_CONFIG_HOME) return path.join(process.env.XDG_CONFIG_HOME, "plitzi");
@@ -642,6 +643,22 @@ var connectionWithSpace = async (api, doing = "to work in") => {
 	}
 	return chosen.value;
 };
+/**
+* A signed-in connection, whichever space it works in — or none: signing in in the browser when there is no session.
+* What a command that names its space itself needs (`plitzi create --from`), since the session reaches every space the
+* person can.
+*/
+var signedIn = async (api, doing) => {
+	const current = await currentConnection(api);
+	if (current.ok && current.value) return current.value;
+	console.log(`\nSign in ${doing}.`);
+	const connected = await connect$2(api, { open: openInBrowser });
+	if (!connected.ok) {
+		fail(connected.error);
+		return;
+	}
+	return connected.value;
+};
 //#endregion
 //#region src/scaffold/client.ts
 /**
@@ -1263,13 +1280,21 @@ var scripts = ({ mode, source }) => ({
 	visual: "playwright test",
 	shot: "node scripts/shot.ts"
 });
-var packageJson$1 = (answers) => `${JSON.stringify({
+/**
+* `extra` is what a project made from a space needs besides (`plitzi create --from`): the packages its plugins and
+* runtime import. The scaffold's own win where both name one — the SDK and React are this CLI's versions, which the
+* project's plugins are rebuilt against.
+*/
+var packageJson$1 = (answers, extra = {}) => `${JSON.stringify({
 	name: answers.name,
 	version: "0.0.0",
 	private: true,
 	type: "module",
 	scripts: scripts(answers),
-	dependencies: dependencies(answers),
+	dependencies: Object.fromEntries(Object.entries({
+		...extra,
+		...dependencies(answers)
+	}).sort(([a], [b]) => a.localeCompare(b))),
 	devDependencies: devDependencies(answers),
 	engines: NODE_ENGINES,
 	...managerPackageFields(answers.packageManager)
@@ -1430,14 +1455,14 @@ ${code(".claude/skills/plitzi-cli/SKILL.md")} first: ${code("plitzi add plugin")
 * prefix — ship a server credential to every visitor. The two modes therefore name different variables, because
 * they hold different keys.
 */
-var envFile = ({ key, environment, mode }) => mode === "server" ? `# The space's self-hosting key. Secret: never commit it, never ship it in a page.
+var envFile = ({ key, environment, revision, mode }) => mode === "server" ? `# The space's self-hosting key. Secret: never commit it, never ship it in a page.
 # Credentials, in the builder.
 PLITZI_HOST_KEY=${key}
 
 # Which version this serves. 'main' is what the builder is editing; a published environment serves the latest
 # release, and PLITZI_REVISION pins one exact version.
 PLITZI_ENVIRONMENT=${environment}
-# PLITZI_REVISION=12
+${revision ? `PLITZI_REVISION=${String(revision)}` : "# PLITZI_REVISION=12"}
 
 PORT=8080
 ` : `# The space's public render key. It ships in the page by design; the origin the browser states is what
@@ -3368,198 +3393,1126 @@ This project lists its plugins in src/main.ts (projects created since find them
 	}
 };
 //#endregion
-//#region src/commands/create.ts
-var MODES = ["server", "client"];
-var SOURCES = ["local", "cloud"];
-/**
-* The choices a project is BUILT around, which belong to whoever it is for — never to a default nobody chose.
-*
-* Each one is written into the project: the package manager into every command its README, lockfile, Playwright config
-* and install use; the mode into whether there is a Node tier at all; the source into whether the space is in the repo.
-* Assumed, they are the wrong project for somebody, and an agent running this was the one assuming. So what was not
-* passed is asked for when a person is at the terminal, and refused when nobody is — with the exact questions to put
-* to the person.
-*/
-var resolveDecisions = async (options) => {
-	const detected = detectPackageManager();
-	const packageManager = {
-		flag: "--package-manager",
-		choices: PACKAGE_MANAGERS,
-		question: `Which package manager will you work in? (this was run through ${detected})`,
-		given: PACKAGE_MANAGERS.find((manager) => manager === options.packageManager),
-		fallback: detected
-	};
-	const mode = {
-		flag: "--mode",
-		choices: MODES,
-		question: "Should pages render on a Node server of your own (server: SSR + RSC), or only in the browser (client)?",
-		given: MODES.find((candidate) => candidate === options.mode),
-		fallback: "server"
-	};
-	const source = {
-		flag: "--source",
-		choices: SOURCES,
-		question: "Should the space live in the project as code you edit (local), or be read live from your Plitzi account (cloud, which needs a key from Credentials in the builder)?",
-		given: SOURCES.find((candidate) => candidate === options.source),
-		fallback: "local"
-	};
-	const missing = [
-		packageManager,
-		mode,
-		source
-	].filter((question) => question.given === void 0);
-	if (missing.length === 0 || options.yes && atTerminal()) return {
-		packageManager: packageManager.given ?? packageManager.fallback,
-		mode: mode.given ?? mode.fallback,
-		source: source.given ?? source.fallback
-	};
-	if (!atTerminal()) {
-		refuseWithoutTerminal("project", missing);
-		return;
-	}
-	const rl = readline.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const manager = packageManager.given ?? await ask(rl, packageManager);
-		const tier = manager && (mode.given ?? await ask(rl, mode));
-		const origin = tier && (source.given ?? await ask(rl, source));
-		if (!manager || !tier || !origin) {
-			process.exitCode = 1;
+//#region ../../packages/sdk-shared/dist/actions/functions.mjs
+var r$1 = (e) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*\.(ts|js|mjs|json)$/.test(e) && !e.split("/").some((e) => e === ".." || e === "." || e === "");
+var i$1 = async (e, t) => {
+	let n = {}, i = async (a) => {
+		let o;
+		try {
+			o = await t.list(a ? `${e}/${a}` : e);
+		} catch {
 			return;
 		}
+		for (let s of o) {
+			let o = a ? `${a}/${s.name}` : s.name;
+			s.directory ? s.name !== "node_modules" && !s.name.startsWith(".") && await i(o) : r$1(o) && (n[o] = await t.read(`${e}/${o}`));
+		}
+	};
+	return await i(""), n;
+};
+//#endregion
+//#region src/commands/functions.ts
+var FUNCTIONS_DIR = "functions";
+var STATE_FILE = path.join(".plitzi", "functions.json");
+var isRecord$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The project's root: where `functions/` and `.plitzi/` go. */
+var rootOf = async () => (await findProject(process.cwd()))?.root ?? process.cwd();
+/** Every source file under `functions/`, by its path there — read by the one rule of what a source is. */
+var readLocal = (root) => i$1(path.join(root, FUNCTIONS_DIR), {
+	list: async (dir) => (await fs.readdir(dir, { withFileTypes: true })).map((entry) => ({
+		name: entry.name,
+		directory: entry.isDirectory()
+	})),
+	read: (file) => fs.readFile(file, "utf8")
+});
+var readState = async (root) => {
+	try {
+		const value = JSON.parse(await fs.readFile(path.join(root, STATE_FILE), "utf8"));
+		if (!isRecord$6(value) || typeof value.space !== "number" || typeof value.version !== "string" || !isRecord$6(value.files)) return;
+		const files = Object.fromEntries(Object.entries(value.files).flatMap(([name, text]) => typeof text === "string" ? [[name, text]] : []));
 		return {
-			packageManager: manager,
-			mode: tier,
-			source: origin
+			space: value.space,
+			version: value.version,
+			files
 		};
-	} finally {
-		rl.close();
+	} catch {
+		return;
 	}
 };
-var keyQuestion = (mode) => `The ${mode === "server" ? "self-hosting" : "public render"} key the project reads the space with (Credentials, in the builder).`;
-var askForKey = async (mode) => {
-	const rl = readline.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		return (await rl.question(`\n${keyQuestion(mode)}\n> `)).trim();
-	} finally {
-		rl.close();
-	}
+var writeFunctionsState = async (root, state) => {
+	await fs.mkdir(path.join(root, ".plitzi"), { recursive: true });
+	await fs.writeFile(path.join(root, STATE_FILE), `${JSON.stringify(state, null, 2)}\n`);
 };
-var create = async (directory, options) => {
-	const target = path.resolve(directory ?? ".");
-	const name = path.basename(target);
-	const wasEmpty = await isEmpty(target);
-	if (!options.force && !wasEmpty) {
-		console.error(chalk.red(`${target} is not empty. Pass --force to write into it anyway.`));
-		process.exitCode = 1;
+/** The files that differ between two copies — added, removed or changed — sorted. */
+var changedFiles = (a, b) => [.../* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])].filter((file) => a[file] !== b[file]).sort();
+var taskList = (draft) => draft.manifest?.tasks.length ? draft.manifest.tasks.map((task) => `${task.namespace}.${task.action}`).join(", ") : "no tasks";
+var connect$1 = async (options, doing) => {
+	const api = await apiFor(options);
+	return api ? connectionWithSpace(api, doing) : void 0;
+};
+var readDraft = async (connection, spaceId) => {
+	const answered = await authorizedRequest(connection, `/spaces/${spaceId}/functions`);
+	if (!answered.ok) {
+		fail(answered.error);
 		return;
 	}
-	const decisions = await resolveDecisions(options);
-	if (!decisions) return;
-	const { packageManager, mode, source } = decisions;
-	if (source === "cloud" && !options.key && !atTerminal()) {
-		refuseWithoutTerminal("project", [{
-			flag: "--key",
-			choices: ["<key>"],
-			question: keyQuestion(mode)
-		}]);
+	const { reply } = answered.value;
+	if (reply.status !== 200) {
+		fail(reply.data.error ?? `Could not read the space’s functions (${reply.status}).`);
 		return;
 	}
-	const key = source === "cloud" ? options.key ?? await askForKey(mode) : "";
-	if (source === "cloud" && !key) {
-		console.error(chalk.red("\nNo key. Mint one under Credentials in the builder, then run this again."));
-		process.exitCode = 1;
+	return reply.data;
+};
+var pullFunctions = async (options) => {
+	const connection = await connect$1(options, "to pull from");
+	if (!connection?.space) return;
+	const root = await rootOf();
+	const [local, state] = await Promise.all([readLocal(root), readState(root)]);
+	const unpushed = state ? changedFiles(local, state.files) : Object.keys(local);
+	if (!options.force && (state?.space ?? connection.space.id) !== connection.space.id) {
+		fail("functions/ is a copy of another space’s. Pull into another project, or pass --force to replace it.");
 		return;
 	}
-	await writeFiles(target, scaffold({
-		name,
-		mode,
-		source,
-		key,
-		environment: options.environment ?? "main",
-		packageManager,
-		managerVersion: detectManagerVersion(packageManager, await nearestExisting(target))
-	}));
-	const wantsInstall = options.install !== false;
-	const installed = wantsInstall && await install(packageManager, target);
-	/**
-	* A failed install is a failed command, not a next step.
-	*
-	* The files are already written, so the summary below still prints — but printed on its own after a screen of
-	* resolver errors it reads as success, and a script that ran `create` carries on into a project with no
-	* `node_modules`.
-	*/
-	if (wantsInstall && !installed) {
-		console.error(chalk.red(`\n\`${installCommand(packageManager)}\` failed. The project is written; the reason is in the output above.`));
-		console.error(chalk.dim(INSTALL_HINTS[packageManager]));
-		process.exitCode = 1;
-	}
-	/**
-	* Formatted by the project's own Prettier, once, so the first commit is already in its style — the scaffold writes
-	* tables and lists whose layout depends on what they hold. Only into a folder that was empty: `--force` into one
-	* with work in it must never reformat that work.
-	*/
-	if (installed && wasEmpty) await runScript(packageManager, "format", target);
-	const where = cdPrefix(target);
-	console.log(chalk.green(`\n${name} — ${mode === "server" ? "server-rendered" : "browser-rendered"}, space ${source === "cloud" ? "from Plitzi" : "in the project"}.`));
-	console.log("");
-	if (!installed) console.log(`  ${where}${installCommand(packageManager)}`);
-	console.log(`  ${where}${runCommand(packageManager, "start")}`);
-	console.log("");
-	console.log(chalk.dim(`.claude/skills carries Plitzi's authoring skill; \`${runCommand(packageManager, "visual")}\` opens the page and checks it.`));
-	if (source === "cloud") console.log(chalk.dim(".env holds the key and is already git-ignored."));
-	console.log("");
-};
-//#endregion
-//#region src/commands/createPlugin.ts
-var DEFAULT_NAME = "plitzi-plugin-my-element";
-/** What an agent is told to ask for, and the flags that carry the answers. */
-var QUESTIONS = {
-	name: {
-		flag: "--name",
-		choices: ["<package name>"],
-		question: "What is the plugin called? Its package name, e.g. plitzi-plugin-seat-picker."
-	},
-	directory: {
-		flag: "<directory> (the first argument)",
-		choices: ["<folder>"],
-		question: "Which folder should the plugin be written to?"
+	if (!options.force && unpushed.length) {
+		fail(`Pulling would overwrite what is not pushed yet: ${unpushed.join(", ")}.\nPush it first, or pass --force to throw it away.`);
+		return;
 	}
-};
-var splitNames = (list) => list.split(",").map((name) => name.trim()).filter(Boolean);
-/**
-* What is wrong with the other elements asked for, if anything: a name that makes no element, or two elements — the
-* package's own among them — that would share a type, which a space could not tell apart.
-*/
-var elementListProblem = (main, others) => {
-	for (const name of others) {
-		const problem = pluginNameProblem(name);
-		if (problem) return problem;
+	const draft = await readDraft(connection, connection.space.id);
+	if (!draft) return;
+	const base = path.join(root, FUNCTIONS_DIR);
+	await Promise.all(Object.keys(local).filter((file) => !Object.hasOwn(draft.files, file)).map((file) => fs.rm(path.join(base, file))));
+	for (const [file, text] of Object.entries(draft.files)) {
+		await fs.mkdir(path.dirname(path.join(base, file)), { recursive: true });
+		await fs.writeFile(path.join(base, file), text);
 	}
-	const types = [pluginNames(main).type, ...others.map((name) => pluginNames(name).type)];
-	const repeated = types.find((type, index) => types.indexOf(type) !== index);
-	return repeated ? `Two elements would both be "${repeated}": give each a name of its own.` : void 0;
-};
-/** The folders a repository keeps its packages in, as places for this one — or `./<name>` outside of any. */
-var folderOptions = (project, base) => {
-	if (!project) return [];
-	const root = project.workspaceRoot ?? project.root;
-	return [.../* @__PURE__ */ new Set([...project.workspaceFolders, "plugins"])].map((folder) => {
-		const value = path.join(root, folder, base);
-		return {
-			label: path.relative(process.cwd(), value) || ".",
-			value
-		};
+	await writeFunctionsState(root, {
+		space: connection.space.id,
+		version: draft.version,
+		files: draft.files
 	});
+	const count = Object.keys(draft.files).length;
+	console.log(count ? `Pulled ${count} file${count === 1 ? "" : "s"} of ${chalk.bold(connection.space.name)}’s functions into functions/ — ${taskList(draft)}.` : `${chalk.bold(connection.space.name)} has no functions yet. Write functions/index.ts and plitzi functions push.`);
 };
-var askDirectory = async (rl, project, base) => {
-	const typed = {
-		question: "Which folder? (relative to here)",
+var printProblems = (problems) => {
+	console.error(chalk.red("The functions were not saved:"));
+	problems.forEach(({ file, line, column, message }) => {
+		const where = file ? `functions/${file}${line ? `:${String(line)}${column ? `:${String(column)}` : ""}` : ""}` : "functions";
+		console.error(`  ${chalk.bold(where)} ${message}`);
+	});
+	process.exitCode = 1;
+};
+var pushFunctions = async (options) => {
+	const connection = await connect$1(options, "to push to");
+	if (!connection?.space) return;
+	const root = await rootOf();
+	const [local, state] = await Promise.all([readLocal(root), readState(root)]);
+	if (!Object.hasOwn(local, "index.ts")) {
+		fail("There is no functions/index.ts here: it is where a space’s functions start. Pull them, or write it.");
+		return;
+	}
+	let base = state?.space === connection.space.id ? state.version : void 0;
+	if (base === void 0) {
+		const draft = await readDraft(connection, connection.space.id);
+		if (!draft) return;
+		if (Object.keys(draft.files).length) {
+			fail(`${connection.space.name} already has functions. Pull them first: plitzi functions pull.`);
+			return;
+		}
+		base = draft.version;
+	}
+	if (state?.space === connection.space.id && !changedFiles(local, state.files).length) {
+		console.log("Nothing to push: functions/ is what was pulled.");
+		return;
+	}
+	const answered = await authorizedRequest(connection, `/spaces/${connection.space.id}/functions`, {
+		method: "PUT",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			files: local,
+			base
+		})
+	});
+	if (!answered.ok) {
+		fail(answered.error);
+		return;
+	}
+	const { reply } = answered.value;
+	if (reply.status === 422 && reply.data.problems) {
+		printProblems(reply.data.problems);
+		return;
+	}
+	if (reply.status === 409) {
+		fail(`${connection.space.name}’s functions changed since your pull — in the builder, or from another copy. Keep your changes aside, pull, and apply them again.`);
+		return;
+	}
+	if (reply.status !== 200 || !reply.data.version) {
+		fail(reply.data.refusal?.error ?? reply.data.error ?? `The functions were not saved (${reply.status}).`);
+		return;
+	}
+	await writeFunctionsState(root, {
+		space: connection.space.id,
+		version: reply.data.version,
+		files: local
+	});
+	console.log(`Pushed to ${chalk.bold(connection.space.name)}’s draft — ${taskList({ manifest: reply.data.manifest ?? null })}. ` + chalk.dim("The live site runs them once the space is published."));
+};
+/** What one run of a task did: its logs, then its value — or why it failed, as a failure of the command. */
+var printRun = (task, report) => {
+	const step = report.steps?.find((entry) => entry.action === task);
+	const took = step ? `${String(step.endTime - step.startTime)} ms` : "";
+	step?.logs?.forEach((line) => console.log(chalk.dim(`log  ${line}`)));
+	if (step?.error) {
+		fail(`${task} failed after ${took}: ${step.error}`);
+		return;
+	}
+	console.log(`${chalk.green(report.status ?? "completed")} ${chalk.dim(took ? `in ${took}` : "")}`);
+	console.log(JSON.stringify(report.output?.value ?? null, null, 2));
+};
+/** `--params`, read: an object of the task's params by name, or nothing when it is not one. */
+var paramsOf = (given) => {
+	try {
+		const params = given ? JSON.parse(given) : {};
+		if (isRecord$6(params)) return params;
+	} catch {}
+	fail("--params is a JSON object of the task’s params, by name: --params '{\"name\":\"Ada\"}'");
+};
+var tryFunction = async (task, options) => {
+	const params = paramsOf(options.params);
+	if (!params) return;
+	const connection = await connect$1(options, "to try it in");
+	if (!connection?.space) return;
+	const answered = await authorizedRequest(connection, `/spaces/${connection.space.id}/functions/try`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			task,
+			params
+		})
+	});
+	if (!answered.ok) {
+		fail(answered.error);
+		return;
+	}
+	const { reply } = answered.value;
+	if (reply.status !== 200) {
+		fail(reply.data.error ?? `The task could not be tried (${reply.status}).`);
+		return;
+	}
+	printRun(task, reply.data);
+};
+var isLocalRunner = (value) => isRecord$6(value) && typeof value.createLocalFunctions === "function";
+/**
+* This project's own runner: `dev` runs the functions with the `@plitzi/sdk-server` the project installed, so the build,
+* the checks, the isolates and the limits are the platform's own, at the version the project is on.
+*/
+var projectRunner = async (root) => {
+	try {
+		const entry = createRequire(path.join(root, "package.json")).resolve("@plitzi/sdk-server/functions-runner");
+		const loaded = await import(pathToFileURL(entry).href);
+		if (isLocalRunner(loaded)) return loaded;
+	} catch {}
+	fail("plitzi functions dev runs them with this project’s own @plitzi/sdk-server, and the isolates it needs:\n  npm install --save-dev @plitzi/sdk-server isolated-vm core-js");
+};
+/** `PLITZI_FUNCTIONS_CREDENTIALS`, a JSON object of credential id → its keys: what `ctx.fetch` may name locally. */
+var localCredentials = () => {
+	const raw = process.env.PLITZI_FUNCTIONS_CREDENTIALS;
+	try {
+		const value = raw ? JSON.parse(raw) : {};
+		return isRecord$6(value) ? Object.fromEntries(Object.entries(value).flatMap(([id, keys]) => isRecord$6(keys) ? [[id, Object.fromEntries(Object.entries(keys).filter((pair) => typeof pair[1] === "string"))]] : [])) : {};
+	} catch {
+		return {};
+	}
+};
+var NO_NODE_SNAPSHOT = "--no-node-snapshot";
+/**
+* The isolates `dev` runs need Node's startup snapshot off, and a process cannot turn it off once started: `dev` runs
+* itself again with it, and answers with that run's exit code.
+*/
+var rerunWithoutNodeSnapshot = () => new Promise((resolve, reject) => {
+	const child = spawn(process.execPath, [
+		...process.execArgv,
+		NO_NODE_SNAPSHOT,
+		...process.argv.slice(1)
+	], { stdio: "inherit" });
+	child.once("error", reject);
+	child.once("exit", (code) => {
+		resolve(code ?? 1);
+	});
+});
+/**
+* `plitzi functions dev <task>`: the task run from `functions/` on this machine, as the platform would run it — and,
+* with `--watch`, again every time a file is saved. Nothing reaches the space: its draft is what `push` sends.
+*/
+var devFunction = async (task, options) => {
+	if (!process.execArgv.includes(NO_NODE_SNAPSHOT)) {
+		process.exitCode = await rerunWithoutNodeSnapshot();
+		return;
+	}
+	const params = paramsOf(options.params);
+	const root = await rootOf();
+	const runner = params ? await projectRunner(root) : void 0;
+	if (!params || !runner) return;
+	const local = runner.createLocalFunctions({ credentials: localCredentials() });
+	const run = async () => {
+		const loaded = await local.load(await readLocal(root));
+		if (!loaded.ok) {
+			printProblems(loaded.problems);
+			return;
+		}
+		if (!loaded.tasks.includes(task)) {
+			fail(`functions/ declares no task ${task}. It declares: ${loaded.tasks.join(", ") || "none"}.`);
+			return;
+		}
+		printRun(task, await local.tryTask(task, params));
+	};
+	await run();
+	if (!options.watch) return;
+	console.log(chalk.dim("\nWatching functions/ — every save runs it again. ^C to stop."));
+	let pending;
+	watch(path.join(root, FUNCTIONS_DIR), { recursive: true }, () => {
+		clearTimeout(pending);
+		pending = setTimeout(() => {
+			process.exitCode = void 0;
+			console.log(chalk.dim(`\n— ${(/* @__PURE__ */ new Date()).toLocaleTimeString()}`));
+			run();
+		}, 150);
+	});
+};
+//#endregion
+//#region src/commands/projectFormatter.ts
+var isRecord$5 = (value) => typeof value === "object" && value !== null;
+var isPrettier = (value) => isRecord$5(value) && [
+	"format",
+	"resolveConfig",
+	"getFileInfo"
+].every((name) => typeof value[name] === "function");
+var unformatted = (_file, text) => Promise.resolve(text);
+/** Loads the project's Prettier once. A project without one formats nothing. */
+var projectFormatter = async (root) => {
+	let loaded;
+	try {
+		const resolved = createRequire(path.join(root, "package.json")).resolve("prettier");
+		loaded = await import(pathToFileURL(resolved).href);
+	} catch {
+		return unformatted;
+	}
+	const prettier = isPrettier(loaded) ? loaded : isRecord$5(loaded) ? loaded.default : void 0;
+	if (!isPrettier(prettier)) return unformatted;
+	const api = prettier;
+	const ignorePath = [".prettierignore", ".gitignore"].map((file) => path.join(root, file));
+	return async (file, text) => {
+		const filepath = path.join(root, file);
+		const info = await api.getFileInfo(filepath, {
+			ignorePath,
+			resolveConfig: true
+		});
+		if (info.ignored || !info.inferredParser) return text;
+		return api.format(text, {
+			...await api.resolveConfig(filepath),
+			filepath
+		});
+	};
+};
+//#endregion
+//#region src/scaffold/fromSpace.ts
+var TEXT = /\.((m|c)?(t|j)sx?|json|css|scss|sass|less|md|txt|html|svg|ya?ml|xml|csv|graphql)$/i;
+/** Whether a file of the project is text — written, compared and formatted as such — rather than bytes. */
+var isTextFile = (path) => TEXT.test(path);
+/** The example plugin and space `create` writes for a project of its own, which one made from a space replaces. */
+var EXAMPLE = ["src/plugins/StatCard/StatCard.tsx", "src/plugins/StatCard/index.ts"];
+var decode = (base64) => Buffer.from(base64, "base64").toString("utf-8");
+/** One import line of the generated code. */
+var importLine = (names, from) => `import ${names} from '${from}';\n`;
+/** `export { pizarra as space }`: the name the project's own code imports the space under, whatever it was exported as. */
+var spaceEntry = (exportName) => `/**
+ * The space, as Plitzi kept it, written out as the code that authors it (\`./space/\`): a file per page, the shared
+ * classes in \`styles.ts\`. It is this project's now — edit it, and the next start renders the change.
+ */
+export { ${exportName} as space } from './space/index.ts';
+`;
+/** The lines that import every action written as code, each under a name of its own however their ids camelCase. */
+var codedImports = (coded) => {
+	const taken = /* @__PURE__ */ new Set();
+	const imports = coded.map(({ identifier, exportName }) => {
+		let name = exportName;
+		for (let next = 2; taken.has(name); next += 1) name = `${exportName}${String(next)}`;
+		taken.add(name);
+		return {
+			name,
+			line: importLine(`{ ${name === exportName ? name : `${exportName} as ${name}`} }`, `./actions/${identifier}.ts`)
+		};
+	});
+	return {
+		lines: imports.map(({ line }) => line).join(""),
+		names: imports.map(({ name }) => name)
+	};
+};
+var actionsModule = (coded) => {
+	const { lines, names } = codedImports(coded);
+	return `import { readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+${lines ? `\n${lines}` : ""}
+import type { ActionLookups } from '@plitzi/sdk-server/actions';
+
+type ActionEntry = NonNullable<Awaited<ReturnType<ActionLookups['getAction']>>>;
+type Connector = NonNullable<Awaited<ReturnType<NonNullable<ActionLookups['getConnector']>>>>;
+
+/** The JSON documents of a folder beside this file: none when there is no such folder. */
+const read = (folder: string): unknown[] => {
+  const dir = path.join(import.meta.dirname, folder);
+  try {
+    return readdirSync(dir)
+      .filter(file => file.endsWith('.json'))
+      .map((file): unknown => JSON.parse(readFileSync(path.join(dir, file), 'utf-8')));
+  } catch {
+    return [];
+  }
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+/**
+ * The space's server actions, in \`src/actions/\`: one \`defineAction\` each — edit one, and the next start runs it —
+ * and, as JSON, any the builder wrote in a form code has no words for. Their ways in say whether they are on.
+ */
+const actions: ActionEntry[] = [${names.length > 0 ? `\n  ${names.join(",\n  ")},` : ""}
+  ...read('actions').flatMap(entry =>
+    isRecord(entry) && typeof entry.id === 'string' && isRecord(entry.document)
+      ? // A document Plitzi checked when it was saved, and that the server checks again on every run.
+        [{ id: entry.id, document: entry.document as ActionEntry['document'] }]
+      : []
+  )
+];
+
+/** The space's connectors, as Plitzi kept them: one JSON manifest each, in \`src/connectors/\`. */
+const connectors = new Map(
+  read('connectors').flatMap(entry =>
+    isRecord(entry) && typeof entry.id === 'string' && isRecord(entry.manifest)
+      ? // A manifest Plitzi checked when it was saved.
+        [[entry.id, entry.manifest as Connector] as const]
+      : []
+  )
+);
+
+/**
+ * The one space this server serves, as its adapters name it — 1, whether they read it from this project or from
+ * Plitzi: what the scheduler watches for actions on a clock.
+ */
+const SPACE_ID = 1;
+
+export const lookups: ActionLookups = {
+  getAction: (_spaceId, actionId) => Promise.resolve(actions.find(entry => entry.id === actionId)),
+  listActions: () => Promise.resolve(actions),
+  getConnector: (_spaceId, connectorId) => Promise.resolve(connectors.get(connectorId)),
+  listScheduledSpaces: () => Promise.resolve([SPACE_ID])
+};
+`;
+};
+/** What a space with visitor roles needs of a server of its own, said where its auth would be handed over. */
+var visitorsNote = (roles) => `
+/**
+ * The space declares visitor roles (${roles.join(", ")}). On Plitzi its visitors sign in with their Plitzi account, and
+ * hold the roles the space gives them by email. Here nobody signs in until this server does it itself: \`createAuth\`
+ * from \`@plitzi/sdk-server/auth\`, handed to \`createServer\` as \`auth\`, over the accounts it keeps — giving each
+ * person the permissions of the roles they hold (\`visitorAccess\` from \`@plitzi/sdk-shared/auth/visitorRoles\`, over
+ * the space's \`settings.visitorRoles\`). Until then every action that asks for a role refuses. See Self-hosting, in
+ * Plitzi's docs.
+ */`;
+var BUILT_PLUGINS = `
+/**
+ * The space's plugins no source of was kept, as they were built: \`vendor/plugins/<type>/\`, each beside the manifest it
+ * was published with. They run and render as they are — on the server too — and cannot be changed here: upload one
+ * again from its source (\`plitzi upload plugin\`), and \`plitzi pull\` brings its code in their place.
+ */
+type BuiltManifest = {
+  version?: string;
+  pluginSchema?: Record<string, unknown>;
+  assets?: Record<string, { src: string; type: string; isMain?: boolean }>;
+};
+
+const VENDOR_PLUGINS_DIR = path.resolve(import.meta.dirname, '../vendor/plugins');
+const built = readdirSync(VENDOR_PLUGINS_DIR, { withFileTypes: true })
+  .filter(entry => entry.isDirectory())
+  .map(entry => {
+    const dir = path.join(VENDOR_PLUGINS_DIR, entry.name);
+    // What \`plitzi pack plugin\` wrote beside the bundle when it was published.
+    const manifest = JSON.parse(readFileSync(path.join(dir, 'plugin-manifest.json'), 'utf-8')) as BuiltManifest;
+    const assets = Object.values(manifest.assets ?? {});
+    const script = assets.find(asset => asset.type === 'script' && asset.isMain) ?? assets.find(asset => asset.type === 'script');
+    const style = assets.find(asset => asset.type === 'style');
+    if (!script) {
+      throw new Error(\`vendor/plugins/\${entry.name}/plugin-manifest.json names no script to run.\`);
+    }
+
+    return {
+      type: entry.name,
+      provides: Object.keys(manifest.pluginSchema ?? {}),
+      source: {
+        js: path.join(dir, script.src),
+        ...(style ? { css: path.join(dir, style.src) } : {}),
+        action: 'copy' as const,
+        version: manifest.version ?? '1.0.0'
+      }
+    };
+  });
+const builtPlugins = Object.fromEntries(built.map(({ type, source }) => [type, source]));
+/** Every element type they provide, for the space's use of them to be authored as a plugin's rather than a typo's. */
+const builtTypes = built.flatMap(({ type, provides }) => [type, ...provides]);
+`;
+var runtimeLines = ({ runtimeEntry, packedRuntime }) => {
+	if (runtimeEntry) return `/**
+ * The space's runtime — its own server code, run by Plitzi beside the space — run here, in this process: its tasks join
+ * the functions, and its endpoints answer before anything else. Its variables are this process's environment.
+ */
+const runtime = await serveRuntime(spaceRuntime, { env: process.env, publicUrl });`;
+	if (packedRuntime) return `/**
+ * The space's runtime, as it was built: no source of it was kept, so it runs as it is and cannot be changed here. Push
+ * it again from its source (\`plitzi runtime push\`), and \`plitzi pull\` brings its code in its place.
+ */
+const runtime = await serveRuntime(
+  await loadRuntime(readFileSync(path.join(PROJECT_ROOT, 'vendor/runtime.bundle')), path.join(PROJECT_ROOT, '.runtime')),
+  { env: process.env, publicUrl }
+);`;
+	return "";
+};
+var fromSpaceMain = (options) => {
+	const { source, runtimeEntry, packedRuntime, builtPlugins, visitorRoles } = options;
+	const hasRuntime = Boolean(runtimeEntry) || packedRuntime;
+	const local = source === "local";
+	const fsImports = ["readdirSync", ...packedRuntime || builtPlugins ? ["readFileSync"] : []].join(", ");
+	const allPlugins = builtPlugins ? "{ ...plugins, ...builtPlugins }" : "plugins";
+	const allNames = builtPlugins ? "[...pluginNames, ...Object.keys(builtPlugins)]" : "pluginNames";
+	const runtimeImports = [...packedRuntime ? ["loadRuntime"] : [], ...hasRuntime ? ["serveRuntime"] : []].join(", ");
+	return `import { ${fsImports} } from 'node:fs';
+import path from 'node:path';
+
+import { closeOnSignals, consoleLogger, ${local ? "createJsonAdapters" : "createCloudAdapters"}, createServer, loadFunctions } from '@plitzi/sdk-server';
+${hasRuntime ? importLine(`{ ${runtimeImports} }`, "@plitzi/sdk-server/runtime") : ""}${local ? `\n${importLine("{ authorSpace }", "@plitzi/sdk-authoring")}` : ""}
+${importLine("{ lookups }", "./actions.ts")}${local ? importLine("{ declarations }", "./plugins/declarations.ts") : ""}${runtimeEntry ? importLine("spaceRuntime", runtimeEntry) : ""}${local ? importLine("{ space }", "./space.ts") : ""}
+/**
+ * The project's settings — the key its actions sign with, the variables the space was given on Plitzi — kept in \`.env\`,
+ * out of git. \`plitzi create\` wrote one with a fresh signing key; \`.env.example\` names the rest.
+ */
+try {
+  process.loadEnvFile(new URL('../.env', import.meta.url));
+} catch {
+  // None: the environment the process was started with is all there is.
+}
+
+const PORT = Number(process.env.PORT ?? 8080);
+// Loopback unless told otherwise: a container publishes a port only from an address it listens on (\`HOST=0.0.0.0\`).
+const HOST = process.env.HOST ?? '127.0.0.1';
+/** Where people reach this server: \`PUBLIC_URL\` behind a proxy, its own address otherwise. */
+const publicUrl = (process.env.PUBLIC_URL ?? \`http://127.0.0.1:\${String(PORT)}\`).replace(/\\/+$/, '');
+${builtPlugins ? BUILT_PLUGINS : ""}${local ? `
+/**
+ * The space, held in this project: \`src/space/\`, authored at boot — saving a page and letting \`--watch\` restart is
+ * the whole edit loop, and the warnings are printed where somebody editing it is watching.
+ */
+const { schema, style, warnings } = authorSpace(space, { plugins: declarations${builtPlugins ? ", pluginTypes: builtTypes" : ""} });
+
+for (const warning of warnings) {
+  console.warn(\`[author] \${warning.message}\`);
+}
+` : `
+/** The space's HOST key (Credentials, in the builder): secret, never committed, never shipped in a page. */
+const HOST_KEY = process.env.PLITZI_HOST_KEY ?? '';
+
+if (!HOST_KEY) {
+  throw new Error('Set PLITZI_HOST_KEY in .env — Credentials, in the builder.');
+}
+`}
+${PLUGINS}
+
+/** The space's functions: \`functions/\`, built the way Plitzi builds them and run here, in this process. */
+const functions = await loadFunctions(new URL('../functions/', import.meta.url));
+${hasRuntime ? `\n${runtimeLines(options)}\n` : ""}${visitorRoles.length > 0 ? `${visitorsNote(visitorRoles)}\n` : ""}
+/**
+ * Everything the space is, served by this server alone: its pages, its plugins, its server actions (\`src/actions/\`),
+ * its functions${hasRuntime ? " and runtime" : ""}, and its files (\`public/\`, where Plitzi's CDN served them from).
+ */
+const server = createServer(
+  {
+    port: PORT,
+    devMode: process.env.NODE_ENV !== 'production',
+    adapters: ${local ? `createJsonAdapters({
+      offlineData: { schema, style },
+      deployment: { spaceId: 1, environment: 'main', revision: 0, pluginNames: ${allNames} }
+    })` : `createCloudAdapters({
+      webKey: HOST_KEY,
+      ...(process.env.PLITZI_SERVER_URL ? { serverUrl: process.env.PLITZI_SERVER_URL } : {}),
+      environment: (process.env.PLITZI_ENVIRONMENT ?? 'main') as 'main' | 'production',
+      deployment: { pluginNames: ${allNames} }
+    })`},
+    plugins: ${allPlugins},
+    publicDir: path.join(PROJECT_ROOT, 'public'),
+    functions: { native: ${hasRuntime ? "[...functions, ...runtime.native]" : "functions"} },
+    // What \`ctx.sign\` and \`ctx.verify\` sign with: the key that was the space's on Plitzi stays there.
+    action: { lookups, signingSecret: process.env.PLITZI_SIGNING_SECRET },
+    logger: consoleLogger
+  }${hasRuntime ? ",\n  { preAuth: [runtime.stage] }" : ""}
+);
+
+server.listen(PORT, HOST);
+console.log(\`pages on \${publicUrl}/\`);
+
+closeOnSignals(server${hasRuntime ? ", { afterClose: () => runtime.close() }" : ""});
+`;
+};
+/** A path of the source tree, where the project keeps it: under `src/`, unless it was already a project's `src/`. */
+var placeOf = (paths) => {
+	const prefix = paths.length > 0 && paths.every((path) => path.startsWith("src/")) ? "" : "src/";
+	return (path) => `${prefix}${path}`;
+};
+/** The import `src/main.ts` names the runtime's module by. */
+var fromMain = (path) => `./${path.replace(/^src\//, "")}`;
+/** What the space was given on Plitzi, by name, as `.env.example` lists it — and `.env`, with values where they are known. */
+var settingsLines = (exported) => [
+	"# What the space was given on Plitzi, by name — the values never leave it. Copy this to .env and fill them in.",
+	"# What the project signs with (ctx.sign): at least 32 characters, secret.",
+	"PLITZI_SIGNING_SECRET=",
+	...exported.variables.map((name) => `${name}=`),
+	...exported.credentials.map(({ identifier, name, provider }) => `# ${name} (${provider}): the credential "${identifier}"`),
+	"PORT=8080",
+	""
+];
+/**
+* The project's own `.env`, ready to run: a signing key made for it — the space's own stays on Plitzi — and the rest
+* left for whoever has the values. Read from Plitzi, the key it is read with comes first, as a project of its own has
+* it. Written once, by `create`: it is the project's, and nothing pulled ever touches it.
+*/
+var envFromSpace = (exported, answers, signingSecret) => {
+	const settings = settingsLines(exported).join("\n").replace("PLITZI_SIGNING_SECRET=", `PLITZI_SIGNING_SECRET=${signingSecret}`);
+	return answers.source === "cloud" ? `${envFile(answers)}\n${settings}\n` : `${settings}\nPORT=8080\n`;
+};
+/** What a project made from a space holds, from what the platform answered for it — the same for `create` and `pull`. */
+var projectFromSpace = (exported, spaceSource) => {
+	const { source, builtOnly, assets, report } = exported;
+	const place = placeOf(Object.keys(source.files));
+	const local = (text) => assets.reduce((written, { url, path }) => written.split(url).join(`/${path}`), text);
+	const files = {};
+	const binaries = {};
+	Object.entries(source.files).forEach(([path, content]) => {
+		if (isTextFile(path)) files[place(path)] = local(decode(content));
+		else binaries[place(path)] = content;
+	});
+	if (exported.authoring) {
+		Object.entries(exported.authoring.files).forEach(([path, text]) => {
+			files[`src/space/${path}`] = local(text);
+		});
+		files["src/space.ts"] = spaceEntry(exported.authoring.exportName);
+		files["src/plugins/declarations.ts"] = projectDeclarations(Object.keys(files).map((path) => /^src\/plugins\/([^/]+)\/declaration\.ts$/.exec(path)?.[1]).filter((folder) => folder !== void 0).sort());
+	}
+	const coded = [];
+	const asJson = [];
+	exported.actions.forEach(({ identifier, name, document }) => {
+		const reading = actionSpecFromEntry({
+			id: identifier,
+			document
+		});
+		if (reading.ok) {
+			const { exportName, source: code } = actionToSource(reading.spec);
+			files[`src/actions/${identifier}.ts`] = local(code);
+			coded.push({
+				identifier,
+				exportName
+			});
+			return;
+		}
+		files[`src/actions/${identifier}.json`] = `${local(JSON.stringify({
+			id: identifier,
+			name,
+			document
+		}, null, 2))}\n`;
+		asJson.push(`src/actions/${identifier}.json stays JSON: ${reading.reason}`);
+	});
+	exported.connectors.forEach(({ identifier, name, manifest }) => {
+		files[`src/connectors/${identifier}.json`] = `${JSON.stringify({
+			id: identifier,
+			name,
+			manifest
+		}, null, 2)}\n`;
+	});
+	files["src/actions.ts"] = actionsModule(coded);
+	const functions = Object.fromEntries(Object.entries(exported.functions.files).map(([path, text]) => [path, local(text)]));
+	Object.entries(functions).forEach(([path, text]) => {
+		files[`functions/${path}`] = text;
+	});
+	const runtimeEntry = source.runtime?.entries[0];
+	if (builtOnly.runtime) binaries["vendor/runtime.bundle"] = builtOnly.runtime;
+	files["src/main.ts"] = fromSpaceMain({
+		source: spaceSource,
+		...runtimeEntry ? { runtimeEntry: fromMain(place(runtimeEntry)) } : {},
+		packedRuntime: Boolean(builtOnly.runtime),
+		builtPlugins: builtOnly.plugins.length > 0,
+		visitorRoles: exported.visitorRoles
+	});
+	const extra = Object.fromEntries(Object.entries(source.dependencies).filter(([name]) => !name.startsWith("@plitzi/") && !["react", "react-dom"].includes(name)));
+	const plitzi = Object.fromEntries([...Object.keys(source.dependencies), ...coded.length > 0 ? ["@plitzi/sdk-authoring"] : []].filter((name) => name.startsWith("@plitzi/")).map((name) => [name, SDK_VERSION]));
+	const variables = [...exported.variables, ...exported.credentials.map(({ identifier }) => identifier)];
+	files[".env.example"] = `${settingsLines(exported).join("\n")}\nPORT=8080\n`;
+	files[".prettierignore"] = `${prettierignore(PROJECT_OUTPUTS)}public\nvendor\n`;
+	const lines = [
+		...report.conflicts.map(({ path, kept, others }) => `${place(path)}: ${kept} and ${others.join(", ")} held different copies; ${kept}'s is kept`),
+		...report.rangeConflicts.map(({ name, kept, others }) => `${name}: asked for at ${[kept, ...others].join(" and ")}; ${kept} is written`),
+		...Object.entries(source.dependencies).filter(([name, range]) => name.startsWith("@plitzi/") && range !== SDK_VERSION).map(([name, range]) => `${name}: the source was written against ${range}, and the project runs ${SDK_VERSION}`),
+		...source.plugins.flatMap(({ type, entries }) => {
+			const entry = place(entries[0] ?? "");
+			const folder = /^src\/plugins\/([^/]+)\/index\.ts$/.exec(entry)?.[1];
+			return folder && `${folder.charAt(0).toLowerCase()}${folder.slice(1)}` === type ? [] : [`${type}: its source starts at ${entry}, and the project registers src/plugins/<Name>/index.ts — move it there`];
+		}),
+		...builtOnly.plugins.map(({ type }) => `${type}: no source of this plugin was kept, so it runs as it was built (vendor/plugins/${type}/) and cannot be changed — upload it again from its source with plitzi upload plugin`),
+		...builtOnly.runtime ? ["The runtime came across built only (vendor/runtime.bundle): it runs, and cannot be changed"] : [],
+		...asJson,
+		...exported.visitorRoles.length > 0 ? [`Its visitors (${exported.visitorRoles.join(", ")}) signed in with Plitzi: here nobody signs in until the server does it itself — see the note in src/main.ts`] : [],
+		...report.corrections,
+		...variables.length > 0 ? [`Give the project its variables and credentials in .env: ${variables.join(", ")}`] : []
+	];
+	return {
+		files,
+		binaries,
+		downloads: [...assets.map(({ url, path }) => ({
+			url,
+			to: `public/${path}`
+		})), ...builtOnly.plugins.flatMap(({ type, files: built }) => built.map(({ url, path }) => ({
+			url,
+			to: `vendor/plugins/${type}/${path}`
+		})))],
+		dependencies: {
+			...extra,
+			...plitzi
+		},
+		functions: {
+			version: exported.functions.version,
+			files: functions
+		},
+		omit: EXAMPLE.filter((path) => !Object.hasOwn(files, path)),
+		report: lines
+	};
+};
+//#endregion
+//#region src/commands/spaceOrigin.ts
+/**
+* Where a project `plitzi create --from` made came from, and what the space gave it: `.plitzi/space.json`, committed
+* with the project so everyone working on it pulls from the same point.
+*
+* What it was given is kept as a digest of each file as it was written, never the file: that is enough for `plitzi
+* pull` to tell a file changed here from one the space changed — the two questions a pull asks of every file — and a
+* copy of the whole project beside the project would be the second source of it nobody keeps in step.
+*/
+var ORIGIN_FILE = path.join(".plitzi", "space.json");
+var isRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isStrings = (value) => isRecord$4(value) && Object.values(value).every((entry) => typeof entry === "string");
+var digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/**
+* A file of the project as a pull compares it: the digest of what the project's formatter makes of it — so a file only
+* formatted since is not a file changed — and of its bytes as they are, which is what a project recorded before it had
+* a formatter. Nothing when there is no such file.
+*/
+var digestsOf = async (root, file, format) => {
+	let bytes;
+	try {
+		bytes = await fs.readFile(path.join(root, file));
+	} catch {
+		return;
+	}
+	const raw = digest(bytes);
+	return {
+		formatted: isTextFile(file) ? digest(await format(file, bytes.toString("utf-8"))) : raw,
+		raw
+	};
+};
+/** The project's origin, or `undefined` when it has none — it was not made from a space, or the file is not one. */
+var readOrigin = async (root) => {
+	try {
+		const value = JSON.parse(await fs.readFile(path.join(root, ORIGIN_FILE), "utf-8"));
+		if (!isRecord$4(value) || value.format !== 1 || typeof value.api !== "string" || !isRecord$4(value.space) || typeof value.space.id !== "number" || typeof value.space.name !== "string" || typeof value.space.permanentUrl !== "string" || value.source !== "local" && value.source !== "cloud" || !isRecord$4(value.version) || typeof value.version.environment !== "string" || value.version.revision !== void 0 && typeof value.version.revision !== "number" || !isStrings(value.files) || !isStrings(value.downloads) || !isStrings(value.dependencies)) return;
+		return {
+			format: 1,
+			api: value.api,
+			space: {
+				id: value.space.id,
+				name: value.space.name,
+				permanentUrl: value.space.permanentUrl
+			},
+			source: value.source,
+			version: {
+				environment: value.version.environment,
+				...typeof value.version.revision === "number" ? { revision: value.version.revision } : {}
+			},
+			files: value.files,
+			downloads: value.downloads,
+			dependencies: value.dependencies
+		};
+	} catch {
+		return;
+	}
+};
+/** Kept sorted, so a pull that changed one file changes one line of it. */
+var sorted = (record) => Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
+var writeOrigin = async (root, origin) => {
+	await fs.mkdir(path.join(root, ".plitzi"), { recursive: true });
+	await fs.writeFile(path.join(root, ORIGIN_FILE), `${JSON.stringify({
+		...origin,
+		files: sorted(origin.files),
+		downloads: sorted(origin.downloads),
+		dependencies: sorted(origin.dependencies)
+	}, null, 2)}\n`);
+};
+/** What the project was given, once it is on disk: each file's digest, formatted as the project formats it. */
+var digestsOnDisk = async (root, files, format) => {
+	const digests = await Promise.all(files.map(async (file) => [file, (await digestsOf(root, file, format))?.formatted]));
+	return Object.fromEntries(digests.filter((entry) => entry[1] !== void 0));
+};
+//#endregion
+//#region src/commands/createFrom.ts
+/**
+* `plitzi create --from <space>`: the space as Plitzi keeps it (docs/en/projects-from-spaces.md), asked for as the person — who must be able
+* to change it — and the files of it the project serves itself, fetched once.
+*/
+var isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** What the platform answered is an export: of the format this CLI writes, with every part it reads. */
+var isExport = (value) => isRecord$3(value) && value.format === 1 && isRecord$3(value.space) && isRecord$3(value.version) && isRecord$3(value.source) && isRecord$3(value.builtOnly) && isRecord$3(value.report) && isRecord$3(value.functions) && Array.isArray(value.actions) && Array.isArray(value.assets) && Array.isArray(value.visitorRoles);
+/** How a version is said: `the draft`, `production (latest)`, `production r3`. */
+var versionLabel = ({ environment, revision }) => {
+	if (environment === "main") return "the draft";
+	return revision ? `${environment} r${String(revision)}` : `${environment} (latest)`;
+};
+/**
+* A version of the space named — its id or its permanent URL — put together as a project, or why not, said and
+* `undefined`. `name` is what it is called in what is printed: `from`, unless a pull names it by its id.
+*/
+var fetchExport = async (api, from, { source, version, name = from }) => {
+	const connection = await signedIn(api, `to take ${from} out of Plitzi`);
+	if (!connection) return;
+	console.log(`\nTaking ${chalk.bold(name)} (${versionLabel(version)}) out of ${api}…`);
+	const query = new URLSearchParams({
+		source,
+		environment: version.environment,
+		...version.revision ? { revision: String(version.revision) } : {}
+	});
+	const answered = await authorizedRequest(connection, `/spaces/${encodeURIComponent(from)}/export?${query.toString()}`);
+	if (!answered.ok) {
+		console.error(chalk.red(answered.error));
+		process.exitCode = 1;
+		return;
+	}
+	const { status, data } = answered.value.reply;
+	if (status === 200 && isExport(data)) return data;
+	const said = isRecord$3(data) && typeof data.error === "string" ? data.error : void 0;
+	const why = {
+		403: `You may not take ${from} out: it takes being able to change it — its owner, an administrator or a writer.`,
+		404: said ?? `There is no space ${from} you can reach.`
+	};
+	console.error(chalk.red(why[status] ?? said ?? `The platform would not hand ${from} over (${String(status)}).`));
+	process.exitCode = 1;
+};
+/** A file of the space's CDN, fetched. */
+var download = async (url) => {
+	const response = await fetch(url);
+	if (!response.ok) throw new Error(String(response.status));
+	return Buffer.from(await response.arrayBuffer());
+};
+/** Why a file could not be fetched, as the report says it. */
+var notFetched = (to, url, error) => `${to}: could not be fetched from ${url} (${error instanceof Error ? error.message : String(error)})`;
+/** The project's binary files written, and the space's files fetched from its CDN into the project to be served by it. */
+var writeFromSpace = async (target, project) => {
+	for (const [file, base64] of Object.entries(project.binaries)) {
+		await fs.mkdir(path.dirname(path.join(target, file)), { recursive: true });
+		await fs.writeFile(path.join(target, file), Buffer.from(base64, "base64"));
+	}
+	const missing = [];
+	for (const { url, to } of project.downloads) try {
+		const bytes = await download(url);
+		await fs.mkdir(path.dirname(path.join(target, to)), { recursive: true });
+		await fs.writeFile(path.join(target, to), bytes);
+	} catch (error) {
+		missing.push(notFetched(to, url, error));
+	}
+	return missing;
+};
+/** The space's functions as they are on disk: what `plitzi functions push` compares the project's with. */
+var functionsOnDisk = async (root, project) => Object.fromEntries(await Promise.all(Object.keys(project.functions.files).map(async (file) => [file, await fs.readFile(path.join(root, "functions", file), "utf-8")])));
+/**
+* What the project was given, recorded once it is on disk as it will stay — installed and formatted — so `plitzi pull`
+* tells what changed here from what changed on the space; and its functions as a pulled working copy, so `plitzi
+* functions push` sends them back to the space they came from.
+*/
+var recordOrigin = async (root, { api, exported, source, pinned, project }) => {
+	const files = await digestsOnDisk(root, [
+		...Object.keys(project.files),
+		...Object.keys(project.binaries),
+		...project.downloads.map(({ to }) => to)
+	], await projectFormatter(root));
+	await writeOrigin(root, {
+		format: 1,
+		api,
+		space: exported.space,
+		source,
+		version: {
+			environment: exported.version.environment,
+			...pinned ? { revision: exported.version.revision } : {}
+		},
+		files,
+		downloads: Object.fromEntries(project.downloads.filter(({ to }) => Object.hasOwn(files, to)).map(({ url, to }) => [to, url])),
+		dependencies: project.dependencies
+	});
+	await writeFunctionsState(root, {
+		space: exported.space.id,
+		version: project.functions.version,
+		files: await functionsOnDisk(root, project)
+	});
+};
+//#endregion
+//#region src/commands/create.ts
+var MODES = ["server", "client"];
+var SOURCES = ["local", "cloud"];
+/**
+* The choices a project is BUILT around, which belong to whoever it is for — never to a default nobody chose.
+*
+* Each one is written into the project: the package manager into every command its README, lockfile, Playwright config
+* and install use; the mode into whether there is a Node tier at all; the source into whether the space is in the repo.
+* Assumed, they are the wrong project for somebody, and an agent running this was the one assuming. So what was not
+* passed is asked for when a person is at the terminal, and refused when nobody is — with the exact questions to put
+* to the person.
+*/
+var resolveDecisions = async (options) => {
+	const detected = detectPackageManager();
+	const packageManager = {
+		flag: "--package-manager",
+		choices: PACKAGE_MANAGERS,
+		question: `Which package manager will you work in? (this was run through ${detected})`,
+		given: PACKAGE_MANAGERS.find((manager) => manager === options.packageManager),
+		fallback: detected
+	};
+	const mode = {
+		flag: "--mode",
+		choices: MODES,
+		question: "Should pages render on a Node server of your own (server: SSR + RSC), or only in the browser (client)?",
+		given: MODES.find((candidate) => candidate === options.mode),
+		fallback: "server"
+	};
+	const source = {
+		flag: "--source",
+		choices: SOURCES,
+		question: "Should the space live in the project as code you edit (local), or be read live from your Plitzi account (cloud, which needs a key from Credentials in the builder)?",
+		given: SOURCES.find((candidate) => candidate === options.source),
+		fallback: "local"
+	};
+	const missing = [
+		packageManager,
+		mode,
+		source
+	].filter((question) => question.given === void 0);
+	if (missing.length === 0 || options.yes && atTerminal()) return {
+		packageManager: packageManager.given ?? packageManager.fallback,
+		mode: mode.given ?? mode.fallback,
+		source: source.given ?? source.fallback
+	};
+	if (!atTerminal()) {
+		refuseWithoutTerminal("project", missing);
+		return;
+	}
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const manager = packageManager.given ?? await ask(rl, packageManager);
+		const tier = manager && (mode.given ?? await ask(rl, mode));
+		const origin = tier && (source.given ?? await ask(rl, source));
+		if (!manager || !tier || !origin) {
+			process.exitCode = 1;
+			return;
+		}
+		return {
+			packageManager: manager,
+			mode: tier,
+			source: origin
+		};
+	} finally {
+		rl.close();
+	}
+};
+var keyQuestion = (mode) => `The ${mode === "server" ? "self-hosting" : "public render"} key the project reads the space with (Credentials, in the builder).`;
+var askForKey = async (mode) => {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return (await rl.question(`\n${keyQuestion(mode)}\n> `)).trim();
+	} finally {
+		rl.close();
+	}
+};
+var create = async (directory, options) => {
+	const target = path.resolve(directory ?? ".");
+	const name = path.basename(target);
+	const wasEmpty = await isEmpty(target);
+	if (!options.force && !wasEmpty) {
+		console.error(chalk.red(`${target} is not empty. Pass --force to write into it anyway.`));
+		process.exitCode = 1;
+		return;
+	}
+	if (options.from && options.mode === "client") {
+		console.error(chalk.red("A project made from a space runs its own server: leave out --mode, or pass --mode server."));
+		process.exitCode = 1;
+		return;
+	}
+	const environment = options.environment ?? "main";
+	const revision = options.revision === void 0 ? void 0 : Number(options.revision);
+	if (revision !== void 0 && (!Number.isInteger(revision) || revision < 1 || environment === "main")) {
+		console.error(chalk.red(environment === "main" ? "The draft (main) has no revisions: name a published environment with --environment, then --revision." : `--revision takes a revision number from 1, not "${options.revision ?? ""}".`));
+		process.exitCode = 1;
+		return;
+	}
+	const decisions = await resolveDecisions(options.from ? {
+		...options,
+		mode: "server"
+	} : options);
+	if (!decisions) return;
+	const { packageManager, mode, source } = decisions;
+	if (revision !== void 0 && !options.from && source === "local") {
+		console.error(chalk.red("--revision pins a published version: it goes with --from, or with --source cloud."));
+		process.exitCode = 1;
+		return;
+	}
+	if (source === "cloud" && !options.key && !atTerminal()) {
+		refuseWithoutTerminal("project", [{
+			flag: "--key",
+			choices: ["<key>"],
+			question: keyQuestion(mode)
+		}]);
+		return;
+	}
+	const key = source === "cloud" ? options.key ?? await askForKey(mode) : "";
+	if (source === "cloud" && !key) {
+		console.error(chalk.red("\nNo key. Mint one under Credentials in the builder, then run this again."));
+		process.exitCode = 1;
+		return;
+	}
+	const answers = {
+		name,
+		mode,
+		source,
+		key,
+		environment,
+		...revision ? { revision } : {},
+		packageManager,
+		managerVersion: detectManagerVersion(packageManager, await nearestExisting(target))
+	};
+	const api = options.from ? await apiFor(options) : void 0;
+	const exported = options.from && api ? await fetchExport(api, options.from, {
+		source,
+		version: {
+			environment,
+			...revision ? { revision } : {}
+		}
+	}) : void 0;
+	if (options.from && !exported) return;
+	const fromSpace = exported ? projectFromSpace(exported, source) : void 0;
+	const files = Object.fromEntries(Object.entries(scaffold(answers)).filter(([file]) => !fromSpace?.omit.includes(file)));
+	await writeFiles(target, exported && fromSpace ? {
+		...files,
+		...fromSpace.files,
+		"package.json": packageJson$1(answers, fromSpace.dependencies),
+		".env": envFromSpace(exported, answers, randomBytes(32).toString("hex"))
+	} : files);
+	const missing = fromSpace ? await writeFromSpace(target, fromSpace) : [];
+	const wantsInstall = options.install !== false;
+	const installed = wantsInstall && await install(packageManager, target);
+	/**
+	* A failed install is a failed command, not a next step.
+	*
+	* The files are already written, so the summary below still prints — but printed on its own after a screen of
+	* resolver errors it reads as success, and a script that ran `create` carries on into a project with no
+	* `node_modules`.
+	*/
+	if (wantsInstall && !installed) {
+		console.error(chalk.red(`\n\`${installCommand(packageManager)}\` failed. The project is written; the reason is in the output above.`));
+		console.error(chalk.dim(INSTALL_HINTS[packageManager]));
+		process.exitCode = 1;
+	}
+	/**
+	* Formatted by the project's own Prettier, once, so the first commit is already in its style — the scaffold writes
+	* tables and lists whose layout depends on what they hold. Only into a folder that was empty: `--force` into one
+	* with work in it must never reformat that work.
+	*/
+	if (installed && wasEmpty) await runScript(packageManager, "format", target);
+	if (api && exported && fromSpace) await recordOrigin(target, {
+		api,
+		exported,
+		source,
+		pinned: revision !== void 0,
+		project: fromSpace
+	});
+	const where = cdPrefix(target);
+	console.log(chalk.green(`\n${name} — ${mode === "server" ? "server-rendered" : "browser-rendered"}, space ${source === "cloud" ? "from Plitzi" : "in the project"}.`));
+	console.log("");
+	if (!installed) console.log(`  ${where}${installCommand(packageManager)}`);
+	console.log(`  ${where}${runCommand(packageManager, "start")}`);
+	console.log("");
+	console.log(chalk.dim(`.claude/skills carries Plitzi's authoring skill; \`${runCommand(packageManager, "visual")}\` opens the page and checks it.`));
+	if (source === "cloud") console.log(chalk.dim(".env holds the key and is already git-ignored."));
+	if (exported) {
+		const { version } = exported;
+		const said = version.snapshot ? ` — “${version.snapshot.description}”, made ${version.snapshot.publishedAt}` : "";
+		console.log(chalk.dim(`Taken from ${versionLabel(version)}${said}.`));
+	}
+	const notes = [...fromSpace?.report ?? [], ...missing];
+	if (exported && notes.length > 0) {
+		console.log(chalk.yellow(`\nWhat to know about ${exported.space.name} here:`));
+		notes.forEach((note) => console.log(chalk.yellow(`  - ${note}`)));
+	}
+	console.log("");
+};
+//#endregion
+//#region src/commands/createPlugin.ts
+var DEFAULT_NAME = "plitzi-plugin-my-element";
+/** What an agent is told to ask for, and the flags that carry the answers. */
+var QUESTIONS = {
+	name: {
+		flag: "--name",
+		choices: ["<package name>"],
+		question: "What is the plugin called? Its package name, e.g. plitzi-plugin-seat-picker."
+	},
+	directory: {
+		flag: "<directory> (the first argument)",
+		choices: ["<folder>"],
+		question: "Which folder should the plugin be written to?"
+	}
+};
+var splitNames = (list) => list.split(",").map((name) => name.trim()).filter(Boolean);
+/**
+* What is wrong with the other elements asked for, if anything: a name that makes no element, or two elements — the
+* package's own among them — that would share a type, which a space could not tell apart.
+*/
+var elementListProblem = (main, others) => {
+	for (const name of others) {
+		const problem = pluginNameProblem(name);
+		if (problem) return problem;
+	}
+	const types = [pluginNames(main).type, ...others.map((name) => pluginNames(name).type)];
+	const repeated = types.find((type, index) => types.indexOf(type) !== index);
+	return repeated ? `Two elements would both be "${repeated}": give each a name of its own.` : void 0;
+};
+/** The folders a repository keeps its packages in, as places for this one — or `./<name>` outside of any. */
+var folderOptions = (project, base) => {
+	if (!project) return [];
+	const root = project.workspaceRoot ?? project.root;
+	return [.../* @__PURE__ */ new Set([...project.workspaceFolders, "plugins"])].map((folder) => {
+		const value = path.join(root, folder, base);
+		return {
+			label: path.relative(process.cwd(), value) || ".",
+			value
+		};
+	});
+};
+var askDirectory = async (rl, project, base) => {
+	const typed = {
+		question: "Which folder? (relative to here)",
 		fallback: `./${base}`
 	};
 	if (!project) return path.resolve(await askText(rl, "Which folder should the plugin be written to?", typed.fallback));
@@ -3658,316 +4611,251 @@ var createPlugin = async (directory, options) => {
 			inProject: project !== void 0
 		}));
 		/**
-		* Installed where it will be installed from. Inside a workspace that covers the folder, installing there installs
-		* the workspace; inside a repository that does not list it, Yarn refuses to install a package it does not know —
-		* so that is said, with the fix, rather than failed at.
-		*/
-		const unlisted = project?.workspaceRoot !== void 0 && !coveredByWorkspace(project, target);
-		const wantsInstall = options.install !== false && !unlisted;
-		const installed = wantsInstall && await install(packageManager, target);
-		if (wantsInstall && !installed) {
-			console.error(chalk.red(`\n\`${installCommand(packageManager)}\` failed. The plugin is written; the reason is in the output above.`));
-			console.error(chalk.dim(INSTALL_HINTS[packageManager]));
-			process.exitCode = 1;
-		}
-		if (installed && wasEmpty) await runScript(packageManager, "format", target);
-		const where = cdPrefix(target);
-		console.log(chalk.green(`\n${name} — the ${names.type} element, as a package any space can load.`));
-		if (unlisted) console.log(chalk.yellow(`\n${path.relative(process.cwd(), target)} is not one of the workspace's packages: add it to \`workspaces\`, then install.`));
-		console.log("");
-		if (!installed) console.log(`  ${where}${installCommand(packageManager)}`);
-		console.log(`  ${where}${runCommand(packageManager, "start")}   # the plugin inside a space`);
-		console.log(`  ${where}${runCommand(packageManager, "zip")}     # what the builder takes, under Resources`);
-		console.log("");
-	} finally {
-		rl?.close();
-	}
-};
-//#endregion
-//#region ../../packages/sdk-shared/dist/actions/functions.mjs
-var n = (e) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*\.(ts|js|mjs|json)$/.test(e) && !e.split("/").some((e) => e === ".." || e === "." || e === "");
-var r = async (e, t) => {
-	let r = {}, i = async (a) => {
-		let o;
-		try {
-			o = await t.list(a ? `${e}/${a}` : e);
-		} catch {
-			return;
-		}
-		for (let s of o) {
-			let o = a ? `${a}/${s.name}` : s.name;
-			s.directory ? s.name !== "node_modules" && !s.name.startsWith(".") && await i(o) : n(o) && (r[o] = await t.read(`${e}/${o}`));
-		}
-	};
-	return await i(""), r;
-};
-//#endregion
-//#region src/commands/functions.ts
-var FUNCTIONS_DIR = "functions";
-var STATE_FILE = path.join(".plitzi", "functions.json");
-var isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** The project's root: where `functions/` and `.plitzi/` go. */
-var rootOf = async () => (await findProject(process.cwd()))?.root ?? process.cwd();
-/** Every source file under `functions/`, by its path there — read by the one rule of what a source is. */
-var readLocal = (root) => r(path.join(root, FUNCTIONS_DIR), {
-	list: async (dir) => (await fs.readdir(dir, { withFileTypes: true })).map((entry) => ({
-		name: entry.name,
-		directory: entry.isDirectory()
-	})),
-	read: (file) => fs.readFile(file, "utf8")
-});
-var readState = async (root) => {
-	try {
-		const value = JSON.parse(await fs.readFile(path.join(root, STATE_FILE), "utf8"));
-		if (!isRecord$2(value) || typeof value.space !== "number" || typeof value.version !== "string" || !isRecord$2(value.files)) return;
-		const files = Object.fromEntries(Object.entries(value.files).flatMap(([name, text]) => typeof text === "string" ? [[name, text]] : []));
-		return {
-			space: value.space,
-			version: value.version,
-			files
-		};
-	} catch {
-		return;
-	}
-};
-var writeState = async (root, state) => {
-	await fs.mkdir(path.join(root, ".plitzi"), { recursive: true });
-	await fs.writeFile(path.join(root, STATE_FILE), `${JSON.stringify(state, null, 2)}\n`);
-};
-/** The files that differ between two copies — added, removed or changed — sorted. */
-var changedFiles = (a, b) => [.../* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])].filter((file) => a[file] !== b[file]).sort();
-var taskList = (draft) => draft.manifest?.tasks.length ? draft.manifest.tasks.map((task) => `${task.namespace}.${task.action}`).join(", ") : "no tasks";
-var connect$1 = async (options, doing) => {
-	const api = await apiFor(options);
-	return api ? connectionWithSpace(api, doing) : void 0;
-};
-var readDraft = async (connection, spaceId) => {
-	const answered = await authorizedRequest(connection, `/spaces/${spaceId}/functions`);
-	if (!answered.ok) {
-		fail(answered.error);
-		return;
-	}
-	const { reply } = answered.value;
-	if (reply.status !== 200) {
-		fail(reply.data.error ?? `Could not read the space’s functions (${reply.status}).`);
-		return;
-	}
-	return reply.data;
-};
-var pullFunctions = async (options) => {
-	const connection = await connect$1(options, "to pull from");
-	if (!connection?.space) return;
-	const root = await rootOf();
-	const [local, state] = await Promise.all([readLocal(root), readState(root)]);
-	const unpushed = state ? changedFiles(local, state.files) : Object.keys(local);
-	if (!options.force && (state?.space ?? connection.space.id) !== connection.space.id) {
-		fail("functions/ is a copy of another space’s. Pull into another project, or pass --force to replace it.");
-		return;
-	}
-	if (!options.force && unpushed.length) {
-		fail(`Pulling would overwrite what is not pushed yet: ${unpushed.join(", ")}.\nPush it first, or pass --force to throw it away.`);
-		return;
-	}
-	const draft = await readDraft(connection, connection.space.id);
-	if (!draft) return;
-	const base = path.join(root, FUNCTIONS_DIR);
-	await Promise.all(Object.keys(local).filter((file) => !Object.hasOwn(draft.files, file)).map((file) => fs.rm(path.join(base, file))));
-	for (const [file, text] of Object.entries(draft.files)) {
-		await fs.mkdir(path.dirname(path.join(base, file)), { recursive: true });
-		await fs.writeFile(path.join(base, file), text);
-	}
-	await writeState(root, {
-		space: connection.space.id,
-		version: draft.version,
-		files: draft.files
-	});
-	const count = Object.keys(draft.files).length;
-	console.log(count ? `Pulled ${count} file${count === 1 ? "" : "s"} of ${chalk.bold(connection.space.name)}’s functions into functions/ — ${taskList(draft)}.` : `${chalk.bold(connection.space.name)} has no functions yet. Write functions/index.ts and plitzi functions push.`);
-};
-var printProblems = (problems) => {
-	console.error(chalk.red("The functions were not saved:"));
-	problems.forEach(({ file, line, column, message }) => {
-		const where = file ? `functions/${file}${line ? `:${String(line)}${column ? `:${String(column)}` : ""}` : ""}` : "functions";
-		console.error(`  ${chalk.bold(where)} ${message}`);
-	});
-	process.exitCode = 1;
-};
-var pushFunctions = async (options) => {
-	const connection = await connect$1(options, "to push to");
-	if (!connection?.space) return;
-	const root = await rootOf();
-	const [local, state] = await Promise.all([readLocal(root), readState(root)]);
-	if (!Object.hasOwn(local, "index.ts")) {
-		fail("There is no functions/index.ts here: it is where a space’s functions start. Pull them, or write it.");
-		return;
-	}
-	let base = state?.space === connection.space.id ? state.version : void 0;
-	if (base === void 0) {
-		const draft = await readDraft(connection, connection.space.id);
-		if (!draft) return;
-		if (Object.keys(draft.files).length) {
-			fail(`${connection.space.name} already has functions. Pull them first: plitzi functions pull.`);
-			return;
-		}
-		base = draft.version;
-	}
-	if (state?.space === connection.space.id && !changedFiles(local, state.files).length) {
-		console.log("Nothing to push: functions/ is what was pulled.");
-		return;
-	}
-	const answered = await authorizedRequest(connection, `/spaces/${connection.space.id}/functions`, {
-		method: "PUT",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			files: local,
-			base
-		})
-	});
-	if (!answered.ok) {
-		fail(answered.error);
-		return;
-	}
-	const { reply } = answered.value;
-	if (reply.status === 422 && reply.data.problems) {
-		printProblems(reply.data.problems);
-		return;
-	}
-	if (reply.status === 409) {
-		fail(`${connection.space.name}’s functions changed since your pull — in the builder, or from another copy. Keep your changes aside, pull, and apply them again.`);
-		return;
-	}
-	if (reply.status !== 200 || !reply.data.version) {
-		fail(reply.data.refusal?.error ?? reply.data.error ?? `The functions were not saved (${reply.status}).`);
-		return;
+		* Installed where it will be installed from. Inside a workspace that covers the folder, installing there installs
+		* the workspace; inside a repository that does not list it, Yarn refuses to install a package it does not know —
+		* so that is said, with the fix, rather than failed at.
+		*/
+		const unlisted = project?.workspaceRoot !== void 0 && !coveredByWorkspace(project, target);
+		const wantsInstall = options.install !== false && !unlisted;
+		const installed = wantsInstall && await install(packageManager, target);
+		if (wantsInstall && !installed) {
+			console.error(chalk.red(`\n\`${installCommand(packageManager)}\` failed. The plugin is written; the reason is in the output above.`));
+			console.error(chalk.dim(INSTALL_HINTS[packageManager]));
+			process.exitCode = 1;
+		}
+		if (installed && wasEmpty) await runScript(packageManager, "format", target);
+		const where = cdPrefix(target);
+		console.log(chalk.green(`\n${name} — the ${names.type} element, as a package any space can load.`));
+		if (unlisted) console.log(chalk.yellow(`\n${path.relative(process.cwd(), target)} is not one of the workspace's packages: add it to \`workspaces\`, then install.`));
+		console.log("");
+		if (!installed) console.log(`  ${where}${installCommand(packageManager)}`);
+		console.log(`  ${where}${runCommand(packageManager, "start")}   # the plugin inside a space`);
+		console.log(`  ${where}${runCommand(packageManager, "zip")}     # what the builder takes, under Resources`);
+		console.log("");
+	} finally {
+		rl?.close();
 	}
-	await writeState(root, {
-		space: connection.space.id,
-		version: reply.data.version,
-		files: local
-	});
-	console.log(`Pushed to ${chalk.bold(connection.space.name)}’s draft — ${taskList({ manifest: reply.data.manifest ?? null })}. ` + chalk.dim("The live site runs them once the space is published."));
 };
-/** What one run of a task did: its logs, then its value — or why it failed, as a failure of the command. */
-var printRun = (task, report) => {
-	const step = report.steps?.find((entry) => entry.action === task);
-	const took = step ? `${String(step.endTime - step.startTime)} ms` : "";
-	step?.logs?.forEach((line) => console.log(chalk.dim(`log  ${line}`)));
-	if (step?.error) {
-		fail(`${task} failed after ${took}: ${step.error}`);
-		return;
+//#endregion
+//#region ../../packages/sdk-shared/dist/source/snapshot.mjs
+var t = {
+	files: 2e3,
+	fileBytes: 4194304,
+	totalBytes: 25165824
+};
+var n = ["plugin", "runtime"];
+var r = [
+	/(^|\/)\.env(\.|$)/,
+	/\.(pem|key|p12|pfx)$/i,
+	/(^|\/)id_(rsa|dsa|ecdsa|ed25519)$/
+];
+var i = [
+	{
+		what: "a private key",
+		pattern: /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/
+	},
+	{
+		what: "an AWS access key",
+		pattern: /\bAKIA[0-9A-Z]{16}\b/
+	},
+	{
+		what: "a Stripe live key",
+		pattern: /\b[sr]k_live_[0-9a-zA-Z]{20,}\b/
+	},
+	{
+		what: "a GitHub token",
+		pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/
+	},
+	{
+		what: "a Slack token",
+		pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/
 	}
-	console.log(`${chalk.green(report.status ?? "completed")} ${chalk.dim(took ? `in ${took}` : "")}`);
-	console.log(JSON.stringify(report.output?.value ?? null, null, 2));
+];
+var a = (e) => {
+	let t = e.split("/");
+	if (!e || e.startsWith("/") || /^[a-zA-Z]:/.test(e) || e.includes("\\")) return `"${e}" is not a path relative to the project, with forward slashes`;
+	if (t.some((e) => e === "" || e === "." || e === "..")) return `"${e}" climbs out of the project, or has an empty part`;
+	if (t.some((e) => e === "node_modules" || e === ".git")) return `"${e}" is in node_modules or .git: a package is a dependency, not a file of the project`;
+	if (r.some((t) => t.test(e))) return `"${e}" is a file of credentials: they stay where the project runs, never in what Plitzi keeps`;
+};
+var o = (e) => i.find(({ pattern: t }) => t.test(e))?.what;
+var s = (e) => typeof e == "string" && n.some((t) => t === e);
+var c = (e) => typeof e == "string" && /^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(e);
+var l = (e) => Array.isArray(e) && e.length > 0 && e.every((e) => typeof e == "string");
+var u = (e) => typeof e == "object" && !!e && !Array.isArray(e);
+var d = (e) => u(e) && Object.values(e).every((e) => typeof e == "string");
+var f = (e) => Math.floor(e.length * 3 / 4) - (e.endsWith("==") ? 2 : +!!e.endsWith("="));
+var p = (e, r) => {
+	if (!u(e) || e.format !== 1) return {
+		ok: !1,
+		problems: ["Not a source snapshot of format 1"]
+	};
+	let { kind: i, name: p, entries: m, files: h, dependencies: g } = e, _ = [];
+	if (s(i) || _.push(`Its kind is one of ${n.join(", ")}`), c(p) || _.push("Its name is a plugin type or \"runtime\": letters, digits, dashes and underscores"), !d(h) || !d(g)) return {
+		ok: !1,
+		problems: [..._, "Its files and dependencies are maps of text"]
+	};
+	l(m) ? m.filter((e) => !Object.hasOwn(h, e)).forEach((e) => _.push(`Its entry "${e}" is not among its files`)) : _.push("It names at least one entry");
+	let v = Object.keys(h);
+	v.length > t.files && _.push(`It holds ${String(v.length)} files; a snapshot holds at most ${String(t.files)}`);
+	let y = 0;
+	return v.forEach((e) => {
+		let n = a(e);
+		if (n) {
+			_.push(n);
+			return;
+		}
+		let i = f(h[e]);
+		if (y += i, i > t.fileBytes) {
+			_.push(`"${e}" is ${(i / 1024 / 1024).toFixed(1)} MB; a file of source is at most 4 MB`);
+			return;
+		}
+		let s = o(r(h[e]));
+		s && _.push(`"${e}" holds ${s}: take it out of the code and give it to the project as a variable`);
+	}), y > t.totalBytes && _.push(`It holds ${(y / 1024 / 1024).toFixed(1)} MB of files; a snapshot holds at most 24 MB`), _.length > 0 || !s(i) || !c(p) || !l(m) ? {
+		ok: !1,
+		problems: _
+	} : {
+		ok: !0,
+		snapshot: {
+			format: 1,
+			kind: i,
+			name: p,
+			entries: m,
+			files: h,
+			dependencies: g
+		}
+	};
 };
-/** `--params`, read: an object of the task's params by name, or nothing when it is not one. */
-var paramsOf = (given) => {
+//#endregion
+//#region src/pack/source.ts
+var CODE = /\.(m|c)?(t|j)sx?$/;
+var STYLES = /\.(css|scss|sass|less)$/;
+/** Where an import of a file without its extension can be, in the order a bundler looks. */
+var EXTENSIONS = [
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs",
+	".json",
+	".css",
+	".scss"
+];
+var BUILTINS = new Set(builtinModules);
+var loadTypeScript$1 = (root) => {
 	try {
-		const params = given ? JSON.parse(given) : {};
-		if (isRecord$2(params)) return params;
-	} catch {}
-	fail("--params is a JSON object of the task’s params, by name: --params '{\"name\":\"Ada\"}'");
-};
-var tryFunction = async (task, options) => {
-	const params = paramsOf(options.params);
-	if (!params) return;
-	const connection = await connect$1(options, "to try it in");
-	if (!connection?.space) return;
-	const answered = await authorizedRequest(connection, `/spaces/${connection.space.id}/functions/try`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			task,
-			params
-		})
-	});
-	if (!answered.ok) {
-		fail(answered.error);
-		return;
-	}
-	const { reply } = answered.value;
-	if (reply.status !== 200) {
-		fail(reply.data.error ?? `The task could not be tried (${reply.status}).`);
+		return createRequire(path.join(root, "package.json"))("typescript");
+	} catch {
 		return;
 	}
-	printRun(task, reply.data);
-};
-var isLocalRunner = (value) => isRecord$2(value) && typeof value.createLocalFunctions === "function";
-/**
-* This project's own runner: `dev` runs the functions with the `@plitzi/sdk-server` the project installed, so the build,
-* the checks, the isolates and the limits are the platform's own, at the version the project is on.
-*/
-var projectRunner = async (root) => {
-	try {
-		const entry = createRequire(path.join(root, "package.json")).resolve("@plitzi/sdk-server/functions-runner");
-		const loaded = await import(pathToFileURL(entry).href);
-		if (isLocalRunner(loaded)) return loaded;
-	} catch {}
-	fail("plitzi functions dev runs them with this project’s own @plitzi/sdk-server, and the isolates it needs:\n  npm install --save-dev @plitzi/sdk-server isolated-vm core-js");
 };
-/** `PLITZI_FUNCTIONS_CREDENTIALS`, a JSON object of credential id → its keys: what `ctx.fetch` may name locally. */
-var localCredentials = () => {
-	const raw = process.env.PLITZI_FUNCTIONS_CREDENTIALS;
+var isFile = async (file) => {
 	try {
-		const value = raw ? JSON.parse(raw) : {};
-		return isRecord$2(value) ? Object.fromEntries(Object.entries(value).flatMap(([id, keys]) => isRecord$2(keys) ? [[id, Object.fromEntries(Object.entries(keys).filter((pair) => typeof pair[1] === "string"))]] : [])) : {};
+		return (await fs.stat(file)).isFile();
 	} catch {
-		return {};
+		return false;
 	}
 };
-var NO_NODE_SNAPSHOT = "--no-node-snapshot";
 /**
-* The isolates `dev` runs need Node's startup snapshot off, and a process cannot turn it off once started: `dev` runs
-* itself again with it, and answers with that run's exit code.
+* The file a relative import names, as a bundler finds it: as written, with an extension added, the TypeScript file a
+* `.js` import stands for, or a folder's index.
 */
-var rerunWithoutNodeSnapshot = () => new Promise((resolve, reject) => {
-	const child = spawn(process.execPath, [
-		...process.execArgv,
-		NO_NODE_SNAPSHOT,
-		...process.argv.slice(1)
-	], { stdio: "inherit" });
-	child.once("error", reject);
-	child.once("exit", (code) => {
-		resolve(code ?? 1);
-	});
-});
+var resolveFile = async (from, specifier) => {
+	const target = path.resolve(path.dirname(from), specifier);
+	const candidates = [
+		target,
+		.../\.(m|c)?jsx?$/.test(target) ? [target.replace(/\.(m|c)?js(x?)$/, ".$1ts$2")] : [],
+		...EXTENSIONS.map((extension) => `${target}${extension}`),
+		...EXTENSIONS.map((extension) => path.join(target, `index${extension}`))
+	];
+	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+};
+/** A package's name from what an import asks for: `@scope/name/sub` is `@scope/name`, `name/sub` is `name`. */
+var packageOf = (specifier) => specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
+/** What a stylesheet brings in: its `@import`s and the files its `url()`s point at — not a data URI or an address. */
+var styleImports = (text) => [...text.matchAll(/@import\s+(?:url\()?\s*['"]([^'"]+)['"]/g), ...text.matchAll(/url\(\s*['"]?([^'")]+)['"]?\s*\)/g)].map((match) => match[1].trim()).filter((specifier) => !/^(data:|https?:|\/\/|#)/.test(specifier));
+var codeImports = (ts, text) => ts.preProcessFile(text, true, true).importedFiles.map((file) => file.fileName);
+/** A file's path in the snapshot: relative to the root, with forward slashes whatever the system writes. */
+var projectPath = (root, file) => path.relative(root, file).split(path.sep).join("/");
+/** The package of type declarations TypeScript reads for `name`: `geojson` is `@types/geojson`, `@a/b` is `@types/a__b`. */
+var typesPackageOf = (name) => `@types/${name.startsWith("@") ? name.slice(1).replace("/", "__") : name}`;
 /**
-* `plitzi functions dev <task>`: the task run from `functions/` on this machine, as the platform would run it — and,
-* with `--watch`, again every time a file is saved. Nothing reaches the space: its draft is what `push` sends.
+* The package an import needs, and the range the project asks for it: itself, or — for an import only its types are
+* read from (`import type { Feature } from 'geojson'`) — the package of its declarations.
 */
-var devFunction = async (task, options) => {
-	if (!process.execArgv.includes(NO_NODE_SNAPSHOT)) {
-		process.exitCode = await rerunWithoutNodeSnapshot();
-		return;
-	}
-	const params = paramsOf(options.params);
-	const root = await rootOf();
-	const runner = params ? await projectRunner(root) : void 0;
-	if (!params || !runner) return;
-	const local = runner.createLocalFunctions({ credentials: localCredentials() });
-	const run = async () => {
-		const loaded = await local.load(await readLocal(root));
-		if (!loaded.ok) {
-			printProblems(loaded.problems);
-			return;
+var dependencyOf = async (root, name) => {
+	const manifestDir = await nearestPackage(root);
+	const manifest = manifestDir ? await readPackageJson(manifestDir) : void 0;
+	const rangeOf = (dependency) => manifest?.dependencies?.[dependency] ?? manifest?.devDependencies?.[dependency] ?? manifest?.peerDependencies?.[dependency];
+	const range = rangeOf(name);
+	if (range) return [name, range];
+	const types = typesPackageOf(name);
+	const typesRange = rangeOf(types);
+	return typesRange ? [types, typesRange] : void 0;
+};
+/**
+* The snapshot of what `entries` reach, gzipped as it travels, and as read. Refused, every reason at once, when an
+* import leaves the project, names a file that is not there or a package the project does not declare, or a file it
+* reaches holds a credential.
+*/
+var packSource = async ({ root, kind, name, entries }) => {
+	const ts = loadTypeScript$1(root);
+	if (!ts) throw new Error("Packing the source reads its imports with the project’s own TypeScript:\n  npm install -D typescript");
+	const problems = [];
+	const files = {};
+	const packages = /* @__PURE__ */ new Set();
+	const queue = entries.map((entry) => path.resolve(entry));
+	const seen = /* @__PURE__ */ new Set();
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (file === void 0 || seen.has(file)) continue;
+		seen.add(file);
+		const relative = projectPath(root, file);
+		if (relative.startsWith("..") || path.isAbsolute(relative)) {
+			problems.push(`${relative} is outside the project (${root}): a project's source is the files inside it`);
+			continue;
 		}
-		if (!loaded.tasks.includes(task)) {
-			fail(`functions/ declares no task ${task}. It declares: ${loaded.tasks.join(", ") || "none"}.`);
-			return;
+		const bytes = await fs.readFile(file);
+		files[relative] = bytes.toString("base64");
+		let specifiers = [];
+		if (CODE.test(file)) specifiers = codeImports(ts, bytes.toString("utf-8"));
+		else if (STYLES.test(file)) specifiers = styleImports(bytes.toString("utf-8"));
+		for (const raw of specifiers) {
+			const specifier = raw.replace(/[?#].*$/, "");
+			if (specifier.startsWith(".") || specifier.startsWith("/")) {
+				const found = await resolveFile(file, specifier);
+				if (found) queue.push(found);
+				else problems.push(`${relative} imports "${raw}", which is not there`);
+				continue;
+			}
+			if (!specifier.startsWith("node:") && !BUILTINS.has(specifier)) packages.add(packageOf(specifier));
 		}
-		printRun(task, await local.tryTask(task, params));
+	}
+	const dependencies = {};
+	for (const dependency of [...packages].sort()) {
+		const found = await dependencyOf(root, dependency);
+		if (found) dependencies[found[0]] = found[1];
+		else problems.push(`It imports "${dependency}", which the project's package.json does not list`);
+	}
+	const snapshot = {
+		format: 1,
+		kind,
+		name,
+		entries: entries.map((entry) => projectPath(root, path.resolve(entry))),
+		files,
+		dependencies
+	};
+	const reading = p(snapshot, (base64) => Buffer.from(base64, "base64").toString("utf-8"));
+	problems.push(...reading.ok ? [] : reading.problems);
+	if (problems.length > 0) throw new Error(`The source of ${name} cannot be kept:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+	return {
+		snapshot,
+		bytes: new Uint8Array(gzipSync(JSON.stringify(snapshot)))
 	};
-	await run();
-	if (!options.watch) return;
-	console.log(chalk.dim("\nWatching functions/ — every save runs it again. ^C to stop."));
-	let pending;
-	watch(path.join(root, FUNCTIONS_DIR), { recursive: true }, () => {
-		clearTimeout(pending);
-		pending = setTimeout(() => {
-			process.exitCode = void 0;
-			console.log(chalk.dim(`\n— ${(/* @__PURE__ */ new Date()).toLocaleTimeString()}`));
-			run();
-		}, 150);
-	});
 };
 //#endregion
 //#region src/pack/typeDeclarations.ts
@@ -4041,21 +4929,21 @@ var INLINED = [
 ];
 /** A plugin that cannot be packed, with what to change — never a stack trace out of esbuild. */
 var PackError = class extends Error {};
-var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** The declaration, or what is missing from it — named, so the fix is one edit away. */
 var checkDeclaration = (value, where) => {
 	const missing = (field) => new PackError(`${where}: the declaration has no ${field}. Write it the way \`plitzi add plugin\` does.`);
-	if (!isRecord$1(value) || typeof value.type !== "string" || !value.type) throw missing("`type`");
+	if (!isRecord$2(value) || typeof value.type !== "string" || !value.type) throw missing("`type`");
 	const { content } = value;
-	if (!isRecord$1(content)) throw missing("`content`");
+	if (!isRecord$2(content)) throw missing("`content`");
 	for (const field of [
 		"attributes",
 		"definition",
 		"builder",
 		"market",
 		"defaultStyle"
-	]) if (!isRecord$1(content[field])) throw missing(`\`content.${field}\``);
-	if (!isRecord$1(content.definition) || typeof content.definition.label !== "string") throw missing("`content.definition.label`");
+	]) if (!isRecord$2(content[field])) throw missing(`\`content.${field}\``);
+	if (!isRecord$2(content.definition) || typeof content.definition.label !== "string") throw missing("`content.definition.label`");
 	return value;
 };
 var toImportPath = (file) => file.split(path.sep).join("/");
@@ -4114,7 +5002,31 @@ var integrityOf = async (file) => {
 	const content = await fs.readFile(file);
 	return `sha384-${createHash("sha384").update(content).digest("base64")}`;
 };
-var packPlugin = async ({ root, source, base, version, outDir, zip, types = false }) => {
+/** The files a plugin is built from: the package's entry, or each element's index. */
+var sourceEntries = (source) => source.kind === "package" ? [source.entry] : source.folders.map((folder) => path.join(folder, "index.ts"));
+/** Where the source snapshot of a plugin goes: beside its zip, named after it. */
+var sourceFileOf = (zip) => zip.replace(/\.zip$/, ".source.json.gz");
+/**
+* The plugin's source snapshot written beside its zip — or, when it cannot be kept, why: the plugin still packs, and
+* goes up built only.
+*/
+var writeSource = async (name, source, root, zip) => {
+	try {
+		const { bytes } = await packSource({
+			root,
+			kind: "plugin",
+			name,
+			entries: sourceEntries(source)
+		});
+		const file = sourceFileOf(zip);
+		await fs.mkdir(path.dirname(file), { recursive: true });
+		await fs.writeFile(file, bytes);
+		return { file };
+	} catch (error) {
+		return { problem: error instanceof Error ? error.message : String(error) };
+	}
+};
+var packPlugin = async ({ root, source, base, version, outDir, zip, sourceRoot = root, types = false }) => {
 	const relative = path.relative(root, outDir);
 	if (relative.startsWith("..") || path.isAbsolute(relative) || relative === "") throw new PackError(`${outDir} is not a folder inside ${root}: the build empties it first, so it has to be.`);
 	if (source.kind === "elements") for (const folder of source.folders) for (const file of ["index.ts", "declaration.ts"]) try {
@@ -4186,7 +5098,8 @@ var packPlugin = async ({ root, source, base, version, outDir, zip, types = fals
 		types: declarations.map((declaration) => declaration.type),
 		files,
 		zip,
-		typesOutcome
+		typesOutcome,
+		source: await writeSource(main.type, source, sourceRoot, zip ?? path.join(outDir, `${base}.zip`))
 	};
 };
 //#endregion
@@ -4286,6 +5199,7 @@ var packPluginCommand = async (foldersGiven, options) => {
 			version,
 			outDir,
 			zip,
+			sourceRoot: options.sourceRoot ? path.resolve(options.sourceRoot) : project.root,
 			types: inPackage
 		});
 		console.log(chalk.green(`\n${result.types.join(", ")} — packed at ${path.relative(process.cwd(), outDir) || "."}`));
@@ -4296,6 +5210,11 @@ var packPluginCommand = async (foldersGiven, options) => {
 			console.log(`\n  ${path.relative(process.cwd(), result.zip)}`);
 			console.log(chalk.dim("  Upload it in the builder under Resources, as a plugin."));
 		}
+		if ("file" in result.source) console.log(chalk.dim(`  ${path.relative(process.cwd(), result.source.file)} — its source, which plitzi upload keeps too`));
+		else {
+			console.log(chalk.yellow("\n  Its source is not kept, so the space can be taken back out with this plugin built only:"));
+			console.log(chalk.yellow(`  ${result.source.problem.split("\n").join("\n  ")}`));
+		}
 		console.log("");
 	} catch (error) {
 		if (!(error instanceof PackError)) throw error;
@@ -4304,6 +5223,250 @@ var packPluginCommand = async (foldersGiven, options) => {
 	}
 };
 //#endregion
+//#region src/commands/packSource.ts
+/**
+* `plitzi pack source`: the snapshot `plitzi upload plugin` and `plitzi runtime push` keep beside what they send (RFC
+* 0020), written to a file — to see what of a project would be kept, or for a tool that keeps it itself (the seeder).
+*/
+var packSourceCommand = async (entries, options) => {
+	const root = options.root ? path.resolve(options.root) : (await findProject(process.cwd()))?.root;
+	if (!root) {
+		console.error(chalk.red("plitzi pack source packs a project’s source, and there is no package.json here or above."));
+		process.exitCode = 1;
+		return;
+	}
+	try {
+		const { snapshot, bytes } = await packSource({
+			root,
+			kind: options.kind,
+			name: options.name,
+			entries: entries.map((entry) => path.resolve(entry))
+		});
+		const out = path.resolve(options.out);
+		await fs.mkdir(path.dirname(out), { recursive: true });
+		await fs.writeFile(out, bytes);
+		console.log(chalk.green(`${options.name}: ${String(Object.keys(snapshot.files).length)} files`) + chalk.dim(` — ${path.relative(process.cwd(), out)} (${(bytes.byteLength / 1024).toFixed(0)} KB)`));
+	} catch (error) {
+		console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+		process.exitCode = 1;
+	}
+};
+//#endregion
+//#region src/commands/pull.ts
+/** The version a pull asks for: the one the project follows, or the one it is told to follow from now on. */
+var versionToPull = (options, followed) => {
+	const environment = options.environment ?? followed.environment;
+	const kept = environment === followed.environment ? followed.revision : void 0;
+	if (options.revision === void 0 || options.revision === "latest") {
+		const revision = options.revision === "latest" ? void 0 : kept;
+		return {
+			ok: true,
+			version: {
+				environment,
+				...revision ? { revision } : {}
+			}
+		};
+	}
+	const revision = Number(options.revision);
+	if (environment === "main") return {
+		ok: false,
+		error: "The draft (main) has no revisions: name a published environment with --environment."
+	};
+	if (!Number.isInteger(revision) || revision < 1) return {
+		ok: false,
+		error: `--revision takes a revision number from 1, or latest — not "${options.revision}".`
+	};
+	return {
+		ok: true,
+		version: {
+			environment,
+			revision
+		}
+	};
+};
+var verdictOf = ({ given, was, here }) => {
+	if (given === void 0) {
+		if (here === void 0 || was === void 0) return "same";
+		return here === was ? "remove" : "keep";
+	}
+	if (here === given) return "same";
+	if (here === void 0) {
+		if (was === void 0) return "write";
+		return given === was ? "keep" : "conflict";
+	}
+	if (here === was) return "write";
+	return given === was ? "keep" : "conflict";
+};
+var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The packages the space's code asks for, added to the project's `package.json`: a package it does not list is added,
+* one still at the range the space last asked for follows the space, and one the project changed stays as it is.
+*/
+var mergeDependencies = (manifest, asked, before) => {
+	const current = isRecord$1(manifest.dependencies) ? manifest.dependencies : {};
+	const dependencies = { ...current };
+	const changed = [];
+	const kept = [];
+	Object.entries(asked).forEach(([name, range]) => {
+		const listed = current[name];
+		if (listed === range) return;
+		if (listed === void 0 || listed === before[name]) {
+			dependencies[name] = range;
+			changed.push(`${name}@${range}`);
+			return;
+		}
+		kept.push(`${name}: the space's code now asks for ${range}, and package.json keeps ${JSON.stringify(listed)}`);
+	});
+	return {
+		manifest: {
+			...manifest,
+			dependencies: Object.fromEntries(Object.entries(dependencies).sort(([a], [b]) => a.localeCompare(b)))
+		},
+		changed,
+		kept
+	};
+};
+var writeBytes = async (root, file, bytes) => {
+	await fs.mkdir(path.dirname(path.join(root, file)), { recursive: true });
+	await fs.writeFile(path.join(root, file), bytes);
+};
+var list = (files) => files.map((file) => `\n  ${file}`).join("");
+var plural = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
+var pull = async (options) => {
+	const project = await findProject(process.cwd());
+	const root = project?.root ?? process.cwd();
+	const origin = await readOrigin(root);
+	if (!origin) {
+		fail("This project was not made from a space: there is no .plitzi/space.json here. plitzi create --from <space> makes one.");
+		return;
+	}
+	const api = options.api ? await apiFor(options) : origin.api;
+	if (!api) return;
+	const asked = versionToPull(options, origin.version);
+	if (!asked.ok) {
+		fail(asked.error);
+		return;
+	}
+	const exported = await fetchExport(api, String(origin.space.id), {
+		source: origin.source,
+		version: asked.version,
+		name: origin.space.name
+	});
+	if (!exported) return;
+	const next = projectFromSpace(exported, origin.source);
+	const format = await projectFormatter(root);
+	const given = /* @__PURE__ */ new Map();
+	for (const [file, text] of Object.entries(next.files)) given.set(file, Buffer.from(await format(file, text)));
+	Object.entries(next.binaries).forEach(([file, base64]) => given.set(file, Buffer.from(base64, "base64")));
+	const missing = [];
+	const untouched = /* @__PURE__ */ new Set();
+	for (const { url, to } of next.downloads) {
+		if (origin.downloads[to] === url && await digestsOf(root, to, format) !== void 0) {
+			untouched.add(to);
+			continue;
+		}
+		try {
+			given.set(to, await download(url));
+		} catch (error) {
+			missing.push(notFetched(to, url, error));
+			untouched.add(to);
+		}
+	}
+	const paths = [.../* @__PURE__ */ new Set([...given.keys(), ...Object.keys(origin.files)])].filter((file) => !untouched.has(file));
+	const verdicts = /* @__PURE__ */ new Map();
+	for (const file of paths) {
+		const bytes = given.get(file);
+		const here = await digestsOf(root, file, format);
+		const was = origin.files[file];
+		const unchanged = here !== void 0 && (here.raw === was || here.formatted === was);
+		verdicts.set(file, verdictOf({
+			given: bytes ? digest(bytes) : void 0,
+			was: unchanged ? here.formatted : was,
+			here: here?.formatted
+		}));
+	}
+	const of = (verdict) => [...verdicts].filter(([, value]) => value === verdict).map(([file]) => file);
+	const conflicts = of("conflict");
+	if (conflicts.length > 0 && !options.force) {
+		fail(`Nothing was pulled: these changed here and on ${origin.space.name} too:${list(conflicts)}\nCommit or set aside the changes here and pull again, or pass --force to take the space’s copy of them.`);
+		return;
+	}
+	const written = [...of("write"), ...conflicts];
+	for (const file of written) {
+		const bytes = given.get(file);
+		if (bytes) await writeBytes(root, file, bytes);
+	}
+	const removed = of("remove");
+	await Promise.all(removed.map((file) => fs.rm(path.join(root, file), { force: true })));
+	const packageFile = path.join(root, "package.json");
+	const manifest = JSON.parse(await fs.readFile(packageFile, "utf-8"));
+	const dependencies = mergeDependencies(isRecord$1(manifest) ? manifest : {}, next.dependencies, origin.dependencies);
+	if (dependencies.changed.length > 0) await fs.writeFile(packageFile, `${JSON.stringify(dependencies.manifest, null, 2)}\n`);
+	const files = Object.fromEntries([...[...given].map(([file, bytes]) => [file, digest(bytes)]), ...[...untouched].flatMap((file) => origin.files[file] ? [[file, origin.files[file]]] : [])]);
+	await writeOrigin(root, {
+		...origin,
+		api,
+		space: exported.space,
+		version: asked.version,
+		files,
+		downloads: Object.fromEntries(next.downloads.flatMap(({ url, to }) => {
+			if (given.has(to)) return [[to, url]];
+			const before = origin.downloads[to];
+			return before && Object.hasOwn(files, to) ? [[to, before]] : [];
+		})),
+		dependencies: next.dependencies
+	});
+	if (!of("keep").some((file) => file.startsWith("functions/"))) await writeFunctionsState(root, {
+		space: exported.space.id,
+		version: next.functions.version,
+		files: await functionsOnDisk(root, next)
+	});
+	const kept = of("keep");
+	console.log(chalk.green(`\nPulled ${exported.space.name} (${versionLabel(exported.version)}): ${plural(written.length, "file")} written, ${plural(removed.length, "file")} removed.`));
+	if (written.length > 0) console.log(chalk.dim(list(written)));
+	if (kept.length > 0) console.log(`Changed here, and kept:${list(kept)}`);
+	if (dependencies.changed.length > 0) {
+		const manager = project?.packageManager ?? "npm";
+		console.log(`package.json now asks for ${dependencies.changed.join(", ")}: run ${installCommand(manager)}.`);
+	}
+	const notes = [
+		...dependencies.kept,
+		...missing,
+		...next.report
+	];
+	if (notes.length > 0) {
+		console.log(chalk.yellow(`\nWhat to know about ${exported.space.name} here:`));
+		notes.forEach((note) => console.log(chalk.yellow(`  - ${note}`)));
+	}
+	console.log("");
+};
+//#endregion
+//#region src/commands/keepSource.ts
+/**
+* A packed source snapshot sent beside what was just uploaded or pushed, and kept on the space (docs/en/projects-from-spaces.md): what lets
+* `plitzi create --from` take the space back out as a project. Never undoes what went up before it — the plugin or the
+* runtime runs either way — so a refusal is said, with why, and the command still succeeds.
+*/
+var keepSource = async (connection, spaceId, bytes) => {
+	const sent = await authorizedRequest(connection, `/spaces/${String(spaceId)}/sources`, {
+		method: "PUT",
+		headers: { "Content-Type": "application/octet-stream" },
+		body: new Uint8Array(bytes)
+	});
+	if (!sent.ok) {
+		console.log(chalk.yellow(`  Its source is not kept: ${sent.error}`));
+		return;
+	}
+	const { status, data } = sent.value.reply;
+	if (status === 200 && data.ok) {
+		console.log(chalk.dim(`  Its source too (${String(data.files ?? 0)} files): plitzi create --from can take it back out.`));
+		return;
+	}
+	const problems = data.problems ?? [`The platform answered ${String(status)}`];
+	console.log(chalk.yellow("  Its source is not kept, so a project taken from the space gets it built only:"));
+	problems.forEach((problem) => console.log(chalk.yellow(`    - ${problem}`)));
+};
+//#endregion
 //#region src/commands/runtime.ts
 var DEFAULT_ENTRY = path.join("src", "runtime.ts");
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4357,6 +5520,18 @@ var pushRuntime = async (options) => {
 		return;
 	}
 	console.log(`${chalk.green("✓")} ${connection.space.name}’s draft runtime is ${reply.data.digest.slice(0, 12)} (${(bytes.byteLength / 1024).toFixed(0)} KB). It starts in a moment; publish the space to take it live.`);
+	try {
+		const source = await packSource({
+			root,
+			kind: "runtime",
+			name: "runtime",
+			entries: [entry]
+		});
+		await keepSource(answered.value.connection, connection.space.id, source.bytes);
+	} catch (error) {
+		console.log(chalk.yellow("  Its source is not kept, so a project taken from the space gets it built only:"));
+		console.log(chalk.yellow(`  ${error instanceof Error ? error.message : String(error)}`));
+	}
 };
 var readRuntime = async (connection, spaceId) => {
 	const answered = await authorizedRequest(connection, `/spaces/${String(spaceId)}/runtime`);
@@ -4662,7 +5837,10 @@ var uploadPluginCommand = async (zipGiven, options) => {
 	const installed = data.installed === "updated" ? `now loads ${label}` : `loads ${label} from now on`;
 	console.log(chalk.green(`\n${space.name} ${installed}.`));
 	if (data.resource?.path) console.log(chalk.dim(`  ${data.resource.path}`));
-	console.log(chalk.dim("  Any builder open on the space loads it now.\n"));
+	console.log(chalk.dim("  Any builder open on the space loads it now."));
+	const source = await fs.readFile(sourceFileOf(zipPath)).catch(() => void 0);
+	if (source) await keepSource(uploaded.value.connection, space.id, source);
+	console.log("");
 };
 //#endregion
 //#region src/index.ts
@@ -4680,15 +5858,18 @@ var PROJECT_ONLY = [
 	"source",
 	"key"
 ];
-program.command("create").argument("[directory]", "Where to write it. Defaults to the current directory, or asked for with --plugin.").description("Scaffold a project that renders a Plitzi space, or with --plugin a plugin package").addOption(new Option("-m, --mode <mode>", "server (SSR + RSC on a Node tier) or client (browser only)").choices(["server", "client"])).addOption(new Option("-s, --source <source>", "local (the space travels in the project) or cloud (read it from Plitzi)").choices(["local", "cloud"])).option("-k, --key <key>", "Cloud only: the space key (asked for when omitted)").option("-e, --environment <environment>", "Which version to serve: main, or a published environment", "main").addOption(new Option("-p, --package-manager <manager>", "The package manager the project is written for. Asked for when left out.").choices([...PACKAGE_MANAGERS])).option("--plugin", "A plugin package instead: one element any space can load, with a preview and a build").option("--name <name>", "Plugin only: its package name (plitzi-plugin-seat-picker). Asked for when left out.").option("--title <title>", "Plugin only: what the builder calls the element").option("--description <description>", "Plugin only: what the element is for, in a sentence").option("--owner <owner>", "Plugin only: who publishes it").option("--elements <names>", "Plugin only: other elements the package holds, by name, separated by commas").option("--no-install", "Write the files without installing dependencies").option("-f, --force", "Write into a directory that is not empty").option("-y, --yes", "At a terminal: take the defaults for any choice not passed. Without one, every choice must be passed").action((directory, options) => {
+var API_OPTION = ["--api <url>", "The platform’s API. Defaults to PLITZI_API_URL, else the one signed in to, else https://api.plitzi.com."];
+program.command("create").argument("[directory]", "Where to write it. Defaults to the current directory, or asked for with --plugin.").description("Scaffold a project that renders a Plitzi space, or with --plugin a plugin package").addOption(new Option("-m, --mode <mode>", "server (SSR + RSC on a Node tier) or client (browser only)").choices(["server", "client"])).addOption(new Option("-s, --source <source>", "local (the space travels in the project) or cloud (read it from Plitzi)").choices(["local", "cloud"])).option("-k, --key <key>", "Cloud only: the space key (asked for when omitted)").option("-e, --environment <environment>", "Which version: main (the draft), or a published environment — what --from takes out, and what a cloud project serves", "main").option("--revision <n>", "A published environment’s revision, pinned rather than its latest (with --from or --source cloud)").addOption(new Option("-p, --package-manager <manager>", "The package manager the project is written for. Asked for when left out.").choices([...PACKAGE_MANAGERS])).option("--from <space>", "Make it from a space on Plitzi (its id or permanent URL): its pages, actions, functions, runtime, plugins and files, served by the project alone. Signs in as you; the space must be one you can change.").option(...API_OPTION).option("--plugin", "A plugin package instead: one element any space can load, with a preview and a build").option("--name <name>", "Plugin only: its package name (plitzi-plugin-seat-picker). Asked for when left out.").option("--title <title>", "Plugin only: what the builder calls the element").option("--description <description>", "Plugin only: what the element is for, in a sentence").option("--owner <owner>", "Plugin only: who publishes it").option("--elements <names>", "Plugin only: other elements the package holds, by name, separated by commas").option("--no-install", "Write the files without installing dependencies").option("-f, --force", "Write into a directory that is not empty").option("-y, --yes", "At a terminal: take the defaults for any choice not passed. Without one, every choice must be passed").action((directory, options) => {
 	if (!options.plugin) return create(directory, options);
 	const stray = PROJECT_ONLY.filter((flag) => options[flag] !== void 0);
 	if (stray.length > 0) program.error(`--${stray.join(", --")} shape a project, not a plugin: leave them out with --plugin.`);
 	return createPlugin(directory, options);
 });
+program.command("pull").description("Bring a project made with create --from up to date with its space: what changed there is written, what changed here is kept").option("-f, --force", "Where a file changed both here and on the space, take the space’s copy").option("-e, --environment <environment>", "Follow another version from now on: main (the draft), or a published environment").option("--revision <n>", "Pin a published revision of it, or latest to follow its newest again").option(...API_OPTION).action((options) => pull(options));
 program.command("add").description("Add something to the project you are in").command("plugin").argument("[names...]", "What each element is called: seat-picker. Asked for when left out.").description("Add elements of your own to this project: each one its component, declaration and builder panel").option("-d, --dir <folder>", "The folder that holds the project’s components. Asked for, unless the project says.").option("--title <title>", "One element only: what the builder calls it").option("--description <description>", "One element only: what it is for, in a sentence").option("-f, --force", "Write into a folder that is not empty").action((names, options) => addPlugin(names, options));
-program.command("pack").description("Build something of this project into what the platform takes").command("plugin").argument("[folders...]", "Element folders to pack, the main one first. In a plugin package, left out: all of them.").description("Build a plugin: one ES module, its plugin-manifest.json, and the zip the builder takes under Resources").option("-o, --out <folder>", "Where the build goes. Emptied first; it must be inside the project.").option("--no-zip", "Build without the zip").option("--plugin-version <version>", "The version the manifest carries. Defaults to the one in package.json.").action((folders, options) => packPluginCommand(folders, options));
-var API_OPTION = ["--api <url>", "The platform’s API. Defaults to PLITZI_API_URL, else the one signed in to, else https://api.plitzi.com."];
+var pack = program.command("pack").description("Build something of this project into what the platform takes");
+pack.command("plugin").argument("[folders...]", "Element folders to pack, the main one first. In a plugin package, left out: all of them.").description("Build a plugin: one ES module, its plugin-manifest.json, and the zip the builder takes under Resources").option("-o, --out <folder>", "Where the build goes. Emptied first; it must be inside the project.").option("--no-zip", "Build without the zip").option("--plugin-version <version>", "The version the manifest carries. Defaults to the one in package.json.").option("--source-root <folder>", "The project its source is kept relative to, when the elements are a project of their own inside this one").action((folders, options) => packPluginCommand(folders, options));
+pack.command("source").argument("<entries...>", "The files the build starts from: a runtime module, or each element’s index").description("Write the source snapshot plitzi upload and plitzi runtime push keep beside what they send").addOption(new Option("--kind <kind>", "What it is the source of").choices(["plugin", "runtime"]).makeOptionMandatory()).requiredOption("--name <name>", "The plugin’s type, or runtime").option("--root <folder>", "The project the paths are relative to. Defaults to the nearest package.json’s folder.").requiredOption("-o, --out <file>", "Where the gzipped snapshot goes").action((entries, options) => packSourceCommand(entries, options));
 program.command("login").description("Sign in, in your browser. The session is kept and renewed until plitzi logout").option(...API_OPTION).action((options) => login(options));
 program.command("logout").description("Sign out: the session is revoked on the platform and forgotten here").action(() => logout());
 program.command("whoami").description("Who the CLI is signed in as, and the space it works in").option(...API_OPTION).action((options) => whoami(options));