@plitzi/cli 0.38.10 → 0.38.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/cli",
-  "version": "0.38.10",
+  "version": "0.38.11",
   "license": "AGPL-3.0",
   "description": "Command line for Plitzi: scaffold a project that renders a space, a plugin package, or an element of your own.",
   "files": [
@@ -21,14 +21,14 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@plitzi/sdk-authoring": "0.38.10",
+    "@plitzi/sdk-authoring": "0.38.11",
     "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "esbuild": "^0.28.2",
     "fflate": "^0.8.3"
   },
   "devDependencies": {
-    "@plitzi/sdk-shared": "0.38.10",
+    "@plitzi/sdk-shared": "0.38.11",
     "@types/node": "^26.6.4",
     "eslint": "^9.39.5",
     "eslint-plugin-import": "^2.32.0",

package/skills/plitzi-cli/reference/functions.md

@@ -9,13 +9,18 @@ A space's own server code — TypeScript tasks its actions run as steps, and rou
   changes aside, `functions pull`, apply them again, `functions push`. Never `--force` over somebody else's work to get past it.
 - **A push is checked, not just stored.** A problem comes back as `src/functions/<file>:<line> <message>` and nothing is
   saved — fix it and push again. `index.ts` must default-export `defineFunctions({ … })`; files import each other by
-  relative path and `@plitzi/sdk-server/functions`, nothing else. `src/data/` is read with `ctx.data('x.json')`, never
+  relative path and `@plitzi/sdk-server/functions`, nothing else — a package (installed in the project) is bundled in with
+  `functions add <package>`, as `./vendor/<package>.js`; one that needs Node is refused. `src/data/` is read with `ctx.data('x.json')`, never
   imported (`dev` reads the project's).
 - **`try` runs the saved draft for real** (its fetches and writes happen). `dev` runs `src/functions/` on this machine with
   the project's own `@plitzi/sdk-server` — `npm install -D @plitzi/sdk-server isolated-vm core-js` first — and sends
-  nothing to the space; `PLITZI_FUNCTIONS_CREDENTIALS='{"stripe":{"apiKey":"…"}}'` gives it credentials to name.
+  nothing to the space. Credentials are `PLITZI_CREDENTIALS={"stripe":{"apiKey":"…"}}` in `.env` — what `dev` and the
+  project's own server hand `ctx.fetch({ credential })`; in the cloud, the space's Credentials.
 - **A run gets 100 ms of CPU and 10 s.** A task that needs more asks with `limits: { cpuMs, wallMs }` (or
   `defineFunctions({ limits })` for all), up to the plan's ceiling; asking above it is a problem the push reports.
+- **What must happen in N seconds whether or not a page is open** — a turn that runs out, a bot's move — is
+  `ctx.later({ action, in, input, key })` on an action with a `later` trigger (`flow.later` from a flow): never a page's
+  timer asking the server back. The same `key` replaces what still waits; `ctx.cancelLater(key)` drops it.
 - **The live site runs what the space was last published with.** A push changes the draft; publishing is the person's.
 
 ## A space's runtime (`runtime`)