@plitzi/cli 0.38.13 → 0.38.14

package/dist/index.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { InvalidArgumentError, Option, program } from "commander";
 import fs, { mkdir, readFile, writeFile } from "node:fs/promises";
+import https from "node:https";
 import { builtinModules, createRequire, isBuiltin } from "node:module";
 import path, { dirname, join, posix, relative, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import chalk from "chalk";
 import { execFile, spawn, spawnSync } from "node:child_process";
-import os from "node:os";
+import os, { hostname, networkInterfaces } from "node:os";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import tls from "node:tls";
@@ -19,16 +20,16 @@ import { lookup } from "node:dns/promises";
 import { unzipSync, zipSync } from "fflate";
 import { gzipSync } from "node:zlib";
 import { emitKeypressEvents } from "node:readline";
-var t$7 = `[data-plitzi-devtools] { display: none !important; }`;
+var t$8 = `[data-plitzi-devtools] { display: none !important; }`;
 //#endregion
 //#region ../../packages/sdk-shared/dist/helpers/isRecord.mjs
-var e$5 = (e) => typeof e == "object" && !!e && !Array.isArray(e);
+var e$6 = (e) => typeof e == "object" && !!e && !Array.isArray(e);
 //#endregion
 //#region ../../packages/sdk-shared/dist/realtime/topics.mjs
 var m$2 = "plitzi-observer";
 //#endregion
 //#region ../../packages/sdk-shared/dist/theme/themeCookie.mjs
-var t$5 = "theme";
+var t$7 = "theme";
 //#endregion
 //#region ../../packages/sdk-shared/dist/project/paths.mjs
 var n$7 = "plitzi";
@@ -66,6 +67,13 @@ var x$3 = "tmp/dev-server.json";
 * CLI's all the same: `plitzi upgrade` keeps it current, and what a project changes goes in `src/config/serverOptions.ts`.
 */
 var MAIN_FILE = "src/main.ts";
+/**
+* The project's own notes for agents — how it is built, what must not be undone — which `CLAUDE.md` and `AGENTS.md`,
+* both the CLI's, point at. The project's: `plitzi upgrade` never touches it.
+*/
+var PROJECT_NOTES = "NOTES.md";
+/** The compiler options the CLI keeps up, which the project's own `tsconfig.json` extends. */
+var TSCONFIG_BASE = `${n$7}/tsconfig.base.json`;
 /** The space's server actions, a folder like the space: `index.ts` lists them for the server, one action a file. */
 var ACTIONS_DIR = "src/actions";
 var ACTIONS_ENTRY = `${ACTIONS_DIR}/index.ts`;
@@ -73,6 +81,12 @@ var ACTIONS_ENTRY = `${ACTIONS_DIR}/index.ts`;
 var SERVER_OPTIONS_FILE = "src/config/serverOptions.ts";
 /** What Playwright leaves of a run: traces, failures' pictures. */
 var VISUAL_OUTPUT = `tmp/visual`;
+/**
+* The certificate `plitzi cert` makes for this machine as its network reaches it, and its key — `TLS_CERT` and `TLS_KEY`
+* in `.env`. In `tmp/`: made again on each machine, and a key never committed.
+*/
+var TLS_CERT_FILE = `tmp/tls/cert.pem`;
+var TLS_KEY_FILE = `tmp/tls/key.pem`;
 //#endregion
 //#region src/browser/index.ts
 /**
@@ -84,7 +98,7 @@ var VISUAL_OUTPUT = `tmp/visual`;
 * when it loads, so the CLI depends on no driver.
 */
 var SCHEMES = ["light", "dark"];
-var isChromium = (value) => e$5(value) && typeof value.launch === "function";
+var isChromium = (value) => e$6(value) && typeof value.launch === "function";
 /** A property of an object or of a function, which a module's exports can be either of. */
 var propertyOf = (value, key) => (typeof value === "object" || typeof value === "function") && value !== null ? Reflect.get(value, key) : void 0;
 /** The project's `@playwright/test`'s Chromium, launched — or why there is none. */
@@ -104,13 +118,14 @@ var launchBrowser = async (root) => {
 		return { problem: `Chromium did not start (${error instanceof Error ? error.message.split("\n")[0] : String(error)}): npx playwright install chromium` };
 	}
 };
-/** What `npm start` wrote down when it took a port: the port, and the name its `/health` answers with. */
+/** What `npm start` wrote down when it took a port: the port, where it answers, and the name its `/health` answers with. */
 var recorded = async (root) => {
 	try {
 		const value = JSON.parse(await readFile(path.join(root, x$3), "utf8"));
-		if (!e$5(value)) return {};
+		if (!e$6(value)) return {};
 		return {
 			...typeof value.port === "number" ? { port: value.port } : {},
+			...typeof value.url === "string" ? { url: value.url } : {},
 			...typeof value.name === "string" ? { name: value.name } : {}
 		};
 	} catch {
@@ -118,18 +133,50 @@ var recorded = async (root) => {
 	}
 };
 /**
-* Where the project's server answers: `PORT` when set, the port `npm start` took otherwise, else the mode's default —
-* and, when `npm start` named itself, that what answers there is this project. Something else on the port answers too,
-* with a page and a `200`, and a picture of the wrong server looks like one of the right one.
+* A server of this machine serving HTTPS: a project's own, with a certificate made for the browsers of its network
+* (mkcert) that nothing here was told to trust. What answers is checked by its name instead (`/health`).
+*/
+var isLocalTls = (origin) => {
+	const { protocol, hostname } = new URL(origin);
+	return protocol === "https:" && [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	].includes(hostname);
+};
+/** `/health`, read the way the tools read the pages: a local certificate taken as it is. */
+var readHealth = (origin) => {
+	if (!isLocalTls(origin)) return fetch(`${origin}/health`).then((response) => response.json()).catch(() => null);
+	return new Promise((resolve) => {
+		https.get(`${origin}/health`, { rejectUnauthorized: false }, (response) => {
+			let body = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => body += chunk);
+			response.on("end", () => {
+				try {
+					resolve(JSON.parse(body));
+				} catch {
+					resolve(null);
+				}
+			});
+		}).on("error", () => resolve(null));
+	});
+};
+/**
+* Where the project's server answers: where `npm start` said it does — scheme included, `https` for a project serving
+* a certificate — on `PORT` when that is set, else the mode's default; and, when `npm start` named itself, that what
+* answers there is this project. Something else on the port answers too, with a page and a `200`, and a picture of the
+* wrong server looks like one of the right one.
 */
 var projectOrigin = async (root, project) => {
 	const server = await recorded(root);
-	const port = Number(process.env.PORT ?? server.port ?? (project?.mode === "client" ? 5173 : 8080));
-	const origin = `http://127.0.0.1:${String(port)}`;
+	const where = new URL(server.url ?? "http://127.0.0.1");
+	where.port = String(process.env.PORT ?? server.port ?? (project?.mode === "client" ? 5173 : 8080));
+	const { origin, port } = where;
 	if (!server.name) return { origin };
-	const health = await fetch(`${origin}/health`).then((response) => response.json()).catch(() => null);
-	const answered = e$5(health) && typeof health.Server === "string" ? health.Server : "";
-	if (answered !== server.name) return { problem: answered ? `Port ${String(port)} answers as "${answered}", not this project ("${server.name}"). Start it: npm start` : `Nothing of this project answers on port ${String(port)}. Start it: npm start` };
+	const health = await readHealth(origin);
+	const answered = e$6(health) && typeof health.Server === "string" ? health.Server : "";
+	if (answered !== server.name) return { problem: answered ? `Port ${port} answers as "${answered}", not this project ("${server.name}"). Start it: npm start` : `Nothing of this project answers on port ${port}. Start it: npm start` };
 	return { origin };
 };
 /** A picture as a data URL, which is how a page in the browser is handed one to read. */
@@ -149,10 +196,11 @@ var openProjectPage = async (browser, origin, view) => {
 			height: view.height
 		},
 		colorScheme: view.scheme ?? "light",
-		reducedMotion: view.reducedMotion ? "reduce" : "no-preference"
+		reducedMotion: view.reducedMotion ? "reduce" : "no-preference",
+		ignoreHTTPSErrors: isLocalTls(origin)
 	});
 	await page.context().addCookies([...view.scheme ? [{
-		name: t$5,
+		name: t$7,
 		value: view.scheme,
 		url: origin
 	}] : [], ...view.presence ? [] : [{
@@ -172,7 +220,7 @@ var paintedScheme = (page, machine) => page.evaluate((prefers) => {
 	return classList.contains("light") ? "light" : prefers;
 }, machine);
 /** The page as a visitor sees it: the dev tools' own chrome — the badge, the panel — left out of whatever is looked at. */
-var withoutDevTools = (page) => page.addStyleTag({ content: t$7 });
+var withoutDevTools = (page) => page.addStyleTag({ content: t$8 });
 //#endregion
 //#region src/commands/terminal.ts
 /**
@@ -1027,10 +1075,10 @@ var indexHtml$1 = ({ name }) => `<!doctype html>
   </body>
 </html>
 `;
-var viteConfig$1 = () => `import { createReadStream } from 'node:fs';
+var viteConfig$1 = () => `import { createReadStream, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 
-import { defineConfig } from 'vite';
+import { defineConfig, loadEnv } from 'vite';
 
 import type { Plugin } from 'vite';
 
@@ -1058,16 +1106,52 @@ const devToolsStylesheet = (): Plugin => ({
   }
 });
 
+/**
+ * Writes where Vite serves the page — the port it took, 5173 or the next free one, and the scheme — to
+ * \`${x$3}\`, where \`check\`, \`shot\` and \`visual\` look for it.
+ */
+const recordServer = (): Plugin => ({
+  name: 'plitzi-record-server',
+  apply: 'serve',
+  configureServer(server) {
+    server.httpServer?.once('listening', () => {
+      const address = server.httpServer?.address();
+      if (!address || typeof address === 'string') {
+        return;
+      }
+
+      const scheme = server.config.server.https ? 'https' : 'http';
+      mkdirSync('tmp', { recursive: true });
+      writeFileSync(
+        '${x$3}',
+        \`\${JSON.stringify({ port: address.port, url: \`\${scheme}://127.0.0.1:\${String(address.port)}\` }, null, 2)}\\n\`
+      );
+    });
+  }
+});
+
 /**
  * Otherwise nothing Plitzi-specific: the SDK is an ordinary dependency, so this is a plain Vite app.
  *
- * The host is pinned because Vite binds \`localhost\` — which on most machines is IPv6 — while everything that
- * waits for a dev server to come up asks for 127.0.0.1. The two resolve differently, so the visual suite sat
- * there watching an address nothing was listening on until it gave up.
+ * \`.env\` says where it listens, as a server project's does. \`HOST\` left out, 127.0.0.1: Vite binds \`localhost\` —
+ * which on most machines is IPv6 — while everything that waits for a dev server to come up asks for 127.0.0.1, and the
+ * visual suite sat there watching an address nothing was listening on. \`HOST=0.0.0.0\` opens it to the network (a
+ * phone on the Wi-Fi); \`TLS_CERT\` and \`TLS_KEY\` (\`plitzi cert\`) serve it over HTTPS, which that phone's browser
+ * asks of a page before it gives it the microphone, the camera or the clipboard.
  */
-export default defineConfig({
-  plugins: [devToolsStylesheet()],
-  server: { host: '127.0.0.1', port: 5173 }
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), '');
+
+  return {
+    plugins: [devToolsStylesheet(), recordServer()],
+    server: {
+      host: env.HOST || '127.0.0.1',
+      port: 5173,
+      ...(env.TLS_CERT && env.TLS_KEY
+        ? { https: { cert: readFileSync(env.TLS_CERT), key: readFileSync(env.TLS_KEY) } }
+        : {})
+    }
+  };
 });
 `;
 var preflightCss$1 = () => `/*
@@ -1299,6 +1383,8 @@ point is looked for. One changed is shown as a diff and left, so changing one is
 whole project to what follows — and to what Node, the server and \`space push\` need of it — and says what to fix.
 
 - \`${MAIN_FILE}\` (in \`src/\`) — the entry point: ${server ? "the page server — the space authored and handed to `serveProject` (`@plitzi/sdk-server/project`), which wires its plugins, its data and its code from where they are" : "the Vite app that renders the space"}.${answers.source === "local" ? `\n- \`${r$7}\` — \`npm run author\`: authors \`src/space/\` and says what it found${server ? "; the server runs it on every save, and is handed the documents it serves next" : ""}.` : ""}${server ? `\n- \`${n$7}/assets.d.ts\` — the types of what a plugin imports besides code: a stylesheet, an image, \`?raw\`, \`?inline\`.` : `\n- \`${n$7}/preflight.css\` — the page's base styles.`}
+- \`${TSCONFIG_BASE}\` — the compiler options, which \`tsconfig.json\` extends. \`tsconfig.json\` is yours: a folder of
+  your own (\`scripts/\`, \`tools/\`) goes in its \`include\`.
 
 ${server ? "What the server does besides serving the space is yours, in `src/config/serverOptions.ts`.\n\n" : ""}${PLUGINS(answers)}
 ${server ? `${FUNCTIONS}\n${RUNTIME}\n` : ""}${DATA(answers)}${answers.fromSpace ? `\n${FROM_SPACE}` : ""}`;
@@ -1322,9 +1408,9 @@ var MACHINERY = /* @__PURE__ */ new Set([
 	`${n$7}/preflight.css`,
 	`${n$7}/assets.d.ts`,
 	`${n$7}/README.md`,
+	TSCONFIG_BASE,
 	"index.html",
 	"vite.config.ts",
-	"tsconfig.json",
 	"tsconfig.build.json",
 	".gitignore",
 	"AGENTS.md",
@@ -1443,8 +1529,8 @@ var pluginNames = (packageName) => {
 };
 //#endregion
 //#region ../../packages/sdk-shared/dist/helpers/scroll.mjs
-var e$3 = ["smooth", "auto"];
-var t$3 = [
+var e$5 = ["smooth", "auto"];
+var t$5 = [
 	"start",
 	"center",
 	"end",
@@ -1456,7 +1542,7 @@ var r$5 = {
 	type: "select",
 	description: "How it moves: \"smooth\" glides there, \"auto\" jumps.",
 	default: "smooth",
-	options: [...e$3]
+	options: [...e$5]
 };
 var a$3 = {
 	setState: {
@@ -1560,13 +1646,13 @@ var a$3 = {
 				type: "select",
 				description: "Where the element lands, top to bottom.",
 				default: "start",
-				options: [...t$3]
+				options: [...t$5]
 			},
 			inline: {
 				type: "select",
 				description: "Where it lands, side to side.",
 				default: "nearest",
-				options: [...t$3]
+				options: [...t$5]
 			},
 			behavior: r$5
 		}
@@ -2673,6 +2759,12 @@ var projectScripts = (answers) => {
 			*/
 			"start:dev": watchedNodeWithEnv(`${watchPaths(answers)} ${MAIN_FILE}`),
 			/**
+			* `start:dev` with Node's inspector on 127.0.0.1:9229 — a debugger (VS Code, chrome://inspect) attaches to the
+			* server, and attaches again after each restart. Only the server: the author script a save runs is a process
+			* of its own, started without it.
+			*/
+			"start:dev-inspect": watchedNodeWithEnv(`--inspect ${watchPaths(answers)} ${MAIN_FILE}`),
+			/**
 			* What production runs: the same entry compiled to JavaScript. Node strips types by loading a TypeScript
 			* transformer into the process — ~10 MB a server keeps for its whole life to read one file — so a deployment
 			* runs what `build` emitted and carries no TypeScript at all.
@@ -2729,39 +2821,47 @@ var tsconfigBuild = () => `${JSON.stringify({
 	include: ["src", `${n$7}/assets.d.ts`],
 	exclude: ["src/plugins", "src/functions"]
 }, null, 2)}\n`;
-var tsconfig$1 = ({ mode }) => `${JSON.stringify({
-	compilerOptions: {
-		target: "ES2023",
-		module: "esnext",
-		moduleResolution: "bundler",
-		strict: true,
-		noEmit: true,
-		esModuleInterop: true,
-		skipLibCheck: true,
-		resolveJsonModule: true,
-		allowImportingTsExtensions: true,
-		verbatimModuleSyntax: true,
-		erasableSyntaxOnly: true,
-		/**
-		* `vite/client` in the browser build, and it is not optional there: it is what declares a side-effect CSS
-		* import and `import.meta.env`, both of which the entry point uses.
-		*/
-		types: mode === "client" ? ["node", "vite/client"] : ["node"],
-		lib: [
-			"ES2023",
-			"DOM",
-			"DOM.Iterable"
-		],
-		jsx: "react-jsx"
-	},
-	include: [
+/**
+* The compiler options the CLI keeps up, in its own folder: the project's `tsconfig.json` extends them and says what
+* is read — so a folder of the project's own (`scripts/`, `tools/`) is added there without touching a file of the CLI's.
+*/
+var tsconfigBase = ({ mode }) => `${JSON.stringify({ compilerOptions: {
+	target: "ES2023",
+	module: "esnext",
+	moduleResolution: "bundler",
+	strict: true,
+	noEmit: true,
+	esModuleInterop: true,
+	skipLibCheck: true,
+	resolveJsonModule: true,
+	allowImportingTsExtensions: true,
+	verbatimModuleSyntax: true,
+	erasableSyntaxOnly: true,
+	/**
+	* `vite/client` in the browser build, and it is not optional there: it is what declares a side-effect CSS
+	* import and `import.meta.env`, both of which the entry point uses.
+	*/
+	types: mode === "client" ? ["node", "vite/client"] : ["node"],
+	lib: [
+		"ES2023",
+		"DOM",
+		"DOM.Iterable"
+	],
+	jsx: "react-jsx"
+} }, null, 2)}\n`;
+/**
+* The project's own: the CLI's options, and what the typecheck and the lint read — add a folder of yours here. Written
+* as the project's formatter writes it, since it is the project's to format.
+*/
+var tsconfig$1 = ({ mode }) => {
+	return `{\n  "extends": "./${TSCONFIG_BASE}",\n  "include": [${[
 		n$7,
 		"src",
 		"visual",
 		"playwright.config.ts",
 		...mode === "client" ? ["vite.config.ts"] : []
-	]
-}, null, 2)}\n`;
+	].map((entry) => JSON.stringify(entry)).join(", ")}]\n}\n`;
+};
 /**
 * Yarn's four lines are Yarn's own recommendation, and they are not decoration: with the `node-modules` linker it
 * writes `.yarn/install-state.gz` into the project, which is a cache and belongs in no repository.
@@ -2772,7 +2872,7 @@ var YARN_IGNORES$1 = "\n.yarn/*\n!.yarn/patches\n!.yarn/plugins\n!.yarn/releases
 * the CLI records about it, and is committed — a clone without it could not pull, push or upgrade.
 */
 var gitignore$1 = ({ mode, packageManager }) => `node_modules\n${v$3}\n.env\ntmp\n${mode === "server" ? `${y$2}\n` : ""}${packageManager === "yarn" ? YARN_IGNORES$1 : ""}`;
-var startLine = ({ mode, packageManager, source }) => mode === "server" ? `\`${runCommand(packageManager, "start")}\` serves pages on http://127.0.0.1:8080 — or, when something else holds 8080, the next free port, which it prints and writes to \`${x$3}\` (set \`PORT\` to choose one; \`HOST=0.0.0.0\` opens it to your network — a tablet on the same Wi-Fi — and prints the address to open there). \`${runCommand(packageManager, "start:dev")}\` restarts on a save to the server's code; a save to a plugin swaps it in the open page${source === "local" ? ", and a save to the space reloads it" : ""}. In production, \`${runCommand(packageManager, "build")}\` once and run \`${runCommand(packageManager, "start:prod")}\`, which sets \`NODE_ENV=production\` itself: the compiled server, with no TypeScript in the process.` : `\`${runCommand(packageManager, "start")}\` runs Vite on http://127.0.0.1:5173, with hot module replacement.`;
+var startLine = ({ mode, packageManager, source }) => mode === "server" ? `\`${runCommand(packageManager, "start")}\` serves pages on http://127.0.0.1:8080 — or, when something else holds 8080, the next free port, which it prints and writes to \`${x$3}\` (set \`PORT\` to choose one; \`HOST=0.0.0.0\` opens it to your network — a tablet on the same Wi-Fi — and prints the address to open there; \`plitzi cert\` serves it over HTTPS, which that tablet's browser asks of a page before it gives it the microphone, the camera or the clipboard). \`${runCommand(packageManager, "start:dev")}\` restarts on a save to the server's code; a save to a plugin swaps it in the open page${source === "local" ? ", and a save to the space reloads it" : ""}; \`${runCommand(packageManager, "start:dev-inspect")}\` is the same with Node's inspector open on 127.0.0.1:9229, for a debugger to attach to the server. In production, \`${runCommand(packageManager, "build")}\` once and run \`${runCommand(packageManager, "start:prod")}\`, which sets \`NODE_ENV=production\` itself: the compiled server, with no TypeScript in the process.` : `\`${runCommand(packageManager, "start")}\` runs Vite on http://127.0.0.1:5173, with hot module replacement. \`HOST=0.0.0.0\` in \`.env\` opens it to your network — a tablet on the same Wi-Fi — and \`plitzi cert\` serves it over HTTPS, which that tablet's browser asks of a page before it gives it the microphone, the camera or the clipboard.`;
 var spaceSection = (answers) => {
 	if (answers.source === "cloud") return `## Where the space comes from
 
@@ -2846,6 +2946,15 @@ ${settingsSection(answers)}
 put together before it touches one, and the CLI's, so it knows what \`plitzi\` can do for it — plugins, packing,
 uploading. Claude Code reads them automatically; \`AGENTS.md\` points any other agent at them.
 `;
+/** The project's notes as a project starts with them: what they are for, and nothing yet. */
+var projectNotes = (answers) => `# ${answers.name} — the project's own notes
+
+What every session working here has to know and the code does not say: how something is built, what must not be undone,
+how a task here is done. Kept short and true — a note that stopped being true is deleted.
+
+\`AGENTS.md\` and \`CLAUDE.md\` are the CLI's and \`plitzi upgrade\` replaces them; this file is the project's, and nothing
+the CLI does touches it.
+`;
 /**
 * What any agent opening the project reads first, whichever agent it is.
 *
@@ -2861,12 +2970,14 @@ var agentsFile = (answers) => {
 	const commands = [
 		`| ${code(installCommand(answers.packageManager))} | install |`,
 		`| ${run("start")} | serve it |`,
+		...answers.mode === "server" ? [`| ${run("start:dev-inspect")} | serve it restarting on a save, with Node's inspector on 127.0.0.1:9229 for a debugger |`] : [],
 		...local ? [`| ${run("author")} | author the space and print its warnings and suggestions |`, `| ${run("lint:space")} | how the space's source is written: each practice to change at its file and line |`] : [],
 		`| ${run("visual")} | open the page in a browser and check it rendered |`
 	];
 	const zeroWarnings = local ? `Zero warnings from ${run("author")}.` : "Zero warnings from authoring.";
 	const refusers = [answers.mode === "server" ? "The server" : "", local ? run("author") : ""].filter(Boolean).join(" and ");
-	const port = answers.mode === "server" ? `${run("start")} serves on 8080, or on the next free port when something else holds it — printed, and written to ${code(x$3)}, where ${code("check")}, ${code("shot")} and ${code("visual")} read it. ${code("PORT")} chooses one.` : `${run("start")} runs Vite on 5173.`;
+	const network = `${code("HOST=0.0.0.0")} in ${code(".env")} opens it to the network; ${code("plitzi cert")} serves it over HTTPS — over http, a phone's browser gives the page no microphone, camera or clipboard.`;
+	const port = answers.mode === "server" ? `${run("start")} serves on 8080, or on the next free port when something else holds it — printed, and written to ${code(x$3)}, where ${code("check")}, ${code("shot")} and ${code("visual")} read it. ${code("PORT")} chooses one. ${network}` : `${run("start")} runs Vite on 5173, or the next free port — written to ${code(x$3)}. ${network}`;
 	const serverNotes = answers.mode === "server" ? `- **The server is yours in ${code("src/config/serverOptions.ts")}**, not in ${code(MAIN_FILE)} — that one is the CLI's, and ${code("plitzi upgrade")} keeps it current: what the server does besides serving the space goes there (what ${code("serveProject")} wires itself is not offered)${local ? `, and the space's server actions are ${code("src/actions/")}` : ""}.\n- **Pictures from other sites** are resized by this server once ${code("src/config/serverOptions.ts")} names their hosts — ${code("images: { domains }")}, a list of hosts like ${code("images.example.com")} — and ${code("sharp")} is installed: an ${code("image")} then offers a ${code("srcset")} (give it ${code("sizes")}, and ${code("width")}/${code("height")} so nothing jumps).\n` : "";
 	const dataNote = answers.mode === "server" ? `- **Data with no backend** goes in ${code(`${m}/*.json`)}: the server reads it and never serves it. An ${code("apiContainer")} whose ${code("runtime")} is ${code("server")} and ${code("query")} ${code("/data/products.json")} reads it, and the page arrives with it — bound as ${code("products.data.items")}, on a page or a layout, never inside a component. ${local ? `A browser provider asking for ${code("/data/…")} is refused by ${run("author")}. ` : ""}What a provider reads is in the page it renders: data a page must not carry is read in a server action, which answers only what is shown — a task of ${code("src/functions/")} reads the file with ${code("ctx.data(\"products.json\")")}, never an import.` : `- **Data with no backend** goes in ${code("public/data/*.json")}, fetched by the browser — public like everything in ${code("public/")} — and read by an ${code("apiContainer")} whose ${code("query")} is ${code("/data/products.json")}.`;
 	const settingsNote = answers.mode === "server" ? `Node reads ${code(".env")} as a script starts, before any module loads: read ${code("process.env")}, never load the file yourself.` : `Vite reads it and hands the page only ${code("VITE_*")}, which ships in it: never a secret.`;
@@ -2890,6 +3001,7 @@ ${commands.join("\n")}
 ## This project
 
 - **Yours is \`src/\` — but \`${MAIN_FILE}\`, the entry point — and \`${n$7}/\` is the CLI's**: \`plitzi upgrade\` replaces them, so never edit them. \`${n$7}/README.md\` says what each folder of \`src/\` is.
+- **This project's own notes are ${code(PROJECT_NOTES)}** — read them before you start, and write there what the next session has to know: how something here is built, what must not be undone, how a task here is done. This file and ${code("CLAUDE.md")} are the CLI's and replaced by ${code("plitzi upgrade")}; ${code(PROJECT_NOTES)} never is.
 - **Port.** ${port}
 - **Settings are ${code(".env")}**, never committed; ${code(".env.example")} names them, committed — a new one goes in both. ${settingsNote}
 ${dataNote}
@@ -2920,7 +3032,7 @@ What you leave behind is the next reader's problem — the user's, or the next a
 - **Scratch goes in ${code(`tmp/`)}, or nowhere.** A one-off script, a dump, a picture to look at — never at the root or beside the source, where it reads as part of the project.
 - **One of everything.** A look used twice is a class; a value used twice is a token; a block used twice is a component, and rows of data are one list. Change it where it is defined, and rename everywhere when you rename.
 - **Files a reader can find.** One part per file, named after what it is, in the folder of its kind — the shape ${code("src/space/")} already has. Do not start a parallel layout of your own.
-- **Leave it passing.** ${run("verify")} runs it all and prints only what fails: ${local ? `${run("author")} with zero warnings, ${run("lint:space")} clean, ` : ""}${run("typecheck")}, ${run("lint")} and the format clean, and every page whole (${run("check")}, with the server up) — those for signed-in visitors too, once ${code(".env")} names an account to check them as: ${code("PLITZI_CHECK_USER")} and ${code("PLITZI_CHECK_PASSWORD")}.
+- **Leave it passing.** ${run("verify")} runs it all and prints only what fails: ${local ? `${run("author")} with zero warnings, ${run("lint:space")} clean, ` : ""}${run("typecheck")}, ${run("lint")} and the format clean, the project's own tests when it has a ${code("test")} script, and every page whole (${run("check")}, with the server up) — those for signed-in visitors too, once ${code(".env")} names an account to check them as: ${code("PLITZI_CHECK_USER")} and ${code("PLITZI_CHECK_PASSWORD")}.
 
 ## The rules that go wrong most
 
@@ -2957,13 +3069,13 @@ PLITZI_ENVIRONMENT=${environment}
 ${revision ? `PLITZI_REVISION=${String(revision)}` : "# PLITZI_REVISION=12"}
 
 ` : ""}${SERVER_SETTINGS}`;
-	return source === "cloud" ? `# The space's public render key. It ships in the page by design; the origin the browser states is what
+	return `${source === "cloud" ? `# The space's public render key. It ships in the page by design; the origin the browser states is what
 # protects it — add this project's domain to the space's allowed domains.
 VITE_PLITZI_WEB_KEY=${key}
 VITE_PLITZI_ENVIRONMENT=${environment}
 ` : `# What the page reads as import.meta.env.VITE_*: Vite hands it only what is named VITE_, and each value ships in the
 # page — never a secret.
-`;
+`}${CLIENT_SETTINGS}`;
 };
 /**
 * `.env.example`: the same settings with no secret in them — committed, where `.env` never is, so a clone knows what to
@@ -2976,6 +3088,15 @@ ${envFile({
 	key: ""
 })}`;
 /**
+* HTTPS while developing, in either mode: what `plitzi cert` writes, offered commented until it has.
+*/
+var TLS_SETTINGS = `
+# HTTPS, for that tablet: over http its browser gives a page no microphone, camera or clipboard. \`plitzi cert\` makes a
+# certificate for this machine and its network addresses, and sets these two.
+# TLS_CERT=${TLS_CERT_FILE}
+# TLS_KEY=${TLS_KEY_FILE}
+`;
+/**
 * What every server project is given in `.env`: the key its actions sign with — filled by `plitzi create` with one made
 * for it (`withSigningSecret`), never by the scaffold, which is the same for everybody — and the port, left to choose.
 */
@@ -2987,21 +3108,29 @@ PLITZI_SIGNING_SECRET=
 
 # Left out: this machine only. 0.0.0.0 opens it to the network — a tablet on the same Wi-Fi, and anyone else on it.
 # HOST=0.0.0.0
-
+${TLS_SETTINGS}
 # The secrets the space's actions and functions name — ctx.fetch's credential, a connector's: credential id → its keys.
 # PLITZI_CREDENTIALS={"google":{"clientId":"…","clientSecret":"…"}}
 `;
+/** Where Vite listens, as a server project's `.env` says it — Vite's config reads these, not the page. */
+var CLIENT_SETTINGS = `
+# Left out: this machine only. 0.0.0.0 opens it to the network — a tablet on the same Wi-Fi, and anyone else on it.
+# A space read from Plitzi answers that address once it is among the space's allowed domains.
+# HOST=0.0.0.0
+${TLS_SETTINGS}`;
 /** A `.env` with the signing key `plitzi create` made for the project in its place. */
 var withSigningSecret = (env, secret) => env.replace(/^PLITZI_SIGNING_SECRET=$/m, `PLITZI_SIGNING_SECRET=${secret}`);
 var projectFiles = (answers) => ({
 	...managerFiles(answers.packageManager, answers.managerVersion),
 	"package.json": packageJson$1(answers),
 	"tsconfig.json": tsconfig$1(answers),
+	[TSCONFIG_BASE]: tsconfigBase(answers),
 	...answers.mode === "server" ? { "tsconfig.build.json": tsconfigBuild() } : {},
 	".gitignore": gitignore$1(answers),
 	"README.md": readme$1(answers),
 	"AGENTS.md": agentsFile(answers),
-	"CLAUDE.md": "@AGENTS.md\n",
+	"CLAUDE.md": `@AGENTS.md\n@${PROJECT_NOTES}\n`,
+	[PROJECT_NOTES]: projectNotes(answers),
 	".env": envFile(answers),
 	".env.example": envExample(answers)
 });
@@ -3255,7 +3384,7 @@ var versionOf$2 = (resolvers, packageName) => {
 	const manifest = resolveFrom(resolvers, `${packageName}/package.json`);
 	if (!manifest) return;
 	const parsed = JSON.parse(readFileSync(manifest, "utf-8"));
-	return e$5(parsed) && typeof parsed.version === "string" ? parsed.version : void 0;
+	return e$6(parsed) && typeof parsed.version === "string" ? parsed.version : void 0;
 };
 /** The frontmatter's `version:`, said once: after the skill's `name:`, replacing any already there. */
 var stampVersion = (skill, version) => skill.replace(/^version: .*\n/m, "").replace(/^(name: .*)$/m, `$1\nversion: ${version}`);
@@ -3523,8 +3652,8 @@ var spaceFiles = (answers) => {
 * a space renders through a stack — schema, style, plugins, hydration — where a mistake shows up as a blank page
 * rather than as an exception, and nobody writes the first test for a project that already looks fine.
 */
-var RECORDED = `/** What \`npm start\` wrote down when it took a port: the port, and the name its \`/health\` answers with. */
-const recorded = (): { port?: number; name?: string } => {
+var RECORDED = `/** What \`npm start\` wrote down when it took a port: the port, where it answers and the name its \`/health\` answers with. */
+const recorded = (): { port?: number; url?: string; name?: string } => {
   try {
     const value: unknown = JSON.parse(readFileSync('${x$3}', 'utf8'));
     if (typeof value !== 'object' || value === null) {
@@ -3533,6 +3662,7 @@ const recorded = (): { port?: number; name?: string } => {
 
     return {
       ...('port' in value && typeof value.port === 'number' ? { port: value.port } : {}),
+      ...('url' in value && typeof value.url === 'string' ? { url: value.url } : {}),
       ...('name' in value && typeof value.name === 'string' ? { name: value.name } : {})
     };
   } catch {
@@ -3547,16 +3677,21 @@ ${RECORDED}
 
 // \`PORT\` when set; otherwise the port \`npm start\` took; otherwise the default.
 const PORT = Number(process.env.PORT ?? recorded().port ?? ${mode === "server" ? "8080" : "5173"});
+// Where \`npm start\` said it answers — \`https\` when the server has a certificate — on that port.
+const ORIGIN = new URL(recorded().url ?? 'http://127.0.0.1');
+ORIGIN.port = String(PORT);
 
 export default defineConfig({
   testDir: './visual',
   outputDir: './${VISUAL_OUTPUT}',
-  use: { baseURL: \`http://127.0.0.1:\${PORT}\` },
+  // A local certificate (mkcert) is one this machine's browsers were told to trust, not Playwright's.
+  use: { baseURL: ORIGIN.origin, ignoreHTTPSErrors: true },
   // Playwright starts the project itself, so \`${runCommand(packageManager, "visual")}\` is one command from a
   // cold checkout.
   webServer: {
     command: '${runCommand(packageManager, "start")}',
-    url: \`http://127.0.0.1:\${PORT}\`,
+    url: ORIGIN.origin,
+    ignoreHTTPSErrors: true,
     env: { PORT: String(PORT) },
     reuseExistingServer: true,
     timeout: 120_000
@@ -4282,7 +4417,7 @@ var projectHere = async (what) => {
 };
 //#endregion
 //#region src/commands/projectFormatter.ts
-var isPrettier = (value) => e$5(value) && [
+var isPrettier = (value) => e$6(value) && [
 	"format",
 	"resolveConfig",
 	"getFileInfo"
@@ -4297,7 +4432,7 @@ var projectFormatter = async (root) => {
 	} catch {
 		return unformatted;
 	}
-	const prettier = isPrettier(loaded) ? loaded : e$5(loaded) ? loaded.default : void 0;
+	const prettier = isPrettier(loaded) ? loaded : e$6(loaded) ? loaded.default : void 0;
 	if (!isPrettier(prettier)) return unformatted;
 	const api = prettier;
 	const ignorePath = [".prettierignore", ".gitignore"].map((file) => path.join(root, file));
@@ -4316,8 +4451,8 @@ var projectFormatter = async (root) => {
 };
 //#endregion
 //#region ../../packages/sdk-authoring/dist/index-declare.js
-var e$2 = () => (e) => e;
-var t$2 = () => ({
+var e$3 = () => (e) => e;
+var t$3 = () => ({
 	canDelete: !0,
 	canSelect: !0,
 	canDragDrop: !0,
@@ -4344,7 +4479,7 @@ var r$3 = () => (e) => {
 			...e.content,
 			definition: n$3(e.type, r),
 			builder: {
-				...t$2(),
+				...t$3(),
 				...i
 			},
 			market: {
@@ -4377,22 +4512,22 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 var e$42 = "[a-zA-Z_][a-zA-Z0-9_]*(?:-[a-zA-Z0-9_]+)*";
-var t$62 = `(?:${e$42}|\\d+)`;
-var n$47 = `\\[\\s*(?:\\d+|'[^']*'|"[^"]*"|${e$42}(?:\\.${t$62})*)\\s*\\]`;
-var r$36 = `${`${e$42}(?:${n$47})*(?:\\??\\.${t$62}(?:${n$47})*)*`}(?:\\s*\\?\\?\\s*[^|{}]+?)?(?:\\s*\\|\\s*[a-zA-Z_]+(?:\\([^)]*\\))?)*`;
-var i$29 = `\\{\\{\\s*${r$36}\\s*\\}\\}`;
-var a$24 = `(?:${`\\{\\{\\{\\s*${r$36}\\s*\\}\\}\\}`}|${i$29})`;
+var t$63 = `(?:${e$42}|\\d+)`;
+var n$48 = `\\[\\s*(?:\\d+|'[^']*'|"[^"]*"|${e$42}(?:\\.${t$63})*)\\s*\\]`;
+var r$37 = `${`${e$42}(?:${n$48})*(?:\\??\\.${t$63}(?:${n$48})*)*`}(?:\\s*\\?\\?\\s*[^|{}]+?)?(?:\\s*\\|\\s*[a-zA-Z_]+(?:\\([^)]*\\))?)*`;
+var i$29 = `\\{\\{\\s*${r$37}\\s*\\}\\}`;
+var a$24 = `(?:${`\\{\\{\\{\\s*${r$37}\\s*\\}\\}\\}`}|${i$29})`;
 new RegExp(a$24, "g");
 RegExp(`^${a$24}$`);
 var e$41 = ["smooth", "auto"];
-var t$60 = [
+var t$61 = [
 	"start",
 	"center",
 	"end",
 	"nearest"
 ];
 var s$22 = "onScroll";
-var r$34 = {
+var r$35 = {
 	type: "select",
 	description: "How it moves: \"smooth\" glides there, \"auto\" jumps.",
 	default: "smooth",
@@ -4470,7 +4605,7 @@ var a$22 = {
 				description: "How far down, the same way; negative goes up.",
 				default: ""
 			},
-			behavior: r$34
+			behavior: r$35
 		}
 	},
 	scrollTo: {
@@ -4488,7 +4623,7 @@ var a$22 = {
 				description: "Where down, the same way. Empty stays.",
 				default: ""
 			},
-			behavior: r$34
+			behavior: r$35
 		}
 	},
 	scrollIntoView: {
@@ -4500,15 +4635,15 @@ var a$22 = {
 				type: "select",
 				description: "Where the element lands, top to bottom.",
 				default: "start",
-				options: [...t$60]
+				options: [...t$61]
 			},
 			inline: {
 				type: "select",
 				description: "Where it lands, side to side.",
 				default: "nearest",
-				options: [...t$60]
+				options: [...t$61]
 			},
-			behavior: r$34
+			behavior: r$35
 		}
 	}
 };
@@ -4682,7 +4817,7 @@ var e$40 = {
 		params: {}
 	}
 };
-var t$59 = r$3()({
+var t$60 = r$3()({
 	type: "blockHtml",
 	content: {
 		attributes: { content: "" },
@@ -4697,7 +4832,7 @@ var t$59 = r$3()({
 		defaultStyle: { style: { base: { default: {} } } }
 	}
 });
-var t$58 = r$3()({
+var t$59 = r$3()({
 	type: "blockJsx",
 	content: {
 		attributes: {
@@ -4717,7 +4852,7 @@ var t$58 = r$3()({
 		defaultStyle: { style: { base: { default: {} } } }
 	}
 });
-var t$57 = r$3()({
+var t$58 = r$3()({
 	type: "custom",
 	content: {
 		attributes: {
@@ -4745,7 +4880,7 @@ var t$57 = r$3()({
 		}
 	}
 });
-var t$56 = r$3()({
+var t$57 = r$3()({
 	type: "nodeHtml",
 	content: {
 		attributes: { subType: "div" },
@@ -4768,6 +4903,24 @@ var t$56 = r$3()({
 		}
 	}
 });
+var t$56 = r$3()({
+	type: "plitziSdk",
+	content: {
+		attributes: {
+			spaceKey: "",
+			environment: "main"
+		},
+		definition: {
+			label: "Plitzi Sdk",
+			description: "Another space drawn inside this one, as a widget — its home page, no router of its own: by its key, or from its documents (`offlineData`), bound to UI generated on the fly."
+		},
+		market: {
+			category: "advanced",
+			icon: "https://cdn.plitzi.com/resources/img/favicon.svg"
+		},
+		defaultStyle: { style: { base: { default: {} } } }
+	}
+});
 var t$55 = r$3()({
 	type: "reference",
 	content: {
@@ -4790,7 +4943,7 @@ var t$55 = r$3()({
 		}
 	}
 });
-var n$44 = {
+var n$45 = {
 	"padding-top": "6px",
 	"padding-left": "12px",
 	"padding-right": "12px",
@@ -4803,16 +4956,16 @@ var n$44 = {
 	"border-bottom-left-radius": "4px",
 	"border-bottom-right-radius": "4px"
 };
-var r$33 = r$3()({
+var r$34 = r$3()({
 	type: "button",
 	attributeValues: {
-		subType: e$2()([
+		subType: e$3()([
 			"button",
 			"submit",
 			"reset"
 		]),
-		contentPlacement: e$2()(["before", "after"]),
-		iconPlacement: e$2()(["before", "after"])
+		contentPlacement: e$3()(["before", "after"]),
+		iconPlacement: e$3()(["before", "after"])
 	},
 	content: {
 		attributes: {
@@ -4834,30 +4987,30 @@ var r$33 = r$3()({
 			icon: "fa-solid fa-hand-pointer"
 		},
 		defaultStyle: {
-			style: { base: { default: n$44 } },
+			style: { base: { default: n$45 } },
 			subTypes: {
 				button: {
 					name: "Default Button",
 					displayMode: "desktop",
-					style: { base: { default: n$44 } }
+					style: { base: { default: n$45 } }
 				},
 				reset: {
 					name: "Reset Button",
 					displayMode: "desktop",
-					style: { base: { default: n$44 } }
+					style: { base: { default: n$45 } }
 				},
 				submit: {
 					name: "Submit Button",
 					displayMode: "desktop",
-					style: { base: { default: n$44 } }
+					style: { base: { default: n$45 } }
 				}
 			}
 		}
 	}
 });
-var n$43 = r$3()({
+var n$44 = r$3()({
 	type: "dropdown",
-	attributeValues: { popupPlacement: e$2()([
+	attributeValues: { popupPlacement: e$3()([
 		"left",
 		"right",
 		"top",
@@ -4947,9 +5100,9 @@ var t$54 = r$3()({
 	},
 	initialItems: []
 });
-var n$42 = r$3()({
+var n$43 = r$3()({
 	type: "heading",
-	attributeValues: { subType: e$2()([
+	attributeValues: { subType: e$3()([
 		"h1",
 		"h2",
 		"h3",
@@ -5047,23 +5200,23 @@ var n$42 = r$3()({
 		}
 	}
 });
-var n$41 = r$3()({
+var n$42 = r$3()({
 	type: "link",
 	attributeValues: {
-		mode: e$2()([
+		mode: e$3()([
 			"page",
 			"internal",
 			"external"
 		]),
-		target: e$2()([
+		target: e$3()([
 			"self",
 			"blank",
 			"parent",
 			"top"
 		]),
-		contentPlacement: e$2()(["before", "after"]),
-		iconPlacement: e$2()(["before", "after"]),
-		current: e$2()(["page", "section"])
+		contentPlacement: e$3()(["before", "after"]),
+		iconPlacement: e$3()(["before", "after"]),
+		current: e$3()(["page", "section"])
 	},
 	content: {
 		attributes: {
@@ -5163,9 +5316,9 @@ var t$52 = r$3()({
 		} } } }
 	}
 });
-var n$40 = r$3()({
+var n$41 = r$3()({
 	type: "richText",
-	attributeValues: { format: e$2()([
+	attributeValues: { format: e$3()([
 		"html",
 		"markdown",
 		"text"
@@ -5235,7 +5388,7 @@ var t$51 = r$3()({
 		defaultStyle: { style: { base: { default: { display: "inline" } } } }
 	}
 });
-var n$39 = {
+var n$40 = {
 	"margin-top": "0px",
 	"margin-right": "0px",
 	"margin-bottom": "0px",
@@ -5256,9 +5409,9 @@ var n$39 = {
 	"letter-spacing": "inherit",
 	cursor: "pointer"
 };
-var r$32 = r$3()({
+var r$33 = r$3()({
 	type: "themeToggle",
-	attributeValues: { subType: e$2()(["switch", "segmented"]) },
+	attributeValues: { subType: e$3()(["switch", "segmented"]) },
 	triggers: { onThemeChange: {
 		action: "onThemeChange",
 		title: "On Theme Change",
@@ -5289,10 +5442,10 @@ var r$32 = r$3()({
 		},
 		defaultStyle: {
 			style: {
-				base: { default: n$39 },
+				base: { default: n$40 },
 				icon: { default: {} },
 				option: { default: {
-					...n$39,
+					...n$40,
 					"row-gap": "4px",
 					"column-gap": "4px"
 				} }
@@ -5301,9 +5454,9 @@ var r$32 = r$3()({
 		}
 	}
 });
-var n$38 = r$3()({
+var n$39 = r$3()({
 	type: "form",
-	attributeValues: { method: e$2()(["get", "post"]) },
+	attributeValues: { method: e$3()(["get", "post"]) },
 	sourceType: "apiContainer",
 	triggers: { onSubmit: {
 		action: "onSubmit",
@@ -5381,7 +5534,7 @@ var n$38 = r$3()({
 		defaultStyle: { style: { base: { default: {} } } }
 	}
 });
-var n$37 = {
+var n$38 = {
 	width: "100%",
 	display: "flex",
 	"align-items": "center",
@@ -5410,8 +5563,8 @@ var n$37 = {
 	outline: "none",
 	position: "relative"
 };
-var r$31 = {
-	...n$37,
+var r$32 = {
+	...n$38,
 	"line-height": "20px"
 };
 var i$26 = {
@@ -5494,7 +5647,7 @@ var d$12 = {
 	cursor: "pointer"
 };
 var f$10 = {
-	...n$37,
+	...n$38,
 	cursor: "pointer"
 };
 var p$11 = {
@@ -5543,7 +5696,7 @@ var m$7 = (e, t, { field: n, icon: r } = {}) => ({
 var h$4 = { field: l$13 };
 var g$4 = r$3()({
 	type: "formControl",
-	attributeValues: { subType: e$2()([
+	attributeValues: { subType: e$3()([
 		"text",
 		"number",
 		"email",
@@ -5616,21 +5769,21 @@ var g$4 = r$3()({
 			style: { base: { default: {} } },
 			subTypes: {
 				hidden: m$7("Form Control Hidden", {}),
-				text: m$7("Form Control Text", r$31, h$4),
-				number: m$7("Form Control Number", r$31, h$4),
-				email: m$7("Form Control Email", r$31, h$4),
-				password: m$7("Form Control Password", r$31, {
+				text: m$7("Form Control Text", r$32, h$4),
+				number: m$7("Form Control Number", r$32, h$4),
+				email: m$7("Form Control Email", r$32, h$4),
+				password: m$7("Form Control Password", r$32, {
 					...h$4,
 					icon: d$12
 				}),
-				search: m$7("Form Control Search", r$31, h$4),
-				url: m$7("Form Control URL", r$31, h$4),
-				tel: m$7("Form Control Phone", r$31, h$4),
-				date: m$7("Form Control Date", r$31, h$4),
-				time: m$7("Form Control Time", r$31, h$4),
-				color: m$7("Form Control Color", r$31, h$4),
+				search: m$7("Form Control Search", r$32, h$4),
+				url: m$7("Form Control URL", r$32, h$4),
+				tel: m$7("Form Control Phone", r$32, h$4),
+				date: m$7("Form Control Date", r$32, h$4),
+				time: m$7("Form Control Time", r$32, h$4),
+				color: m$7("Form Control Color", r$32, h$4),
 				textarea: m$7("Form Control Textarea", {
-					...r$31,
+					...r$32,
 					color: "inherit",
 					resize: "vertical"
 				}),
@@ -5669,9 +5822,9 @@ var g$4 = r$3()({
 		}
 	}
 });
-var n$36 = r$3()({
+var n$37 = r$3()({
 	type: "layoutContainer",
-	attributeValues: { subType: e$2()([
+	attributeValues: { subType: e$3()([
 		"div",
 		"header",
 		"footer",
@@ -5737,13 +5890,14 @@ var t$49 = r$3()({
 		} } } }
 	}
 });
-var t$48 = r$3()({
+var r$31 = r$3()({
 	type: "page",
 	serverTemplates: [
 		"seoPageTitle",
 		"seoPageDescription",
 		"notFound"
 	],
+	attributeValues: { documentScroll: ["locked", "noBounce"] },
 	triggers: { onPageLoad: {
 		action: "onPageLoad",
 		title: "On Page Load",
@@ -5847,12 +6001,12 @@ var t$46 = r$3()({
 var n$35 = r$3()({
 	type: "image",
 	attributeValues: {
-		fetchPriority: e$2()([
+		fetchPriority: e$3()([
 			"high",
 			"low",
 			"auto"
 		]),
-		loadMode: e$2()([
+		loadMode: e$3()([
 			"auto",
 			"eager",
 			"lazy"
@@ -5935,7 +6089,7 @@ var t$44 = r$3()({
 var n$34 = r$3()({
 	type: "apiContainer",
 	attributeValues: {
-		subType: e$2()([
+		subType: e$3()([
 			"",
 			"div",
 			"header",
@@ -5948,19 +6102,19 @@ var n$34 = r$3()({
 			"address",
 			"figure"
 		]),
-		method: e$2()([
+		method: e$3()([
 			"get",
 			"post",
 			"put",
 			"delete",
 			"patch"
 		]),
-		credentials: e$2()([
+		credentials: e$3()([
 			"include",
 			"omit",
 			"same-origin"
 		]),
-		pagination: e$2()([
+		pagination: e$3()([
 			"none",
 			"url",
 			"append"
@@ -6088,7 +6242,7 @@ var n$34 = r$3()({
 });
 var n$33 = r$3()({
 	type: "channel",
-	attributeValues: { subType: e$2()([
+	attributeValues: { subType: e$3()([
 		"",
 		"div",
 		"section",
@@ -6295,7 +6449,7 @@ var t$42 = r$3()({
 var r$30 = r$3()({
 	type: "container",
 	attributeValues: {
-		subType: e$2()([
+		subType: e$3()([
 			"div",
 			"header",
 			"footer",
@@ -6319,7 +6473,7 @@ var r$30 = r$3()({
 			"p",
 			"span"
 		]),
-		live: e$2()([
+		live: e$3()([
 			"",
 			"polite",
 			"assertive"
@@ -6384,16 +6538,16 @@ var n$31 = {
 	outline: "none",
 	cursor: "pointer"
 };
-var B$2 = {
+var V$2 = {
 	ApiContainer: n$34,
-	BlockHtml: t$59,
-	BlockJsx: t$58,
-	Button: r$33,
+	BlockHtml: t$60,
+	BlockJsx: t$59,
+	Button: r$34,
 	Carousel: t$42,
 	CarouselTrack: t$43,
 	Channel: n$33,
 	Container: r$30,
-	Custom: t$57,
+	Custom: t$58,
 	DialogContainer: r$3()({
 		type: "dialogContainer",
 		sourceType: "dialogContainer",
@@ -6560,21 +6714,21 @@ var B$2 = {
 		},
 		initialItems: ["container"]
 	}),
-	Dropdown: n$43,
+	Dropdown: n$44,
 	DropdownPopup: t$54,
 	Embed: t$47,
 	FontAwesome: t$46,
-	Form: n$38,
+	Form: n$39,
 	FormControl: g$4,
-	Heading: n$42,
+	Heading: n$43,
 	Image: n$35,
-	LayoutContainer: n$36,
-	Link: n$41,
+	LayoutContainer: n$37,
+	Link: n$42,
 	List: r$3()({
 		type: "list",
 		attributeValues: {
-			subType: e$2()(["ul", "ol"]),
-			source: e$2()(["none", "controlled"])
+			subType: e$3()(["ul", "ol"]),
+			source: e$3()(["none", "controlled"])
 		},
 		sourceType: "list",
 		content: {
@@ -6803,14 +6957,14 @@ var B$2 = {
 		},
 		initialItems: ["container"]
 	}),
-	NodeHtml: t$56,
+	NodeHtml: t$57,
 	NotFound: t$49,
-	Page: t$48,
+	Page: r$31,
 	Pagination: r$3()({
 		type: "pagination",
 		attributeValues: {
-			mode: e$2()(["pages", "loadMore"]),
-			target: e$2()(["url", "interaction"])
+			mode: e$3()(["pages", "loadMore"]),
+			target: e$3()(["url", "interaction"])
 		},
 		triggers: { onPageChange: {
 			action: "onPageChange",
@@ -6857,8 +7011,9 @@ var B$2 = {
 		}
 	}),
 	Paragraph: t$52,
+	PlitziSdk: t$56,
 	Reference: t$55,
-	RichText: n$40,
+	RichText: n$41,
 	Svg: t$45,
 	TabContainer: r$3()({
 		type: "tabContainer",
@@ -6970,12 +7125,12 @@ var B$2 = {
 		}
 	}),
 	Text: t$51,
-	ThemeToggle: r$32,
+	ThemeToggle: r$33,
 	Video: t$44
 };
-Object.fromEntries(Object.values(B$2).flatMap((e) => "serverTemplates" in e ? [[e.type, e.serverTemplates]] : []));
+Object.fromEntries(Object.values(V$2).flatMap((e) => "serverTemplates" in e ? [[e.type, e.serverTemplates]] : []));
 /** Every declaration, read through the part of its shape this catalog uses. */
-var declarations$1 = B$2;
+var declarations$1 = V$2;
 /** Keyed by the schema `type`, which is what a document and every catalog address a type by. */
 var elementCatalog = Object.fromEntries(Object.values(declarations$1).map((declaration) => [declaration.type, {
 	label: declaration.content?.definition?.label ?? declaration.type,
@@ -8356,6 +8511,11 @@ Object.values(t$30).map((e) => ({
 }));
 t$30.DISPLAY, t$30.FLEX_WRAP, t$30.FLEX_DIRECTION, t$30.ALIGN_ITEMS, t$30.JUSTIFY_ITEMS, t$30.JUSTIFY_CONTENT, t$30.ALIGN_CONTENT, t$30.ROW_GAP, t$30.COLUMN_GAP, t$30.GRID_ROW_GAP, t$30.GRID_COLUMN_GAP, t$30.GRID_TEMPLATE_AREAS, t$30.GRID_TEMPLATE_COLUMNS, t$30.GRID_TEMPLATE_ROWS, t$30.GRID_AUTO_FLOW, t$30.GRID_AUTO_ROWS, t$30.GRID_AUTO_COLUMNS, t$30.GRID_ROW_START, t$30.GRID_COLUMN_START, t$30.GRID_ROW_END, t$30.GRID_COLUMN_END, t$30.ALIGN_SELF, t$30.JUSTIFY_SELF, t$30.ORDER, t$30.FLEX_GROW, t$30.FLEX_SHRINK, t$30.FLEX_BASIS, t$30.LIST_STYLE, t$30.LIST_STYLE_TYPE, t$30.LIST_STYLE_POSITION, t$30.LIST_STYLE_IMAGE, t$30.BACKGROUND_COLOR, t$30.BACKGROUND_IMAGE, t$30.BACKGROUND_POSITION, t$30.BACKGROUND_SIZE, t$30.BACKGROUND_CLIP, t$30.BACKGROUND_ORIGIN, t$30.BACKGROUND_REPEAT, t$30.BACKGROUND_ATTACHMENT, t$30.BACKGROUND_BLEND_MODE, t$30.MASK_IMAGE, t$30.MASK_SIZE, t$30.MASK_POSITION, t$30.MASK_REPEAT, t$30.MASK_COMPOSITE, t$30.WEBKIT_MASK_IMAGE, t$30.BORDER_TOP_STYLE, t$30.BORDER_TOP_WIDTH, t$30.BORDER_TOP_COLOR, t$30.BORDER_BOTTOM_STYLE, t$30.BORDER_BOTTOM_WIDTH, t$30.BORDER_BOTTOM_COLOR, t$30.BORDER_LEFT_STYLE, t$30.BORDER_LEFT_WIDTH, t$30.BORDER_LEFT_COLOR, t$30.BORDER_RIGHT_STYLE, t$30.BORDER_RIGHT_WIDTH, t$30.BORDER_RIGHT_COLOR, t$30.BORDER_TOP_LEFT_RADIUS, t$30.BORDER_TOP_RIGHT_RADIUS, t$30.BORDER_BOTTOM_LEFT_RADIUS, t$30.BORDER_BOTTOM_RIGHT_RADIUS, t$30.BORDER_COLLAPSE, t$30.BORDER_SPACING, t$30.TABLE_LAYOUT, t$30.OPACITY, t$30.VISIBILITY, t$30.CURSOR, t$30.TRANSITION, t$30.TRANSITION_PROPERTY, t$30.TRANSITION_DURATION, t$30.TRANSITION_TIMING_FUNCTION, t$30.TRANSITION_DELAY, t$30.TRANSITION_BEHAVIOR, t$30.ANIMATION, t$30.ANIMATION_NAME, t$30.ANIMATION_DURATION, t$30.ANIMATION_TIMING_FUNCTION, t$30.ANIMATION_DELAY, t$30.ANIMATION_ITERATION_COUNT, t$30.ANIMATION_DIRECTION, t$30.ANIMATION_FILL_MODE, t$30.ANIMATION_PLAY_STATE, t$30.ANIMATION_TIMELINE, t$30.ANIMATION_RANGE, t$30.BOX_SHADOW, t$30.FILTER, t$30.BACKDROP_FILTER, t$30.MIX_BLEND_MODE, t$30.ISOLATION, t$30.CLIP_PATH, t$30.TRANSFORM, t$30.TRANSFORM_ORIGIN, t$30.TRANSLATE, t$30.ROTATE, t$30.SCALE, t$30.TRANSFORM_STYLE, t$30.PERSPECTIVE, t$30.PERSPECTIVE_ORIGIN, t$30.BACKFACE_VISIBILITY, t$30.WILL_CHANGE, t$30.OUTLINE_WIDTH, t$30.OUTLINE_STYLE, t$30.OUTLINE_COLOR, t$30.OUTLINE_OFFSET, t$30.POINTER_EVENTS, t$30.USER_SELECT, t$30.TOUCH_ACTION, t$30.RESIZE, t$30.APPEARANCE, t$30.SCROLL_BEHAVIOR, t$30.OVERSCROLL_BEHAVIOR, t$30.SCROLL_SNAP_TYPE, t$30.SCROLL_SNAP_ALIGN, t$30.SCROLL_SNAP_STOP, t$30.SCROLL_PADDING_TOP, t$30.SCROLL_MARGIN_TOP, t$30.ACCENT_COLOR, t$30.CARET_COLOR, t$30.COLOR_SCHEME, t$30.POSITION, t$30.FLOAT, t$30.CLEAR, t$30.Z_INDEX, t$30.TOP, t$30.BOTTOM, t$30.LEFT, t$30.RIGHT, t$30.BOX_SIZING, t$30.ASPECT_RATIO, t$30.WIDTH, t$30.HEIGHT, t$30.MIN_WIDTH, t$30.MIN_HEIGHT, t$30.MAX_WIDTH, t$30.MAX_HEIGHT, t$30.OVERFLOW, t$30.OVERFLOW_X, t$30.OVERFLOW_Y, t$30.SCROLLBAR_WIDTH, t$30.SCROLLBAR_COLOR, t$30.CONTAINER_TYPE, t$30.CONTENT, t$30.CONTAINER_NAME, t$30.OBJECT_FIT, t$30.OBJECT_POSITION, t$30.COLUMN_WIDTH, t$30.COLUMN_COUNT, t$30.MARGIN_TOP, t$30.MARGIN_BOTTOM, t$30.MARGIN_LEFT, t$30.MARGIN_RIGHT, t$30.PADDING_TOP, t$30.PADDING_BOTTOM, t$30.PADDING_LEFT, t$30.PADDING_RIGHT, t$30.FONT_FAMILY, t$30.FONT_WEIGHT, t$30.FONT_SIZE, t$30.LINE_HEIGHT, t$30.COLOR, t$30.TEXT_ALIGN, t$30.FONT_STYLE, t$30.FONT_VARIANT, t$30.FONT_VARIANT_NUMERIC, t$30.FONT_FEATURE_SETTINGS, t$30.TEXT_DECORATION, t$30.TEXT_DECORATION_LINE, t$30.TEXT_DECORATION_COLOR, t$30.TEXT_DECORATION_STYLE, t$30.TEXT_DECORATION_THICKNESS, t$30.TEXT_UNDERLINE_OFFSET, t$30.LETTER_SPACING, t$30.WORD_SPACING, t$30.TEXT_INDENT, t$30.TEXT_TRANSFORM, t$30.DIRECTION, t$30.WRITING_MODE, t$30.TEXT_ORIENTATION, t$30.WHITE_SPACE, t$30.TEXT_WRAP, t$30.WORD_BREAK, t$30.OVERFLOW_WRAP, t$30.HYPHENS, t$30.VERTICAL_ALIGN, t$30.TEXT_OVERFLOW, t$30.TEXT_SHADOW, t$30.LINE_CLAMP, t$30.WEBKIT_LINE_CLAMP, t$30.WEBKIT_BOX_ORIENT, t$30.WEBKIT_TEXT_FILL_COLOR, t$30.WEBKIT_BACKGROUND_CLIP, t$30.BOX_DECORATION_BREAK, t$30.WEBKIT_BOX_DECORATION_BREAK, t$30.FILL, t$30.STROKE, t$30.STROKE_WIDTH;
 [...e$39];
+/**
+* The attribute a binding writes, from where it lands: `offlineData.schema` writes part of `offlineData` — the runtime
+* sets the path — so it is `offlineData` an element has to read.
+*/
+var boundAttribute = (to) => to.split(".", 1)[0];
 /** Both binding forms as one list. The map form targets attributes, which is what nearly every binding does. */
 var toBindingSpecs = (bind) => Array.isArray(bind) ? bind : Object.entries(bind).map(([to, source]) => ({
 	to,
@@ -8564,7 +8724,7 @@ var callFactory = (type, declaration, first, second) => {
 * the caller says they are, and nothing is claimed that is not known.
 */
 var defineElement = (declaration) => (first, second) => callFactory(declaration.type, declaration, first, second);
-var declarationsByType = new Map(Object.values(B$2).map((declaration) => [declaration.type, declaration]));
+var declarationsByType = new Map(Object.values(V$2).map((declaration) => [declaration.type, declaration]));
 var elements_exports = /* @__PURE__ */ __exportAll({
 	apiContainer: () => apiContainer,
 	blockHtml: () => blockHtml,
@@ -8592,6 +8752,7 @@ var elements_exports = /* @__PURE__ */ __exportAll({
 	nodeHtml: () => nodeHtml,
 	pagination: () => pagination,
 	paragraph: () => paragraph,
+	plitziSdk: () => plitziSdk,
 	reference: () => reference,
 	richText: () => richText,
 	svg: () => svg,
@@ -8617,30 +8778,30 @@ var elements_exports = /* @__PURE__ */ __exportAll({
 * appear in real documents, and their components are attached to their parent rather than exported on their own,
 * which is why their declarations had to be written before they could be authored at all.
 */
-var apiContainer = defineElement(B$2.ApiContainer);
-var blockHtml = defineElement(B$2.BlockHtml);
-var blockJsx = defineElement(B$2.BlockJsx);
-var button$1 = defineElement(B$2.Button);
+var apiContainer = defineElement(V$2.ApiContainer);
+var blockHtml = defineElement(V$2.BlockHtml);
+var blockJsx = defineElement(V$2.BlockJsx);
+var button$1 = defineElement(V$2.Button);
 /**
 * A carousel's `items` may name the source its slides come from, as a list's may: `carousel({ id: 'hero', items:
 * 'site.data.slides', row: r => … })` writes the slide into a `carouselTrack`, and its `children` are the controls.
 */
-var carousel = defineElement(B$2.Carousel);
-var carouselTrack = defineElement(B$2.CarouselTrack);
-var channel = defineElement(B$2.Channel);
-var container = defineElement(B$2.Container);
-var custom$1 = defineElement(B$2.Custom);
-var dialogContainer = defineElement(B$2.DialogContainer);
-var dropdown = defineElement(B$2.Dropdown);
-var dropdownPopup = defineElement(B$2.DropdownPopup);
-var embed = defineElement(B$2.Embed);
-var fontAwesome = defineElement(B$2.FontAwesome);
-var form = defineElement(B$2.Form);
-var formControl = defineElement(B$2.FormControl);
-var heading = defineElement(B$2.Heading);
-var image = defineElement(B$2.Image);
-var link = defineElement(B$2.Link);
-var listFactory = defineElement(B$2.List);
+var carousel = defineElement(V$2.Carousel);
+var carouselTrack = defineElement(V$2.CarouselTrack);
+var channel = defineElement(V$2.Channel);
+var container = defineElement(V$2.Container);
+var custom$1 = defineElement(V$2.Custom);
+var dialogContainer = defineElement(V$2.DialogContainer);
+var dropdown = defineElement(V$2.Dropdown);
+var dropdownPopup = defineElement(V$2.DropdownPopup);
+var embed = defineElement(V$2.Embed);
+var fontAwesome = defineElement(V$2.FontAwesome);
+var form = defineElement(V$2.Form);
+var formControl = defineElement(V$2.FormControl);
+var heading = defineElement(V$2.Heading);
+var image = defineElement(V$2.Image);
+var link = defineElement(V$2.Link);
+var listFactory = defineElement(V$2.List);
 var isTypedList = (props) => isSourcePath(props.items);
 function list$1(first, second) {
 	if (Array.isArray(first)) return listFactory(first, second);
@@ -8651,22 +8812,24 @@ function list$1(first, second) {
 		row: typeof row === "function" ? (named) => row(sourceRow(named.source, items)) : row
 	});
 }
-var listItem = defineElement(B$2.ListItem);
-var markdown = defineElement(B$2.Markdown);
-var modalContainer = defineElement(B$2.ModalContainer);
-var nodeHtml = defineElement(B$2.NodeHtml);
-var pagination = defineElement(B$2.Pagination);
-var paragraph = defineElement(B$2.Paragraph);
-var reference = defineElement(B$2.Reference);
-var richText = defineElement(B$2.RichText);
-var svg = defineElement(B$2.Svg);
-var tabContainer = defineElement(B$2.TabContainer);
-var tabContainerBody = defineElement(B$2.TabContainerBody);
-var tabContainerHeader = defineElement(B$2.TabContainerHeader);
-var tabContainerItem = defineElement(B$2.TabContainerItem);
-var text$1 = defineElement(B$2.Text);
-var themeToggle = defineElement(B$2.ThemeToggle);
-var video = defineElement(B$2.Video);
+var listItem = defineElement(V$2.ListItem);
+var markdown = defineElement(V$2.Markdown);
+var modalContainer = defineElement(V$2.ModalContainer);
+var nodeHtml = defineElement(V$2.NodeHtml);
+var pagination = defineElement(V$2.Pagination);
+var paragraph = defineElement(V$2.Paragraph);
+/** Another space drawn inside this one, as a widget: `plitziSdk({ id: 'card', bind: { offlineData: 'view.data' } })`. */
+var plitziSdk = defineElement(V$2.PlitziSdk);
+var reference = defineElement(V$2.Reference);
+var richText = defineElement(V$2.RichText);
+var svg = defineElement(V$2.Svg);
+var tabContainer = defineElement(V$2.TabContainer);
+var tabContainerBody = defineElement(V$2.TabContainerBody);
+var tabContainerHeader = defineElement(V$2.TabContainerHeader);
+var tabContainerItem = defineElement(V$2.TabContainerItem);
+var text$1 = defineElement(V$2.Text);
+var themeToggle = defineElement(V$2.ThemeToggle);
+var video = defineElement(V$2.Video);
 var e$33 = (e) => typeof e == "object" && !!e && !Array.isArray(e);
 var STEP_TYPES = [
 	"trigger",
@@ -12893,7 +13056,7 @@ new Set(Object.keys({
 		const names = ctx.attributeNamesFor(element);
 		const bindings = element.definition.bindings;
 		if (!names || !bindings?.attributes) return;
-		const reads = (binding) => binding.to === "visibility" || binding.to === "className" || names.includes(binding.to);
+		const reads = (binding) => binding.to === "visibility" || binding.to === "className" || names.includes(boundAttribute(binding.to));
 		for (const binding of bindings.attributes.filter((candidate) => !reads(candidate))) report(`Removed the binding onto "${binding.to}", which a "${element.definition.type}" never reads.`, {
 			on: "binding",
 			op: "remove",
@@ -14651,7 +14814,7 @@ var placementOf = ({ name, declaration, attributes }, id = declaration.type) =>
 var pluginText = (plugin) => {
 	const { declaration } = plugin;
 	const definition = declaration.content?.definition;
-	const description = e$5(definition) && typeof definition.description === "string" ? definition.description : "";
+	const description = e$6(definition) && typeof definition.description === "string" ? definition.description : "";
 	const attributes = Object.entries(declaration.content?.attributes ?? {});
 	const triggers = Object.keys(declaration.triggers ?? {});
 	const callbacks = Object.keys(declaration.callbacks ?? {});
@@ -14673,13 +14836,13 @@ var pluginText = (plugin) => {
 var requireServerTypes = async (root) => {
 	const file = path.join(root, "package.json");
 	const json = JSON.parse(await fs.readFile(file, "utf-8"));
-	if (!e$5(json)) return;
+	if (!e$6(json)) return;
 	if ([
 		json.dependencies,
 		json.devDependencies,
 		json.peerDependencies
-	].some((list) => e$5(list) && "@plitzi/sdk-server" in list)) return;
-	const devDependencies = e$5(json.devDependencies) ? json.devDependencies : {};
+	].some((list) => e$6(list) && "@plitzi/sdk-server" in list)) return;
+	const devDependencies = e$6(json.devDependencies) ? json.devDependencies : {};
 	json.devDependencies = Object.fromEntries(Object.entries({
 		...devDependencies,
 		"@plitzi/sdk-server": SDK_VERSION
@@ -14923,7 +15086,7 @@ var addPlugin = async (namesGiven, options) => {
 * carry it — is not refused anything: every file that differs is then shown as the project's, for its author to take.
 */
 var SCAFFOLD_RECORD_FILE = path.join(".plitzi", "scaffold.json");
-var stringRecord = (value) => e$5(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
+var stringRecord = (value) => e$6(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
 var isPackageManager = (value) => PACKAGE_MANAGERS.some((manager) => manager === value);
 var digestOf = (contents) => createHash("sha256").update(contents).digest("hex");
 var readScaffoldRecord = async (root) => {
@@ -14933,12 +15096,12 @@ var readScaffoldRecord = async (root) => {
 	} catch {
 		return;
 	}
-	if (!e$5(parsed) || parsed.format !== 1 || typeof parsed.cli !== "string" || !e$5(parsed.files)) return;
+	if (!e$6(parsed) || parsed.format !== 1 || typeof parsed.cli !== "string" || !e$6(parsed.files)) return;
 	return {
 		format: 1,
 		cli: parsed.cli,
 		files: stringRecord(parsed.files),
-		...e$5(parsed.scripts) ? { scripts: stringRecord(parsed.scripts) } : {},
+		...e$6(parsed.scripts) ? { scripts: stringRecord(parsed.scripts) } : {},
 		...isPackageManager(parsed.packageManager) ? { packageManager: parsed.packageManager } : {}
 	};
 };
@@ -14946,7 +15109,7 @@ var readScaffoldRecord = async (root) => {
 var scriptsOf$1 = (packageJsonText) => {
 	try {
 		const parsed = JSON.parse(packageJsonText ?? "");
-		return e$5(parsed) ? stringRecord(parsed.scripts) : {};
+		return e$6(parsed) ? stringRecord(parsed.scripts) : {};
 	} catch {
 		return {};
 	}
@@ -15243,7 +15406,7 @@ var projectFromSpace = (exported, spaceSource) => {
 * copy of the whole project beside the project would be the second source of it nobody keeps in step.
 */
 var ORIGIN_FILE = path.join(".plitzi", "space.json");
-var isStrings$1 = (value) => e$5(value) && Object.values(value).every((entry) => typeof entry === "string");
+var isStrings$1 = (value) => e$6(value) && Object.values(value).every((entry) => typeof entry === "string");
 var digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 /**
 * A file of the project as a pull compares it: the digest of what the project's formatter makes of it — so a file only
@@ -15267,7 +15430,7 @@ var digestsOf = async (root, file, format) => {
 var readOrigin = async (root) => {
 	try {
 		const value = JSON.parse(await fs.readFile(path.join(root, ORIGIN_FILE), "utf-8"));
-		if (!e$5(value) || value.format !== 1 || typeof value.api !== "string" || !e$5(value.space) || typeof value.space.id !== "number" || typeof value.space.name !== "string" || typeof value.space.permanentUrl !== "string" || value.source !== "local" && value.source !== "cloud" || !e$5(value.version) || typeof value.version.environment !== "string" || value.version.revision !== void 0 && typeof value.version.revision !== "number" || value.draft !== void 0 && typeof value.draft !== "string" || !isStrings$1(value.files) || !isStrings$1(value.downloads) || !isStrings$1(value.dependencies) || value.data !== void 0 && typeof value.data !== "string") return;
+		if (!e$6(value) || value.format !== 1 || typeof value.api !== "string" || !e$6(value.space) || typeof value.space.id !== "number" || typeof value.space.name !== "string" || typeof value.space.permanentUrl !== "string" || value.source !== "local" && value.source !== "cloud" || !e$6(value.version) || typeof value.version.environment !== "string" || value.version.revision !== void 0 && typeof value.version.revision !== "number" || value.draft !== void 0 && typeof value.draft !== "string" || !isStrings$1(value.files) || !isStrings$1(value.downloads) || !isStrings$1(value.dependencies) || value.data !== void 0 && typeof value.data !== "string") return;
 		return {
 			format: 1,
 			api: value.api,
@@ -15415,12 +15578,12 @@ var SCOPED_NAME = /(@plitzi\/[\w.-]+?)(?:@[^/]*)?$/;
 var readJson = async (file) => {
 	try {
 		const parsed = JSON.parse(await fs.readFile(file, "utf-8"));
-		return e$5(parsed) ? parsed : void 0;
+		return e$6(parsed) ? parsed : void 0;
 	} catch {
 		return;
 	}
 };
-var stringsOf$2 = (value) => e$5(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
+var stringsOf$2 = (value) => e$6(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
 /** The folder Node finds the scope in from the project's root: the nearest `node_modules/@plitzi`, here or above. */
 var scopeFolder = async (root) => {
 	for (let dir = root;; dir = path.dirname(dir)) {
@@ -15442,8 +15605,8 @@ var overridden = (manifest) => {
 	return [
 		["overrides", manifest.overrides],
 		["resolutions", manifest.resolutions],
-		["pnpm.overrides", e$5(manifest.pnpm) ? manifest.pnpm.overrides : void 0]
-	].flatMap(([field, value]) => Object.entries(e$5(value) ? value : {}).flatMap(([key, to]) => {
+		["pnpm.overrides", e$6(manifest.pnpm) ? manifest.pnpm.overrides : void 0]
+	].flatMap(([field, value]) => Object.entries(e$6(value) ? value : {}).flatMap(([key, to]) => {
 		const name = SCOPED_NAME.exec(key)?.[1];
 		return name ? [{
 			name,
@@ -15463,9 +15626,9 @@ var linked = async (root, scope) => {
 	}));
 };
 /** One package of the scope as npm recorded it: what is installed (`node_modules/.package-lock.json`), or saved. */
-var npmEntries = (lock) => new Map(Object.entries(e$5(lock?.packages) ? lock.packages : {}).flatMap(([key, entry]) => {
+var npmEntries = (lock) => new Map(Object.entries(e$6(lock?.packages) ? lock.packages : {}).flatMap(([key, entry]) => {
 	const name = key.startsWith(`node_modules/${SCOPE$1}/`) ? key.slice(13) : void 0;
-	if (!name || name.includes("/node_modules/") || !e$5(entry)) return [];
+	if (!name || name.includes("/node_modules/") || !e$6(entry)) return [];
 	return [[name, {
 		...typeof entry.version === "string" ? { version: entry.version } : {},
 		...typeof entry.resolved === "string" ? { resolved: entry.resolved } : {}
@@ -15591,23 +15754,36 @@ var UPGRADE_PARTS = [
 	"skills",
 	"renames"
 ];
-var RENAMES = [{
-	name: "canTemplate",
-	to: "canSnippet",
-	since: "0.38.0",
-	what: "a plugin’s builder config key"
-}, ...[
-	"authorTemplate",
-	"validateTemplate",
-	"TemplateSpec",
-	"AuthoredTemplate"
-].map((name) => ({
-	name,
-	to: name.replace("Template", "Snippet"),
-	since: "0.38.0",
-	what: "what the builder saves from a subtree is a snippet",
-	from: "@plitzi/sdk-authoring"
-}))];
+var RENAMES = [
+	{
+		name: "canTemplate",
+		to: "canSnippet",
+		since: "0.38.0",
+		what: "a plugin’s builder config key"
+	},
+	...[
+		"authorTemplate",
+		"validateTemplate",
+		"TemplateSpec",
+		"AuthoredTemplate"
+	].map((name) => ({
+		name,
+		to: name.replace("Template", "Snippet"),
+		since: "0.38.0",
+		what: "what the builder saves from a subtree is a snippet",
+		from: "@plitzi/sdk-authoring"
+	})),
+	...[
+		["usePlitziServiceContext", "usePlitzi"],
+		["PlitziServiceProvider", "PlitziProvider"],
+		["PlitziServiceContextValue", "PlitziContextValue"]
+	].map(([name, to]) => ({
+		name,
+		to,
+		since: "0.38.12",
+		what: "what the host rendering a space tells its elements: `usePlitzi()`"
+	}))
+];
 /** The project's own source: TypeScript and JavaScript under `src/` and `visual/`, never what was installed or built. */
 var sourceFiles = async (root) => {
 	const found = [];
@@ -15685,7 +15861,7 @@ var isBelow = (range, than) => {
 	const at = a.findIndex((part, index) => part !== b[index]);
 	return at !== -1 && a[at] < b[at];
 };
-var stringsOf$1 = (value) => e$5(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
+var stringsOf$1 = (value) => e$6(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
 /**
 * `package.json` brought up to the CLI. `wrote` is what the CLI wrote of its scripts (the scaffold record): one the
 * project still has as written is the CLI's and takes today's command; one it changed is its own and is only said.
@@ -15694,8 +15870,8 @@ var stringsOf$1 = (value) => e$5(value) ? Object.fromEntries(Object.entries(valu
 var planPackages = (text, answers, wrote = {}, local = /* @__PURE__ */ new Set()) => {
 	const parsed = JSON.parse(text);
 	const ours = JSON.parse(packageJson$1(answers));
-	const project = e$5(parsed) ? { ...parsed } : {};
-	const scaffold = e$5(ours) ? ours : {};
+	const project = e$6(parsed) ? { ...parsed } : {};
+	const scaffold = e$6(ours) ? ours : {};
 	const plan = {
 		added: [],
 		raised: [],
@@ -15858,6 +16034,30 @@ var machineryPlan = async (root, answers, { origin, recorded, take = [] }) => {
 		spaces: machinery.filter(([file]) => given.has(file)).map(([file]) => file)
 	};
 };
+/** Every file of a skill as it is in the project, by its path from the root. */
+var skillOnDisk = async (root, name) => {
+	const folder = path.join(".claude/skills", name);
+	const entries = await fs.readdir(path.join(root, folder), {
+		recursive: true,
+		withFileTypes: true
+	}).catch(() => []);
+	const found = {};
+	for (const entry of entries.filter((candidate) => candidate.isFile())) {
+		const file = path.relative(root, path.join(entry.parentPath, entry.name));
+		found[file] = await readText$1(path.join(root, file)) ?? "";
+	}
+	return found;
+};
+/**
+* Whether any file of a skill is not what the installed package has — one added, gone or changed. `SKILL.md` alone
+* missed a change made only in a reference, which a build of the same version makes.
+*/
+var skillFilesDiffer = async (root, name, files) => {
+	const prefix = `.claude/skills/${name}/`;
+	const wanted = Object.entries(files).filter(([file]) => file.startsWith(prefix));
+	const present = await skillOnDisk(root, name);
+	return wanted.length !== Object.keys(present).length || wanted.some(([file, text]) => present[file.split("/").join(path.sep)] !== text);
+};
 var planSkills = async (root) => {
 	const files = skillFiles(SKILL_NAMES, root);
 	const plans = [];
@@ -15866,7 +16066,7 @@ var planSkills = async (root) => {
 		if (!(skill in files)) continue;
 		const now = files[skill];
 		const was = await readText$1(path.join(root, skill));
-		if (was !== now) plans.push({
+		if (was !== now || await skillFilesDiffer(root, name, files)) plans.push({
 			name,
 			...was === void 0 ? {} : { was: skillVersion(was) ?? "unversioned" },
 			now: skillVersion(now) ?? "unversioned"
@@ -16022,7 +16222,7 @@ var upgrade = async (parts, options) => {
 			if (after !== void 0) {
 				installed = "needed";
 				if (write) {
-					await fs.writeFile(path.join(root, "package.json"), after);
+					await fs.writeFile(path.join(root, "package.json"), await (await projectFormatter(root))("package.json", after));
 					if (local.length > 0) installed = "skipped";
 					else if (options.install !== false && !options.json) installed = await install(manager, root) ? "done" : "failed";
 				}
@@ -16086,38 +16286,47 @@ export default defineRuntime({
   })
 });
 `;
-/** `start:dev` brought to restart on the runtime too — when it is the CLI's; one the project changed is said, not rewritten. */
-var planStartDev = async (root, answers) => {
-	const command = projectScripts({
+/** The scripts that restart the server on its own code: a runtime is one folder more each of them watches. */
+var WATCHING = ["start:dev", "start:dev-inspect"];
+/** The watching scripts brought to restart on the runtime too — those that are the CLI's; one the project changed is said. */
+var planWatching = async (root, answers) => {
+	const withRuntime = projectScripts({
 		...answers,
 		runtime: true
-	})["start:dev"];
-	const text = await fs.readFile(path.join(root, "package.json"), "utf-8");
-	const manifest = JSON.parse(text);
-	const scripts = e$5(manifest) && e$5(manifest.scripts) ? manifest.scripts : {};
-	const current = scripts["start:dev"];
-	if (current === command) return { command };
-	const recorded = (await readScaffoldRecord(root))?.scripts?.["start:dev"];
-	const theCli = current === projectScripts({
+	});
+	const without = projectScripts({
 		...answers,
 		runtime: false
-	})["start:dev"] || current === recorded;
-	if (typeof current === "string" && theCli) {
-		const next = {
-			...e$5(manifest) ? manifest : {},
-			scripts: {
-				...scripts,
-				"start:dev": command
-			}
-		};
-		return {
-			command,
-			script: `${JSON.stringify(next, null, 2)}\n`
-		};
+	});
+	const recorded = (await readScaffoldRecord(root))?.scripts ?? {};
+	const manifest = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf-8"));
+	const scripts = e$6(manifest) && e$6(manifest.scripts) ? manifest.scripts : {};
+	const changed = {};
+	const yours = [];
+	for (const name of WATCHING) {
+		const current = scripts[name];
+		if (typeof current !== "string" || current === withRuntime[name]) continue;
+		if (current === without[name] || current === recorded[name]) changed[name] = withRuntime[name];
+		else yours.push({
+			name,
+			command: current
+		});
 	}
+	if (Object.keys(changed).length === 0) return {
+		changed,
+		yours
+	};
+	const next = {
+		...e$6(manifest) ? manifest : {},
+		scripts: {
+			...scripts,
+			...changed
+		}
+	};
 	return {
-		command,
-		yours: typeof current === "string" ? current : ""
+		changed,
+		script: `${JSON.stringify(next, null, 2)}\n`,
+		yours
 	};
 };
 var addRuntime = async (options) => {
@@ -16138,25 +16347,25 @@ var addRuntime = async (options) => {
 	}
 	const answers = await answersFor(project.root, plitzi, project.packageManager ?? "npm", await readOrigin(project.root) !== void 0);
 	const module = await (await projectFormatter(project.root))(_$1, RUNTIME_MODULE);
-	const startDev = await planStartDev(project.root, answers);
+	const watching = await planWatching(project.root, answers);
 	if (options.dryRun) {
-		sayDryRun("plitzi runtime add", [...await filesWouldWrite(project.root, [_$1]), ...startDev.script ? ["~ package.json — start:dev restarts on src/runtime/ too"] : []]);
+		sayDryRun("plitzi runtime add", [...await filesWouldWrite(project.root, [_$1]), ...watching.script ? [`~ package.json — ${WATCHING.join(" and ")} restart on ${g$2}/ too`] : []]);
 		return;
 	}
 	await writeFiles(project.root, {
 		[_$1]: module,
-		...startDev.script ? { "package.json": startDev.script } : {}
+		...watching.script ? { "package.json": watching.script } : {}
 	});
-	if (startDev.script) {
+	if (watching.script) {
 		const recorded = (await readScaffoldRecord(project.root))?.scripts ?? {};
 		await writeScaffoldRecord(project.root, CLI_VERSION, { scripts: {
 			...recorded,
-			"start:dev": startDev.command
+			...watching.changed
 		} });
 	}
 	console.log(chalk.green(`\n${_$1} — the space's runtime`));
 	console.log("\nThe server runs it — `/hello` answers on this project — and `plitzi runtime push` sends it to the space: the same module, tried here before it goes.");
-	if (startDev.yours !== void 0) console.log(chalk.yellow(`\nstart:dev is yours ("${startDev.yours}"): add --watch-path=./${g$2} to it, for a save to the runtime to restart the server.`));
+	for (const { name, command } of watching.yours) console.log(chalk.yellow(`\n${name} is yours ("${command}"): add --watch-path=./${g$2} to it, for a save to the runtime to restart the server.`));
 	console.log("");
 };
 //#endregion
@@ -16179,9 +16388,9 @@ var WINDOW_MS = 6e5;
 var read = async (root, now) => {
 	try {
 		const parsed = JSON.parse(await fs.readFile(path.join(root, FILE), "utf-8"));
-		if (!e$5(parsed)) return {};
+		if (!e$6(parsed)) return {};
 		const kept = {};
-		for (const [key, entry] of Object.entries(parsed)) if (e$5(entry) && typeof entry.count === "number" && typeof entry.at === "number" && now - entry.at < WINDOW_MS) kept[key] = {
+		for (const [key, entry] of Object.entries(parsed)) if (e$6(entry) && typeof entry.count === "number" && typeof entry.at === "number" && now - entry.at < WINDOW_MS) kept[key] = {
 			count: entry.count,
 			at: entry.at
 		};
@@ -16206,7 +16415,7 @@ var noteRefused = async (root, command, now = Date.now()) => {
 var AGAIN = "This is the same command refused again: running it once more will not change the answer. Change what it names, edit the call by hand (`plitzi element where` shows it), or ask the person what they meant.";
 //#endregion
 //#region ../../packages/sdk-shared/dist/helpers/canonicalJson.mjs
-var t$1 = (t) => t === void 0 ? "undefined" : JSON.stringify(t, (t, n) => e$5(n) ? Object.fromEntries(Object.keys(n).toSorted().map((e) => [e, n[e]])) : n);
+var t$2 = (t) => t === void 0 ? "undefined" : JSON.stringify(t, (t, n) => e$6(n) ? Object.fromEntries(Object.keys(n).toSorted().map((e) => [e, n[e]])) : n);
 //#endregion
 //#region src/commands/projectSpace.ts
 /** What `projectSpaceAt` refuses with a message that is the whole report: the root, the layout, a module with no space. */
@@ -17256,9 +17465,9 @@ var readingOf = ({ elementId, type, rootId, classes, attributes, templates, boun
 });
 var isStrings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 /** What another process printed, read as the space when every entry is an element's reading. */
-var isReadings = (value) => Array.isArray(value) && value.every((entry) => e$5(entry) && typeof entry.elementId === "string" && typeof entry.type === "string" && typeof entry.rootId === "string" && isStrings(entry.classes) && e$5(entry.attributes) && isStrings(entry.templates) && isStrings(entry.bound) && isStrings(entry.children));
+var isReadings = (value) => Array.isArray(value) && value.every((entry) => e$6(entry) && typeof entry.elementId === "string" && typeof entry.type === "string" && typeof entry.rootId === "string" && isStrings(entry.classes) && e$6(entry.attributes) && isStrings(entry.templates) && isStrings(entry.bound) && isStrings(entry.children));
 var shown = (value) => {
-	const text = t$1(value);
+	const text = t$2(value);
 	return text.length > SHOWN ? `${text.slice(0, 59)}…` : text;
 };
 var FIELDS$1 = [
@@ -17302,7 +17511,7 @@ var spaceEffects = (before, after) => {
 			});
 			continue;
 		}
-		for (const field of FIELDS$1) if (t$1(old[field]) !== t$1(element[field])) effects.push({
+		for (const field of FIELDS$1) if (t$2(old[field]) !== t$2(element[field])) effects.push({
 			elementId,
 			kind: "field",
 			field,
@@ -17311,7 +17520,7 @@ var spaceEffects = (before, after) => {
 		for (const key of /* @__PURE__ */ new Set([...Object.keys(old.attributes), ...Object.keys(element.attributes)])) {
 			const from = old.attributes[key];
 			const to = element.attributes[key];
-			if (t$1(from) === t$1(to)) continue;
+			if (t$2(from) === t$2(to)) continue;
 			const line = from === void 0 ? `${elementId}.${key} = ${shown(to)}` : to === void 0 ? `${elementId}.${key} removed (was ${shown(from)})` : `${elementId}.${key}: ${shown(from)} → ${shown(to)}`;
 			effects.push({
 				elementId,
@@ -17361,7 +17570,7 @@ var surprises = (effects, after, asked) => {
 	const absent = [...asked].flatMap(([elementId, changes]) => {
 		const element = readings.get(elementId);
 		if (!element) return [`${elementId} is no longer in the space`];
-		return changes.filter((change) => change.value === void 0 ? change.key in element.attributes : t$1(element.attributes[change.key]) !== t$1(change.value)).map((change) => change.value === void 0 ? `${elementId}.${change.key} is still set` : `${elementId}.${change.key} reads ${shown(element.attributes[change.key])}, not ${shown(change.value)}`);
+		return changes.filter((change) => change.value === void 0 ? change.key in element.attributes : t$2(element.attributes[change.key]) !== t$2(change.value)).map((change) => change.value === void 0 ? `${elementId}.${change.key} is still set` : `${elementId}.${change.key} reads ${shown(element.attributes[change.key])}, not ${shown(change.value)}`);
 	});
 	const unasked = effects.filter((effect) => effect.key === void 0 || !asked.get(effect.elementId)?.some((change) => change.key === effect.key)).map((effect) => `it changed ${effect.line} too, which was not asked`);
 	return [...absent, ...unasked];
@@ -17376,18 +17585,18 @@ var reachedToo = (effects, after, asked, changes) => {
 	return effects.flatMap(({ elementId, key }) => {
 		const change = changes.find((candidate) => candidate.key === key && candidate.value !== void 0);
 		const reads = readings.get(elementId)?.attributes[key ?? ""];
-		if (key === void 0 || !change || asked.get(elementId)?.some((known) => known.key === key) || t$1(reads) !== t$1(change.value)) return [];
+		if (key === void 0 || !change || asked.get(elementId)?.some((known) => known.key === key) || t$2(reads) !== t$2(change.value)) return [];
 		return [{
 			elementId,
 			change
 		}];
 	});
 };
-var run$2 = promisify(execFile);
+var run$3 = promisify(execFile);
 /** The space as it authors now, read by a fresh process: this one loaded the files before they were edited. */
 var readAfresh = async () => {
 	try {
-		const { stdout } = await run$2(process.execPath, [
+		const { stdout } = await run$3(process.execPath, [
 			process.argv[1],
 			"element",
 			"readings"
@@ -17397,9 +17606,9 @@ var readAfresh = async () => {
 		});
 		const parsed = JSON.parse(stdout);
 		if (isReadings(parsed)) return parsed;
-		return { problem: e$5(parsed) && typeof parsed.problem === "string" ? parsed.problem : "it did not answer" };
+		return { problem: e$6(parsed) && typeof parsed.problem === "string" ? parsed.problem : "it did not answer" };
 	} catch (error) {
-		return { problem: (e$5(error) && typeof error.stdout === "string" ? error.stdout.trim() : "") || (error instanceof Error ? error.message.split("\n")[0] : String(error)) };
+		return { problem: (e$6(error) && typeof error.stdout === "string" ? error.stdout.trim() : "") || (error instanceof Error ? error.message.split("\n")[0] : String(error)) };
 	}
 };
 /**
@@ -17691,6 +17900,10 @@ var move$1 = async (elementId, options) => {
 	].join("\n"));
 };
 //#endregion
+//#region ../../packages/sdk-shared/dist/project/network.mjs
+var e$2 = (e) => Object.values(e).flat().flatMap((e) => e && e.family === "IPv4" && !e.internal ? [e.address] : []);
+var t$1 = (e) => `${(e.split(".").at(0) ?? "").toLowerCase()}.local`;
+//#endregion
 //#region src/commands/projectSettings.ts
 /**
 * What the project's processes start with: what its `.env` sets, under what the environment already has — as its
@@ -17704,6 +17917,106 @@ var projectSettings = async (root) => {
 		value: (name) => process.env[name] ?? parsed[name] ?? ""
 	};
 };
+/**
+* `.env`'s text with `name` set to `value`: its line replaced where it is — the commented one `.env.example` offers too,
+* `# HOST=0.0.0.0` — or added at the end. Every other line as it was, comments included.
+*/
+var withSetting = (text, name, value) => {
+	const line = `${name}=${value}`;
+	const pattern = new RegExp(`^(?:#\\s*)?${name}=.*$`, "m");
+	if (pattern.test(text)) return text.replace(pattern, line);
+	return `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${line}\n`;
+};
+//#endregion
+//#region src/commands/cert.ts
+var run$2 = promisify(execFile);
+var LOOPBACK$1 = [
+	"localhost",
+	"127.0.0.1",
+	"::1"
+];
+/**
+* What the certificate names: this machine (loopback), its network addresses — what a phone opens today — its mDNS
+* name, which outlives the addresses, and any the person adds.
+*/
+var certificateNames = (interfaces, machine, extra = []) => [.../* @__PURE__ */ new Set([
+	...LOOPBACK$1,
+	...e$2(interfaces),
+	t$1(machine),
+	...extra
+])];
+var INSTALL_MKCERT = {
+	darwin: "brew install mkcert",
+	linux: "apt install mkcert (or your distribution’s package; see https://github.com/FiloSottile/mkcert)",
+	win32: "choco install mkcert, or scoop install mkcert"
+};
+/** mkcert's authority folder, or `undefined` when mkcert is not installed. */
+var authorityFolder = async () => {
+	try {
+		const { stdout } = await run$2("mkcert", ["-CAROOT"]);
+		return stdout.trim();
+	} catch {
+		return;
+	}
+};
+/** `mkcert -install`, at the terminal: it may ask for the password that lets it trust its authority on this machine. */
+var trustHere = () => new Promise((resolve) => {
+	spawn("mkcert", ["-install"], { stdio: "inherit" }).on("error", () => resolve(false)).on("exit", (code) => resolve(code === 0));
+});
+var cert = async (options) => {
+	const project = await projectHere("to serve over HTTPS");
+	if (!project) return;
+	const { root } = project;
+	const authority = await authorityFolder();
+	if (authority === void 0) {
+		fail(`mkcert is not installed: it makes the certificate, and the authority your devices trust. Install it — ${INSTALL_MKCERT[process.platform] ?? "see https://github.com/FiloSottile/mkcert"} — and run plitzi cert again.`);
+		return;
+	}
+	const trusted = atTerminal() && !options.json ? await trustHere() : false;
+	const names = certificateNames(networkInterfaces(), hostname(), options.name);
+	await fs.mkdir(path.join(root, path.dirname(TLS_CERT_FILE)), { recursive: true });
+	try {
+		await run$2("mkcert", [
+			"-cert-file",
+			TLS_CERT_FILE,
+			"-key-file",
+			TLS_KEY_FILE,
+			...names
+		], { cwd: root });
+	} catch (error) {
+		fail(`mkcert could not make the certificate: ${error instanceof Error ? error.message : String(error)}`);
+		return;
+	}
+	const envFile = path.join(root, ".env");
+	const env = await fs.readFile(envFile, "utf-8").catch(() => "");
+	await fs.writeFile(envFile, withSetting(withSetting(env, "TLS_CERT", TLS_CERT_FILE), "TLS_KEY", TLS_KEY_FILE));
+	const rootCa = path.join(authority, "rootCA.pem");
+	const settings = await projectSettings(root);
+	const open = settings.value("HOST") !== "" && !LOOPBACK$1.includes(settings.value("HOST"));
+	const port = settings.value("PORT") || (project.plitzi?.kind === "project" && project.plitzi.mode === "client" ? "5173" : "8080");
+	const urls = names.filter((name) => !LOOPBACK$1.includes(name)).map((name) => `https://${name}:${port}/`);
+	if (options.json) {
+		console.log(JSON.stringify({
+			cert: TLS_CERT_FILE,
+			key: TLS_KEY_FILE,
+			names,
+			authority: existsSync(rootCa) ? rootCa : null,
+			open,
+			urls
+		}, null, 2));
+		return;
+	}
+	console.log(`${chalk.green("✓")} ${TLS_CERT_FILE} for ${names.join(", ")} — .env serves it (TLS_CERT, TLS_KEY).`);
+	if (!trusted) console.log(`  This machine’s browsers trust it once mkcert’s authority is installed here: run ${chalk.bold("mkcert -install")} at a terminal (it may ask for your password).`);
+	console.log("");
+	if (!open) console.log(`Open it to your network: ${chalk.bold("HOST=0.0.0.0")} in .env — anyone on that network can then reach it.`);
+	console.log(`Start it, and on the phone open ${urls.map((url) => chalk.bold(url)).join(" or ")}`);
+	console.log("");
+	console.log(`The phone has to trust the authority that signed it: ${chalk.bold(rootCa)} — that file only, never rootCA-key.pem beside it, which signs for anything.`);
+	console.log("  iPhone, iPad: AirDrop or mail it, install the profile (Settings › General › VPN & Device Management), then turn on full trust in Settings › General › About › Certificate Trust Settings.");
+	console.log("  Android: Settings › Security › Encryption & credentials › Install a certificate › CA certificate.");
+	console.log(`A certificate names the addresses it was made for: when the router gives this machine another, run plitzi cert again — or open ${t$1(hostname())}, which stays.`);
+};
 //#endregion
 //#region src/commands/check.ts
 /** The account `verify` signs in as for the pages that send a visitor to sign in: the project's, in `.env`. */
@@ -17971,8 +18284,8 @@ var momentChanges = (before, after, state) => {
 	const appeared = after.shown.filter((id) => !before.shown.includes(id));
 	const gone = before.shown.filter((id) => !after.shown.includes(id));
 	const listed = (ids) => ids.length > 6 ? `${ids.slice(0, 6).join(", ")} and ${String(ids.length - 6)} more` : ids.join(", ");
-	const stateBefore = e$5(state.before) ? state.before : {};
-	const stateAfter = e$5(state.after) ? state.after : {};
+	const stateBefore = e$6(state.before) ? state.before : {};
+	const stateAfter = e$6(state.after) ? state.after : {};
 	const said = (value) => value === void 0 ? "unset" : JSON.stringify(value);
 	const stateChanges = [.../* @__PURE__ */ new Set([...Object.keys(stateBefore), ...Object.keys(stateAfter)])].flatMap((key) => said(stateBefore[key]) === said(stateAfter[key]) ? [] : [`state.${key}: ${said(stateBefore[key])} → ${said(stateAfter[key])}`]);
 	return [
@@ -18300,7 +18613,7 @@ var heldText = (report, asked) => {
 /** A value's shape in a few words: a list's length, an object's keys, a short value as it is. */
 var shapeOf = (value) => {
 	if (Array.isArray(value)) return `a list of ${String(value.length)}`;
-	if (e$5(value)) {
+	if (e$6(value)) {
 		const keys = Object.keys(value);
 		return `{ ${keys.slice(0, 8).join(", ")}${keys.length > 8 ? ", …" : ""} }`;
 	}
@@ -18454,7 +18767,7 @@ var readFunctionsFiles = (root) => s$2(path.join(root, h$1), {
 var readFunctionsState = async (root) => {
 	try {
 		const value = JSON.parse(await fs.readFile(path.join(root, FUNCTIONS_STATE_FILE), "utf8"));
-		if (!e$5(value) || typeof value.space !== "number" || typeof value.version !== "string" || !e$5(value.files)) return;
+		if (!e$6(value) || typeof value.space !== "number" || typeof value.version !== "string" || !e$6(value.files)) return;
 		const files = Object.fromEntries(Object.entries(value.files).flatMap(([name, text]) => typeof text === "string" ? [[name, text]] : []));
 		return {
 			space: value.space,
@@ -18619,7 +18932,7 @@ var printRun = (task, report) => {
 var paramsOf = (given) => {
 	try {
 		const params = given ? JSON.parse(given) : {};
-		if (e$5(params)) return params;
+		if (e$6(params)) return params;
 	} catch {}
 	fail("--params is a JSON object of the task’s params, by name: --params '{\"name\":\"Ada\"}'");
 };
@@ -18647,7 +18960,7 @@ var tryFunction = async (task, options) => {
 	}
 	printRun(task, reply.data);
 };
-var isLocalRunner = (value) => e$5(value) && typeof value.createLocalFunctions === "function";
+var isLocalRunner = (value) => e$6(value) && typeof value.createLocalFunctions === "function";
 /**
 * This project's own runner: `dev` runs the functions with the `@plitzi/sdk-server` the project installed, so the build,
 * the checks, the isolates and the limits are the platform's own, at the version the project is on.
@@ -18722,7 +19035,7 @@ var devFunction = async (task, options) => {
 * to change it — and the files of it the project serves itself, fetched once.
 */
 /** What the platform answered is an export: of the format this CLI writes, with every part it reads. */
-var isExport = (value) => e$5(value) && value.format === 1 && e$5(value.space) && e$5(value.version) && e$5(value.source) && e$5(value.builtOnly) && e$5(value.report) && e$5(value.functions) && e$5(value.data) && Array.isArray(value.actions) && Array.isArray(value.assets) && Array.isArray(value.visitorRoles);
+var isExport = (value) => e$6(value) && value.format === 1 && e$6(value.space) && e$6(value.version) && e$6(value.source) && e$6(value.builtOnly) && e$6(value.report) && e$6(value.functions) && e$6(value.data) && Array.isArray(value.actions) && Array.isArray(value.assets) && Array.isArray(value.visitorRoles);
 /** How a version is said: `the draft`, `production (latest)`, `production r3`. */
 var versionLabel = ({ environment, revision }) => {
 	if (environment === "main") return "the draft";
@@ -18745,7 +19058,7 @@ var requestExport = async (connection, from, { source, version, name = from }) =
 		ok: true,
 		value: data
 	};
-	const said = e$5(data) && typeof data.error === "string" ? data.error : void 0;
+	const said = e$6(data) && typeof data.error === "string" ? data.error : void 0;
 	return {
 		ok: false,
 		error: {
@@ -19246,8 +19559,8 @@ var merge = (shape, value) => {
 		for (const item of value) merge(shape.array.item, item);
 		return;
 	}
-	const keys = e$5(value) ? Object.keys(value) : [];
-	if (e$5(value) && keys.length >= 2 && keys.every((key) => !KEY.test(key))) {
+	const keys = e$6(value) ? Object.keys(value) : [];
+	if (e$6(value) && keys.length >= 2 && keys.every((key) => !KEY.test(key))) {
 		shape.map ??= {
 			keys: [],
 			value: emptyShape()
@@ -19256,7 +19569,7 @@ var merge = (shape, value) => {
 		for (const field of Object.values(value)) merge(shape.map.value, field);
 		return;
 	}
-	if (e$5(value)) {
+	if (e$6(value)) {
 		shape.object ??= {
 			count: 0,
 			fields: /* @__PURE__ */ new Map()
@@ -19320,14 +19633,14 @@ var rowsOf = (value) => {
 	const candidates = [];
 	const visit = (node, at) => {
 		if (Array.isArray(node)) {
-			if (node.some(e$5)) candidates.push({
+			if (node.some(e$6)) candidates.push({
 				path: at,
 				rows: node
 			});
 			node.forEach((item, index) => visit(item, `${at}[${String(index)}]`));
 			return;
 		}
-		if (e$5(node)) for (const [key, field] of Object.entries(node)) visit(field, at ? `${at}.${key}` : key);
+		if (e$6(node)) for (const [key, field] of Object.entries(node)) visit(field, at ? `${at}.${key}` : key);
 	};
 	visit(value, "");
 	return candidates.sort((a, b) => b.rows.length - a.rows.length)[0];
@@ -19336,14 +19649,14 @@ var rowsOf = (value) => {
 var shorten = (value) => {
 	if (typeof value === "string") return value.length > 80 ? `${value.slice(0, 77)}…` : value;
 	if (Array.isArray(value)) return value.length > 3 ? [...value.slice(0, 3).map(shorten), `… ${String(value.length - 3)} more`] : value.map(shorten);
-	if (e$5(value)) return Object.fromEntries(Object.entries(value).map(([key, field]) => [key, shorten(field)]));
+	if (e$6(value)) return Object.fromEntries(Object.entries(value).map(([key, field]) => [key, shorten(field)]));
 	return value;
 };
 var describeData = (value) => {
 	const shape = emptyShape();
 	merge(shape, value);
 	const rows = rowsOf(value);
-	const first = rows?.rows.find(e$5);
+	const first = rows?.rows.find(e$6);
 	return {
 		shape: render(shape, 0),
 		...rows && first ? { example: {
@@ -19357,7 +19670,7 @@ var dataDescribe = async (file, options) => {
 	try {
 		value = JSON.parse(await fs.readFile(file, "utf-8"));
 	} catch (error) {
-		const missing = e$5(error) && error.code === "ENOENT";
+		const missing = e$6(error) && error.code === "ENOENT";
 		const beside = missing ? await fs.readdir(path.dirname(file)).then((names) => names.filter((name) => name.endsWith(".json")), () => []) : [];
 		const nearest = closest(path.basename(file), beside);
 		fail(missing ? `${file} does not exist${nearest ? ` — did you mean ${path.join(path.dirname(file), nearest)}?` : beside.length > 0 ? `: the JSON there is ${beside.join(", ")}` : "."}` : `${file} is not a JSON file this can read: ${error instanceof Error ? error.message : String(error)}`);
@@ -19861,7 +20174,7 @@ var V = (e) => {
 	for (let n of e.filter((e) => x$1.test(e))) t.set(M(n), [...t.get(M(n)) ?? [], n]);
 	return [...t].flatMap(([e, t]) => t.slice(1).map((n) => y("plugin-type-taken", `${o$5}/${n}/`, `${o$5}/${t[0]}/ and ${o$5}/${n}/ are both the plugin ${e}: the server registers a folder by its name with a small first letter, and keeps one.`, `Put them in one folder, or rename one: git mv ${o$5}/${n} ${o$5}/<AnotherName>`)));
 };
-var H = (t) => e$5(t.assets) ? Object.values(t.assets).flatMap((t) => e$5(t) && typeof t.src == "string" && typeof t.type == "string" ? [{
+var H = (t) => e$6(t.assets) ? Object.values(t.assets).flatMap((t) => e$6(t) && typeof t.src == "string" && typeof t.type == "string" ? [{
 	src: t.src,
 	type: t.type,
 	isMain: t.isMain === !0
@@ -19875,7 +20188,7 @@ var U = (t, n) => {
 	} catch (e) {
 		return { problem: y("vendor-manifest-invalid", i, `${i} is not JSON (${e instanceof Error ? e.message : String(e)}), so ${n} does not run.`, a) };
 	}
-	if (!e$5(o)) return { problem: y("vendor-manifest-invalid", i, `${i} is not a manifest, so ${n} does not run.`, a) };
+	if (!e$6(o)) return { problem: y("vendor-manifest-invalid", i, `${i} is not a manifest, so ${n} does not run.`, a) };
 	let s = H(o), l = s.find((e) => e.type === "script" && e.isMain) ?? s.find((e) => e.type === "script");
 	if (!l) return { problem: y("vendor-script-missing", i, `${i} names no script to run, so ${n} does not run.`, a) };
 	if (!C(t, path.posix.join(r, l.src), "file")) return { problem: y("vendor-script-missing", i, `${i} names ${l.src} as the script to run, and ${r}/${l.src} is not there, so ${n} does not run.`, a) };
@@ -19999,7 +20312,7 @@ var ce = (e, t) => {
 var Z = (t) => {
 	try {
 		let n = JSON.parse(readFileSync(path.join(t, "package.json"), "utf-8"));
-		return e$5(n) && [n.dependencies, n.devDependencies].some((t) => e$5(t) && "@plitzi/sdk-server" in t);
+		return e$6(n) && [n.dependencies, n.devDependencies].some((t) => e$6(t) && "@plitzi/sdk-server" in t);
 	} catch {
 		return !1;
 	}
@@ -20054,7 +20367,7 @@ var declarationsFile = (root) => {
 		const manifest = path.join(dir, "node_modules", PACKAGE, "package.json");
 		if (existsSync(manifest)) {
 			const parsed = JSON.parse(readFileSync(manifest, "utf-8"));
-			const types = e$5(parsed) && typeof parsed.types === "string" ? parsed.types : "dist/index.d.ts";
+			const types = e$6(parsed) && typeof parsed.types === "string" ? parsed.types : "dist/index.d.ts";
 			return path.join(path.dirname(manifest), types);
 		}
 		if (path.dirname(dir) === dir) return;
@@ -20353,9 +20666,9 @@ var editSources = async (root, fixes) => {
 /** A plan as `plitzi space fix --json` prints it. */
 var planFromJson = (stdout) => {
 	const parsed = JSON.parse(stdout);
-	if (!e$5(parsed)) return { problem: "the space did not answer as a plan" };
+	if (!e$6(parsed)) return { problem: "the space did not answer as a plan" };
 	if (typeof parsed.problem === "string") return { problem: parsed.problem };
-	const entries = (value) => Array.isArray(value) ? value.filter(e$5) : [];
+	const entries = (value) => Array.isArray(value) ? value.filter(e$6) : [];
 	const elementOf = (entry) => typeof entry.elementId === "string" ? entry.elementId : null;
 	return {
 		fixes: entries(parsed.fixes).map((entry) => ({
@@ -20384,7 +20697,7 @@ var planAfresh = async () => {
 		});
 		return planFromJson(stdout);
 	} catch (error) {
-		const printed = e$5(error) && typeof error.stdout === "string" ? error.stdout.trim() : "";
+		const printed = e$6(error) && typeof error.stdout === "string" ? error.stdout.trim() : "";
 		if (printed.startsWith("{")) return planFromJson(printed);
 		return { problem: error instanceof Error ? error.message.split("\n").slice(0, 3).join(" ") : String(error) };
 	}
@@ -20468,7 +20781,7 @@ var vendorFileOf = (name) => `${name.replace(/^@/, "").replace("/", "__")}.js`;
 var manifestOf$1 = async (entry, name) => {
 	for (let dir = path.dirname(entry); dir !== path.dirname(dir); dir = path.dirname(dir)) try {
 		const parsed = JSON.parse(await fs.readFile(path.join(dir, "package.json"), "utf8"));
-		if (e$5(parsed) && parsed.name === name) return {
+		if (e$6(parsed) && parsed.name === name) return {
 			version: typeof parsed.version === "string" ? parsed.version : "?",
 			license: typeof parsed.license === "string" ? parsed.license : "no licence stated"
 		};
@@ -20507,7 +20820,7 @@ var bundle = async (root, name, withDefault) => {
 			exports
 		};
 	} catch (error) {
-		return { errors: e$5(error) && Array.isArray(error.errors) ? error.errors.flatMap((entry) => e$5(entry) && typeof entry.text === "string" ? [{ text: entry.text }] : []) : [{ text: error instanceof Error ? error.message : String(error) }] };
+		return { errors: e$6(error) && Array.isArray(error.errors) ? error.errors.flatMap((entry) => e$6(entry) && typeof entry.text === "string" ? [{ text: entry.text }] : []) : [{ text: error instanceof Error ? error.message : String(error) }] };
 	}
 };
 /** Why esbuild could not bundle it, in the words that say what to do: a Node module is a package that cannot run here. */
@@ -20605,8 +20918,8 @@ var siteOwnership = async (url, options) => {
 		problem: answered.error
 	};
 	const { status, data } = answered.value.reply;
-	const space = e$5(data) && e$5(data.space) && typeof data.space.name === "string" ? data.space.name : "";
-	if (status === 200 && e$5(data) && typeof data.domain === "string") return {
+	const space = e$6(data) && e$6(data.space) && typeof data.space.name === "string" ? data.space.name : "";
+	if (status === 200 && e$6(data) && typeof data.domain === "string") return {
 		ok: true,
 		said: `${data.domain}, verified for ${space || "one of your spaces"}`
 	};
@@ -20818,10 +21131,10 @@ var s$1 = (e) => a.find(({ pattern: t }) => t.test(e))?.what;
 var c$1 = (e) => typeof e == "string" && r.some((t) => t === e);
 var l$1 = (e) => typeof e == "string" && /^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(e);
 var u = (e) => Array.isArray(e) && e.length > 0 && e.every((e) => typeof e == "string");
-var d = (t) => e$5(t) && Object.values(t).every((e) => typeof e == "string");
+var d = (t) => e$6(t) && Object.values(t).every((e) => typeof e == "string");
 var f = (e) => Math.floor(e.length * 3 / 4) - (e.endsWith("==") ? 2 : +!!e.endsWith("="));
 var p = (t, i) => {
-	if (!e$5(t) || t.format !== 1) return {
+	if (!e$6(t) || t.format !== 1) return {
 		ok: !1,
 		problems: ["Not a source snapshot of format 1"]
 	};
@@ -21039,17 +21352,17 @@ var PackError = class extends Error {};
 /** The declaration, or what is missing from it — named, so the fix is one edit away. */
 var checkDeclaration = (value, where) => {
 	const missing = (field) => new PackError(`${where}: the declaration has no ${field}. Write it the way \`plitzi plugin add\` does.`);
-	if (!e$5(value) || typeof value.type !== "string" || !value.type) throw missing("`type`");
+	if (!e$6(value) || typeof value.type !== "string" || !value.type) throw missing("`type`");
 	const { content } = value;
-	if (!e$5(content)) throw missing("`content`");
+	if (!e$6(content)) throw missing("`content`");
 	for (const field of [
 		"attributes",
 		"definition",
 		"builder",
 		"market",
 		"defaultStyle"
-	]) if (!e$5(content[field])) throw missing(`\`content.${field}\``);
-	if (!e$5(content.definition) || typeof content.definition.label !== "string") throw missing("`content.definition.label`");
+	]) if (!e$6(content[field])) throw missing(`\`content.${field}\``);
+	if (!e$6(content.definition) || typeof content.definition.label !== "string") throw missing("`content.definition.label`");
 	return value;
 };
 var toImportPath = (file) => file.split(path.sep).join("/");
@@ -21460,7 +21773,7 @@ var verdictOf = ({ given, was, here }) => {
 * one still at the range the space last asked for follows the space, and one the project changed stays as it is.
 */
 var mergeDependencies = (manifest, asked, before) => {
-	const current = e$5(manifest.dependencies) ? manifest.dependencies : {};
+	const current = e$6(manifest.dependencies) ? manifest.dependencies : {};
 	const dependencies = { ...current };
 	const changed = [];
 	const kept = [];
@@ -21545,7 +21858,7 @@ var pull = async (options) => {
 	if (options.dryRun) {
 		const packageText = await fs.readFile(path.join(root, "package.json"), "utf-8");
 		const manifest = JSON.parse(packageText);
-		const { changed } = mergeDependencies(e$5(manifest) ? manifest : {}, next.dependencies, origin.dependencies);
+		const { changed } = mergeDependencies(e$6(manifest) ? manifest : {}, next.dependencies, origin.dependencies);
 		sayDryRun(`plitzi space pull — ${origin.space.name}, ${versionLabel(asked.version)}`, [
 			...await filesWouldWrite(root, of("write")),
 			...of("remove").map((file) => `- ${file}`),
@@ -21569,7 +21882,7 @@ var pull = async (options) => {
 	await Promise.all(removed.map((file) => fs.rm(path.join(root, file), { force: true })));
 	const packageFile = path.join(root, "package.json");
 	const manifest = JSON.parse(await fs.readFile(packageFile, "utf-8"));
-	const dependencies = mergeDependencies(e$5(manifest) ? manifest : {}, next.dependencies, origin.dependencies);
+	const dependencies = mergeDependencies(e$6(manifest) ? manifest : {}, next.dependencies, origin.dependencies);
 	if (dependencies.changed.length > 0) await fs.writeFile(packageFile, `${JSON.stringify(dependencies.manifest, null, 2)}\n`);
 	const dataKept = of("keep").some((file) => file.startsWith(`${m}/`));
 	const files = Object.fromEntries([...[...given].map(([file, bytes]) => [file, digest(bytes)]), ...[...untouched].flatMap((file) => origin.files[file] ? [[file, origin.files[file]]] : [])]);
@@ -21855,9 +22168,9 @@ var projectActions = async (root) => {
 		return;
 	}
 	const loaded = await import(pathToFileURL(file).href);
-	const listed = e$5(loaded) ? loaded.actions : void 0;
+	const listed = e$6(loaded) ? loaded.actions : void 0;
 	if (!Array.isArray(listed)) return { problem: `${ACTIONS_ENTRY} exports no \`actions\` list: it is where the project’s actions are.` };
-	return listed.flatMap((entry) => e$5(entry) && typeof entry.id === "string" && e$5(entry.document) ? [{
+	return listed.flatMap((entry) => e$6(entry) && typeof entry.id === "string" && e$6(entry.document) ? [{
 		identifier: entry.id,
 		name: typeof entry.document.name === "string" ? entry.document.name : entry.id,
 		document: entry.document
@@ -21870,8 +22183,8 @@ var projectActions = async (root) => {
 var projectConnectors = async (root) => {
 	const read = await readJsonFolder(path.join(root, "src/connectors"));
 	if (!read || read.length === 0) return;
-	const broken = read.find(({ value }) => !e$5(value) || typeof value.id !== "string" || !e$5(value.manifest));
-	return broken ? { problem: `src/connectors/${broken.file} is not a connector: { "id", "name", "manifest" }.` } : read.flatMap(({ value }) => e$5(value) && typeof value.id === "string" && e$5(value.manifest) ? [{
+	const broken = read.find(({ value }) => !e$6(value) || typeof value.id !== "string" || !e$6(value.manifest));
+	return broken ? { problem: `src/connectors/${broken.file} is not a connector: { "id", "name", "manifest" }.` } : read.flatMap(({ value }) => e$6(value) && typeof value.id === "string" && e$6(value.manifest) ? [{
 		identifier: value.id,
 		name: typeof value.name === "string" ? value.name : value.id,
 		manifest: value.manifest
@@ -21996,7 +22309,7 @@ var keepSource = async (connection, spaceId, bytes) => {
 };
 //#endregion
 //#region src/commands/runtime.ts
-var isPacker = (value) => e$5(value) && typeof value.packRuntime === "function";
+var isPacker = (value) => e$6(value) && typeof value.packRuntime === "function";
 /** This project's own packer — read, since it is the project's. */
 var projectPacker = async (root) => {
 	try {
@@ -23615,6 +23928,10 @@ var stepsOf = (scripts) => [
 		name: "lint",
 		command: scripts.lint
 	}] : [],
+	...scripts.test ? [{
+		name: "test",
+		command: scripts.test
+	}] : [],
 	...Object.hasOwn(scripts, "format") && scripts.format.startsWith("prettier") ? [{
 		name: "format",
 		command: "prettier --check .",
@@ -23649,7 +23966,7 @@ var run = (root, command) => new Promise((resolve) => {
 var tail = (output) => output.split("\n").map((line) => line.trimEnd()).filter((line) => line.trim() !== "").slice(-15);
 var scriptsOf = async (root) => {
 	const parsed = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf-8"));
-	const scripts = e$5(parsed) && e$5(parsed.scripts) ? parsed.scripts : {};
+	const scripts = e$6(parsed) && e$6(parsed.scripts) ? parsed.scripts : {};
 	return Object.fromEntries(Object.entries(scripts).filter((entry) => typeof entry[1] === "string"));
 };
 /** A page the browser was sent away from — one for signed-in visitors, sent to sign in. */
@@ -23774,17 +24091,24 @@ var projectModule = async (root, specifier) => {
 * file of the project's, installs, or touches git is recommended instead.
 */
 var readText = (file) => fs.readFile(file, "utf-8").catch(() => void 0);
+/**
+* A file of the project's written as its own Prettier writes it: a repair that left the next `format --check` — the one
+* `verify` runs — something to say would trade one problem for another.
+*/
+var writeFormatted = async (root, file, text) => {
+	const format = await projectFormatter(root);
+	await fs.writeFile(path.join(root, file), await format(file, text));
+};
 /** `package.json` changed by `edit`, written with the indentation it has — so the diff is the lines that changed. */
 var editManifest = (root, says, edit) => ({
 	says,
 	run: async () => {
-		const file = path.join(root, "package.json");
-		const text = await readText(file) ?? "{}";
+		const text = await readText(path.join(root, "package.json")) ?? "{}";
 		const parsed = JSON.parse(text);
-		if (!e$5(parsed)) throw new Error("package.json is not an object");
+		if (!e$6(parsed)) throw new Error("package.json is not an object");
 		edit(parsed);
 		const indent = /^\{\n([ \t]+)"/.exec(text)?.[1] ?? "  ";
-		await fs.writeFile(file, `${JSON.stringify(parsed, null, indent)}\n`);
+		await writeFormatted(root, "package.json", `${JSON.stringify(parsed, null, indent)}\n`);
 	}
 });
 /** Lines added to the end of `.gitignore`, one each. */
@@ -23818,10 +24142,7 @@ var freshSecret = (root, name) => ({
 	says: `writes a new ${name} to .env`,
 	run: async () => {
 		const file = path.join(root, ".env");
-		const text = await readText(file) ?? "";
-		const line = `${name}=${randomBytes(32).toString("hex")}`;
-		const pattern = new RegExp(`^${name}=.*$`, "m");
-		await fs.writeFile(file, pattern.test(text) ? text.replace(pattern, line) : `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${line}\n`);
+		await fs.writeFile(file, withSetting(await readText(file) ?? "", name, randomBytes(32).toString("hex")));
 	}
 });
 /**
@@ -23836,14 +24157,14 @@ var editTsConfig = async (root, file, says, edit) => {
 	} catch {
 		return;
 	}
-	if (!e$5(parsed)) return;
+	if (!e$6(parsed)) return;
 	const config = parsed;
 	return {
 		says,
 		run: async () => {
 			edit(config);
 			const indent = /^\{\n([ \t]+)"/.exec(text ?? "")?.[1] ?? "  ";
-			await fs.writeFile(path.join(root, file), `${JSON.stringify(config, null, indent)}\n`);
+			await writeFormatted(root, file, `${JSON.stringify(config, null, indent)}\n`);
 		}
 	};
 };
@@ -23930,11 +24251,11 @@ var readTsConfig = async (root, file) => {
 	} catch (error) {
 		return { problem: error instanceof Error ? error.message : String(error) };
 	}
-	if (!e$5(parsed)) return { problem: "it is not an object" };
+	if (!e$6(parsed)) return { problem: "it is not an object" };
 	return {
 		...typeof parsed.extends === "string" ? { extends: parsed.extends } : {},
 		include: Array.isArray(parsed.include) ? parsed.include.filter((entry) => typeof entry === "string") : [],
-		options: e$5(parsed.compilerOptions) ? parsed.compilerOptions : {}
+		options: e$6(parsed.compilerOptions) ? parsed.compilerOptions : {}
 	};
 };
 /** A repair that may be none, spread into a finding's details. */
@@ -23960,9 +24281,32 @@ var NODE_OPTIONS = [
 		why: "an `enum` or a parameter property passes the typecheck and fails at start"
 	}
 ];
+/** The options `TSCONFIG_BASE` sets, as the CLI writes it for this project. */
+var baseOptions = (answers) => {
+	const base = JSON.parse(tsconfigBase(answers));
+	return e$6(base) && e$6(base.compilerOptions) ? base.compilerOptions : {};
+};
+/**
+* A `tsconfig.json` from before the CLI kept its options apart, made to extend them: what it sets the same as the base
+* goes, and only what is the project's own is left in it.
+*/
+var extendBase = (root, answers) => editTsConfig(root, "tsconfig.json", `makes tsconfig.json extend ${TSCONFIG_BASE}, keeping the options it changes`, (json) => {
+	const base = baseOptions(answers);
+	const own = e$6(json.compilerOptions) ? Object.entries(json.compilerOptions).filter(([key, value]) => JSON.stringify(value) !== JSON.stringify(base[key])) : [];
+	json.extends = `./${TSCONFIG_BASE}`;
+	if (own.length > 0) json.compilerOptions = Object.fromEntries(own);
+	else Reflect.deleteProperty(json, "compilerOptions");
+});
 var tsconfigChecks = async ({ root, answers }) => {
 	const config = await readTsConfig(root, "tsconfig.json");
-	if (!config) return [];
+	if (!config) return [say$8.error("tsconfig-missing", "There is no tsconfig.json: nothing type-checks the project, and the lint reads none of it.", {
+		file: "tsconfig.json",
+		fix: `Write one that extends ./${TSCONFIG_BASE} and includes the project's folders.`,
+		repair: {
+			says: "writes tsconfig.json",
+			run: () => writeFormatted(root, "tsconfig.json", tsconfig$1(answers))
+		}
+	})];
 	if ("problem" in config) return [say$8.error("tsconfig-unreadable", `tsconfig.json cannot be read: ${config.problem}.`, {
 		file: "tsconfig.json",
 		fix: "plitzi upgrade files shows the CLI’s"
@@ -23983,6 +24327,11 @@ var tsconfigChecks = async ({ root, answers }) => {
 		fix: `Add "${n$7}" to "include".`,
 		...await repairOf$1(included(n$7))
 	}));
+	if (!config.extends) findings.push(say$8.warning("tsconfig-stands-alone", `tsconfig.json does not extend ./${TSCONFIG_BASE}: the compiler options the CLI keeps up never reach it.`, {
+		file: "tsconfig.json",
+		fix: `Set "extends": "./${TSCONFIG_BASE}" and keep in "compilerOptions" only what is the project's own.`,
+		...await repairOf$1(extendBase(root, answers))
+	}));
 	if (!config.extends) {
 		for (const { option, why } of NODE_OPTIONS) if (config.options[option] !== true) findings.push(say$8.warning("tsconfig-node-option", `tsconfig.json does not set ${option}: ${why}.`, {
 			file: "tsconfig.json",
@@ -24000,7 +24349,7 @@ var buildChecks = async (root) => {
 		fix: "plitzi upgrade files shows the CLI’s"
 	})];
 	const manifest = JSON.parse(await readOptional(path.join(root, "package.json")) ?? "{}");
-	const scripts = e$5(manifest) && e$5(manifest.scripts) ? manifest.scripts : {};
+	const scripts = e$6(manifest) && e$6(manifest.scripts) ? manifest.scripts : {};
 	const startProd = typeof scripts["start:prod"] === "string" ? scripts["start:prod"] : "";
 	const builds = typeof scripts.build === "string" && scripts.build.includes("tsconfig.build.json");
 	const runs = /node\s+(?:--\S+\s+)*(\S+\.js)\b/.exec(startProd)?.[1];
@@ -24086,7 +24435,7 @@ var gitChecks = async ({ root, answers }) => {
 /** The minimum the project's own server holds a signing secret to — or nothing, when it cannot be asked. */
 var minimumSecret = async (root) => {
 	const actions = await projectModule(root, "@plitzi/sdk-server/actions").catch(() => void 0);
-	const minimum = e$5(actions) ? actions.MIN_SIGNING_SECRET_LENGTH : void 0;
+	const minimum = e$6(actions) ? actions.MIN_SIGNING_SECRET_LENGTH : void 0;
 	return typeof minimum === "number" ? minimum : void 0;
 };
 var envChecks = async ({ root, answers }) => {
@@ -24127,8 +24476,21 @@ var envChecks = async ({ root, answers }) => {
 	}));
 	return findings;
 };
+/** The project's notes, which `CLAUDE.md` imports and `AGENTS.md` sends every agent to: one a project from before them lacks. */
+var notesChecks = async ({ root, answers }) => {
+	if (await readOptional(path.join(root, "NOTES.md")) !== void 0) return [];
+	return [say$8.warning("notes-missing", `There is no ${PROJECT_NOTES}: the agents are sent to it for what this project has to know, and find nothing.`, {
+		file: PROJECT_NOTES,
+		fix: `Write ${PROJECT_NOTES}: how the project is built, what must not be undone.`,
+		repair: {
+			says: `writes ${PROJECT_NOTES}`,
+			run: () => writeFormatted(root, PROJECT_NOTES, projectNotes(answers))
+		}
+	})];
+};
 var checkConfig = async (context) => [
 	...await tsconfigChecks(context),
+	...await notesChecks(context),
 	...await gitignoreChecks(context),
 	...await gitChecks(context),
 	...await envChecks(context)
@@ -24159,11 +24521,11 @@ var checkData = async ({ root, answers }) => [...answers.mode === "server" ? awa
 * definition, imports of its own files and the contract alone, and the most a bundle may weigh.
 */
 var say$6 = sayer("functions");
-var isProblem = (value) => e$5(value) && typeof value.message === "string";
+var isProblem = (value) => e$6(value) && typeof value.message === "string";
 /** `buildFunctions` of the project's own sdk-server — or nothing, when it has none that offers it. */
 var projectBuild = async (root) => {
 	const runner = await projectModule(root, "@plitzi/sdk-server/functions-runner").catch(() => void 0);
-	const build = e$5(runner) ? runner.buildFunctions : void 0;
+	const build = e$6(runner) ? runner.buildFunctions : void 0;
 	return typeof build === "function" ? build : void 0;
 };
 var checkFunctions = async ({ root, answers }) => {
@@ -24182,7 +24544,7 @@ var checkFunctions = async ({ root, answers }) => {
 		await build(files);
 		return [];
 	} catch (error) {
-		const problems = e$5(error) && Array.isArray(error.problems) ? error.problems.filter(isProblem) : [];
+		const problems = e$6(error) && Array.isArray(error.problems) ? error.problems.filter(isProblem) : [];
 		if (problems.length === 0) return [say$6.error("functions-do-not-build", error instanceof Error ? error.message : String(error), { file: h$1 })];
 		return problems.map((problem) => say$6.error("functions-do-not-build", problem.message, { file: problem.file ? `${h$1}/${problem.file}${problem.line ? `:${String(problem.line)}` : ""}` : h$1 }));
 	}
@@ -24290,7 +24652,7 @@ var moveFiles = async (root, moves) => {
 	const manifestFile = path.join(root, "package.json");
 	const manifestText = await fs.readFile(manifestFile, "utf-8");
 	const manifest = JSON.parse(manifestText);
-	if (e$5(manifest) && e$5(manifest.scripts)) {
+	if (e$6(manifest) && e$6(manifest.scripts)) {
 		const scripts = Object.fromEntries(Object.entries(manifest.scripts).map(([name, command]) => {
 			if (typeof command !== "string") return [name, command];
 			const next = scriptRewritten(command, moves);
@@ -24302,7 +24664,7 @@ var moveFiles = async (root, moves) => {
 			return [name, next];
 		}));
 		const indent = /^\{\n([ \t]+)"/.exec(manifestText)?.[1] ?? "  ";
-		await fs.writeFile(manifestFile, `${JSON.stringify({
+		await writeFormatted(root, "package.json", `${JSON.stringify({
 			...manifest,
 			scripts
 		}, null, indent)}\n`);
@@ -24543,7 +24905,7 @@ var say$4 = sayer("machinery");
 var ESSENTIAL = /* @__PURE__ */ new Set([
 	MAIN_FILE,
 	r$7,
-	"tsconfig.json",
+	TSCONFIG_BASE,
 	"tsconfig.build.json",
 	"vite.config.ts",
 	"index.html",
@@ -24604,11 +24966,11 @@ var LOCKFILES = {
 	"yarn.lock": "yarn",
 	"pnpm-lock.yaml": "pnpm"
 };
-var stringsOf = (value) => e$5(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
+var stringsOf = (value) => e$6(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
 var readManifest = async (dir) => {
 	try {
 		const parsed = JSON.parse(await fs.readFile(path.join(dir, "package.json"), "utf-8"));
-		return e$5(parsed) ? parsed : void 0;
+		return e$6(parsed) ? parsed : void 0;
 	} catch {
 		return;
 	}
@@ -24650,12 +25012,12 @@ var manifestChecks = (context) => {
 			manifest.type = "module";
 		})
 	}));
-	if (typeof (e$5(context.manifest.engines) ? context.manifest.engines.node : void 0) !== "string") findings.push(say$3.warning("engines-missing", `package.json names no Node version: the project needs Node ${NODE_ENGINES.node}.`, {
+	if (typeof (e$6(context.manifest.engines) ? context.manifest.engines.node : void 0) !== "string") findings.push(say$3.warning("engines-missing", `package.json names no Node version: the project needs Node ${NODE_ENGINES.node}.`, {
 		file: "package.json",
 		fix: `Add "engines": { "node": "${NODE_ENGINES.node}" } to package.json.`,
 		repair: editManifest(context.root, `sets "engines": { "node": "${NODE_ENGINES.node}" } in package.json`, (manifest) => {
 			manifest.engines = {
-				...e$5(manifest.engines) ? manifest.engines : {},
+				...e$6(manifest.engines) ? manifest.engines : {},
 				...NODE_ENGINES
 			};
 		})
@@ -24853,7 +25215,7 @@ var lockfileChecks = async (context) => {
 };
 var checkPackages = async (context) => {
 	const scaffold = JSON.parse(packageJson$1(context.answers));
-	const ours = e$5(scaffold) ? {
+	const ours = e$6(scaffold) ? {
 		...stringsOf(scaffold.dependencies),
 		...stringsOf(scaffold.devDependencies)
 	} : {};
@@ -24907,10 +25269,10 @@ var assetsLeftOut = {
 		});
 	}
 };
-var isMessage = (value) => e$5(value) && typeof value.text === "string";
+var isMessage = (value) => e$6(value) && typeof value.text === "string";
 /** What a failed build says: each of its messages — or, failing in a way that names none, its error, never nothing. */
 var failureOf = (error) => {
-	const messages = e$5(error) && Array.isArray(error.errors) ? error.errors.filter(isMessage) : [];
+	const messages = e$6(error) && Array.isArray(error.errors) ? error.errors.filter(isMessage) : [];
 	return messages.length > 0 ? messages : [{
 		text: error instanceof Error ? error.message : String(error),
 		location: null
@@ -24920,8 +25282,8 @@ var failureOf = (error) => {
 var declaredType = async (file) => {
 	try {
 		const loaded = await import(pathToFileURL(file).href);
-		const declaration = e$5(loaded) ? loaded.default : void 0;
-		return e$5(declaration) && typeof declaration.type === "string" ? { type: declaration.type } : { problem: "exports no declaration by default: `export default { type: …, … }`" };
+		const declaration = e$6(loaded) ? loaded.default : void 0;
+		return e$6(declaration) && typeof declaration.type === "string" ? { type: declaration.type } : { problem: "exports no declaration by default: `export default { type: …, … }`" };
 	} catch (error) {
 		return { problem: `does not load: ${error instanceof Error ? error.message : String(error)}` };
 	}
@@ -25019,7 +25381,7 @@ var checkFolder = async (root, folder, packages) => {
 * one shadowed by a built copy and the built ones' manifests are the layout check's (`plitzi doctor`'s `layout`).
 */
 var checkPlugins = async ({ root, manifest }) => {
-	const declared = /* @__PURE__ */ new Set([...e$5(manifest.dependencies) ? Object.keys(manifest.dependencies) : [], ...e$5(manifest.devDependencies) ? Object.keys(manifest.devDependencies) : []]);
+	const declared = /* @__PURE__ */ new Set([...e$6(manifest.dependencies) ? Object.keys(manifest.dependencies) : [], ...e$6(manifest.devDependencies) ? Object.keys(manifest.devDependencies) : []]);
 	const folders = await foldersOf(path.join(root, o$5));
 	return (await Promise.all(folders.map((folder) => checkFolder(root, folder, declared)))).flat();
 };
@@ -25076,7 +25438,7 @@ var packageOf = (specifier) => {
 	const parts = specifier.split("/");
 	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
 };
-var stringKeys = (value) => e$5(value) ? Object.keys(value) : [];
+var stringKeys = (value) => e$6(value) ? Object.keys(value) : [];
 /** How `from` imports `to`: relative, with its extension, as Node wants it. */
 var specifierOf = (from, to) => {
 	const written = path.relative(path.dirname(from), to).split(path.sep).join("/");
@@ -25419,7 +25781,7 @@ var projectContext = async (project) => {
 		return { problem: `package.json is not JSON: ${error instanceof Error ? error.message : String(error)}` };
 	}
 	const plitzi = project.plitzi?.kind === "project" ? project.plitzi : void 0;
-	if (!plitzi || !e$5(manifest)) return { problem: "plitzi doctor checks a project plitzi create wrote — one that depends on @plitzi/plitzi-sdk and starts at src/main.ts — and this is not one." };
+	if (!plitzi || !e$6(manifest)) return { problem: "plitzi doctor checks a project plitzi create wrote — one that depends on @plitzi/plitzi-sdk and starts at src/main.ts — and this is not one." };
 	const root = await fs.realpath(project.root);
 	const record = await readScaffoldRecord(root);
 	const manager = await lockfileManager([root]) ?? record?.packageManager ?? project.packageManager ?? "npm";
@@ -25553,7 +25915,7 @@ var SCOPE = "@plitzi";
 var versionOf = async (folder) => {
 	try {
 		const manifest = JSON.parse(await fs.readFile(path.join(folder, "package.json"), "utf-8"));
-		return e$5(manifest) && typeof manifest.name === "string" && typeof manifest.version === "string" ? [manifest.name, manifest.version] : void 0;
+		return e$6(manifest) && typeof manifest.name === "string" && typeof manifest.version === "string" ? [manifest.name, manifest.version] : void 0;
 	} catch {
 		return;
 	}
@@ -25573,7 +25935,7 @@ var installedPackages = async (root) => {
 var nameOf = async (root) => {
 	try {
 		const manifest = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf-8"));
-		return e$5(manifest) && typeof manifest.name === "string" ? manifest.name : path.basename(root);
+		return e$6(manifest) && typeof manifest.name === "string" ? manifest.name : path.basename(root);
 	} catch {
 		return path.basename(root);
 	}
@@ -26963,7 +27325,7 @@ pageGroup.command("import").argument("<url>", "The page to start from: https://e
 	390
 ])).option("-f, --force", "Write over what --out already holds").option("--account", "A site not served from this machine: ask your Plitzi account whether one of your spaces verified its domain (signs in)").option("--json", "One object, for a tool or an agent").option(...API_OPTION).option(...DRY_RUN_OPTION).action((url, options) => importPage(url, options));
 pageGroup.command("shot").argument("[path]", "The page: /about. The home page when left out").description("A picture of one page of the running project — and, asked, how it differs from another or what moves").addOption(new Option("--width <px>", "The viewport width").argParser(width).default(1280)).addOption(new Option("--height <px>", "The viewport height (the picture is the whole page unless --viewport, --scroll-to or --clip)").argParser(positiveInteger).default(800)).addOption(schemeOption()).option("-o, --out <file>", "Where the picture goes. tmp/shots/<page>-<width>-<scheme>.png by default").option("--compare <url>", "Another site: the same page there, side by side, and how much differs by section").addOption(new Option("--frames <n>", "Pictures taken one after another: which sections move (a marquee, an autoplay)").argParser(positiveInteger)).addOption(new Option("--every <ms>", "How far apart --frames are taken").argParser(positiveInteger).default(500)).addOption(new Option("--from <moment>", "When --frames start: once the page settles, or as soon as its HTML is in (load) — what plays as it arrives").choices([...SHOT_MOMENTS]).default("settled")).option("--wait-for <element>", "An element to wait for first: its name (data-plitzi-el) or a CSS selector").option("--clip <element>", "Only this element — its name or a CSS selector — scrolled to wherever it is").option("--scroll-to <element>", "The page scrolled until this element is in view; the picture is the screen there").option("--viewport", "Only what fits the viewport, not the whole page").option("--click <element...>", "Click these in order once the page settles — each its name or a CSS selector, inside a plugin too — picturing what each changed (--frames pictures --every ms apart after each)").option("--sheet", "Every picture taken — before, after each click, each frame — on one contact sheet").option("--steps <script>", "An interaction, step by step: \"click <el>; type <el> <text>; press <key>; wait <ms>; wait-for <el>; shot [label]; frames <n> [ms]\" — or @file with one per line").option("--reduced-motion", "As a visitor who asked for less motion").option("--as <username>", "Sign in first as this account, through the server’s /auth routes — the password from PLITZI_CHECK_PASSWORD, in .env").option("--presence", "Take part in the page’s realtime channels as a visitor does — arrive, announce, send. Otherwise it only watches them").option("--json", "One object, for a tool or an agent").action((path, options) => shot(path, options));
-program.command("verify").description("Whether the project is left passing: author, lints, types, format and every page, only the problems said").option("--no-pages", "Leave the pages out — said as such").option("--keep-going", "Run every check even after one fails — by default the first failure ends the run").option("--json", "One object, for a tool or an agent").action((options) => verify(options));
+program.command("verify").description("Whether the project is left passing: author, lints, types, its tests, format and every page, only the problems said").option("--no-pages", "Leave the pages out — said as such").option("--keep-going", "Run every check even after one fails — by default the first failure ends the run").option("--json", "One object, for a tool or an agent").action((options) => verify(options));
 elementGroup.command("where").argument("<query>", "An element’s id, a class it wears, or words it shows: hero-cta, navLink, \"Get started\"").description("Where the project’s code writes an element: the file, the line and the call itself").addOption(new Option("--by <reading>", "Read the query one way only, not the first of id, class and words that matches").choices(WHERE_READINGS)).option("--json", "One object, for a tool or an agent").action((query, options) => where(query, options));
 elementGroup.command("edit").argument("<id>", "The element, by its id: hero-cta").description("Change an element’s attributes in the call that writes it, then check the space still authors").option("--set <key=value...>", "An attribute to write: content=\"Start free\", required=true").option("--remove <key...>", "An attribute to take out").option("--every", "The call writes other elements too, and the change is for every one").option("--json", "One object, for a tool or an agent").action((id, options) => edit(id, options));
 elementGroup.command("remove").argument("<id>", "The element, by its id: ent-trust").description("Take an element out of the code that writes it, with what only it used, then check the space").option("--json", "One object, for a tool or an agent").action((id, options) => remove$1(id, options));
@@ -26972,6 +27334,7 @@ elementGroup.command("readings", { hidden: true }).action(() => elements());
 program.command("explain").argument("[name]", "An element, a step, a trigger, a problem’s code, a transformer or a helper: container, navigate, class-and-css, bindTemplate, motion").description("What a name means when authoring a space — what it takes, fires, reads and how it is written").option("--list <kind>", "Every name of a kind: elements, steps, triggers, codes, transformers, helpers").option("--json", "One object, for a tool or an agent").action((name, options) => explainCommand(name, options));
 program.command("upgrade").argument("[parts...]", `Only these: ${UPGRADE_PARTS.join(", ")} — every one when none is named`).description("Bring the project up to this CLI: its machinery files, package.json, the skills and renamed names — shown; with --write made").option("--write", "Make the changes: files nobody changed replaced, package.json merged and installed, names renamed").option("--take <files...>", "Replace these files of your own too (`all` for every one), after reading their diff").option("--no-install", "Write package.json and leave the install to you").option("--json", "One object, for a tool or an agent").action((parts, options) => upgrade(parts, options));
 program.command("doctor").description("Whether the project the CLI set up is whole — packages, its files, configs, what Node runs, plugins, data files, functions, records — each problem with its fix. Not the space: that is `npm run author`, and how it is written `plitzi space lint`").option("--fix", "Repair what is simple and safe — a layout an older CLI left, dead files, .gitignore, a missing secret — then check again").option(...DRY_RUN_OPTION).option("--strict", "Warnings fail too (exit 1): for a CI that keeps the project up to its CLI").option("--json", "One object, for a tool or an agent").action((options) => doctor(options));
+program.command("cert").description("HTTPS while developing, for a phone or a tablet on your Wi-Fi: a certificate for this machine and its network addresses (mkcert), named in .env").option("--name <names...>", "Other names this machine answers by, in the certificate too: studio.tailnet.ts.net").option("--json", "One object, for a tool or an agent").action((options) => cert(options));
 program.command("feedback").description("Start a report to Plitzi: writes the page in tmp/feedback/ with the versions and the project already in it, and tells the agent how to fill and publish it — to send as a link").option("--previous <url>", "An earlier report this one continues — its numbering, and what changed. Repeat it", collect, []).option("--json", "One object: { file, facts, brief }, for a tool or an agent").action((options) => feedback(options));
 spaceGroup.command("lint").description("How the space in src/space/ is written, eslint’s way: each practice to change at its file and line, what to write instead, and what authoring suggests. Not whether it authors — `npm run author` — nor the project: `plitzi doctor`").option("--strict", "Warnings fail too (exit 1)").addOption(new Option("--max-warnings <n>", "More warnings than this fail (exit 1)").argParser(count)).option("--json", "One object: { scope, notChecked, findings }, for a tool or an agent").action((options) => lint(options));
 program.command("skills").description("The Plitzi skills an agent reads in .claude/skills/").command("update").description("Bring them up to the Plitzi packages this project has installed, each replaced whole (`upgrade skills --write`)").option(...DRY_RUN_OPTION).action((options) => upgrade(["skills"], { write: !options.dryRun }));