@plitzi/cli 0.38.9 → 0.38.10

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # @plitzi/cli
 
+## 0.38.10
+
+### Patch Changes
+
+- 200da2f: - **`focus-on-field-box`** (`@plitzi/sdk-authoring`): a warning for a `focus` or `focus-visible` state on a text
+  field's or a select's `input` slot. That slot is the box the field is drawn in, a `<div>` that never takes focus, so
+  the rule was never seen and a keyboard user tabbing to the field found no ring. The fix it names: `'focus-within'` on
+  the same class, or the state on the `field` slot.
+  - **`modalContainer` says how it is laid out** (`@plitzi/sdk-elements`): its description now names its slots and how
+    they sit — the dim layer and the dialog side by side, not one inside the other; the dialog centred by `top`/`left`
+    50% and a `translate`. A space styled the dim layer as a flex container to place the dialog, which moved nothing.
+  - **A field shows where the keyboard is** (`@plitzi/plitzi-sdk`, `@plitzi/sdk-elements`): a text field's or a select's
+    box is ringed (`2px solid currentColor`) while the field inside has keyboard focus, and a textarea while it has. No
+    text field or select showed any focus at all: the box had `outline: none`, and the field inherited it. One class of
+    specificity, so whatever a space writes about the outline wins; never in the builder's canvas, where the selection is
+    the ring. The field no longer inherits the box's outline — the box draws it.
+  - **The dim layer of a modal and a dialog is `rgb(0 0 0 / 50%)`** (`@plitzi/plitzi-sdk`, `@plitzi/sdk-elements`), not
+    black at `opacity: 0.5`: the default looks the same, and a colour a space gives the layer is drawn as it is — it was
+    halved. A space that set its own colour sees it darker: the one it wrote.
+  - **`required-message-unused`** (`@plitzi/sdk-authoring`): a warning for a `requiredMessage` on a field nothing requires —
+    since 0.38.9 a field is optional unless `required: true`, so the message is never shown and an empty answer is sent.
+    The formControl's description, the cheat sheet and the forms recipe say the default.
+  - **A page's title can say its record** (`@plitzi/sdk-shared`, `@plitzi/sdk-server`, `@plitzi/sdk-elements`,
+    `@plitzi/sdk-authoring`): `seoTitle` and `seoDescription` may be templates over the page's `runtime: 'server'`
+    providers (its layouts' too) and `navigation` — `'{{ apiContainer_post.title }} — Blog'`. The server evaluates them
+    as it writes the head, from the answers it already has; the browser evaluates the same over `rsc.data`, so the tab
+    follows a navigation from record to record. One that reads anything else — a browser provider, `state` — is refused
+    (`page-template`): it was written into the head as it was, braces included. A declaration's `serverTemplates` names
+    the attributes the page server evaluates against a context of its own (a page's title and description, a provider's
+    `notFound`): the element runtime leaves them as written — interpolated where the page renders, a `|default(…)`
+    resolved to its fallback before the head could read the providers — and the authoring lint reads the same list.
+  - **A page says when its address shows nothing** (`@plitzi/sdk-server`, `@plitzi/sdk-authoring`): `notFound` on the
+    page, one expression over the same answers its title reads — `"{{ not (apiContainer_feed.topics|find('slug',
+navigation.routeParams.slug)) }}"` — sends it with status 404, rendered as written. A provider's own `notFound` reads
+    only its answer, and one in a layout is every page's: a record read from the layout had no way to say it was not
+    there, and the page answered 200.
+  - **The Export keeps the flows of a plugin hosted by `custom`** (`@plitzi/sdk-authoring`): `specFromSpace` judged such
+    an element by `custom`'s own triggers and callbacks, and dropped a flow on the component's event (`onChange` on an
+    editor) as one "a custom never fires" — the space read back was not the space written.
+  - **`page check` reads every word on the page, in the colour the browser paints it** (`@plitzi/sdk-authoring`): what a
+    plugin draws inside an element of the space is measured too, named by the element and a selector; the measure is
+    WCAG's contrast (under 2:1 is unreadable), not "nearly the same colour"; and a colour the browser answers as
+    `oklch()`, `oklab()` or `color(srgb …)` — every token and every `color-mix()` — is read as that, where it was read as
+    `rgb()` numbers and came out near black. A plugin's dark-on-dark status line passed as "nothing wrong".
+  - **`verify` checks every theme the space can be painted in** (`@plitzi/cli`): light and dark, unless the space says
+    light only — "48 checks at 1440 and 390 px, light and dark". A page unreadable in the dark theme passed in the light
+    one; a failure names the theme it was found in.
+  - **`plitzi upgrade` says where fields became optional** (`@plitzi/cli`): for a project last upgraded before 0.38.9,
+    each `formControl(…)` with no `required`, at its file and line — said, never written. And a `.gitkeep` is asked for
+    only in a folder with nothing else in it: `upgrade` wrote one beside code, and `doctor` called it missing once deleted
+    as AGENTS.md asks ("nothing unused") — the three now say the same.
+  - **`devMode` and `devReload` are the project's** (`@plitzi/sdk-server`): `src/config/serverOptions.ts` may set them,
+    over `NODE_ENV`, which they still follow when left out. A deployment started without `NODE_ENV` (a container's `CMD`)
+    says `devMode: false`, and a public action answers with its output alone.
+  - **`page shot --from load`** (`@plitzi/cli`): `--frames` start as soon as the page's HTML is in, not once it settles —
+    an entrance that plays while the page loads had ended before the first picture.
+  - **`heavy-animation` says where each animation is** (`@plitzi/sdk-authoring`): the class and its variant, state or
+    slot — or the `customCss` rule — and writes the fix against that selector. It said "in `customCss`" for an animation
+    declared on a class's variant, and offered `.glow`, a class no space has.
+  - **`page shot --steps`** (`@plitzi/cli`): an interaction played step by step — `click`, `type`, `press`, `wait`,
+    `wait-for`, `shot [label]`, `frames <n> [ms]`, separated by `;` or written in a file (`@file`) — each picture labelled
+    with its step and the time since the first, and said when nothing changed since the one before. A queue filling, a
+    restart, an opening frame by frame took a Playwright script of the project's own. Targets take Playwright's selectors
+    too (`text=Saved`).
+  - **A space's task may take a `number` param** (`@plitzi/sdk-server`): saved functions refused it ("a type the builder
+    cannot draw") while a project's server ran it, so code that worked self-hosted failed on the platform — and the
+    builder draws one, a callback's. A step's params now arrive as the types the task declares, on every server: a
+    `number` written as text is the number, a `boolean` written `'true'` is `true`, as the browser reads a callback's.
+  - **`page shot --as <username>`** (`@plitzi/cli`): signs in first, as `page check --as` does, the password from
+    `PLITZI_CHECK_PASSWORD` in `.env`. A page for signed-in visitors was pictured as the sign-in page it sent the browser
+    to, without a word; `page shot` now says when the page sent it elsewhere, and that the picture is of that page.
+  - **A capture is of the page at rest** (`@plitzi/sdk-mcp`): the local screenshot client takes every picture with
+    `prefers-reduced-motion: reduce`, as the browser pod now does — the declared motion and a space's own keyframes that
+    honour the query are shown finished. A splash still covering its page, or an arrival caught halfway, was what a
+    thumbnail or a `plitzi_look` showed of a page that animates as it loads.
+  - **The server renders in the visitor's theme, not only the class** (`@plitzi/sdk-shared`): `ThemeProvider` set the
+    starting theme from a layout effect, which never runs on a server, so a page was drawn from the theme store's own
+    start — `{{ theme.resolved }}` was `light` under a `<html class="dark">`, and whatever named the scheme (a picture's
+    address, a `when` rule) was swapped for the other one as the page hydrated. The theme a host supplies (the cookie) is
+    now the server's snapshot of the store, and the hydration's; the shared store is never written on the server.
+- Updated dependencies [200da2f]
+  - @plitzi/sdk-authoring@0.38.10
+
 ## 0.38.9
 
 ### Patch Changes

package/README.md

@@ -193,6 +193,9 @@ plitzi page shot /about --width 390 --scheme dark
 plitzi page shot / --frames 4 --every 500       # what moves: a marquee, an autoplay
 plitzi page shot / --viewport --click .knob open-button --frames 4 --every 250 --sheet   # an interaction, on one sheet
 plitzi page shot / --compare https://example.com --width 1440   # beside another site: what differs, and how
+plitzi page shot /studio --width 390 --as maya   # a page for signed-in visitors: the picture is of it, not of the sign-in
+plitzi page shot / --viewport --frames 6 --every 200 --from load --sheet   # what plays as the page arrives
+plitzi page shot / --clip machine --sheet --steps "click .gm__knob; wait 300; frames 6 150; wait-for .gm__capsule; shot opened"   # an interaction, step by step
 ```
 
 Both run on the project's own Playwright against its running server (`npm start`), and refuse a port that answers as
@@ -200,7 +203,8 @@ another project. They wait for the page to settle — loaded, then half a second
 stream that stays open, so a page with a realtime `channel` is checked like any other (`openPage` of
 `@plitzi/sdk-authoring`, which the generated `npm run visual` uses too). `page check` reports every element the space owes the page that is missing or hidden (with why), broken
 images, sideways scroll, a link or words cut off at the screen's edge (an ancestor hiding them, nothing scrolling to
-them), text in the colour behind it, console errors, refused requests and failed flows — and the
+them), words that cannot be told from what is behind them (under 2:1 — the space's elements and what a plugin draws
+inside one; `aria-hidden` words are a decoration), console errors, refused requests and failed flows — and the
 page's data: a binding that reads a path its provider's answer lacks (with the keys it has) — none inside an element
 the page is not showing, which is not mounted — a provider that failed, and each list's rows, drawn and in its source
 (`feed 4 of 8 rows`, `hits not rendered (16 in its source)`; `--json`: `lists: { id: { rendered, source } }`). A page's state in a few hundred tokens, where a screenshot costs thousands.
@@ -320,11 +324,12 @@ An element's own selector and its bindings are named after its place under its n
 among its siblings — so a move renames nothing.
 
 `verify` runs each check the project has a script for, as its package manager runs one, then opens every page with
-no parameter in its path at 1440 and 390 px (the server must be up: `npm start`). Only what fails is printed, with the
+no parameter in its path at 1440 and 390 px, in every theme the space can be painted in — light and dark, unless
+it says light only — (the server must be up: `npm start`). Only what fails is printed, with the
 last lines it said, and the first failure ends the run — one broken file fails every step after it the same way — the
 rest said as not run until it passes (`--keep-going` runs them anyway). A page the browser was sent away from — one
 for signed-in visitors — is checked again signed in as the project's account, when `.env` names one:
-`PLITZI_CHECK_USER` and `PLITZI_CHECK_PASSWORD`, the password `page check --as` reads too (the environment wins over
+`PLITZI_CHECK_USER` and `PLITZI_CHECK_PASSWORD`, the password `page check --as` and `page shot --as` read too (the environment wins over
 `.env`, as it does for the project's scripts; never on the command line, which a shell keeps). One that even that
 account is sent away from, or with no account named, is said as not checked, never as passing — on its own line, with
 what checks it, without failing the run. Exit 1 when anything failed.
@@ -513,7 +518,9 @@ plitzi upgrade --write --take plitzi/author.ts
 A project brought up to the CLI it has now, part by part: `files` (the machinery — `author.ts`, `main.ts`, the
 Playwright and lint configs, `AGENTS.md`), `packages` (`package.json` merged, `@plitzi/*` raised to this version, then
 the install), `skills` (`.claude/skills/plitzi-*`, whole, so a reference a skill no longer has goes with it) and
-`renames` (a name a version renamed, at its file and line). A file nobody changed since the CLI wrote it is replaced;
+`renames` (a name a version renamed, at its file and line — and, for a project last upgraded before a change it may
+count on, where that change lands: a `formControl` with no `required`, optional since 0.38.9; said, never written). A
+`.gitkeep` is written only in a folder with nothing else in it. A file nobody changed since the CLI wrote it is replaced;
 one the project made its own is a diff, left unless `--take` names it (`all` for every one). The generated
 `.prettierignore` names them, so the project's `format` never turns one into a file `upgrade` believes was changed. A file of the project's own
 that the machinery reads (`src/config/serverOptions.ts`, `src/actions/index.ts`) is written when the project has none and the
@@ -780,7 +787,8 @@ for a clone to copy and fill in. A server project's `.env` is read as each scrip
 before any of its modules is evaluated, so `src/config/serverOptions.ts` and the actions find their settings in
 `process.env` as they load. A change to it is read on the next start, and a deployment that sets its environment needs
 no file. `start:prod` also sets `NODE_ENV=production` itself — without it a deployed server is a development one, its
-dev tools on and every action's trace in what a visitor is answered (`doctor` says a `start:prod` that does not). A browser
+dev tools on and every action's trace in what a visitor is answered (`doctor` says a `start:prod` that does not). A
+deployment started some other way says `devMode: false` in `src/config/serverOptions.ts`, which wins over `NODE_ENV`. A browser
 project's is Vite's: only `VITE_*` reaches the page, and ships in it.
 `create` gives each one a signing key there, made for it: `PLITZI_SIGNING_SECRET`, what `ctx.sign` and `ctx.verify`
 sign with — at least 32 characters (`doctor --fix` writes one where it is missing). `PORT` is left commented out: 8080,