@plitzi/plitzi-builder 0.38.14 → 0.38.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +117 -0
- package/dist/package.json.d.ts +1 -1
- package/dist/plitzi-builder.js +611 -610
- package/dist/plitzi-builder.js.gz +0 -0
- package/dist/plitzi-functions-worker.js +1 -1
- package/package.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,122 @@
|
|
|
1
1
|
# @plitzi/plitzi-builder
|
|
2
2
|
|
|
3
|
+
## 0.38.15
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 6cdd5cf: ## Security
|
|
8
|
+
|
|
9
|
+
- **A write another site caused is refused, cookie or none** (`@plitzi/sdk-server`, `@plitzi/sdk-shared`): the page
|
|
10
|
+
server guarded nothing it answers past `/auth` — a server action (`/_action`), a realtime publish, a space's `/fn/`
|
|
11
|
+
route, its runtime's endpoints, the deployment's own `data` stages, the adapter-only `loginPath`, `logoutPath` and
|
|
12
|
+
`exchangePath`. A plain `text/plain` POST from any page open in the same browser ran them, with the visitor's session
|
|
13
|
+
cookie when there was one (`SameSite=None` off this machine) and, in a project nobody signs in to, as whoever holds
|
|
14
|
+
the server's own credentials. Every unsafe request a browser says another site caused (`Sec-Fetch-Site: cross-site`,
|
|
15
|
+
or a foreign `Origin`) is now refused `403 reason: 'foreign'`, saying how to allow it: `crossSiteWrites.origins`
|
|
16
|
+
(with `auth`, `identity.platformOrigins` too) and `crossSiteWrites.paths` for a form other sites post to by design.
|
|
17
|
+
`Authorization`, and callers that are not browsers — webhooks, scripts — pass as before. One rule for this and the
|
|
18
|
+
sign-in check (`crossSiteRequest`, `csrf.ts`). A self-hosted runtime's endpoints now sit where the platform forwards a
|
|
19
|
+
space's — after the auth chain and this guard (`data`, was `preAuth`).
|
|
20
|
+
|
|
21
|
+
## Testing
|
|
22
|
+
- **`page check` and `page shot` anywhere the project is served** (`@plitzi/cli`): `--url <origin>` for a second server
|
|
23
|
+
of it, staging or a deploy, instead of `npm start`'s port; `page check --space <module>` holds the pages to that space
|
|
24
|
+
instead of the project's — an agent's page — authored with `authorIsolated`.
|
|
25
|
+
- **A route with a query is checked as its page** (`@plitzi/cli`): `page check "/?v=2"` matched the query as part of
|
|
26
|
+
the path, found no page, and checked the space's "not found" page in its place.
|
|
27
|
+
|
|
28
|
+
- **What an element that chooses its children draws is checked** (`@plitzi/sdk-authoring`, `@plitzi/cli`): with
|
|
29
|
+
`choosesChildren`, the page checks owed none of its children — and checked none of them either: a dashboard drawing
|
|
30
|
+
three panels reported `checked: 1`. Each child it may draw, and what is inside one under no condition of its own,
|
|
31
|
+
now carries `shownWith` (the child it comes with) on its handle: once that child is on screen it and everything
|
|
32
|
+
named in it are owed like the rest of the page, and `checked` counts them. `onScreenIfChosen(handles, page)` lists
|
|
33
|
+
them.
|
|
34
|
+
- **A page that met a server error is looked at once more** (`@plitzi/cli`): `page check` and `verify` failed a page
|
|
35
|
+
for a `500` from somebody else's service having a bad second (`/fn/<space>/weather`), and passed on the next run with
|
|
36
|
+
nothing changed. A page whose requests got a `5xx` is checked again once; its report is the second look, and says
|
|
37
|
+
what failed the first time (`retriedAfter`). A `4xx` fails the same way twice, and is never retried.
|
|
38
|
+
|
|
39
|
+
## Plugins
|
|
40
|
+
- **`useNotify`** (`@plitzi/plitzi-sdk`): a plugin shows the page's notifications — `notify('Deleted 79 recordings', {
|
|
41
|
+
appearance: 'danger' })` — the same toasts an `addNotification` step shows, in the space's theme and `notifications`
|
|
42
|
+
look, with no trigger, flow or `window` event of the space's to wire. The step's vocabulary (`NOTIFICATION_PLACEMENTS`,
|
|
43
|
+
`NOTIFICATION_APPEARANCES`, `NOTIFICATION_DEFAULTS`) is one list in `@plitzi/sdk-shared`, read by both.
|
|
44
|
+
- **`appearance: 'danger'` looks like one** (`@plitzi/plitzi-sdk`): it reached the toast library as a type it does not
|
|
45
|
+
know, so a danger notification showed neither the error icon nor the colour `notifications.danger` sets.
|
|
46
|
+
A value a notification does not take — from a flow, or a plugin in plain JavaScript — is set aside by name and said
|
|
47
|
+
in the console, rather than shown as the default in silence (`readNotificationOptions`, `@plitzi/sdk-shared`).
|
|
48
|
+
- **`useServerAction`** (`@plitzi/plitzi-sdk`, `@plitzi/sdk-authoring`, `@plitzi/sdk-interactions`,
|
|
49
|
+
`@plitzi/sdk-server`): a plugin runs one of the space's server actions, awaited —
|
|
50
|
+
`useServerAction<typeof habitDone>('habits-done')({ id })` answers `{ ok, output }` or `{ ok: false, reason, error }`
|
|
51
|
+
— through the `runServerAction` step itself: the same access, refusals, session handling and dev-tools entry.
|
|
52
|
+
`defineAction` keeps the literal types of its `call` way in, so the input is typed by the fields it declares (the
|
|
53
|
+
required ones required); `taskAction` types both ends from the task's `run`, and `FunctionTask<T, R>` takes what
|
|
54
|
+
`run` answers. `CallInputOf` / `CallOutputOf` read them. One operation is one action, never a `case` in one route.
|
|
55
|
+
What a run answers is typed (`ServerActionStatus`): a status the server never uses reads as a run that did not
|
|
56
|
+
complete, never as one that did.
|
|
57
|
+
The key those types ride under (`CALL_TYPES`) is exported, by `@plitzi/sdk-shared` and `@plitzi/sdk-authoring` with
|
|
58
|
+
`TypedActionEntry`, `CallInputOf` and `CallOutputOf`: a package that emits declarations could not write the type of an
|
|
59
|
+
action it exports (`TS4023` on every `export const actions = [defineAction(…)]`).
|
|
60
|
+
- **A plugin is drawn on the server first** (docs): a preference per device belongs in kept state (`keepState`,
|
|
61
|
+
`paintedState`) as a bound prop, never read from `localStorage` while rendering — React discards the whole tree on the
|
|
62
|
+
mismatch, and only in the browser of whoever saved something. `@plitzi/plitzi-ui` is not the page's: a plugin
|
|
63
|
+
importing it bundles its own copy, with its own contexts and its own look. The authoring skill's `plugin-reach.md`
|
|
64
|
+
says what a plugin says and to whom: a notification, another element (an event and the space's flow), a server
|
|
65
|
+
action, shared state, other pages.
|
|
66
|
+
|
|
67
|
+
## Realtime
|
|
68
|
+
- **A channel that retains** (`@plitzi/sdk-shared`, `@plitzi/sdk-server`, `@plitzi/sdk-elements`): declared
|
|
69
|
+
`retain: true` (with `publish: 'server'`, which authoring requires), the server keeps the latest message of each type
|
|
70
|
+
on a topic — said by `ctx.publish` or a flow's `realtime.publish` — and hands them to every page that joins, marked
|
|
71
|
+
`retained`. A page reads them as `<channel>.retained.<type>`, a plugin as `useChannel(topic).retained`, the newest of
|
|
72
|
+
a type holding whichever order they arrive in; `null` forgets a type. Kept in the store the actions' `kv` uses (beside
|
|
73
|
+
the grants, by compare-and-swap), so every replica hands out the same; a topic keeps at most 64 types and 512 KB, and
|
|
74
|
+
a publish past that is refused before anything is sent. State every screen shares is one publish and one binding —
|
|
75
|
+
no kv key, initial read or copy in `state` of the project's own. The fleet store `realtime.grants` is now
|
|
76
|
+
`realtime.kv`.
|
|
77
|
+
- **The MCP writes every field a channel takes** (`@plitzi/sdk-mcp`): `patchSettings`'s channel had no `grant` — which
|
|
78
|
+
the guide taught — nor `retain` or the limits, so an agent could not declare a private channel at all. All are there
|
|
79
|
+
now, and the guide says what `retain` is for and that `channel_<id>.retained` holds it.
|
|
80
|
+
|
|
81
|
+
## Authoring
|
|
82
|
+
- **`plitzi explain` knows every `@plitzi` package installed** (`@plitzi/cli`): a name that was not
|
|
83
|
+
`@plitzi/sdk-authoring`'s (`createServer`, `createJsonAdapters`, `useChannel`) was answered as the project's own code,
|
|
84
|
+
to `grep` in `src/`. It is read from the published types of every one installed, through their re-exports and entry
|
|
85
|
+
points (`@plitzi/sdk-server/handlers`), and a name two packages export — `createServer` is sdk-server's and sdk-mcp's
|
|
86
|
+
— is answered with both.
|
|
87
|
+
|
|
88
|
+
- **A space module somebody else wrote, authored where it reaches nothing** (`@plitzi/sdk-authoring`):
|
|
89
|
+
`authorIsolated(file, { timeoutMs })` of `@plitzi/sdk-authoring/node` runs `authorSpace` on it in a process Node's
|
|
90
|
+
permission model holds to reading the module's folder and its packages — no file written, no process started, no
|
|
91
|
+
variable of the caller's environment — kills one that runs too long, and validates what it answers again, so a forged
|
|
92
|
+
answer gains nothing. A refusal comes back as `authorSpace` says it, with the problems as data.
|
|
93
|
+
- **Pages an agent writes, served** (`@plitzi/sdk-server`): `createAuthoringHost({ dir, frameAncestors })` serves each
|
|
94
|
+
space it is handed at an address of its own (`put(space, { id }) → /?__pt=<id>`) as a draft of its one space, kept in
|
|
95
|
+
`dir` across restarts; `drop(id)` forgets one, and anything else answers `404` saying where the pages are.
|
|
96
|
+
- **A space is chosen by host or credential** (`@plitzi/sdk-server`, docs): `getSpaceDeployment` is asked on every
|
|
97
|
+
request, and what a page fetches after it carries nothing of its address but the host — a space chosen by the page's
|
|
98
|
+
query or path lost everything it asked for, and `/_plitzi/space/<hash>.json` answered a bare `404`. The contract and
|
|
99
|
+
the README say so (the README offered "by path prefix"), and that `404` says why.
|
|
100
|
+
|
|
101
|
+
- **`plitzi explain on` says how to read what a trigger carries** (`@plitzi/sdk-authoring`): its doc sat above a
|
|
102
|
+
helper, so `explain` printed only the signature. It now leads with `[named('picked', on('onPick')), …('{{ picked.seat
|
|
103
|
+
}}')]`, and the CLI skill's plugin section says the same.
|
|
104
|
+
|
|
105
|
+
- Updated dependencies [6cdd5cf]
|
|
106
|
+
- @plitzi/plitzi-sdk@0.38.15
|
|
107
|
+
- @plitzi/sdk-auth@0.38.15
|
|
108
|
+
- @plitzi/sdk-authoring@0.38.15
|
|
109
|
+
- @plitzi/sdk-dev-tools@0.38.15
|
|
110
|
+
- @plitzi/sdk-elements@0.38.15
|
|
111
|
+
- @plitzi/sdk-event-bridge@0.38.15
|
|
112
|
+
- @plitzi/sdk-interactions@0.38.15
|
|
113
|
+
- @plitzi/sdk-navigation@0.38.15
|
|
114
|
+
- @plitzi/sdk-plugins@0.38.15
|
|
115
|
+
- @plitzi/sdk-schema@0.38.15
|
|
116
|
+
- @plitzi/sdk-shared@0.38.15
|
|
117
|
+
- @plitzi/sdk-style@0.38.15
|
|
118
|
+
- @plitzi/sdk-variables@0.38.15
|
|
119
|
+
|
|
3
120
|
## 0.38.14
|
|
4
121
|
|
|
5
122
|
### Patch Changes
|