@plitzi/sdk-elements 0.38.13 → 0.38.15

package/CHANGELOG.md

@@ -1,5 +1,268 @@
 # @plitzi/sdk-elements
 
+## 0.38.15
+
+### Patch Changes
+
+- 6cdd5cf: ## Security
+
+  - **A write another site caused is refused, cookie or none** (`@plitzi/sdk-server`, `@plitzi/sdk-shared`): the page
+    server guarded nothing it answers past `/auth` — a server action (`/_action`), a realtime publish, a space's `/fn/`
+    route, its runtime's endpoints, the deployment's own `data` stages, the adapter-only `loginPath`, `logoutPath` and
+    `exchangePath`. A plain `text/plain` POST from any page open in the same browser ran them, with the visitor's session
+    cookie when there was one (`SameSite=None` off this machine) and, in a project nobody signs in to, as whoever holds
+    the server's own credentials. Every unsafe request a browser says another site caused (`Sec-Fetch-Site: cross-site`,
+    or a foreign `Origin`) is now refused `403 reason: 'foreign'`, saying how to allow it: `crossSiteWrites.origins`
+    (with `auth`, `identity.platformOrigins` too) and `crossSiteWrites.paths` for a form other sites post to by design.
+    `Authorization`, and callers that are not browsers — webhooks, scripts — pass as before. One rule for this and the
+    sign-in check (`crossSiteRequest`, `csrf.ts`). A self-hosted runtime's endpoints now sit where the platform forwards a
+    space's — after the auth chain and this guard (`data`, was `preAuth`).
+
+  ## Testing
+  - **`page check` and `page shot` anywhere the project is served** (`@plitzi/cli`): `--url <origin>` for a second server
+    of it, staging or a deploy, instead of `npm start`'s port; `page check --space <module>` holds the pages to that space
+    instead of the project's — an agent's page — authored with `authorIsolated`.
+  - **A route with a query is checked as its page** (`@plitzi/cli`): `page check "/?v=2"` matched the query as part of
+    the path, found no page, and checked the space's "not found" page in its place.
+
+  - **What an element that chooses its children draws is checked** (`@plitzi/sdk-authoring`, `@plitzi/cli`): with
+    `choosesChildren`, the page checks owed none of its children — and checked none of them either: a dashboard drawing
+    three panels reported `checked: 1`. Each child it may draw, and what is inside one under no condition of its own,
+    now carries `shownWith` (the child it comes with) on its handle: once that child is on screen it and everything
+    named in it are owed like the rest of the page, and `checked` counts them. `onScreenIfChosen(handles, page)` lists
+    them.
+  - **A page that met a server error is looked at once more** (`@plitzi/cli`): `page check` and `verify` failed a page
+    for a `500` from somebody else's service having a bad second (`/fn/<space>/weather`), and passed on the next run with
+    nothing changed. A page whose requests got a `5xx` is checked again once; its report is the second look, and says
+    what failed the first time (`retriedAfter`). A `4xx` fails the same way twice, and is never retried.
+
+  ## Plugins
+  - **`useNotify`** (`@plitzi/plitzi-sdk`): a plugin shows the page's notifications — `notify('Deleted 79 recordings', {
+appearance: 'danger' })` — the same toasts an `addNotification` step shows, in the space's theme and `notifications`
+    look, with no trigger, flow or `window` event of the space's to wire. The step's vocabulary (`NOTIFICATION_PLACEMENTS`,
+    `NOTIFICATION_APPEARANCES`, `NOTIFICATION_DEFAULTS`) is one list in `@plitzi/sdk-shared`, read by both.
+  - **`appearance: 'danger'` looks like one** (`@plitzi/plitzi-sdk`): it reached the toast library as a type it does not
+    know, so a danger notification showed neither the error icon nor the colour `notifications.danger` sets.
+    A value a notification does not take — from a flow, or a plugin in plain JavaScript — is set aside by name and said
+    in the console, rather than shown as the default in silence (`readNotificationOptions`, `@plitzi/sdk-shared`).
+  - **`useServerAction`** (`@plitzi/plitzi-sdk`, `@plitzi/sdk-authoring`, `@plitzi/sdk-interactions`,
+    `@plitzi/sdk-server`): a plugin runs one of the space's server actions, awaited —
+    `useServerAction<typeof habitDone>('habits-done')({ id })` answers `{ ok, output }` or `{ ok: false, reason, error }`
+    — through the `runServerAction` step itself: the same access, refusals, session handling and dev-tools entry.
+    `defineAction` keeps the literal types of its `call` way in, so the input is typed by the fields it declares (the
+    required ones required); `taskAction` types both ends from the task's `run`, and `FunctionTask<T, R>` takes what
+    `run` answers. `CallInputOf` / `CallOutputOf` read them. One operation is one action, never a `case` in one route.
+    What a run answers is typed (`ServerActionStatus`): a status the server never uses reads as a run that did not
+    complete, never as one that did.
+    The key those types ride under (`CALL_TYPES`) is exported, by `@plitzi/sdk-shared` and `@plitzi/sdk-authoring` with
+    `TypedActionEntry`, `CallInputOf` and `CallOutputOf`: a package that emits declarations could not write the type of an
+    action it exports (`TS4023` on every `export const actions = [defineAction(…)]`).
+  - **A plugin is drawn on the server first** (docs): a preference per device belongs in kept state (`keepState`,
+    `paintedState`) as a bound prop, never read from `localStorage` while rendering — React discards the whole tree on the
+    mismatch, and only in the browser of whoever saved something. `@plitzi/plitzi-ui` is not the page's: a plugin
+    importing it bundles its own copy, with its own contexts and its own look. The authoring skill's `plugin-reach.md`
+    says what a plugin says and to whom: a notification, another element (an event and the space's flow), a server
+    action, shared state, other pages.
+
+  ## Realtime
+  - **A channel that retains** (`@plitzi/sdk-shared`, `@plitzi/sdk-server`, `@plitzi/sdk-elements`): declared
+    `retain: true` (with `publish: 'server'`, which authoring requires), the server keeps the latest message of each type
+    on a topic — said by `ctx.publish` or a flow's `realtime.publish` — and hands them to every page that joins, marked
+    `retained`. A page reads them as `<channel>.retained.<type>`, a plugin as `useChannel(topic).retained`, the newest of
+    a type holding whichever order they arrive in; `null` forgets a type. Kept in the store the actions' `kv` uses (beside
+    the grants, by compare-and-swap), so every replica hands out the same; a topic keeps at most 64 types and 512 KB, and
+    a publish past that is refused before anything is sent. State every screen shares is one publish and one binding —
+    no kv key, initial read or copy in `state` of the project's own. The fleet store `realtime.grants` is now
+    `realtime.kv`.
+  - **The MCP writes every field a channel takes** (`@plitzi/sdk-mcp`): `patchSettings`'s channel had no `grant` — which
+    the guide taught — nor `retain` or the limits, so an agent could not declare a private channel at all. All are there
+    now, and the guide says what `retain` is for and that `channel_<id>.retained` holds it.
+
+  ## Authoring
+  - **`plitzi explain` knows every `@plitzi` package installed** (`@plitzi/cli`): a name that was not
+    `@plitzi/sdk-authoring`'s (`createServer`, `createJsonAdapters`, `useChannel`) was answered as the project's own code,
+    to `grep` in `src/`. It is read from the published types of every one installed, through their re-exports and entry
+    points (`@plitzi/sdk-server/handlers`), and a name two packages export — `createServer` is sdk-server's and sdk-mcp's
+    — is answered with both.
+
+  - **A space module somebody else wrote, authored where it reaches nothing** (`@plitzi/sdk-authoring`):
+    `authorIsolated(file, { timeoutMs })` of `@plitzi/sdk-authoring/node` runs `authorSpace` on it in a process Node's
+    permission model holds to reading the module's folder and its packages — no file written, no process started, no
+    variable of the caller's environment — kills one that runs too long, and validates what it answers again, so a forged
+    answer gains nothing. A refusal comes back as `authorSpace` says it, with the problems as data.
+  - **Pages an agent writes, served** (`@plitzi/sdk-server`): `createAuthoringHost({ dir, frameAncestors })` serves each
+    space it is handed at an address of its own (`put(space, { id }) → /?__pt=<id>`) as a draft of its one space, kept in
+    `dir` across restarts; `drop(id)` forgets one, and anything else answers `404` saying where the pages are.
+  - **A space is chosen by host or credential** (`@plitzi/sdk-server`, docs): `getSpaceDeployment` is asked on every
+    request, and what a page fetches after it carries nothing of its address but the host — a space chosen by the page's
+    query or path lost everything it asked for, and `/_plitzi/space/<hash>.json` answered a bare `404`. The contract and
+    the README say so (the README offered "by path prefix"), and that `404` says why.
+
+  - **`plitzi explain on` says how to read what a trigger carries** (`@plitzi/sdk-authoring`): its doc sat above a
+    helper, so `explain` printed only the signature. It now leads with `[named('picked', on('onPick')), …('{{ picked.seat
+}}')]`, and the CLI skill's plugin section says the same.
+
+- Updated dependencies [6cdd5cf]
+  - @plitzi/sdk-auth@0.38.15
+  - @plitzi/sdk-event-bridge@0.38.15
+  - @plitzi/sdk-interactions@0.38.15
+  - @plitzi/sdk-navigation@0.38.15
+  - @plitzi/sdk-schema@0.38.15
+  - @plitzi/sdk-shared@0.38.15
+
+## 0.38.14
+
+### Patch Changes
+
+- 493955a: ## SDK
+
+  - **An embedded space leaves the page's theme alone** (`@plitzi/plitzi-sdk`, `@plitzi/plitzi-builder`): plitzi-ui's
+    `Provider` stamps `dark` on `<html>` by default — and, being `light`, takes it off — so every space mounted with
+    `themeScope: 'container'` turned the page around it light, and nothing put it back. The SDK and the builder now leave
+    the class to their own theme provider (`applyColorModeClass={false}`).
+  - **A space inside a space** (`@plitzi/plitzi-sdk`, `@plitzi/sdk-shared`): one drawn inside another — the `plitziSdk`
+    element, a plugin rendering one, the builder's canvas — knows it (`render.enclosed`). It is `container` unless it
+    says otherwise, wears its theme on its own root and starts from the page's when its own is `system`, keeps its
+    stylesheet to its own root (`@scope` — its `:root` palette and `.dark` rules repainted the outer page, its
+    `.plitzi-sdk` rule restyled the outer root), writes no `<title>` (`ownsHead`) and no `theme` cookie.
+  - **The `plitziSdk` element draws** (`@plitzi/plitzi-sdk`): it rendered in `widget` mode with no page to show, so it
+    drew nothing. A widget with no `currentPageId` now shows the page its home address would. And it takes a space's
+    documents as well as a key: `offlineData`, bound whole (an `apiContainer`'s answer, a runtime's route, what
+    `plitzi_render` returns) or as `offlineData.schema` and `offlineData.style` from two elements — waiting, without an
+    error, for the half that has not answered; one that cannot be drawn is said why, in the console and on the canvas.
+  - **`<PlitziSdk>` inside a plugin draws** (`@plitzi/plitzi-sdk`): it mounted a router of its own inside the page's, and
+    React Router refused it — `routing: 'memory'` or not. A space inside another is a widget: `raw` becomes `widget`
+    there, one page and no router (a frame of its own, `iframe` or `shadow`, is left as asked).
+  - **A space inside another is as tall as what it holds** (`@plitzi/plitzi-sdk`): its root was `min-h-screen`, as a
+    space that IS the page is, so a card of three lines drawn in a panel took the window's height.
+  - **`<PlitziSdk.Plugin component>` takes a component with its own props** (`@plitzi/plitzi-sdk`), as `render()`'s
+    plugins do: typed `ComponentPluginFC`, it refused any component that read its attributes.
+  - **An edited page keeps its address in step** (`@plitzi/plitzi-sdk`): the routes are built from the pages' own
+    elements, and those were read again only when the list of pages changed — an edit to one page (its slug, its flag)
+    leaves that list the same, and the routes kept its old address until something else rebuilt them.
+  - **Packages declare only what they use** (`@plitzi/sdk-dev-tools`, `@plitzi/sdk-shared`): `@plitzi/sdk-plugins`, which
+    the dev tools no longer import, and `terser`, which no build here runs, are no longer dependencies.
+  - **An edited page keeps its route up to date** (`@plitzi/plitzi-sdk`): the routes are built from the pages' own
+    elements, which were read again only when the list of pages changed — an edit to one page (its slug, its flag) left
+    the list the same and the route at the old address. They follow every edit to a page now, and stay the same object
+    while no page changes.
+  - **`@plitzi/sdk-dev-tools` no longer depends on `@plitzi/sdk-plugins`**, which nothing in it imports.
+  - **A dropdown's menu opens inside a card that lifts or clips** (`@plitzi/sdk-elements`, `@plitzi/sdk-shared`): drawn
+    inside the dropdown, an ancestor with a `transform` — a card lifting on hover — made itself the containing block of
+    the menu's `position: fixed`, and one with `overflow: hidden` cut it off: the menu opened and nobody saw it. The open
+    menu and its backdrop are drawn at the space's root (`spaceRootOf`, `@plitzi/sdk-shared/helpers/spaceRoot`); a
+    style written for the popup by an ancestor's selector no longer reaches it — its own classes do.
+  - **A copy button says when it could not copy** (`@plitzi/sdk-elements`, `@plitzi/sdk-shared`,
+    `@plitzi/sdk-interactions`, `@plitzi/sdk-variables`, `@plitzi/sdk-dev-tools`): a page not served over https has no
+    clipboard — a phone opening a development server by its address — and a code block's "Copy" threw there. It reads
+    "Not copied", and says why. `clipboardWriter` and `copyText` (`@plitzi/sdk-shared/helpers/clipboard`) are the one
+    check, the `copyToClipboard` step's too.
+
+  ## Authoring
+  - **`plitziSdk` is authored like any element** (`@plitzi/sdk-authoring`, `@plitzi/sdk-elements`): its declaration moved
+    to `@plitzi/sdk-elements` beside the others, so it has a factory — `plitziSdk({ id, bind: { offlineData: 'view.data'
+} })` —, its attributes typed, and `plitzi explain` knows it.
+  - **A binding may write part of an attribute** (`@plitzi/sdk-authoring`): `offlineData.schema` writes into
+    `offlineData`, as the runtime always did; authoring refused it as an attribute nothing reads.
+  - **`choosesChildren`** (`@plitzi/sdk-shared`, `@plitzi/sdk-authoring`): a plugin that shows only some of the elements
+    put inside it — a dashboard's panels, a wizard's step — says so in its declaration, and the page checks owe none of
+    them on screen; what it draws is still read by the checks of the whole page (images, sideways scroll, legibility).
+    `verify` was red on every such page.
+
+  - **A page says how the document scrolls** (`@plitzi/sdk-elements`, `@plitzi/sdk-authoring`, `@plitzi/sdk-mcp`):
+    `documentScroll: 'locked'` holds the document still while the page is open — a dashboard or a board used with a
+    finger, where the whole page was dragged and bounced back though nothing in it scrolls — and `'noBounce'` keeps the
+    scroll without the rubber band or pull-to-refresh. The page draws the rule itself, so it is in the server's HTML and
+    leaves with the page; never inside a widget, a space drawn in another, or the builder's canvas. A Settings select,
+    `PageSpec.documentScroll`, `upsertPage`'s `documentScroll` (`null` undoes it) and the page read; an unknown value is
+    refused (`attribute-value`). `upsertPage` is now held to the lint of the page it writes, as element writes are.
+
+  ## MCP
+  - **`@plitzi/sdk-mcp/render`** (`@plitzi/sdk-mcp`): `plitzi_render`'s widget render on its own — no MCP server, no SSR,
+    no OAuth — for a project whose own agent draws in its own pages: `render`, `renderWidgetShape` to declare it as a
+    tool, `renderGuideText` for the agent. `base`, the style of the project's space, brings its tokens, classes and fonts
+    to the widget.
+
+  ## Server
+  - **`publicUrl` says where people reach the server** (`@plitzi/sdk-server`): it was `http://127.0.0.1:<port>` whatever
+    the server was. It is `https` once `serverOptions.tls` gives it a certificate, and this machine's network address
+    with `HOST` open to the network (what a tablet opens, what an OAuth provider sends it back to); `PUBLIC_URL` still
+    wins. The network addresses it prints say `https` too.
+  - **A server serving TLS reaches itself** (`@plitzi/sdk-server`): with a local certificate (mkcert) Node trusts nothing
+    the browsers were told to, so a runtime calling its own MCP failed. Its requests to its own address now connect to its
+    listener and are taken when it presents exactly its certificate (`reachOwnServer`, exported from `/runtime`).
+  - **A runtime reads compressed answers again** (`@plitzi/sdk-server`): the dispatcher `reachOwnServer` (and the
+    platform's `reachSpaceInside`) installs reached every other host with an undici connector that offers HTTP/2, and an
+    answer that came back over h2 reached Node's `fetch` without its `content-encoding` — every API that compresses read
+    as Brotli bytes. Other hosts are reached over HTTP/1.1 now, as Node's own `fetch` reaches them.
+  - **A project's server serves HTTPS from `.env`** (`@plitzi/sdk-server`, `@plitzi/sdk-shared`): `TLS_CERT` and
+    `TLS_KEY`, the certificate's and the key's paths — what `plitzi cert` writes — with no code of the project's;
+    `serverOptions.tls` still wins. A network address the certificate does not name is said at boot, the machine's
+    `.local` name is printed among the addresses when it is named, and a server on loopback alone says how to open it to
+    the network.
+  - **A session survives a phone on the Wi-Fi** (`@plitzi/sdk-server`): a private network address (`192.168.…`, `10.…`,
+    Tailscale's `100.64/10`, IPv6 unique- and link-local) and a machine's mDNS name (`studio.local`) get the local
+    cookie profile — `SameSite=Lax`, no `Secure`, no `Domain`. They got `SameSite=None; Secure`, which a browser drops
+    over http: nobody could sign in from a tablet. A deployment's own `.local` sub-domains (`app.example.local`) keep the
+    strict profile.
+  - **Hiding the dev tools on a server over HTTPS hydrates** (`@plitzi/sdk-server`): a server with a certificate speaks
+    HTTP/2, which sends no `Host` — only `:authority` — and the cookies named for the origin's port (the dev tools'
+    `plitzi_debug_<port>`, forced flags, painted state) were looked for without it. Shift+F12 hid the dev tools in the
+    browser, the server rendered them back, and the page failed to hydrate. Every one is read off `requestAuthority`.
+  - **A rebuild of plugins says it finished** (`@plitzi/sdk-server`): bundles removed under a running server (`tmp/`
+    deleted) were each a warning, "rebuilding…", and their "ready" at a level a project's terminal does not show. It is
+    one episode now: said when noticed, and again when the last is built — how many, how long, which failed.
+  - **`tmp/dev-server.json` records the scheme** (`@plitzi/sdk-server`): `url` is `https` with a certificate, and the
+    file adds the network addresses and the `publicUrl`.
+  - **`public/` is asked about every time** (`@plitzi/sdk-server`): it was cached for an hour — a `.js` or `.css` in it
+    for a year, `immutable` — so a file a project rewrites while it runs arrived stale. It is `no-cache` now, answered
+    `304` by its `ETag` while unchanged; `immutable` stays for what is versioned (the SDK, the plugins).
+
+  ## CLI
+  - **`check`, `shot`, `verify` and `visual` find a server on HTTPS** (`@plitzi/cli`): they rebuilt
+    `http://127.0.0.1:<port>`, so a project serving a certificate had no page checked. They read the URL `npm start`
+    recorded, and take a local certificate on this machine only. A project's `playwright.config.ts` comes from
+    `plitzi upgrade`.
+  - **`verify` runs the project's tests** (`@plitzi/cli`): a step `test`, after the lint, when `package.json` has a
+    `test` script.
+  - **`tsconfig.json` is the project's** (`@plitzi/cli`): the compiler options moved to `plitzi/tsconfig.base.json`, which
+    the CLI keeps up and `tsconfig.json` extends — so a folder of the project's own (`scripts/`, `tools/`) goes in its
+    `include` without changing a file of the CLI's. `plitzi doctor --fix` makes an older `tsconfig.json` extend it,
+    keeping only the options the project changed.
+  - **`doctor --fix` and `upgrade` write as the project's Prettier does** (`@plitzi/cli`): a repaired `tsconfig.json` or
+    `package.json` left `verify`'s format step red.
+  - **`upgrade` renames `usePlitziServiceContext`** (`@plitzi/cli`): with `PlitziServiceProvider` and
+    `PlitziServiceContextValue`, renamed in 0.38.12 with no alias — import, use and the module path that named it.
+  - **`skills update` compares every file** (`@plitzi/cli`): only `SKILL.md` was, so a change in a reference alone was
+    "up to date".
+  - **`NOTES.md`, the project's notes for agents** (`@plitzi/cli`): `AGENTS.md` and `CLAUDE.md` are the CLI's and
+    `upgrade` replaces them, so what a project's own sessions had to know had nowhere to live. `CLAUDE.md` imports
+    `NOTES.md`, `AGENTS.md` sends every agent to it, and nothing the CLI does touches it; `doctor --fix` writes one for
+    a project that has none.
+
+  - **`start:dev-inspect`** (`@plitzi/cli`): a server project's `start:dev` with Node's inspector open on
+    127.0.0.1:9229, so a debugger (VS Code, `chrome://inspect`) attaches to the server, and again after each restart.
+    `plitzi upgrade` adds it; `plitzi runtime add` has it restart on the runtime too.
+  - **`plitzi cert`** (`@plitzi/cli`): HTTPS while developing, for a phone or a tablet on the Wi-Fi — over http its
+    browser gives a page no microphone, camera or clipboard. A certificate from mkcert's local authority for this machine,
+    its network addresses and its `.local` name, in `tmp/tls/`, named in `.env`; what to install on the phone, said.
+  - **A browser project opens to the network** (`@plitzi/cli`): its `vite.config.ts` reads `HOST`, `TLS_CERT` and
+    `TLS_KEY` from `.env`, as a server project does, and writes `tmp/dev-server.json` — the port Vite took and the scheme
+    — so `page check`, `page shot` and `visual` find it on another port or over HTTPS. `plitzi upgrade` brings it.
+
+  ## Docs
+  - **Two plugins share through `state`** (`@plitzi/sdk-authoring` skill): each plugin is a bundle of its own, so a module
+    both import is two copies, and what one keeps there the other never sees.
+  - **`verify --help`** names the project's tests among its steps.
+
+- Updated dependencies [493955a]
+  - @plitzi/sdk-auth@0.38.14
+  - @plitzi/sdk-event-bridge@0.38.14
+  - @plitzi/sdk-interactions@0.38.14
+  - @plitzi/sdk-navigation@0.38.14
+  - @plitzi/sdk-schema@0.38.14
+  - @plitzi/sdk-shared@0.38.14
+
 ## 0.38.13
 
 ### Patch Changes

package/dist/components/MarkdownDocument/components/CodeBlock/CodeBlock.mjs

@@ -1,34 +1,40 @@
 import { useCallback as e, useEffect as t, useState as n } from "react";
 import { jsx as r, jsxs as i } from "react/jsx-runtime";
 import a from "clsx";
+import { NOT_COPIED_REASON as o, copyText as s } from "@plitzi/sdk-shared/helpers/clipboard";
 //#region src/components/MarkdownDocument/components/CodeBlock/CodeBlock.tsx
-var o = 2e3, s = ({ language: s, code: c, classNames: l, children: u }) => {
-	let [d, f] = n(!1);
+var c = 2e3, l = {
+	idle: "Copy",
+	copied: "Copied",
+	refused: "Not copied"
+}, u = ({ language: u, code: d, classNames: f, children: p }) => {
+	let [m, h] = n("idle");
 	t(() => {
-		if (!d) return;
-		let e = setTimeout(() => f(!1), o);
+		if (m === "idle") return;
+		let e = setTimeout(() => h("idle"), c);
 		return () => clearTimeout(e);
+	}, [m]);
+	let g = e(() => {
+		s(d).then((e) => h(e ? "copied" : "refused"));
 	}, [d]);
-	let p = e(() => {
-		navigator.clipboard.writeText(c).then(() => f(!0));
-	}, [c]);
 	return /* @__PURE__ */ i("div", {
-		className: a("markdown-code", l.codeBlockFrame),
-		"data-language": s,
+		className: a("markdown-code", f.codeBlockFrame),
+		"data-language": u,
 		children: [/* @__PURE__ */ i("div", {
-			className: a("markdown-code-header", l.codeBlockHeader),
+			className: a("markdown-code-header", f.codeBlockHeader),
 			children: [/* @__PURE__ */ r("span", {
-				className: a("markdown-code-language", l.codeBlockLanguage),
-				children: s ?? "text"
+				className: a("markdown-code-language", f.codeBlockLanguage),
+				children: u ?? "text"
 			}), /* @__PURE__ */ r("button", {
 				type: "button",
-				className: a("markdown-code-copy", l.codeBlockCopy),
-				onClick: p,
+				className: a("markdown-code-copy", f.codeBlockCopy),
+				onClick: g,
 				"aria-live": "polite",
-				children: d ? "Copied" : "Copy"
+				title: m === "refused" ? o : void 0,
+				children: l[m]
 			})]
-		}), u]
+		}), p]
 	});
 };
 //#endregion
-export { s as default };
+export { u as default };

package/dist/elements/advanced/PlitziSdk/Settings.mjs

@@ -7,33 +7,48 @@ var a = ({ spaceKey: a = "", environment: o = "main", onUpdate: s }) => {
 	let c = e(s);
 	return /* @__PURE__ */ n("div", {
 		className: "flex flex-col gap-4 py-2",
-		children: [/* @__PURE__ */ t(r, {
-			value: a,
-			label: "Space Key",
-			onChange: c.text("spaceKey")
-		}), /* @__PURE__ */ n(i, {
-			value: o,
-			label: "Environment",
-			onChange: c.text("environment"),
-			children: [
-				/* @__PURE__ */ t("option", {
-					value: "main",
-					children: "Main"
-				}),
-				/* @__PURE__ */ t("option", {
-					value: "development",
-					children: "Development"
-				}),
-				/* @__PURE__ */ t("option", {
-					value: "staging",
-					children: "Staging"
-				}),
-				/* @__PURE__ */ t("option", {
-					value: "production",
-					children: "Production"
-				})
-			]
-		})]
+		children: [
+			/* @__PURE__ */ t(r, {
+				value: a,
+				label: "Space Key",
+				onChange: c.text("spaceKey")
+			}),
+			/* @__PURE__ */ n(i, {
+				value: o,
+				label: "Environment",
+				onChange: c.text("environment"),
+				children: [
+					/* @__PURE__ */ t("option", {
+						value: "main",
+						children: "Main"
+					}),
+					/* @__PURE__ */ t("option", {
+						value: "development",
+						children: "Development"
+					}),
+					/* @__PURE__ */ t("option", {
+						value: "staging",
+						children: "Staging"
+					}),
+					/* @__PURE__ */ t("option", {
+						value: "production",
+						children: "Production"
+					})
+				]
+			}),
+			/* @__PURE__ */ n("p", {
+				className: "text-xs",
+				children: [
+					"Or bind ",
+					/* @__PURE__ */ t("code", { children: "offlineData" }),
+					" to a space's documents — an API's answer, a runtime's route — or",
+					/* @__PURE__ */ t("code", { children: "offlineData.schema" }),
+					" and ",
+					/* @__PURE__ */ t("code", { children: "offlineData.style" }),
+					" from two elements, to draw it with no backend; the key is then not read."
+				]
+			})
+		]
 	});
 };
 //#endregion

package/dist/elements/advanced/PlitziSdk/declaration.d.ts

@@ -0,0 +1,39 @@
+import { Environment, OfflineDataRaw } from '@plitzi/sdk-shared';
+/** What this element can be authored with. */
+export type PlitziSdkAttributes = {
+    /** The space drawn, fetched by its key. */
+    spaceKey?: string;
+    environment?: Environment;
+    /**
+     * The space drawn from its documents instead — `schema` and `style` with its compiled `cache`, what `plitzi_render`
+     * answers — with no backend behind it: UI generated on the fly, a preview. Usually bound: whole, to an
+     * `apiContainer`'s answer or a runtime's route, or `offlineData.schema` and `offlineData.style` from two elements.
+     * With it, `spaceKey` is not read.
+     */
+    offlineData?: OfflineDataRaw;
+};
+declare const declaration: import('@plitzi/sdk-shared/authoring/declare').DeclaredElement<{
+    readonly type: "plitziSdk";
+    readonly content: {
+        readonly attributes: {
+            readonly spaceKey: "";
+            readonly environment: "main";
+        };
+        readonly definition: {
+            readonly label: "Plitzi Sdk";
+            readonly description: "Another space drawn inside this one, as a widget — its home page, no router of its own: by its key, or from its documents (`offlineData`), bound to UI generated on the fly.";
+        };
+        readonly market: {
+            readonly category: "advanced";
+            readonly icon: "https://cdn.plitzi.com/resources/img/favicon.svg";
+        };
+        readonly defaultStyle: {
+            readonly style: {
+                readonly base: {
+                    readonly default: {};
+                };
+            };
+        };
+    };
+}, PlitziSdkAttributes>;
+export default declaration;

package/dist/elements/advanced/PlitziSdk/declaration.mjs

@@ -0,0 +1,22 @@
+import { elementDeclaration as e } from "@plitzi/sdk-shared/authoring/declare";
+//#region src/elements/advanced/PlitziSdk/declaration.ts
+var t = e()({
+	type: "plitziSdk",
+	content: {
+		attributes: {
+			spaceKey: "",
+			environment: "main"
+		},
+		definition: {
+			label: "Plitzi Sdk",
+			description: "Another space drawn inside this one, as a widget — its home page, no router of its own: by its key, or from its documents (`offlineData`), bound to UI generated on the fly."
+		},
+		market: {
+			category: "advanced",
+			icon: "https://cdn.plitzi.com/resources/img/favicon.svg"
+		},
+		defaultStyle: { style: { base: { default: {} } } }
+	}
+});
+//#endregion
+export { t as default };

package/dist/elements/basic/Dropdown/Dropdown.d.ts

@@ -12,7 +12,7 @@ export type DropdownProps = {
     containerLeftOffset?: number;
     disabled?: boolean;
 };
-declare const Dropdown: ({ ref, children, className, popupPlacement, openPopup, backgroundDisabled, closeOnClickBackground, closeOnClickPopup, containerTopOffset, containerLeftOffset, disabled }: DropdownProps) => import('react').JSX.Element;
+declare const Dropdown: ({ ref: refProp, children, className, popupPlacement, openPopup, backgroundDisabled, closeOnClickBackground, closeOnClickPopup, containerTopOffset, containerLeftOffset, disabled }: DropdownProps) => import('react').JSX.Element;
 declare const _default: {
     (props: import('../../../Element/hocs/withElement').WithElementProps<DropdownProps>): import('react').JSX.Element;
     displayName: string;

package/dist/elements/basic/Dropdown/Dropdown.mjs

@@ -4,64 +4,78 @@ import { RootElement as n } from "../../../Element/RootElement.mjs";
 import r from "./DropdownContext.mjs";
 import i from "./useDropdown.mjs";
 import a from "./useDropdownTrigger.mjs";
-import { useCallback as o, useMemo as s, useRef as c } from "react";
-import l from "@plitzi/sdk-shared/hooks/usePlitzi";
-import { jsx as u, jsxs as d } from "react/jsx-runtime";
-import f from "clsx";
+import { useCallback as o, useLayoutEffect as s, useMemo as c, useRef as l, useState as u } from "react";
+import d from "@plitzi/sdk-shared/hooks/usePlitzi";
+import { jsx as f, jsxs as p } from "react/jsx-runtime";
+import m from "clsx";
+import { createPortal as h } from "react-dom";
+import { spaceRootOf as g } from "@plitzi/sdk-shared/helpers/spaceRoot";
 //#region src/elements/basic/Dropdown/Dropdown.tsx
-var p = ({ ref: e, children: p, className: m = "", popupPlacement: h = "bottom", openPopup: g = !1, backgroundDisabled: _ = !1, closeOnClickBackground: v = !0, closeOnClickPopup: y = !0, containerTopOffset: b = 5, containerLeftOffset: x = 5, disabled: S = !1 }) => {
-	let { setElementState: C, definition: { styleSelectors: w } } = t(), { settings: { previewMode: T }, utils: { getWindow: E } } = l(), D = c(null), O = c(null), k = s(() => E(), [E]), A = o((e) => {
-		v && (e.stopPropagation(), e.preventDefault(), C((e) => ({
+var _ = ({ ref: e, children: _, className: v = "", popupPlacement: y = "bottom", openPopup: b = !1, backgroundDisabled: x = !1, closeOnClickBackground: S = !0, closeOnClickPopup: C = !0, containerTopOffset: w = 5, containerLeftOffset: T = 5, disabled: E = !1 }) => {
+	let { setElementState: D, definition: { styleSelectors: O } } = t(), { settings: { previewMode: k }, utils: { getWindow: A } } = d(), j = l(null), M = e ?? j, N = l(null), P = l(null), F = c(() => A(), [A]), I = o((e) => {
+		S && (e.stopPropagation(), e.preventDefault(), D((e) => ({
 			...e,
 			openPopup: !1
 		})));
-	}, [v, C]), j = o((e) => {
-		C((t) => ({
+	}, [S, D]), L = o((e) => {
+		D((t) => ({
 			...t,
 			openPopup: e
 		}));
-	}, [C]), [, , M, N, , P] = i({
-		ref: e,
-		popupRef: D,
-		open: g,
-		disabled: !T || S,
-		closeOnClickPopup: y,
-		closeOnClickOutside: v && !_,
-		placement: h,
-		offsetX: x,
-		offsetY: b,
-		myWindow: k,
-		onChange: j
-	}), F = a({
-		popupRef: D,
-		open: g,
-		positioned: !!P,
-		enabled: !!T && !S
-	}), I = o((e) => {
-		F(e), M(e);
-	}, [F, M]), L = s(() => ({
-		popupRef: D,
-		openPopup: g,
-		parameters: P,
-		onClick: N
-	}), [
-		N,
-		g,
-		P
+	}, [D]), [, , R, z, , B] = i({
+		ref: M,
+		popupRef: N,
+		open: b,
+		disabled: !k || E,
+		closeOnClickPopup: C,
+		closeOnClickOutside: S && !x,
+		placement: y,
+		offsetX: T,
+		offsetY: w,
+		myWindow: F,
+		onChange: L
+	}), [V, H] = u(null);
+	s(() => {
+		b && k && !V && H(g(M.current));
+	}, [
+		b,
+		k,
+		V,
+		M
 	]);
-	return /* @__PURE__ */ d(n, {
-		ref: e,
-		className: f("plitzi-component__dropdown", m, { "container--empty--skip": !T && !p }),
-		onClick: I,
-		children: [/* @__PURE__ */ u(r, {
-			value: L,
-			children: p
-		}), g && _ && T && /* @__PURE__ */ u("div", {
-			ref: O,
-			className: f("plitzi-component__dropdown__background-container", w.backgroundContainer),
-			onClick: A
-		})]
+	let U = k ? V : null, W = a({
+		rootRef: M,
+		popupRef: N,
+		open: b,
+		positioned: !!B,
+		enabled: !!k && !E
+	}), G = o((e) => {
+		W(e), R(e);
+	}, [W, R]), K = c(() => ({
+		popupRef: N,
+		openPopup: b,
+		parameters: B,
+		onClick: z,
+		layer: U
+	}), [
+		z,
+		b,
+		B,
+		U
+	]), q = b && x && k && /* @__PURE__ */ f("div", {
+		ref: P,
+		className: m("plitzi-component__dropdown__background-container", O.backgroundContainer),
+		onClick: I
+	});
+	return /* @__PURE__ */ p(n, {
+		ref: M,
+		className: m("plitzi-component__dropdown", v, { "container--empty--skip": !k && !_ }),
+		onClick: G,
+		children: [/* @__PURE__ */ f(r, {
+			value: K,
+			children: _
+		}), q && U ? h(q, U) : q]
 	});
-}, m = e(p);
+}, v = e(_);
 //#endregion
-export { p as Dropdown, m as default };
+export { _ as Dropdown, v as default };

package/dist/elements/basic/Dropdown/DropdownContext.d.ts

@@ -5,6 +5,8 @@ export type DropdownContextValue = {
     openPopup: boolean;
     parameters?: FloatingPosition;
     onClick: (e: MouseEvent) => void;
+    /** Where the open popup is drawn instead of in place: the space's root, once the menu has opened (see `Dropdown`). */
+    layer: HTMLElement | null;
 };
 declare const DropdownContext: import('react').Context<DropdownContextValue>;
 export default DropdownContext;