@plitzi/sdk-interactions 0.38.6 → 0.38.8

package/CHANGELOG.md

@@ -1,5 +1,396 @@
 # @plitzi/sdk-interactions
 
+## 0.38.8
+
+### Patch Changes
+
+- 1b45aae: ## The CLI's commands are named after what they act on
+
+  Every command sits under the thing it acts on — `plitzi element move`, never a bare `move` that could mean anything —
+  and only what acts on the project as a whole or the account stays at the top:
+
+  | Before                                       | Now                                                                |
+  | -------------------------------------------- | ------------------------------------------------------------------ |
+  | `where`, `edit`, `remove`, `move`            | `element where`, `element edit`, `element remove`, `element move`  |
+  | `check`, `shot`, `import`                    | `page check`, `page shot`, `page import`                           |
+  | `space`, `pull`, `push`, `lint`, `fix`       | `space use`, `space pull`, `space push`, `space lint`, `space fix` |
+  | `add plugin`, `pack plugin`, `upload plugin` | `plugin add`, `plugin pack`, `plugin upload`                       |
+  | `add runtime`                                | `runtime add`                                                      |
+  | `pack source`                                | `source pack`                                                      |
+  | `update` (alias of `upgrade`)                | `upgrade`                                                          |
+
+  `create`, `verify`, `doctor`, `upgrade`, `explain`, `feedback`, `login`, `logout` and `whoami` stay at the top, beside
+  `functions`, `runtime`, `data` and `skills`. There are no aliases: a name asked for at the top that is a group's command
+  answers where it is — `There is no plitzi push: it is one of plitzi space push, plitzi runtime push, plitzi functions
+push` — read off the commands themselves. A project's scripts (`lint:space`, `check`, `shot`) call the new names;
+  `plitzi upgrade --write` updates the ones the CLI wrote.
+
+  ## Agents load less to do the same (RFC 0025)
+  - **The MCP lists the operations vocabulary once.** A connection with a space listed ~69k tokens of tools before an
+    agent did anything — the operations schema five times. `plitzi_apply` carries it; `plitzi_render` lists only its
+    operations' types beside it (and keeps the whole schema on a guest connection, where it is alone). The listing is
+    now ~18k tokens.
+  - **`plitzi_validate` is `plitzi_apply`'s `dryRun`**, which already answered the same; the `validate` function, its
+    `validateShape` and `ValidateInput` are gone from `@plitzi/sdk-mcp`.
+  - **`plitzi_apply` looks at the page it would leave**: `look: 'html' | 'image' | 'accessibility' | 'both'` (with
+    `pageRef`, `viewport`, `fullPage`) renders it — with `dryRun`, as the batch would leave it, nothing saved; without, as
+    saved. Check, look and save with the operations written twice, not four times.
+  - **`plitzi_look` is the one way to see a saved page** — its accessibility outline (the default: text, cheap), its HTML
+    or a PNG; `plitzi_preview` and `plitzi_screenshot` are gone. It is always offered: without a browser service it answers
+    the HTML and says so.
+  - **`plitzi_describe_operation { type }`** answers one operation's schema, or every type there is; a type that does not
+    exist is answered with the nearest one.
+  - `closest` is exported from `@plitzi/sdk-authoring`: the nearest of a closed list of names.
+  - **`plitzi element where <id | class | words>`** answers where the project's code writes an element — the file, the line and
+    the call itself — asked of the code as it is now, so it follows an element wherever somebody moved it. A class is
+    found by its name or by the variable that holds it (`nav-link`, `navLink`).
+  - **`plitzi element edit <id> --set key=value --remove key`** writes attributes in that call (`content` where the factory takes
+    it first), keeping each one's kind, formatted as the project formats, and keeps the change only if the space still
+    authors with every value there. Behind both, `locateElements` in `@plitzi/sdk-authoring`: every element with the call
+    that wrote it.
+  - A generated project's `AGENTS.md` says to ask `where` instead of keeping a note of where things are.
+  - **`plitzi doctor` says one fact once**: packages installed from the same place, and packages behind the same version,
+    are one line each — on a project installed from local tarballs, ~1,050 tokens of output became ~330.
+  - **A mistake costs one line.** An operation type that does not exist is answered with the nearest one; a field an
+    operation, an element, a binding or a flow step does not have is refused naming the one meant — it used to be dropped,
+    and `prop` for `props` answered success having applied nothing. An element type spelt with other capitals
+    (`Heading`) is read as the catalog spells it and said in `warnings`.
+  - **The same batch refused twice is not run a third time** (`REPEATED_BATCH`), and the second refusal says so; `plitzi
+edit` does the same, kept in the project's `tmp/refusals.json`.
+  - **`plitzi_apply`'s `look` renders a batch through the path a save takes** (`draftBatch`): a
+    `repeatElement` expanded, what has one reading read, the same refusals.
+  - **Each skill is a core an agent reads every time, and references it opens when the task names one.** The core —
+    what it is for, the rules that go wrong most, a table routing each task to its one file — is held to 1,500 tokens:
+    `plitzi-authoring` went from ~4,000 to ~920 (every rule kept in `reference/rules.md`, the recipes indexed in
+    `reference/recipes.md`, every reference in `reference/index.md`), `plitzi-cli` from ~4,000 to ~820 (projects,
+    plugins and troubleshooting are references of their own), `plitzi-render` from ~3,100 to ~1,050.
+  - **Intent tools on the MCP**: `plitzi_set_attributes`, `plitzi_set_classes` (classes added or removed, the rest
+    kept), `plitzi_bind_attribute`, `plitzi_place_component`, `plitzi_add_page` — a few parameters, the element by its ref alone (the
+    page is found, a ref that does not exist answered with the nearest), checked and saved as `plitzi_apply` saves, and
+    answered in a line with the next step.
+  - **An element may only wear a class the space has, or the batch declares**: `plitzi_apply` used to save one nothing
+    defines — rendered unstyled, said by nobody. It is refused naming the nearest class.
+  - **`plitzi explain` answers any export of `@plitzi/sdk-authoring`** — `pageFamily`, `styles`, `SpaceSpec` — with its
+    signature and the first paragraph of its doc, read from the `.d.ts` the project installed: a few dozen tokens where an
+    agent used to search ~180k of published types.
+  - **`plitzi element where --by id|class|text`** reads a query one way; without it, the first reading that matches is answered
+    and every other one that matched is said with its count and the command for it — a query that means two things is
+    never answered as one. `plitzi element edit` reads its element by id alone.
+  - **A helper written once and called for many elements** is told apart: `locateElements` answers each element's
+    `through` — the calls of the author's code that led to the one that wrote it — so `plitzi element where` says which other
+    elements the same call writes and the call that leads to this one alone, and `plitzi element edit` changes a value the helper
+    is handed where it is handed (`pageHead('about-head', 'About us')`), refuses an edit of a call that writes several
+    elements unless `--every` says so, and never writes `content` beside words given as the factory's first argument.
+  - `plitzi explain` of a name that is the project's own says where to read it.
+  - **Nothing a write does is silent.** `plitzi_apply` answers `effects`: every change the batch made, read off the space
+    before and after it (elements added or removed by subtree, attributes, classes, moves, styles, settings, connectors,
+    actions), with a note where a changed attribute is one a binding computes; a batch that changed nothing says so, and
+    a store with no persister leads the warnings as `NOT saved: …`. The intent tools answer those `effects`, whether it
+    was `saved` and what was already so, refuse to take off a class the element does not wear and to write a value under
+    a binding. `plitzi element edit` reads the whole space before and after the edit (`plitzi element readings`, in a fresh process),
+    prints every change, and puts the files back when anything changed that was not asked, naming it; it refuses an
+    attribute a binding computes, and `plitzi element where` marks those `Bound`. `canonicalJson` (`@plitzi/sdk-shared`) is
+    what every before-and-after comparison is made with. Authoring keeps deep enough a call stack (64 frames) that a
+    helper inside a helper is still told apart.
+  - `locateElements` answers the parts of every component too, in the component (`rootId` is its id): `plitzi element where`
+    and `plitzi element edit` reach an element inside a component as they reach one on a page or a layout.
+
+  ## Fixed
+  - **A layout no longer mounts twice when the page hydrates.** An element with `runtime: 'server'` was wrapped in its
+    static shell while hydrating and handed back without it — under another key — on the next render, so React tore
+    down everything under it and built it again. With a server provider around a layout (an `apiContainer` that draws
+    no markup of its own), the whole layout's DOM was replaced on every page, and every `motion` arrival in it played
+    twice: a visible flicker on load. The shell now stays around the element on both sides of hydration, under the same
+    key, and only stops freezing (`frozen`).
+  - **A component's instance is written somewhere.** `component(…)` — and each child it places in a slot — rebuilt its
+    spec with a spread and lost the marker of where the author wrote it: `plitzi element where` could not place an instance and
+    `plitzi element edit` refused it. The original marker is carried (`carryWrittenAt`); `where` finds the words an instance
+    hands its component, and `edit` writes an instance's props.
+  - `plitzi element edit` follows a value read off a list the call is repeated for (`item.question` in
+    `QUESTIONS.flatMap(item => …)`) to the one entry that holds it, in the file the list is written in; when the shared
+    value is not a literal it says where it comes from instead of offering `--every`.
+  - **`plitzi page check --element` says which class wins.** Each property more than one of the element's classes sets, at
+    rest: the value shown, the class it comes from and what the others say — or that they all set it so. Which wins is
+    asked of the page, each class taken off for a moment; a style change is verified in text, not with a picture.
+  - **`plitzi element where` reads more.** By words it finds every word an element says (`words` on `WrittenElement`: content,
+    `label`, `title`, `alt`, `placeholder`, binding templates, an instance's props); by class it says where the class
+    is declared (`locateClasses` in `@plitzi/sdk-authoring`); an element repeated over a list says which list, and its
+    file; a page or a layout is placed at the object it is declared as.
+  - **`plitzi element edit` edits a page** by the attributes `where` shows (`seoPageTitle` written as `seoTitle`;
+    `PAGE_SPEC_FIELDS` in `@plitzi/sdk-authoring`), refusing `layout` and `seoEnabled`, which are no field of their own;
+    and a value read in more than one place (a list entry a nav and a menu both draw) changes them all only with
+    `--every`, each named.
+  - **A component prop of a type that does not exist is refused** (`prop-type-unknown`, with the types there are):
+    `type: 'string'` was accepted at run time, offered by no editor and checked against nothing. `BUILTIN_PARAM_TYPES`
+    in `@plitzi/sdk-shared` is the list, and `BuiltinParamType` is derived from it.
+  - **`plitzi element remove <id>` and `plitzi element move <id> --before|--after <id>`** take an element out of the code that writes
+    it, or reorder it among its siblings — following a section a helper returns to the helper's call — checked as
+    `edit` is: a removal may take only the element and what it holds, a move only reorder its parent, or the file goes
+    back. Styles and imports only the removed call used go with it, named; a helper left unread is said.
+  - **`plitzi verify`** runs the project's checks — author (no warning), lint:space, typecheck, lint, format — and every
+    page with no parameter, and prints only what fails; a page it could not open is said as not checked. Generated
+    projects get `npm run verify`, and their `AGENTS.md` names it as the way to leave the project passing.
+  - **A component's refusal says where it is written** (by its root's call).
+  - **`check --element`** says a class changes nothing on the element only when every property it sets stays without
+    it, and names the other elements the class is on: changing the class changes them; taking it off this element does
+    not.
+  - **An element's generated selector and binding ids are named after its id**, under its parent's place, not after its
+    position among its siblings: a move renames nothing. Every space written in code gets new generated names once —
+    the same rules, so nothing a visitor sees changes.
+  - A change of an element's children is said as what came, went or moved (`faq moved — now after hero, before pricing`).
+  - **`plitzi page check --click <id>`** clicks one element and says what changed — flows run and how each step ended, the
+    page it went to, what scrolled, what is shown now and what no longer is, the state — or that nothing did, in those words; a flow that
+    succeeded while nothing on the page changed is said as that. A click that could not be made, or a flow that failed,
+    fails the check.
+  - **A refusal of the authored space's gate says where**: each of the validator's errors (`UNRESOLVED_INTERACTION_TARGET`,
+    `UNRESOLVED_BINDING_SOURCE`, …) carries the file and line of the element it is about, and a name nothing answers to is
+    offered the nearest element that answers the step it was for (`openModal('search')` → `search-modal`, not the
+    `search-q` field), or the few that do. `SchemaValidationError` gains `missing` and `wantedBy` (`@plitzi/sdk-schema`).
+  - **`plitzi element where` finds the words a list's rows show** when the list is handed them as data (`items:
+[...PLANS]`), and says the list they are the entries of and its file (`Its rows are the entries of PLANS
+(src/space/enterprise/content.ts)`).
+  - `plitzi page check --click` says what is **shown** now and what no longer is (drawn, wherever the page is scrolled),
+    not "on screen".
+  - `plitzi upgrade` says packages installed locally in one line past three, and a skill rewritten within the same
+    version as that, not `0.38.7 → 0.38.7`.
+  - **What `element edit`, `remove` and `move` read back goes through the gate `npm run author` does**: a change that
+    leaves the space refused — a flow still opening a modal that was removed — is put back, the refusal said with where.
+    `element remove` refuses before writing when another element's flows act on what it takes away, and says what it
+    took once, by the outermost element (`search-modal removed, with 18 inside`). Moving an element beside itself is
+    refused as nothing to do.
+  - **An id, a plugin folder or a data file written a letter off is offered the nearest one** (`element where`, `edit`,
+    `remove`, `move`, `plugin pack`, `data describe`).
+  - **A project file that does not load is said at its file and line** — `src/space/hero.ts:139: Expected ','` — by the
+    server, `npm run author` and every CLI command, never as a stack (`ProjectModuleError` and `moduleProblem` in
+    `@plitzi/sdk-authoring/node`).
+  - **`plitzi verify` stops at the first failure** — one broken file fails every later step the same way — and says the
+    rest as not run (`--keep-going` runs them anyway); `--no-pages` no longer fails a run that passed.
+  - **`plitzi space fix` no longer drops attributes written one level too deep**: `attributes: { value: 5 }` where
+    `value: 5` was meant is put in its place (a new `unwrap` fix), not removed with what it said.
+  - **`plitzi explain <type>` explains the project's own elements** (`src/plugins/`), and `plugin add` prints how to place
+    one with the attributes it was declared with.
+  - **`plitzi data describe` says an object keyed by data once**, as a map of one shape with how many keys, so a file of
+    five hundred articles reads as one.
+  - **`plitzi page check` says a path no page answers before opening it**, with the paths the pages do answer — never a
+    redirect home read as a page for signed-in visitors.
+  - **`copyToClipboard(text)`**, a utility step (`@plitzi/sdk-interactions`, built with `copyToClipboard` in
+    `@plitzi/sdk-authoring`): a "Copy link" button had no step to write with. A browser that gives the page no clipboard
+    fails the step, so a toast after it is never said of a copy that was not made.
+  - **`plitzi explain` lists the values a param takes only when it is a choice** (`select`): `setState`'s `value` read
+    as `'true' | 'false'`, the examples of a free value taken for its only ones.
+  - **`plitzi page check --click` says what the page said** — a toast or an alert, `said: "Link copied"` — and **a form
+    the browser held back**, with the field and the browser's reason, never as a click that changed nothing.
+  - **`plitzi page check --click <id> --fill <id>=<value>`** fills fields before the click as a visitor does (typed, an
+    option chosen, a box ticked), so a form's success flow is checked, not only its refusal when empty. A container of
+    several fields is refused with their ids; a field filled inside another element says whose it is.
+
+- Updated dependencies [1b45aae]
+  - @plitzi/sdk-shared@0.38.8
+  - @plitzi/sdk-auth@0.38.8
+  - @plitzi/sdk-event-bridge@0.38.8
+
+## 0.38.7
+
+### Patch Changes
+
+- c7bbc2b: ## A server project's `src/main.ts` is a few lines
+
+  - **`serveProject` from `@plitzi/sdk-server/project`**: the generated `src/main.ts` hands the space, its actions and
+    its options to the server, and the rest comes with the package — the port, the plugins of `src/plugins` and
+    `vendor/plugins`, the functions and runtime, `public/`, `src/data/`, the `kv` in `state/kv.json`, `/health`,
+    `tmp/dev-server.json` and the reloads while developing. A fix there arrives with `npm update`, not `plitzi upgrade`.
+  - **No more `tmp/space.json` while developing**: a saved space is authored again in its own process and handed to the
+    server over IPC (`plitzi/author.ts --ipc`, in place of `--out`); the server swaps it in memory and the open pages
+    reload, and a refused space keeps the last one that authored. `plitzi doctor` reports a leftover `tmp/space.json`.
+  - **`projectAuthoring()` in `@plitzi/sdk-authoring/node`**: what a project's space is checked against — its plugins'
+    declarations, its built plugins, its data files — once, for the server and `npm run author` alike. Neither it nor
+    `serveProject` takes a root: it is the working directory, where every script runs (`projectAuthoringAt(root)` for a
+    tool working on another folder).
+  - **`authorProjectSpace` and `projectSpace()` in `@plitzi/sdk-authoring/node`**: the project's space read from
+    `src/space/index.ts` — `dist/space/index.js` when the server runs built — once its root and layout are checked, and
+    authored. `src/main.ts` is `serveProject({ space: authorProjectSpace, actions, connectors, serverOptions })`, with no
+    import of the space; `plitzi/author.ts`, the visual tests and the CLI's checks read it the same way. A module that
+    exports no `space` is refused saying what to export (`ProjectSpaceError`).
+  - **`.env` lives at the root and Node reads it** as each script starts (`--env-file-if-exists=.env`; `start:dev`
+    preloads `@plitzi/sdk-server/env`, since a watched process would restart on every change beside the file). Settings
+    read at the top level of `src/config/serverOptions.ts` or the actions are set. Every project gets `.env` and
+    `.env.example`; `plitzi upgrade` removes the old `src/env.ts`.
+  - **One check of a project's layout** (`@plitzi/sdk-shared/project/layout`): a plugin folder with no entry, a
+    JavaScript entry, `src/plugin/` for `src/plugins/`, a `.env` inside `src/`, a space exported by default, a broken
+    `vendor/` plugin… The server refuses to boot listing every error with its fix, `npm run author` and the CLI's checks
+    refuse with the same words, `plitzi doctor` lists them under `layout` and `--fix` makes the ones with a single fix,
+    and `plitzi lint` points at doctor. A plugin folder added broken while developing is reported in the terminal
+    instead of failing in esbuild. Plugins may start at `index.tsx`.
+  - **`createJsonAdapters` serves documents held in memory**: `offlineData` may be a function returning them, not only a
+    path.
+  - **One source for a project's layout**, `@plitzi/sdk-shared/project/paths`; `src/config/serverOptions.ts` is typed
+    `ProjectServerOptions`. `plitzi upgrade files --write` brings an existing project's `main.ts` and `author.ts` up.
+  - **`npm run build` no longer fails on a plugin's stylesheet**: `tsconfig.build.json` includes `plitzi/assets.d.ts`,
+    which a space importing a plugin's declaration reaches through its component.
+
+  ## A write refreshes what shows it
+  - **Writes now refresh server-driven providers.** `runServerAction`, `webHook`, `writeRecord` and the
+    `invalidateQueries` step reach `runtime: 'server'` api containers by id, by `query` URL, or all of them, just as
+    they reach cached browser requests. Before, they reached only the browser's query cache, so a saved write left the
+    page showing the old value until a reload. Hidden providers refresh when they are shown.
+  - **A refresh because something changed asks around every cache.** `performQuery`, writes and invalidations send
+    `Cache-Control: no-cache`; `/_rsc` resolves such a request again instead of serving its cached slice, and keeps the
+    new answer. A `refreshSeconds` timer and a "load more" page still go through the caches.
+  - **`refreshRsc`'s fourth argument is an options object**, `{ location?, fresh? }`.
+
+  ## A space's functions read its data
+  - **`ctx.data('products.json')`** reads one file of the space's data (a project's `src/data/`), parsed and read-only,
+    as of the run's version. Plugins' functions are refused it.
+  - **Self-hosted servers read `dataDir` through the same lookup as the platform**, so `/data/<file>` providers and
+    `ctx.data` read the same files; `plitzi functions dev` reads `src/data`. `/data/../x.json` is now the provider's
+    error state instead of falling through to `publicDir`.
+  - **Importing a file outside `functions/` names the boundary and the fix**: read the space's data with
+    `ctx.data('<file>')`.
+
+  ## Signing in on a self-hosted server
+  - **`createServer({ auth })` tells the pages it renders where to sign in** (`server.auth`: provider, endpoints and
+    the session hint cookie), so a space signs in with no auth settings declared. Settings a space does declare still
+    win, and a space that names another provider ignores the server's description. New `pageAuth` server option, for a
+    deployment whose `/auth` flows are served by another host.
+  - **A page with no auth provider no longer offers `auth.login` / `auth.logout`**, and a sign-in that cannot work says
+    why in the console (`[plitzi] auth.login: …`) instead of failing silently. What a visitor keeps there
+    (`keepState`, `paintedState`) is the browser's, as on any space without accounts: what was kept as a guest's on such
+    a page before is let go once, on the first visit after the upgrade.
+  - **Renewal verifies the refresh token itself.** `findByRefreshToken` no longer has to report `refreshExpiresAt`; when
+    it does, it overrides the token's own expiry.
+  - **New authoring reference `auth.md`**: providers, `authLogin` and its result, `authLogout`, `{{ auth.* }}`,
+    `accessLevel`, visitor roles, action `access` and `ctx.user`.
+
+  ## Flows
+  - **Authoring refuses a `when` that asks a step for a key it never publishes** (`condition-field-unpublished`).
+    `whenSucceeded` / `whenFailed` after `authLogin` always ran the failure branch: they read a server action's
+    `status`. The message names what the step publishes and suggests testing `signedIn.ok` with `when`.
+  - **`explain` lists what a step publishes** (`Reads:`) and finds the auth steps by their builders (`authLogin`,
+    `authLogout`, `authRefreshDetails`). `authLogin({ username, password })` no longer needs `mode`.
+
+  ## Elements
+  - **Images no longer default to a 140×140 square**: they are 140px wide and as tall as their ratio, so `width` or
+    `aspect-ratio` on a class just works. `object-fit` shows in the builder too.
+  - **`formControl` with `subType: 'switch'` renders an on/off switch** (`role="switch"`) — it rendered only its label.
+    Checkboxes and switches show a `true` default or binding as ticked.
+  - **The theme toggle drops the native button look**, and the **`current` style state covers the chosen item of any
+    set**: the link to the page shown, a pressed toggle, a selected tab. The exported `CURRENT_PAGE_SELECTOR` is now
+    `CURRENT_SELECTOR`.
+  - **Element defaults in the style inspector and the MCP catalogue match what the SDK renders**, held by a test. The
+    dialog's `bodyContainer` and `headerCloseButton` slots now reach the page; pagination lays out as declared.
+  - **Markdown takes a class for each part of the document** through its own slot (`heading`, `paragraph`, `link`,
+    `list`, `listItem`, `quote`, `code`, `codeBlock`, `image`, `table`, `anchor`), and `headingLinks: false` drops the
+    link each heading offers to itself while keeping its id, so `/page#anchor` links still work. Its description spells
+    out the HTML it outputs.
+  - **Tabs show every trigger.** The SDK hid every inactive tab item, the header's included, so a set of tabs showed
+    one tab and no way to the others; only the body's panels take turns now.
+  - **A link that names a query is current only on that query**: of `/?window=6h` and `/?window=24h`, the one shown
+    carries `aria-current` — with the path alone, every one of them did. A link with no query is still current on its
+    page whatever the query.
+
+  ## The style language says what `customCss` used to
+  - **Pseudo-elements on a class**: `pseudos: { after: { css: { content: '"→"' }, states: { hover: { … } } } }` —
+    `before`, `after`, `marker`, `placeholder`, `first-letter`, `first-line`, `selection`, each in the class's states and
+    variants. Authoring refuses what draws nothing: a `before`/`after` with no `content`, a `content` without its quotes,
+    a property the browser drops on that pseudo-element.
+  - **Conditions on a class**: `conditions: { 'motion-reduce': { … }, 'container card (max-width: 30rem)': { … } }` —
+    reduced or allowed motion, and container widths, each with its states and pseudo-elements.
+  - **The space's `keyframes`**, validated and written at the top of `customCss`; an `animation-name` no keyframes declare
+    is warned (`animation-name-unknown`).
+  - **New states**: `expanded` (`aria-expanded`), `first`, `last`, `odd`, `even`; the tab panel on show is `current`, and
+    the theme toggle's icon of the scheme in use is `current` on its `icon` slot.
+  - **`ancestors['>']`** is the parent, whatever it wears — a closed component's part reacting to the element around it.
+  - The builder's style inspector, the MCP's definition ops (`pseudos`, `conditions`, and variants with their states) and
+    the export to code read and write all of it; an MCP `patchDefinition` no longer drops what it did not name. Rules in
+    `customCss` a class can hold now — `.link::after`, one under `@media (prefers-reduced-motion: reduce)`, `.row:first-child`,
+    `.row:nth-child(even)`, `.toggle[aria-expanded='true']` — are folded into the class on export and suggested by
+    `custom-css-class`.
+
+  ## Elements take a class for each part
+  - **`formControl`**: `field` (the `<input>` itself), `icon` (the show-password button) and `requiredMark` slots; a switch's
+    knob reads in dark mode and takes `--plitzi-switch-thumb`, `--plitzi-switch-thumb-checked`, `--plitzi-switch-thumb-shadow`.
+  - **`pagination`**: `previous`, `page` (the one shown is its `current` state), `next`, `loadMore`.
+  - **`richText`** and **`markdown`**: a slot per part — `heading` and `heading1`…`heading6`, `strong`, `emphasis`,
+    `divider`, `tableHead`, `tableRow`, `tableHeaderCell`, `tableCell`, and the code block's frame, header, language and
+    copy button. Both heading slots dress one `<h3>`, so `heading-level-overridden` warns when they set the same property
+    and the stylesheet's order makes the general one win. A document is drawn by the SDK's own renderer
+    (`MarkdownDocument` in `@plitzi/sdk-elements`) — plitzi-ui's `Markdown` keeps GitHub's stylesheet for a library's
+    consumers — and reads as a document unstyled: headings, lists, code, tables and quotes get their type from the SDK's
+    base layer, at no weight (`:where()`), so a class on a part's slot replaces what it sets property by property. A
+    `richText` body reads the same.
+  - `custom-css-slot` suggests the slot for a `customCss` rule on a part's SDK class — only where a class on the slot can
+    say the rest of the selector (a state, a pseudo-element); `element-slot-unknown` warns of a slot an element does not
+    have.
+
+  ## Links, refreshes and toasts
+  - **`current: 'section'` on a link** keeps it current on its page and every page under its path (`aria-current="true"`
+    there), styled by the `current` state — no `activeOn` binding for a section.
+  - **A refresh asks only about elements the page shown holds**: a provider on the page being left no longer sends a
+    `/_rsc` about the new address.
+  - **The toasts' parts are `notifications` fields**: `minHeight`, `fontWeight`, `lineHeight`, `iconSize`, `iconGap`,
+    `closeColor`, `closeOpacity`, `progressHeight`.
+  - **A page asked for with its space's token hydrates its own space.** On a host serving many spaces
+    (`?access-token=`), the space document fetched beside the page went without the token, so the host's own space
+    answered it and the browser hydrated another space's document over the page — a hydration error, and its tree
+    rebuilt. The document's address now carries the token the page was asked for with.
+  - **The SDK's stylesheet carries the space's variables from the server's HTML.** It read them from what a provider
+    below it publishes while the page renders, which the server had not done yet when it wrote the sheet; it now
+    resolves them from the document itself (`useResolvedVariables` of `@plitzi/sdk-shared/dataSource/hooks`), the same
+    on both sides.
+  - **A realtime message the pub/sub cannot deliver is answered, not fatal.** A publish that Redis refuses — a timeout under
+    load — is answered `503` with `reason: 'unavailable'`, by the `POST` and in the WebSocket's `ack` alike; a connect,
+    a disconnect or a revoke that fails is logged, on either transport. Each used to reject with nobody waiting, and the server's `unhandledRejection` handler
+    shut the whole process down.
+
+  ## Reporting to Plitzi
+  - **`plitzi feedback`** starts a report of what broke, misled or cost time: it writes the page the report is laid out
+    in (`tmp/feedback/`) with the installed versions, the project and what `doctor` finds already in it, and tells the
+    agent how to fill it — each finding reproduced first, with evidence, impact, workaround and fix, no secrets — and to
+    publish it as an artifact whose link the developer sends. `--previous <url>` continues an earlier report.
+
+  ## Pages that load on every browser
+  - **The import map comes before anything that loads a module**, in the page server's HTML, a published site's
+    (`index.hbs` on the platform), the SDK's and the builder's. React's `modulepreload` links came first, and a browser
+    that had fetched a module already — Chrome before 133 — ignored the map: every bare `import "react"` failed
+    ("Failed to resolve module specifier") and the page never hydrated.
+
+  ## The dev tools
+  - **A page loads the React its dev tools need.** The development build only while the visitor has the dev tools on
+    (shift+F12, within what the deployment allows); turned off, the next load is a production page, React included. It
+    followed the authorization alone, so a space that allowed debugging always shipped development React.
+
+  ## check and lint
+  - **`plitzi check`, `push`, `lint` and `fix` hold the space to what `npm run author` and the server do**: its data
+    files too, so `push` no longer sends a space whose browser provider reads `src/data/` (`server-data-in-browser`).
+  - **`plitzi check` lists each list's rows as drawn and as held in its source** (`feed 4 of 8 rows`,
+    `hits not rendered (16 in its source)`). In `--json`, `lists` is now `{ id: { rendered, source } }`.
+  - **`plitzi check` no longer reports bindings inside a container the page isn't showing**, nor text "in the colour
+    behind it" because of a bar painted over it or a pane that clips it.
+  - **`window.__plitzi.sources()` no longer turns a shared array into `'[…]'`**, and a list row no longer replaces its
+    list's `items`.
+  - **`plitzi lint` says authoring suggestions are quieted with `quiet` on the element**, and reports a
+    `plitzi-lint-disable` comment that names one (`disable-names-suggestion`).
+  - **`plitzi check` says when a page sent the browser elsewhere** (a page for signed-in visitors, to the sign-in) instead
+    of reporting every element missing, and `--as <username>` signs in first through the server's `/auth` routes, the
+    password from `PLITZI_CHECK_PASSWORD`.
+  - **`plitzi upgrade` never replaces @plitzi packages installed locally** — a tarball, a link, a portal, an override: it
+    leaves them and the install, and says which and the command that would install the registry's.
+  - **`plitzi explain` covers every code**: authoring's, `plitzi lint`'s and the project layout's.
+  - **Authoring reads the global sources' fields**: `auth.authenticated` in a condition is refused with "did you mean
+    `isAuthenticated`?" (`global-field-unknown`), and `invalidateElements` must name providers that exist
+    (`element-ids-target`). A template's reads of `computed`, `flags` and the global sources come off the parsed
+    template: a string inside it (`'https://auth.acme.com'`) is no longer read as `auth.acme`.
+  - **`custom-css-notifications` no longer reads the rules `notifications` itself writes** as toasts dressed by hand.
+  - **A refused space or layout is a report, not a stack**: the server's entry point imports the space once the layout is
+    checked, and `npm start` and `npm run author` print every problem and exit with 1.
+  - **New authoring suggestion `class-overrides-class`**: one class's shorthand (`padding`) silently erases a longhand
+    (`padding-top`) another class on the same element writes out.
+
+- Updated dependencies [c7bbc2b]
+  - @plitzi/sdk-auth@0.38.7
+  - @plitzi/sdk-event-bridge@0.38.7
+  - @plitzi/sdk-shared@0.38.7
+
 ## 0.38.6
 
 ### Patch Changes

package/dist/InteractionsSourcesProvider.mjs

@@ -9,26 +9,22 @@ import { jsx as s } from "react/jsx-runtime";
 import { useRenderSettings as c, useSdkStore as l } from "@plitzi/sdk-shared/store";
 //#region src/InteractionsSourcesProvider.tsx
 var u = ({ children: u, hostActions: d }) => {
-	let [[f = "basic", p, m, h]] = l([
-		"schema.settings.userProvider",
+	let [[f, p, m]] = l([
 		"navigation.routeParams",
 		"navigation.queryParams",
 		"navigation.currentPageId"
-	]), { previewMode: g } = c();
+	]), { previewMode: h } = c();
 	return /* @__PURE__ */ s(e, {
-		currentPageId: h,
-		routeParams: p,
-		queryParams: m,
-		children: /* @__PURE__ */ s(n, {
-			authProvider: f,
-			children: /* @__PURE__ */ s(o, { children: /* @__PURE__ */ s(t, { children: /* @__PURE__ */ s(a, { children: /* @__PURE__ */ s(i, {
-				previewMode: g,
-				children: /* @__PURE__ */ s(r, {
-					actions: d,
-					children: u
-				})
-			}) }) }) })
-		})
+		currentPageId: m,
+		routeParams: f,
+		queryParams: p,
+		children: /* @__PURE__ */ s(n, { children: /* @__PURE__ */ s(o, { children: /* @__PURE__ */ s(t, { children: /* @__PURE__ */ s(a, { children: /* @__PURE__ */ s(i, {
+			previewMode: h,
+			children: /* @__PURE__ */ s(r, {
+				actions: d,
+				children: u
+			})
+		}) }) }) }) })
 	});
 };
 //#endregion

package/dist/sources/AuthSource/AuthInteractions.d.ts

@@ -1,7 +1,6 @@
 import { ReactNode } from 'react';
 export type AuthInteractionsProps = {
     children?: ReactNode;
-    authProvider?: string;
 };
-declare const AuthInteractions: ({ children, authProvider }: AuthInteractionsProps) => ReactNode;
+declare const AuthInteractions: ({ children }: AuthInteractionsProps) => ReactNode;
 export default AuthInteractions;

package/dist/sources/AuthSource/AuthInteractions.mjs

@@ -1,24 +1,24 @@
 import e from "../../InteractionsContext.mjs";
 import { authCallbacks as t } from "./callbacks.mjs";
-import { use as n, useCallback as r, useMemo as i } from "react";
-import { toInteractionCallbacks as a } from "@plitzi/sdk-shared/authoring/builder";
-import { AuthContext as o } from "@plitzi/sdk-auth";
+import { use as n, useMemo as r } from "react";
+import { toInteractionCallbacks as i } from "@plitzi/sdk-shared/authoring/builder";
+import { AuthContext as a } from "@plitzi/sdk-auth";
 //#region src/sources/AuthSource/AuthInteractions.tsx
-var s = ({ children: s, authProvider: c = "basic" }) => {
-	let { login: l, refresh: u, logout: d } = n(o), { useInteractions: f } = n(e), p = r((e) => l(e), [l]), m = r((e) => u(e), [u]), h = r(() => d(), [d]);
-	return f({
+var o = ({ children: o }) => {
+	let { login: s, refresh: c, logout: l, provider: u } = n(a), { useInteractions: d } = n(e);
+	return d({
 		id: "auth",
-		callbacks: i(() => c === "" ? {} : a(t, {
-			login: p,
-			refreshDetails: m,
-			logout: h
+		callbacks: r(() => !u || !s || !c || !l ? {} : i(t, {
+			login: (e) => s(e),
+			refreshDetails: (e) => c(e),
+			logout: () => l()
 		}), [
-			p,
-			h,
-			m,
-			c
+			s,
+			l,
+			c,
+			u
 		])
-	}), s;
+	}), o;
 };
 //#endregion
-export { s as default };
+export { o as default };

package/dist/sources/AuthSource/callbacks.d.ts

@@ -27,6 +27,6 @@ import { BuiltinGlobalCallback } from '@plitzi/sdk-shared/authoring/builder';
  *
  * There is no user on a `TokenResult`, deliberately: who the session belongs to is loaded separately and arrives on
  * the `auth` source, not out of this step. A flow that wants to greet somebody by name reads what they typed, or
- * reads `auth.user` on a later render.
+ * reads `auth.details.username` on a later render.
  */
 export declare const authCallbacks: Record<string, BuiltinGlobalCallback>;

package/dist/sources/QueriesSource/writeParams.mjs

@@ -7,7 +7,7 @@ var e = {
 }, t = (t, n = () => !0) => ({
 	invalidateQueries: {
 		type: "select",
-		description: "What to refresh once the write succeeded, so the page shows the new data: the cached requests to the same site, all of them, only the api containers named in `invalidateElements`, or none for a step that only reads. Containers on screen ask again at once; the rest when they are shown.",
+		description: "What to refresh once the write succeeded, so the page shows the new data: the requests to the same site, every provider on the page, only the api containers named in `invalidateElements`, or none for a step that only reads. Server-driven containers are refreshed too, asking the server past its cache. Containers on screen ask again at once; the rest when they are shown.",
 		default: t[0],
 		options: [...t],
 		optionLabels: Object.fromEntries(t.map((t) => [t, e[t]])),

package/dist/utility/copyToClipboard.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Writes `text` to the visitor's clipboard. A browser with no clipboard — an insecure origin, a document without focus,
+ * a permission refused — throws, and the step fails with what it said: the flow's `onFailure` is where to tell them.
+ */
+declare const copyToClipboard: import('@plitzi/sdk-shared').InteractionCallback<{
+    text: string;
+}>;
+export default copyToClipboard;

package/dist/utility/copyToClipboard.mjs

@@ -0,0 +1,10 @@
+import { copyToClipboardSpec as e } from "./copyToClipboardSpec.mjs";
+import { toInteractionCallback as t } from "@plitzi/sdk-shared/authoring/builder";
+//#region src/utility/copyToClipboard.ts
+var n = t("copyToClipboard", e, async ({ text: e }) => {
+	let t = typeof navigator > "u" ? void 0 : Reflect.get(navigator, "clipboard"), n = typeof t == "object" && t ? Reflect.get(t, "writeText") : void 0;
+	if (typeof n != "function") throw Error("This page has no clipboard to write to: the browser offers none here (a page not on https?)");
+	await Reflect.apply(n, t, [e]);
+});
+//#endregion
+export { n as default };

package/dist/utility/copyToClipboardSpec.d.ts

@@ -0,0 +1,8 @@
+import { BuiltinActionSpec } from '@plitzi/sdk-shared/authoring/builder';
+/**
+ * The copy-to-clipboard step, as the editor and anything authoring one offline read it: the words to copy — a template
+ * like any step's param, so `{{ navigation.href }}` copies the page's address and `{{ snippet.code }}` what a source
+ * holds. Run where there is no clipboard to write to, or one the browser refuses, the step fails: the flow stops and
+ * its `onFailure` runs, so "Copied" is never said of something that was not.
+ */
+export declare const copyToClipboardSpec: BuiltinActionSpec;

package/dist/utility/copyToClipboardSpec.mjs

@@ -0,0 +1,15 @@
+//#region src/utility/copyToClipboardSpec.ts
+var e = {
+	title: "Copy To Clipboard",
+	type: "utility",
+	strictParams: !0,
+	params: { text: {
+		type: "text",
+		description: "The words to copy — a template reads the page: {{ navigation.href }} is its address.",
+		default: "",
+		label: "Text",
+		required: !0
+	} }
+};
+//#endregion
+export { e as copyToClipboardSpec };

package/dist/utility/index.d.ts

@@ -1,4 +1,7 @@
 declare const _default: {
+    copyToClipboard: import('@plitzi/sdk-shared').InteractionCallback<{
+        text: string;
+    }>;
     delayTime: import('@plitzi/sdk-shared').InteractionCallback<{
         time: number;
     }>;

package/dist/utility/index.mjs

@@ -1,11 +1,13 @@
-import e from "./delayTime.mjs";
-import t from "./twigTemplate.mjs";
-import n from "./webHook.mjs";
+import e from "./copyToClipboard.mjs";
+import t from "./delayTime.mjs";
+import n from "./twigTemplate.mjs";
+import r from "./webHook.mjs";
 //#region src/utility/index.ts
-var r = {
-	delayTime: e,
-	twigTemplate: t,
-	webHook: n
+var i = {
+	copyToClipboard: e,
+	delayTime: t,
+	twigTemplate: n,
+	webHook: r
 };
 //#endregion
-export { r as default };
+export { i as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-interactions",
-  "version": "0.38.6",
+  "version": "0.38.8",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -154,6 +154,14 @@
       "types": "./dist/utility/index.d.ts",
       "import": "./dist/utility/index.mjs"
     },
+    "./utility/copyToClipboard": {
+      "types": "./dist/utility/copyToClipboard.d.ts",
+      "import": "./dist/utility/copyToClipboard.mjs"
+    },
+    "./utility/copyToClipboardSpec": {
+      "types": "./dist/utility/copyToClipboardSpec.d.ts",
+      "import": "./dist/utility/copyToClipboardSpec.mjs"
+    },
     "./utility/delayTime": {
       "types": "./dist/utility/delayTime.d.ts",
       "import": "./dist/utility/delayTime.mjs"
@@ -194,10 +202,10 @@
     "vitest": "^5.0.3"
   },
   "dependencies": {
-    "@plitzi/plitzi-ui": "^1.6.31",
-    "@plitzi/sdk-auth": "0.38.6",
-    "@plitzi/sdk-event-bridge": "0.38.6",
-    "@plitzi/sdk-shared": "0.38.6"
+    "@plitzi/plitzi-ui": "^1.6.32",
+    "@plitzi/sdk-auth": "0.38.8",
+    "@plitzi/sdk-event-bridge": "0.38.8",
+    "@plitzi/sdk-shared": "0.38.8"
   },
   "peerDependencies": {
     "react": "^19"