@plitzi/sdk-server 0.35.9 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @plitzi/sdk-server
 
+## 0.36.0
+
+### Minor Changes
+
+- - **An `apiContainer` can keep its browser requests in a query cache, the way react-query does.** Moving between
+    sections or pages used to ask the API again every time a provider was shown: a provider in a hidden section is
+    mounted but disabled, so showing it fired a fresh request, and a page navigation remounted it and did the same.
+    With the new `cache: true` an answer is kept for `staleTime` seconds (30 by default) and shared by every cached
+    provider asking the same thing — same method, URL, credentials and headers, the token included, so two visitors
+    never share one. Past its time the answer is still drawn at once and a fresh one is fetched behind it; an answer
+    nobody shows is forgotten after `gcTime` seconds (300 by default). A refused request (`4xx`/`5xx`) is shown but
+    never kept. **The cache is off unless an element asks for it**: an uncached provider behaves as before, asking on
+    every mount and sharing nothing.
+
+    The cache is `@plitzi/sdk-shared/queries` (`queryCache`, `useQuery`, `invalidateQueries`,
+    `invalidateQueriesForWrite`), a nexus store written with the per-path `ttl` of `@plitzi/nexus` 1.2.0, which every
+    consumer now requires. It reacts to the store's own freshness events, so anything that expires a query's path
+    makes the providers on screen ask again.
+
+    An answer stops counting as current before its time when the element's `performQuery` runs (it always asks
+    again), when a flow runs the new global `invalidateQueries` step (source `queries`: `elements`, api container ids
+    — a container's requests are tagged with its own id — and/or a `url` prefix), and after a write. Both write steps
+    gained `invalidateQueries` / `invalidateElements`: a `webHook` sent with anything but `GET`/`HEAD` refreshes the
+    requests to its own site by default, a completed `runServerAction` refreshes all of them by default, and either
+    can name containers instead or refresh nothing. A `writeRecord` refreshes all. Providers on screen ask again at
+    once; the rest when they are next shown. A sign-in, sign-out or change of account drops everything held. Server-driven
+    providers and RSC are untouched.
+
+  - **A `webHook` that reads can be cached** (`cache`, `staleTime`), in the same cache and under the same key as an api
+    container asking the same thing. Its declaration now lives beside it (`utility/webHookSpec`) and the authoring
+    catalog gathers it instead of keeping a copy. A `HEAD` is no longer sent with a body, which `fetch` refused.
+
+  - **Step params can pick several elements.** A new param type, `elementIds` (with an `elementType` filter), is drawn
+    in the flow editor as a picker: the matching elements of the space to add, and the picked ones as chips to remove —
+    an id no element answers to any more is kept and flagged. The value is a list of ids, so nobody types a
+    comma-separated list; `invalidateQueries.elements` and the write steps' `invalidateElements` use it, and the MCP
+    catalog says which element type each such param takes.
+
+  - The dev-tools' Store tab lists the paths a store holds with a TTL — how long ago each was written, what is left
+    of it, and a button to expire one or all of them. The query cache appears there as "Queries".
+
+  - `useApi` no longer takes `params`: nothing passed them, and a GET cannot carry a body anyway. A mock now answers
+    synchronously, without a loading frame, and a provider whose URL has not resolved asks for nothing.
+
+### Patch Changes
+
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.36.0
+  - @plitzi/sdk-shared@0.36.0
+
+## 0.35.10
+
+### Patch Changes
+
+- **Breaking:** the space setting that lets a published site open the dev tools is now `settings.debugMode`, and
+  `settings.devTools` is gone.
+
+  It was always the same decision the SDK and the page server call `debugMode` — whether the dev-tools panel is
+  authorized — and having a third name for it invited confusing it with `devMode`, which is a different thing: it turns a
+  deployment into a development server (the unminified bundles, request timings, and the full action trace with every
+  step's results). A space can authorize debugging for its own site; it can never make its server a development one.
+
+  A space that stored `settings.devTools` needs it moved to `settings.debugMode`; nothing reads the old key.
+
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.35.10
+  - @plitzi/sdk-shared@0.35.10
+
 ## 0.35.9
 
 ### Patch Changes

package/dist/helpers/debugAuthorization.d.ts

@@ -3,13 +3,13 @@ type DebugConfig = {
     debugMode?: boolean;
     devMode?: boolean;
 };
-type DebugSettings = Pick<Schema['settings'], 'devTools'> | undefined;
+type DebugSettings = Pick<Schema['settings'], 'debugMode'> | undefined;
 /**
  * Whether a page — and what its flows did — may be debugged. One rule for the render and for every run it reports.
  *
  * The server decides first, through `debugMode`: set, it speaks for every space, and `false` is a refusal no space can
  * turn around. Left unset, a development server authorizes it, and so does a space whose own settings switched
- * `devTools` on. The settings are what this server loaded, never anything the request carries.
+ * `debugMode` on. The settings are what this server loaded, never anything the request carries.
  *
  * A page nobody authorized is told nothing: not the steps behind it, not even that a flow ran.
  */

package/dist/helpers/debugAuthorization.js

@@ -4,11 +4,11 @@
 *
 * The server decides first, through `debugMode`: set, it speaks for every space, and `false` is a refusal no space can
 * turn around. Left unset, a development server authorizes it, and so does a space whose own settings switched
-* `devTools` on. The settings are what this server loaded, never anything the request carries.
+* `debugMode` on. The settings are what this server loaded, never anything the request carries.
 *
 * A page nobody authorized is told nothing: not the steps behind it, not even that a flow ran.
 */
-var authorizesDebugging = (config, settings) => config.debugMode ?? (config.devMode === true || settings?.devTools === true);
+var authorizesDebugging = (config, settings) => config.debugMode ?? (config.devMode === true || settings?.debugMode === true);
 /**
 * The same rule, for a request that has not loaded the space yet.
 *

package/dist/modules/actions/runtime/runAction.js

@@ -547,6 +547,12 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 		}));
 		if (status !== "completed" && failureHandler?.enabled) await undo(failureHandler);
 		const output = returned ?? {};
+		/**
+		* Redacted again as a whole, and copied. A step's result was redacted when it landed, against the credentials
+		* known at that moment — a later step may have resolved one an earlier result echoed — and a step still running
+		* past the deadline may yet push into the live array.
+		*/
+		const recordedTrace = redact([...trace]);
 		await record({
 			runId,
 			actionId: entry.id,
@@ -554,13 +560,13 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 			environment: request.environment,
 			trigger: request.trigger,
 			status,
+			startedAt,
 			durationMs: Date.now() - startedAt,
 			...request.user ? { userId: request.user.id } : {},
-			nodes: trace.map((step) => ({
-				id: step.node.id,
-				action: step.node.action,
-				status: step.status
-			})),
+			steps: [...steps],
+			input: redact(request.input),
+			output: redact(output),
+			trace: recordedTrace,
 			...failure === void 0 ? {} : { error: redact(failure) }
 		});
 		if (fatal) {

package/dist/modules/actions/runtime/runLogger.js

@@ -23,7 +23,7 @@ var createRunLogger = (logger) => (record) => {
 			trigger: record.trigger,
 			status: record.status,
 			...record.userId === void 0 ? {} : { userId: record.userId },
-			steps: record.nodes.map((node) => `${node.action}:${node.status}`),
+			steps: record.steps.map((step) => `${step.action}:${step.status}`),
 			durationMs: record.durationMs,
 			ok: record.status === "completed",
 			...record.error === void 0 ? {} : { error: record.error },

package/dist/modules/ssr/prepareRender.js

@@ -62,7 +62,7 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 	* product from the same cookie on its first pass, so the markup it hydrates matches.
 	*
 	* Who may authorize it: the server first, through `debugMode`. When it said nothing, a development server does, and
-	* so does the space itself (`settings.devTools`) — an owner inspecting their own published site. The space is read
+	* so does the space itself (`settings.debugMode`) — an owner inspecting their own published site. The space is read
 	* from what this server loaded, never from the request, so a visitor has no say in it.
 	*/
 	const debugAuthorized = !Boolean(req.query["__pt"]) && authorizesDebugging(config, schema?.settings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.35.9",
+  "version": "0.36.0",
   "license": "AGPL-3.0",
   "files": [
     "dist",
@@ -58,8 +58,8 @@
   "type": "module",
   "sideEffects": false,
   "dependencies": {
-    "@plitzi/plitzi-sdk": "0.35.9",
-    "@plitzi/sdk-shared": "0.35.9",
+    "@plitzi/plitzi-sdk": "0.36.0",
+    "@plitzi/sdk-shared": "0.36.0",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.2",
     "jsonwebtoken": "^9.0.3",