@plitzi/sdk-shared 0.37.1 → 0.37.3

package/dist/actions/access.d.ts

@@ -0,0 +1,12 @@
+import { ActionAccess } from '../types/ActionTypes';
+/** Who is asking, as far as access is concerned: whether they are signed in, and what they may do. */
+export type AccessCaller = {
+    permissions: readonly string[];
+} | undefined;
+/**
+ * Why a caller may not use something guarded by `access`, or `undefined` when they may.
+ *
+ * One reading of the access vocabulary for everything that speaks it — an action's trigger, a realtime channel — so
+ * `session` and `role` cannot come to mean two things in two places.
+ */
+export declare const accessRefusal: (access: ActionAccess | undefined, caller: AccessCaller) => "unauthenticated" | "forbidden" | undefined;

package/dist/actions/access.mjs

@@ -0,0 +1,13 @@
+//#region src/actions/access.ts
+var e = (e, t) => {
+	if (!e) return "forbidden";
+	if (e.mode !== "public") {
+		if (!t) return "unauthenticated";
+		if (e.mode === "role") {
+			let n = new Set(t.permissions);
+			return e.permissions.every((e) => n.has(e)) ? void 0 : "forbidden";
+		}
+	}
+};
+//#endregion
+export { e as accessRefusal };

package/dist/actions/cron.d.ts

@@ -10,25 +10,34 @@ type WallClock = {
     month: number;
     weekday: number;
 };
+export declare const zonedClock: (at: Date, timeZone: string) => WallClock | undefined;
+export declare const cronMatches: (expression: string, at: Date, timeZone?: string) => boolean;
 /**
- * The same instant, as the clock on a wall in `timeZone` reads it.
+ * The first minute at or after `from` that this expression fires on, or undefined when it never does.
+ *
+ * **This is what a schedule stores**, and why it is here rather than in a scheduler: a due time written into a row
+ * is a decision made once, by whoever wrote it, and every replica afterwards reads the same instant instead of each
+ * asking its own clock whether the moment has come. Nodes in different countries then disagree about what time it
+ * is — which they will — without ever disagreeing about which fires have happened.
  *
- * Through `Intl` rather than an offset table, because an offset is not a constant: "9am in Santiago" is a
- * different instant in January and in July, and a schedule that means the working day has to follow the change.
- * `hourCycle: 'h23'` matters — the other cycles render midnight as 24, which cron has no hour for.
+ * Inclusive of `from`, so a caller that wants the one strictly after an instant asks from the minute after it. The
+ * search steps by whole minutes, skipping a day at a time when the date cannot match and an hour at a time when the
+ * hour cannot — a yearly expression costs a few hundred comparisons rather than half a million.
  *
- * An unknown zone answers `undefined` rather than falling back to UTC. Falling back is what this whole change is
- * about: a schedule that fires at the wrong hour and says nothing.
+ * DST is the reason the skips are computed from the WALL clock and then re-read rather than added as fixed offsets:
+ * jumping "to midnight" lands an hour early on the night a zone falls back, which costs one more comparison, and an
+ * hour late on the night it springs forward — into minutes that did not exist locally, so there was nothing there
+ * to miss.
  */
-export declare const zonedClock: (at: Date, timeZone: string) => WallClock | undefined;
+export declare const cronNextFire: (expression: string, from: Date, timeZone?: string) => Date | undefined;
 /**
- * Whether an expression fires at this minute — in `timeZone` when one is named, in UTC when none is.
+ * How many times an expression would have fired in `(after, until]`.
  *
- * Day-of-month and day-of-week are OR'd when both are restricted, which is the rule every cron implementation
- * follows and the one that surprises people who expect AND — `0 0 1 * 1` fires on the first of the month AND on
- * every Monday.
+ * What an operator is owed after an outage: the run that is about to happen is one fire, and this is the number of
+ * others that went by while nothing was there to take them. Capped, because the answer's purpose is to be shown to
+ * somebody — a minutely schedule down for a week is "at least `limit`", not a number worth spending a second on.
  */
-export declare const cronMatches: (expression: string, at: Date, timeZone?: string) => boolean;
+export declare const cronFiresBetween: (expression: string, after: Date, until: Date, timeZone?: string, limit?: number) => number;
 /** Whether `Intl` knows this zone. The validator asks so an author hears about a typo in the editor. */
 export declare const isKnownTimeZone: (timeZone: string) => boolean;
 export {};

package/dist/actions/cron.mjs

@@ -37,17 +37,23 @@ var e = [
 	day: e.getUTCDate(),
 	month: e.getUTCMonth() + 1,
 	weekday: e.getUTCDay()
-}), a = (e, t) => {
+}), a = (e) => {
+	let t;
 	try {
-		let n = new Intl.DateTimeFormat("en-US", {
-			timeZone: t,
+		t = new Intl.DateTimeFormat("en-US", {
+			timeZone: e,
 			hourCycle: "h23",
 			month: "numeric",
 			day: "numeric",
 			hour: "numeric",
 			minute: "numeric",
 			weekday: "short"
-		}).formatToParts(e), i = (e) => n.find((t) => t.type === e)?.value ?? "", a = r.indexOf(i("weekday")), o = {
+		});
+	} catch {
+		return;
+	}
+	return (e) => {
+		let n = t.formatToParts(e), i = (e) => n.find((t) => t.type === e)?.value ?? "", a = r.indexOf(i("weekday")), o = {
 			minute: Number(i("minute")),
 			hour: Number(i("hour")),
 			day: Number(i("day")),
@@ -55,18 +61,43 @@ var e = [
 			weekday: a
 		};
 		return a >= 0 && Object.values(o).every(Number.isFinite) ? o : void 0;
-	} catch {
-		return;
+	};
+}, o = (e, t) => a(t)?.(e), s = ([, , e, t, n], r) => {
+	if (!t.has(r.month)) return !1;
+	let i = e.size !== 31, a = n.size !== 7, o = e.has(r.day), s = n.has(r.weekday);
+	return i && a ? o || s : o && s;
+}, c = (e, t) => {
+	let [n, r] = e;
+	return n.has(t.minute) && r.has(t.hour) && s(e, t);
+}, l = (e) => e ? a(e) : i, u = (e, t, r) => {
+	let i = n(e), a = i ? l(r)?.(t) : void 0;
+	return i !== void 0 && a !== void 0 && c(i, a);
+}, d = 6e4, f = 2108160 * d, p = (e, t, r) => {
+	let i = n(e), a = i ? l(r) : void 0;
+	if (!i || !a) return;
+	let o = Math.ceil(t.getTime() / d) * d, c = o + f, [u, p] = i;
+	for (let e = o; e <= c;) {
+		let t = new Date(e), n = a(t);
+		if (!n) return;
+		if (!s(i, n)) {
+			e += (1440 - n.hour * 60 - n.minute) * d;
+			continue;
+		}
+		if (!p.has(n.hour)) {
+			e += (60 - n.minute) * d;
+			continue;
+		}
+		if (u.has(n.minute)) return t;
+		e += d;
+	}
+}, m = (e, t, n, r, i = 1e3) => {
+	let a = 0, o = new Date(t.getTime() + d);
+	for (; a < i;) {
+		let t = p(e, o, r);
+		if (!t || t > n) return a;
+		a += 1, o = new Date(t.getTime() + d);
 	}
-}, o = (e, t, r) => {
-	let o = n(e);
-	if (!o) return !1;
-	let s = r ? a(t, r) : i(t);
-	if (!s) return !1;
-	let [c, l, u, d, f] = o;
-	if (!c.has(s.minute) || !l.has(s.hour) || !d.has(s.month)) return !1;
-	let p = u.size !== 31, m = f.size !== 7, h = u.has(s.day), g = f.has(s.weekday);
-	return p && m ? h || g : h && g;
-}, s = (e) => a(/* @__PURE__ */ new Date(), e) !== void 0;
+	return a;
+}, h = (e) => o(/* @__PURE__ */ new Date(), e) !== void 0;
 //#endregion
-export { o as cronMatches, s as isKnownTimeZone, n as parseCron, a as zonedClock };
+export { m as cronFiresBetween, u as cronMatches, p as cronNextFire, h as isKnownTimeZone, n as parseCron, o as zonedClock };

package/dist/actions/functions.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where a space's functions answer HTTP: `GET /feed/:id` declared, `GET /api/feed/42` served. The path is
+ * the functions' and never a page's — the page server and the page linter both read it from here.
+ */
+export declare const FUNCTION_ROUTES_PREFIX = "/api";
+/** Whether a page at `path` would sit where the space's functions answer. */
+export declare const isFunctionRoutePath: (path: string) => boolean;
+/**
+ * Whether a path is one of a space's functions files: relative, inside `functions/`, a `.ts`, `.js`, `.mjs` or `.json`.
+ * The one rule for what a source is — the platform's build refuses anything else, and every reader of a working copy
+ * reads exactly this.
+ */
+export declare const isFunctionsSourcePath: (path: string) => boolean;
+/** How a reader reaches a directory, whatever it runs on: Node's `fs`, a test's map. */
+export type FunctionsSourceReader = {
+    list: (dir: string) => Promise<{
+        name: string;
+        directory: boolean;
+    }[]>;
+    read: (file: string) => Promise<string>;
+};
+/**
+ * A space's functions as a directory holds them — every source file under `root`, by its path there (`lib/feed.ts`),
+ * `node_modules` and dotted folders skipped. What a project's working copy is read as, by the CLI and by a server
+ * loading its own; a directory that is not there reads as none.
+ */
+export declare const readFunctionsSource: (root: string, reader: FunctionsSourceReader) => Promise<Record<string, string>>;

package/dist/actions/functions.mjs

@@ -0,0 +1,18 @@
+//#region src/actions/functions.ts
+var e = "/api", t = (e) => e === "/api" || e.startsWith("/api/"), n = (e) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*\.(ts|js|mjs|json)$/.test(e) && !e.split("/").some((e) => e === ".." || e === "." || e === ""), r = async (e, t) => {
+	let r = {}, i = async (a) => {
+		let o;
+		try {
+			o = await t.list(a ? `${e}/${a}` : e);
+		} catch {
+			return;
+		}
+		for (let s of o) {
+			let o = a ? `${a}/${s.name}` : s.name;
+			s.directory ? s.name !== "node_modules" && !s.name.startsWith(".") && await i(o) : n(o) && (r[o] = await t.read(`${e}/${o}`));
+		}
+	};
+	return await i(""), r;
+};
+//#endregion
+export { e as FUNCTION_ROUTES_PREFIX, t as isFunctionRoutePath, n as isFunctionsSourcePath, r as readFunctionsSource };

package/dist/actions/index.d.ts

@@ -1,9 +1,13 @@
-export { cronMatches, isKnownTimeZone, parseCron, zonedClock } from './cron';
+export { accessRefusal } from './access';
+export { cronFiresBetween, cronMatches, cronNextFire, isKnownTimeZone, parseCron, zonedClock } from './cron';
 export { FAILURE_HANDLER_TASK } from './failureHandler';
+export { FUNCTION_ROUTES_PREFIX, isFunctionRoutePath, isFunctionsSourcePath, readFunctionsSource } from './functions';
 export { triggerAccess, triggerCacheMs, triggerHasStaleVerify, triggerInput, triggerVerify } from './triggerParams';
 export { actionName, actionTriggers, isActionEnabled } from './triggers';
 export { validateActionDocument } from './validateDocument';
 export { isSingleEmailAddress, readSmtpCredential, SMTP_CREDENTIAL_KEYS } from './smtp';
+export type { AccessCaller } from './access';
+export type { FunctionsSourceReader } from './functions';
 export type { CronExpression } from './cron';
 export type { SmtpCredentialProblem, SmtpCredentialReading, SmtpSecurity, SmtpSettings } from './smtp';
 export type { ActionDocumentIssue, ActionDocumentReport } from './validateDocument';

package/dist/actions/index.mjs

@@ -1,7 +1,9 @@
-import { cronMatches as e, isKnownTimeZone as t, parseCron as n, zonedClock as r } from "./cron.mjs";
-import { FAILURE_HANDLER_TASK as i } from "./failureHandler.mjs";
-import { triggerAccess as a, triggerCacheMs as o, triggerHasStaleVerify as s, triggerInput as c, triggerVerify as l } from "./triggerParams.mjs";
-import { actionName as u, actionTriggers as d, isActionEnabled as f } from "./triggers.mjs";
-import { validateActionDocument as p } from "./validateDocument.mjs";
-import { SMTP_CREDENTIAL_KEYS as m, isSingleEmailAddress as h, readSmtpCredential as g } from "./smtp.mjs";
-export { i as FAILURE_HANDLER_TASK, m as SMTP_CREDENTIAL_KEYS, u as actionName, d as actionTriggers, e as cronMatches, f as isActionEnabled, t as isKnownTimeZone, h as isSingleEmailAddress, n as parseCron, g as readSmtpCredential, a as triggerAccess, o as triggerCacheMs, s as triggerHasStaleVerify, c as triggerInput, l as triggerVerify, p as validateActionDocument, r as zonedClock };
+import { accessRefusal as e } from "./access.mjs";
+import { cronFiresBetween as t, cronMatches as n, cronNextFire as r, isKnownTimeZone as i, parseCron as a, zonedClock as o } from "./cron.mjs";
+import { FAILURE_HANDLER_TASK as s } from "./failureHandler.mjs";
+import { FUNCTION_ROUTES_PREFIX as c, isFunctionRoutePath as l, isFunctionsSourcePath as u, readFunctionsSource as d } from "./functions.mjs";
+import { triggerAccess as f, triggerCacheMs as p, triggerHasStaleVerify as m, triggerInput as h, triggerVerify as g } from "./triggerParams.mjs";
+import { actionName as _, actionTriggers as v, isActionEnabled as y } from "./triggers.mjs";
+import { validateActionDocument as b } from "./validateDocument.mjs";
+import { SMTP_CREDENTIAL_KEYS as x, isSingleEmailAddress as S, readSmtpCredential as C } from "./smtp.mjs";
+export { s as FAILURE_HANDLER_TASK, c as FUNCTION_ROUTES_PREFIX, x as SMTP_CREDENTIAL_KEYS, e as accessRefusal, _ as actionName, v as actionTriggers, t as cronFiresBetween, n as cronMatches, r as cronNextFire, y as isActionEnabled, l as isFunctionRoutePath, u as isFunctionsSourcePath, i as isKnownTimeZone, S as isSingleEmailAddress, a as parseCron, d as readFunctionsSource, C as readSmtpCredential, f as triggerAccess, p as triggerCacheMs, m as triggerHasStaleVerify, h as triggerInput, g as triggerVerify, b as validateActionDocument, o as zonedClock };

package/dist/actions/triggers.d.ts

@@ -25,5 +25,9 @@ export declare const isActionEnabled: (document: ActionDocument) => boolean;
  *
  * Falls back to whatever the document already carries, so a document written before this — or by a caller that
  * names it directly, like the authoring API — keeps the name it was given.
+ *
+ * A title that only repeats the trigger's kind is not a name: it is the default a node gets before anybody names
+ * it. Read as one, every page-rendered action in a workspace was called "render" and every clock "schedule" — a list
+ * of runs nobody could tell apart — while the document's own name sat unused beside it.
  */
 export declare const actionName: (document: ActionDocument) => string;

package/dist/actions/triggers.mjs

@@ -1,4 +1,7 @@
 //#region src/actions/triggers.ts
-var e = (e) => Object.values(e.nodes).filter((e) => e.type === "trigger"), t = (t) => e(t).some((e) => e.enabled), n = (t) => e(t).find((e) => e.title.trim() !== "")?.title.trim() ?? t.name;
+var e = (e) => Object.values(e.nodes).filter((e) => e.type === "trigger"), t = (t) => e(t).some((e) => e.enabled), n = (t) => e(t).find((e) => {
+	let t = e.title.trim();
+	return t !== "" && t !== e.action;
+})?.title.trim() ?? t.name;
 //#endregion
 export { n as actionName, e as actionTriggers, t as isActionEnabled };

package/dist/auth/index.d.ts

@@ -1,3 +1,5 @@
 export { createAuthFailureLink } from './authFailureLink';
 export { authFailureFromResponse, onAuthFailure, reportAuthFailure, sameRegistrableDomain } from './failureChannel';
+export { checkVisitorRoles, visitorAccess, VISITOR_NAME } from './visitorRoles';
 export type { AuthFailureListener, AuthFailureSignal } from './failureChannel';
+export type { VisitorRoles } from './visitorRoles';

package/dist/auth/index.mjs

@@ -1,3 +1,4 @@
 import { authFailureFromResponse as e, onAuthFailure as t, reportAuthFailure as n, sameRegistrableDomain as r } from "./failureChannel.mjs";
 import { createAuthFailureLink as i } from "./authFailureLink.mjs";
-export { e as authFailureFromResponse, i as createAuthFailureLink, t as onAuthFailure, n as reportAuthFailure, r as sameRegistrableDomain };
+import { VISITOR_NAME as a, checkVisitorRoles as o, visitorAccess as s } from "./visitorRoles.mjs";
+export { a as VISITOR_NAME, e as authFailureFromResponse, o as checkVisitorRoles, i as createAuthFailureLink, t as onAuthFailure, n as reportAuthFailure, r as sameRegistrableDomain, s as visitorAccess };

package/dist/auth/visitorRoles.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A space's visitor roles (`settings.visitorRoles`): each role a signed-in visitor may hold there, with the permissions
+ * it gives — what an action's `access: 'role'` and a page's `can()` are answered from.
+ *
+ * One reading of them for everyone who handles them: authoring refuses a space that writes them wrong, the builder's
+ * save refuses the same, and the server that resolves a visitor never reads a malformed map as a grant.
+ */
+export type VisitorRoles = Record<string, string[]>;
+/** A role or a permission: a name a person reads in the builder and an action names in its access rule. */
+export declare const VISITOR_NAME: RegExp;
+/** The roles as declared, or what is wrong with them — said so it can be fixed from the message alone. */
+export declare const checkVisitorRoles: (value: unknown) => {
+    ok: true;
+    roles: VisitorRoles;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * What a visitor holding `held` may do in a space that declares `declared`: the roles the space still declares, and
+ * every permission they give. A role the space no longer declares gives nothing — a grant outlives an edit of the
+ * roles, and must not outlive what it meant. Malformed roles give nothing at all.
+ */
+export declare const visitorAccess: (declared: unknown, held: readonly string[]) => {
+    roles: string[];
+    permissions: string[];
+};

package/dist/auth/visitorRoles.mjs

@@ -0,0 +1,48 @@
+//#region src/auth/visitorRoles.ts
+var e = /^[A-Za-z][\w-]{0,63}$/, t = "`visitorRoles: { author: [\"postPublish\"], editor: [\"postPublish\", \"postEdit\"] }`", n = (n) => {
+	if (typeof n != "object" || !n || Array.isArray(n)) return {
+		ok: !1,
+		problem: `\`settings.visitorRoles\` is ${JSON.stringify(n)}. Write each role with its permissions: ${t}.`
+	};
+	let r = {};
+	for (let [i, a] of Object.entries(n)) {
+		if (!e.test(i)) return {
+			ok: !1,
+			problem: `\`settings.visitorRoles\` has the role "${i}". A role is a name — a letter, then letters, digits, \`-\` or \`_\` — like "author".`
+		};
+		if (!Array.isArray(a) || a.length === 0) return {
+			ok: !1,
+			problem: `\`settings.visitorRoles.${i}\` is ${JSON.stringify(a)}. A role is the permissions it gives, as a list of names: ${t}.`
+		};
+		let n = /* @__PURE__ */ new Set();
+		for (let t of a) {
+			if (typeof t != "string" || !e.test(t)) return {
+				ok: !1,
+				problem: `\`settings.visitorRoles.${i}\` has ${JSON.stringify(t)}, which is not a permission name. Name it the way an action's \`access: 'role'\` asks for it, like "postPublish".`
+			};
+			if (n.has(t)) return {
+				ok: !1,
+				problem: `\`settings.visitorRoles.${i}\` names "${t}" twice.`
+			};
+			n.add(t);
+		}
+		r[i] = [...n];
+	}
+	return {
+		ok: !0,
+		roles: r
+	};
+}, r = (e, t) => {
+	let r = e === void 0 ? void 0 : n(e);
+	if (!r?.ok) return {
+		roles: [],
+		permissions: []
+	};
+	let i = [...new Set(t)].filter((e) => Object.hasOwn(r.roles, e));
+	return {
+		roles: i,
+		permissions: [...new Set(i.flatMap((e) => r.roles[e]))]
+	};
+};
+//#endregion
+export { e as VISITOR_NAME, n as checkVisitorRoles, r as visitorAccess };

package/dist/authoring/builder.mjs

@@ -6,6 +6,7 @@ var e = {
 	boolean: "boolean",
 	number: "text",
 	scalar: "text",
+	json: "codemirror-json",
 	elementIds: "elements"
 }, t = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[-_\s]+/).map((e) => `${e.charAt(0).toUpperCase()}${e.slice(1)}`).join(" "), n = (n, r) => ({
 	type: r.builderType ?? e[r.type],

package/dist/authoring/declare.d.ts

@@ -1,3 +1,6 @@
+import { InteractionCallback } from '../types/InteractionTypes';
+import { PluginBuilder, PluginSchema } from '../types/PluginTypes';
+import { ElementDefinition } from '../types/SchemaTypes';
 /**
  * How an element says what it can be authored with.
  *
@@ -29,6 +32,35 @@ export interface ElementDeclarationData {
      * reads it to resolve a binding that named the element alone.
      */
     sourceType?: string;
+    /**
+     * The triggers this type fires on top of the ones every element does (`onClick`, `onLoad`…), by action name.
+     *
+     * Declared here for the reason `sourceType` is: the component registers exactly these, and the authoring surface
+     * reads them to refuse a flow that starts on a trigger its element never fires — an `onSubmit` on the submit
+     * button rather than on the form is a flow that is written, saved and silently never runs.
+     */
+    triggers?: Record<string, InteractionCallback>;
+    /**
+     * The callbacks this type runs on itself on top of the ones every element does (`setState`, `toggleState`) —
+     * their static half. The component adds what only a mounted element has: the function, a title naming its label,
+     * options drawn from its children. Read by the authoring surface to refuse a step aimed at an element that does not
+     * answer to it — an `openModal` sent to a plain container is a button that does nothing.
+     */
+    callbacks?: Record<string, InteractionCallback>;
+    /**
+     * The type this one only works somewhere inside: it reads its state from that element's context, and anywhere
+     * else it throws on its first render. A dropdown's panel, a tab container's header and body.
+     */
+    ancestorType?: string;
+    /**
+     * The values an enumerated attribute takes — a heading's `subType`, a link's `mode` — by attribute name.
+     *
+     * A component's props say this in TypeScript, which is gone at run time; an author writing JavaScript, a document
+     * that arrived as JSON or a value that went through a cast reaches the element anyway, and `subType: 'h7'` renders an
+     * `<h7>`. Written with {@link valuesOf}, so the list cannot drift from the props it mirrors; read by the authoring
+     * surface to refuse a value outside it.
+     */
+    attributeValues?: Record<string, readonly string[]>;
     content?: {
         attributes?: Record<string, unknown>;
         definition?: {
@@ -36,6 +68,39 @@ export interface ElementDeclarationData {
         };
     };
 }
+/**
+ * A plugin's declaration: an element of somebody's own, declared the way the built-in ones declare themselves.
+ *
+ * On top of what {@link ElementDeclarationData} says of any element it carries the whole `content`, because for a
+ * plugin that is also what gets PUBLISHED — its build writes it into `plugin-manifest.json`, which the builder, the page
+ * server and the MCP server read before they load any code. Data only, so that build can read it without React.
+ *
+ * `A` is the attributes the element accepts: its component's props, minus what the runtime supplies.
+ * `const declaration = { … } satisfies PluginDeclaration<SeatPickerAttributes>` then refuses a default the component
+ * does not take.
+ */
+export interface PluginDeclaration<A extends object = Record<string, unknown>> extends Omit<ElementDeclarationData, 'content'> {
+    content: {
+        /** The element's starting attributes — its component's defaults, where the builder can show them. */
+        attributes: A;
+        definition: Omit<ElementDefinition, 'rootId' | 'parentId' | 'interactions' | 'runtime' | 'loadStrategy'> & {
+            /** What the element is for, in a sentence: the builder shows it, and an agent reads it to choose the element. */
+            description?: string;
+        };
+        builder: PluginBuilder;
+        /** How the builder's catalogue shows the element. Whether it is verified is the platform's to say, never its own. */
+        market: {
+            category: string;
+            owner: string;
+            license: string;
+            website: string;
+            backgroundColor: string;
+            icon: string;
+        };
+        defaultStyle: PluginSchema['defaultStyle'];
+        settings?: Record<string, string | number | boolean>;
+    };
+}
 /**
  * The attributes a declaration accepts, defaulting to "anything" for one that never said.
  *
@@ -60,5 +125,14 @@ type AuthorableProps<Props, Injected extends keyof Props> = Omit<Props, 'ref' |
  * "any value that is not null" everywhere else it could land.
  */
 export type AuthorableAttributes<Props, Injected extends keyof Props = never> = keyof AuthorableProps<Props, Injected> extends never ? unknown : Partial<AuthorableProps<Props, Injected>>;
+/**
+ * Every value of a string-literal union, as a list — and a compile error when the list leaves one out.
+ *
+ * `valuesOf<NonNullable<ButtonProps['subType']>>()(['button', 'submit', 'reset'])`. A value outside the union is
+ * refused by the parameter type; one the union has and the list does not makes the argument ask for `missing`.
+ */
+export declare const valuesOf: <T extends string>() => <const V extends readonly T[]>(values: V & ([Exclude<T, V[number]>] extends [never] ? unknown : {
+    readonly missing: Exclude<T, V[number]>;
+})) => readonly string[];
 export declare const elementDeclaration: <A>() => <const D extends ElementDeclarationData>(declaration: D) => D & ElementAttributesBrand<A>;
 export {};

package/dist/authoring/declare.mjs

@@ -1,4 +1,4 @@
 //#region src/authoring/declare.ts
-var e = () => (e) => e;
+var e = () => (e) => e, t = () => (e) => e;
 //#endregion
-export { e as elementDeclaration };
+export { t as elementDeclaration, e as valuesOf };

package/dist/authoring/index.mjs

@@ -1,6 +1,6 @@
 import { toBuilderParams as e, toInteractionCallback as t, toInteractionCallbacks as n } from "./builder.mjs";
-import { elementDeclaration as r } from "./declare.mjs";
-import { hiddenParams as i, invalidParams as a, missingRequiredParams as o, reconcileParams as s } from "./paramSpec.mjs";
-import { BUILTIN_ELEMENT_CALLBACKS as c, applyElementCallback as l, getElementCallback as u } from "./elementCallbacks.mjs";
-import { spaceCallbacks as d } from "./spaceCallbacks.mjs";
-export { c as BUILTIN_ELEMENT_CALLBACKS, l as applyElementCallback, r as elementDeclaration, u as getElementCallback, i as hiddenParams, a as invalidParams, o as missingRequiredParams, s as reconcileParams, d as spaceCallbacks, e as toBuilderParams, t as toInteractionCallback, n as toInteractionCallbacks };
+import { elementDeclaration as r, valuesOf as i } from "./declare.mjs";
+import { hiddenParams as a, invalidParams as o, missingRequiredParams as s, reconcileParams as c } from "./paramSpec.mjs";
+import { BUILTIN_ELEMENT_CALLBACKS as l, applyElementCallback as u, getElementCallback as d } from "./elementCallbacks.mjs";
+import { spaceCallbacks as f } from "./spaceCallbacks.mjs";
+export { l as BUILTIN_ELEMENT_CALLBACKS, u as applyElementCallback, r as elementDeclaration, d as getElementCallback, a as hiddenParams, o as invalidParams, s as missingRequiredParams, c as reconcileParams, f as spaceCallbacks, e as toBuilderParams, t as toInteractionCallback, n as toInteractionCallbacks, i as valuesOf };

package/dist/authoring/paramSpec.d.ts

@@ -1,5 +1,5 @@
 import { InteractionParamType } from '../types';
-export type BuiltinParamType = 'text' | 'textarea' | 'select' | 'boolean' | 'number' | 'scalar' | 'elementIds';
+export type BuiltinParamType = 'text' | 'textarea' | 'select' | 'boolean' | 'number' | 'scalar' | 'json' | 'elementIds';
 export interface BuiltinParam {
     type: BuiltinParamType;
     description: string;

package/dist/authoring/paramSpec.mjs

@@ -14,6 +14,7 @@ var t = (e, t, n) => {
 		case "number": return typeof e == "number" || typeof e == "string" && r(e);
 		case "select": return typeof e == "string" && (!t.options || t.options.includes(e));
 		case "scalar": return typeof e == "string" || typeof e == "number" || typeof e == "boolean";
+		case "json": return typeof e == "string" || typeof e == "number" || typeof e == "boolean" || typeof e == "object" && !!e;
 		case "text":
 		case "textarea": return typeof e == "string";
 		case "elementIds": return Array.isArray(e) && e.every((e) => typeof e == "string");

package/dist/authoring/spaceCallbacks.mjs

@@ -22,9 +22,9 @@ var e = { addNotification: {
 				"bottom-left"
 			]
 		},
-		appeareance: {
+		appearance: {
 			type: "select",
-			description: "Visual style of the notification. NOTE: the key is spelled \"appeareance\".",
+			description: "Visual style of the notification: success, danger, warning or info.",
 			default: "success",
 			options: [
 				"success",

package/dist/dataSource/computed.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The space's computed values, from its definitions and the global sources they read.
+ *
+ * In declaration order, each one seeing the values before it as `computed.<name>` — so `level` can be written over
+ * `xp` without repeating it. A value that reads one declared after it reads nothing; authoring refuses that.
+ *
+ * Given the `previous` evaluation, a value that comes out the same keeps the object it was, and so does the whole
+ * when none changed. They are all evaluated again whenever the state changes, and a list or a record evaluates to a new
+ * object every time: every element reading one — a star on each of a hundred and sixty library items reading the
+ * favourites — rendered again for the tool in hand changing, because what it read was no longer the same object.
+ */
+export declare const evaluateComputed: (definitions: Record<string, string>, globals: Record<string, unknown>, previous?: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * The sources as a flow step reads them: `state` as the store holds it this instant, and `computed` evaluated over it.
+ *
+ * `runtime.sources` carries both as the last render left them — they are copied there after React renders — so a step
+ * reading them right after an earlier step wrote the state could see the value from before the write, or not,
+ * depending on whether React had rendered in between. Read here, a step always sees every write made before it: the
+ * flow's own and anything else that happened while it waited.
+ */
+export declare const liveSources: (sources: Record<string, unknown>, state: unknown, definitions: unknown) => Record<string, unknown>;

package/dist/dataSource/computed.mjs

@@ -0,0 +1,45 @@
+import { processTwigValue as e } from "../helpers/twigWrapper/processTwig/processTwig.mjs";
+import t from "@plitzi/plitzi-ui/utils/deepEqual";
+//#region src/dataSource/computed.ts
+var n = (n, r, i) => {
+	let a = {}, o = i !== void 0 && Object.keys(i).length === Object.keys(n).length;
+	for (let [s, c] of Object.entries(n)) {
+		let n = e(c, {
+			...r,
+			computed: { ...a }
+		}), l = i?.[s], u = i !== void 0 && Object.hasOwn(i, s) && (l === n || t(l, n));
+		a[s] = u ? l : n, o &&= u;
+	}
+	return o && i ? i : a;
+}, r = (e) => typeof e == "object" && !!e, i = (e) => r(e) && Object.values(e).every((e) => typeof e == "string"), a = [
+	"variables",
+	"navigation",
+	"auth",
+	"host",
+	"theme"
+], o = (e, t, n) => {
+	let a = r(t) ? t : {};
+	return i(n) ? {
+		...e,
+		state: a,
+		computed: c(n, e, a)
+	} : {
+		...e,
+		state: a
+	};
+}, s, c = (e, t, r) => {
+	let i = a.map((e) => t[e]);
+	if (s?.definitions === e && s.state === r && s.globals.every((e, t) => e === i[t])) return s.computed;
+	let o = n(e, {
+		...Object.fromEntries(a.map((e, t) => [e, i[t]])),
+		state: r
+	}, s?.definitions === e ? s.computed : void 0);
+	return s = {
+		definitions: e,
+		state: r,
+		globals: i,
+		computed: o
+	}, o;
+};
+//#endregion
+export { n as evaluateComputed, o as liveSources };