@plitzi/sdk-shared 0.37.7 → 0.37.9

package/CHANGELOG.md

@@ -1,5 +1,252 @@
 # @plitzi/sdk-shared
 
+## 0.37.9
+
+### Patch Changes
+
+- 3ae61a4: ## Components replace segments
+
+  - **What a component is:** a reusable block written once and placed anywhere as an instance. An edit to the component
+    is an edit to every instance.
+  - **Where it lives:** in the space document, as `schema.components`, one tree per component and never in
+    `schema.flat`. It is published, rolled back, copied by templates and exported with the space.
+  - **Props and slots:**
+    - A component declares props (`type`, `description`, `required`, `default`, `options`). An instance hands them in
+      as its own attributes, so templates and bindings reach them. Inside, they are read as `{{ props.<name> }}`.
+    - Slots are elements an instance fills; each child names its slot in `attributes.slot`.
+  - **A prop an instance leaves out prints nothing.** It is its `default`, or `null`. `props` is a settled source:
+    - `processTwig` takes `{ settled }` in place of `keepEmptyTokens: true`.
+    - Every other empty token is still kept for a later pass.
+    - `COMPONENT_PROPS_SOURCE` names the source.
+  - **Fixed: a flow in a list row or a component instance acts on its own copy.** A step's target resolves in the
+    replica the flow fired in first, then outwards. It used to reach whichever copy registered last.
+  - **Fixed: an instance's own `visible` hides it in preview.** The same goes for an element reference.
+  - **Fixed: a list row keeps its state with its record.** Rows are keyed by each record's unique `id`, so filtering no
+    longer moves one row's state onto another.
+  - **Closed scope:** inside, a component reads only its props and the globals. The validator, `lintSpace` and
+    `authorSpace` each refuse a read of the page around an instance. Components nest, and a cycle is refused.
+  - **Where to use them:**
+    - In code (`@plitzi/sdk-authoring`): `SpaceSpec.components` and `component(id, { props, children })`.
+      `specFromSpace` and `specToSource` read and write both.
+    - In the builder:
+      - a Components panel lists them, and an open component becomes the canvas;
+      - an element becomes a component with **Save as component**;
+      - in an instance's settings, an instance gets its props and slots, or is **detached** back into a copy.
+    - In the MCP: `upsertComponent` and `deleteComponent`. Element ops work inside a component through `pageRef`.
+  - **Schema helpers:** `@plitzi/sdk-schema` gains `addComponent`, `updateComponent`, `removeComponent`,
+    `detachInstance`, `renameElement`, `treeOf`, `flatMapOf` and `documentIds`.
+  - **GraphQL and live events:** `SpaceAddComponent`, `SpaceUpdateComponent`, `SpaceRemoveComponent` and
+    `SpaceDetachInstance`, each with a live event. History records a declaration change as a `component` entry.
+  - **Breaking: segments are removed.** This covers:
+    - `@plitzi/sdk-shared`'s segment types, queries, mutations, context and `SEGMENT_*` events;
+    - `referenceType: 'segment'`;
+    - the `Segments` builder module;
+    - `Space.segments` and the `Segment`/`Segments` queries;
+    - `CommonState.prevSchema`.
+  - **Breaking: `ElementLayout` and `LayoutBody` change shape.**
+    - `ElementLayout` is `{ slots, rootId, type }`; it was `{ containerId }`.
+    - `LayoutBody` takes `bodies` keyed by slot.
+    - `reference`'s `referenceContainer` attribute is removed.
+  - Guide: `docs/en/components.md`.
+
+  ## Functions ask for the time they need
+  - **What changes:** a task can ask for more CPU or wall time than the default with `limits`, in milliseconds. Example:
+    `limits: { cpuMs: 1000, wallMs: 20_000 }`. `defineFunctions({ limits })` asks it for every task and route at once,
+    and a task's own limits win over those.
+  - **What a run is given:** what it asked for, or the default (100 ms of CPU, 10 s) when it asked for nothing. Never
+    above the space's plan or the deployment's ceiling.
+  - **Deployment ceilings:** `functions.limits` sets them. `DEFAULT_FUNCTION_CEILINGS` covers each unset one, at 2 s of
+    CPU and 30 s.
+  - **Asking for more than the ceiling** is a problem when the functions are saved; it is never quietly cut down.
+  - **Manifest:** carries what each task asked for, and the builder shows it beside the task.
+
+  ## Functions answer under `/fn`, not `/api`
+
+  A space's routes are served at `/fn/<path>` (`FUNCTION_ROUTES_PREFIX`). `/api` is a slug a site wants for a page of its
+  own. A page under `/fn` is refused instead (`page-route-reserved`).
+
+  ## The builder's Functions panel
+
+  Rebuilt around the code. The panel reads `defineFunctions` as it is typed and writes into it, so the code stays the one
+  place a function is declared.
+
+  - **Layout:** the tasks, routes and files on the left, the code in the middle, the selected task on the right.
+  - **Live list:** tasks and routes are listed as the code declares them, including tasks imported from another file.
+    A task you have written but not saved says so. Tasks built by calling something are counted, and listed once saved.
+  - **Code and panel follow each other:** clicking a task or a route opens its file at its line. Putting the cursor inside
+    a task's code selects that task.
+  - **New task:** + in Tasks asks for its namespace, action and title. The task is written into `defineFunctions` with a
+    `run` to start from, in the file's own quotes, and the editor opens on it.
+  - **Time limit:** each task gets a slider from 100 ms to 1 s of CPU per run, with presets. The value is written into
+    the task as `limits: { cpuMs }`. "Use default" takes it out. `DEFAULT_FUNCTION_TIME_LIMITS` in
+    `@plitzi/sdk-shared/actions` is the default both the panel and the server use.
+  - **Test:** fills a task's params the way its step does, from their defaults: a select, a switch or text. JSON stays a
+    toggle away. With unsaved changes, the button reads "Save & run": it saves, then runs. If the save fails, it says why.
+  - **Header:** shows Saved, Unsaved (and in how many files) or the number of problems the last save found. ⌘S saves.
+    **Discard** asks first, then puts every file back to what was last saved, or back to nothing for functions never
+    saved. Removing the functions is a quiet button beside Save.
+  - **Problems:** clicking one opens its file at its line.
+  - **Editor:** each file has its own editor and undo history. Opening another file no longer marks the one you left as
+    changed. Before this, it could also write the newly opened file's text into the one you left. The cause was in
+    `@plitzi/plitzi-ui`'s CodeMirror, fixed in 1.6.25, which every package now depends on. That release also sets code
+    editors (several lines) in a monospaced face again. Long lines scroll inside the editor, and the line numbers stay
+    in place.
+
+  ## A space's own functions are their own category of steps
+
+  In the action editor's step picker, the space's own functions are listed under **Functions**, apart from the
+  platform's **Tasks**. The other headings now read Callbacks, Global callbacks and Utilities. The saved step is still a
+  `task` node.
+
+  - `@plitzi/sdk-server`: every registered task has an `origin`, `'deployment'` (shipped with the server or a native
+    function) or `'space'` (from the space's functions). `describeCatalog`, `/_action/catalog` and the builder's
+    `SpaceActionTasks` carry it (`ActionTaskDescriptor.origin`).
+  - `@plitzi/sdk-shared`: an `InteractionCallback` may name the `group` the picker lists it under.
+
+  ## Fixed: preview no longer breaks a builder that is embedded in a page
+
+  When the builder is mounted inside a Plitzi page (the platform's `/spaces/:id/update`), going to preview with a page
+  that has SEO turned on left the builder unstyled. The previewed page wrote its title and description through a head
+  manager of the builder's own, and that manager rewrote the host page's head, removing the builder's own stylesheet.
+
+  - `@plitzi/sdk-shared`: a new render setting, `ownsHead`, says whether the page may write the document head. It is on
+    by default (`DEFAULT_RENDER_SETTINGS`).
+  - `@plitzi/sdk-elements`: `Page` writes its SEO only where `ownsHead` is on.
+  - Builder: sets `ownsHead: false` for its canvas. A page drawn there is in a frame, and the document head is the
+    editor's. The canvas's own `HelmetProvider` is gone.
+
+  ## Fixed: the builder's plan usage panel shows the space being edited
+  - **The 404 is gone.** Opening Plan usage said "The account breakdown could not be read (The server answered 404.)".
+    The panel asked `/account/usage`, which went away when accounts became workspaces.
+  - **Only this space.** The panel listed every space of the workspace. It now reads `/spaces/:spaceId/usage`, which
+    now also answers the space's own `pages` (the heaviest ten), `pagesTotal` and `periodEndsAt`. The plan's ceilings
+    stay on top. Anyone who can edit the space can read it, including a guest of another workspace.
+  - **It scrolls.** A long breakdown scrolls inside the modal, where it used to overflow.
+  - **`getKeyDecoded(webKey, true)` reads the token's subject.** The function, in `@plitzi/sdk-shared`, looked for
+    `data.spaceId`, which space tokens no longer carry, so every space decoded as 0. The builder asked about space 0, and
+    the builder and the SDK kept every space's persisted state under the same key on a host. Pages served without a
+    `webKey` (SSR) still decode as 0, which is what their painted-state cookie is named after.
+
+  ## Fixed: a remote plugin in the builder reads the canvas it sits in
+
+  The builder carries its own copy of the Plitzi runtime. A remote plugin imports `@plitzi/plitzi-sdk`, which the page's
+  import map resolves to the SDK's copy. Each copy made its own React contexts, so on the builder's canvas a plugin read
+  none of the canvas's providers. In the builder embedded in Plitzi's site, it read the site around the builder instead:
+  the site's element as its own, the site's live mode (so it stayed interactive while being edited), and the site's store
+  and interactions.
+
+  - `@plitzi/sdk-shared` gains `sharedContext(name, default)`: a context made once per page and handed to every copy of
+    the runtime that asks for it.
+  - The runtime's contexts now go through it, so a provider from any copy reaches a consumer from any copy:
+    - `@plitzi/sdk-shared`: service, component, schema, network, theme scope, dev tools, builder.
+    - `@plitzi/sdk-elements`: element, element parent, layout body.
+    - interactions, plugins, event bridge, auth, variables and style.
+  - The store's contexts need `@plitzi/nexus` 1.4.0, which does the same. Every `@plitzi/*` package now asks for
+    `^1.4.0`, which is published.
+
+  ## The source of plugins and runtimes is kept on the space
+
+  What a plugin or a runtime is built from now goes up with it, so a space can be taken back out as a project
+  (`plitzi create --from`, below).
+
+  - `@plitzi/cli`:
+    - `plitzi pack plugin` writes the plugin's source beside its zip: every file of the project its elements import,
+      `import type` included, and the packages they need. `--source-root` names the project those paths are relative to.
+    - `plitzi upload plugin` and `plitzi runtime push` keep that source on the space, in its private bucket.
+    - `plitzi pack source` writes it to a file.
+    - A source that cannot be kept (a file outside the project, an undeclared package, a credential in the code) never
+      stops the upload or the push: they say why, and the artifact is kept built only.
+  - `@plitzi/sdk-shared/source`: the snapshot's format, the paths it may hold and the credential check, shared by the CLI
+    and the platform.
+
+  ## `plitzi create --from` and `plitzi pull`: a space on Plitzi as a project of your own
+
+  The way back from everything the CLI puts on Plitzi. `plitzi create my-board --from pizarra` writes a server project
+  holding what the space is made of, and runs it with nothing of Plitzi's: neither its servers nor its CDN. `plitzi pull`
+  keeps it in step with the space. See `docs/en/projects-from-spaces.md`.
+
+  - **What lands in the project:**
+    - its pages as authoring code;
+    - its server actions as `defineAction` code — JSON, with the reason said, for one that would not read back exactly;
+    - its plugins and runtime as the source they were uploaded from, and its functions;
+    - its files, downloaded into `public/`, with every CDN address rewritten to the project's.
+  - **`src/main.ts`** serves all of it, the runtime in the same process.
+  - **`.env`** gets a key made for the project's actions to sign with, and the names of the variables and credentials
+    the space had. Their values stay on Plitzi.
+  - **Who may run it:** the person must be signed in and able to change the space (owner, administrator or writer).
+  - **Plugins** are rebuilt against the project's SDK. One uploaded before sources were kept runs as it was built, from
+    `vendor/plugins/`, and the report says to upload it again.
+  - **The end of `create`** says what came across differently, including a space whose visitors sign in with Plitzi.
+  - `--source cloud` keeps the pages on Plitzi and runs the rest locally.
+  - **Any version:** `--environment` and `--revision` take out a published snapshot — its latest, or one revision pinned
+    — instead of the draft, with the source its plugins and runtime were built from then. A cloud project serves that
+    revision pinned.
+  - **`plitzi pull`** writes what changed on the space, keeps what changed in the project, and writes nothing when a
+    file changed on both — naming them, with `--force` to take the space's copy. It never touches `.env`, only adds to
+    `package.json`, and keeps `plitzi functions push` working from the project. It follows the version the project was
+    made from, and `--environment`/`--revision` move it.
+  - `@plitzi/sdk-authoring`:
+    - `actionSpecFromEntry` reads an action document back into its `defineAction` declaration, only when the round trip
+      is exact, and `actionToSource` writes it as a module.
+    - `defineAction` takes `limits`.
+    - `specToSource` takes `importExtension: '.ts'`, for split files that Node imports as they are.
+
+  ## The builder shows what a snapshot holds
+
+  **Make Snapshot** lists what it will freeze — pages, layouts and elements, server actions, connectors, functions, the
+  runtime and the plugins, each with whether its source is kept — and what no snapshot freezes: the space's files, its
+  variables and credentials. A space's components are part of its document, so they are frozen with its pages. **Publish Snapshot** lists what the chosen environment's snapshot holds.
+
+  ## Fixed: a space read from Plitzi kept its server elements
+  - **What happened:** a page server reading its space from Plitzi (`createCloudAdapters`) never ran an element's
+    `render` action, and a browser-rendered space ignored `loadStrategy`. The space's GraphQL answered neither
+    `runtime` nor `loadStrategy` of an element, nor the space's `rsc` settings.
+  - **Now:** the platform answers them, and the SDK, the builder and the cloud adapters ask for them.
+
+  ## A plugin the deployment registers is not looked for elsewhere
+
+  `@plitzi/sdk-server` used to fetch the manifest of every plugin the space lists on its CDN, even one the deployment
+  registers itself, and logged a warning when the CDN was out of reach. It now asks only for the ones it does not have.
+
+  ## Fixed: inline code in Markdown carries nothing of the syntax tree
+
+  A `markdown` element wrote every inline `` `code` `` as `<code node="[object Object]">`: `react-markdown` hands its
+  renderers the syntax-tree node as a prop, and the inline branch spread it onto the tag. Fixed in
+  `@plitzi/plitzi-ui` 1.6.26 (with a test), which every package now asks for.
+
+  ## Dev tools hear about the render run the page stopped waiting for
+
+  When a server element's action ran past the section's budget, the page was answered without it. The run ended a moment
+  later, after the page's runs had been sent, so the dev tools never showed the one run that needed debugging. It is now
+  told the moment the page stops waiting, as `aborted`, with the reason.
+
+  ## Fixed: a tab you come back to no longer loses its session
+  - **What happened:** a page left in another tab past its access token's life signed its visitor out on return. A
+    reload put them right back in.
+  - **Why:** the browser drops the cookie carrying the access token the moment the token expires, and the background
+    tab's renewal timer had not run. The first check on return was told `missing`, which the client took as no
+    session at all.
+  - **Now:** a `missing` refusal is renewed instead whenever the browser can still renew, meaning it holds a refresh
+    token or a session hint whose renewal window is open. The session ends only if that renewal fails.
+  - **Requests made in that moment:** `reportAuthFailure` now answers whether it renewed the session. A read refused
+    as the tab came back is asked again, once, once the session is renewed. This covers an api container's read and a
+    server section's refresh, so they no longer show a 401 that only a reload cleared.
+
+## 0.37.8
+
+### Patch Changes
+
+- 4d10e0a: ## Fixed: an api container could not read a file from a CDN
+
+  - **What happened:** the api container sent `Content-Type: application/json` on every request, including a GET with no
+    body to describe. That made every read a non-simple cross-origin request, so the browser asked the host's
+    permission first.
+  - **Who it hit:** hosts that allow plain cross-origin reads (GET and HEAD from any origin, the usual CORS of a public
+    bucket, the space's own CDN among them) refused that preflight. The file never loaded. Tremor's world outlines on
+    `cdn-dev.plitzi.com` are one example.
+  - **What changes:** a read now sends `Accept: application/json`, and `Content-Type` goes only with a body, unless the
+    author set their own. Headers the author adds still make the request non-simple, as they must.
+
 ## 0.37.7
 
 ### Patch Changes

package/dist/actions/functions.d.ts

@@ -1,8 +1,17 @@
 /**
- * Where a space's functions answer HTTP: `GET /feed/:id` declared, `GET /api/feed/42` served. The path is
- * the functions' and never a page's — the page server and the page linter both read it from here.
+ * Where a space's functions answer HTTP: `GET /feed/:id` declared, `GET /fn/feed/42` served. The path is the functions'
+ * and never a page's — the page server and the page linter both read it from here. `/fn`, not `/api`: a space's pages
+ * are its own to name, and `api` is a slug a site wants for a page about its API.
  */
-export declare const FUNCTION_ROUTES_PREFIX = "/api";
+export declare const FUNCTION_ROUTES_PREFIX = "/fn";
+/**
+ * The CPU and time an invocation gets when its task asks for none: what the server runs it with, and what the builder
+ * shows as "default". A task asks for more in its `limits`, up to what its deployment allows.
+ */
+export declare const DEFAULT_FUNCTION_TIME_LIMITS: {
+    readonly cpuMs: 100;
+    readonly wallMs: 10000;
+};
 /** Whether a page at `path` would sit where the space's functions answer. */
 export declare const isFunctionRoutePath: (path: string) => boolean;
 /**

package/dist/actions/functions.mjs

@@ -1,6 +1,9 @@
 //#region src/actions/functions.ts
-var e = "/api", t = (e) => e === "/api" || e.startsWith("/api/"), n = (e) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*\.(ts|js|mjs|json)$/.test(e) && !e.split("/").some((e) => e === ".." || e === "." || e === ""), r = async (e, t) => {
-	let r = {}, i = async (a) => {
+var e = "/fn", t = {
+	cpuMs: 100,
+	wallMs: 1e4
+}, n = (e) => e === "/fn" || e.startsWith("/fn/"), r = (e) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*\.(ts|js|mjs|json)$/.test(e) && !e.split("/").some((e) => e === ".." || e === "." || e === ""), i = async (e, t) => {
+	let n = {}, i = async (a) => {
 		let o;
 		try {
 			o = await t.list(a ? `${e}/${a}` : e);
@@ -9,10 +12,10 @@ var e = "/api", t = (e) => e === "/api" || e.startsWith("/api/"), n = (e) => /^[
 		}
 		for (let s of o) {
 			let o = a ? `${a}/${s.name}` : s.name;
-			s.directory ? s.name !== "node_modules" && !s.name.startsWith(".") && await i(o) : n(o) && (r[o] = await t.read(`${e}/${o}`));
+			s.directory ? s.name !== "node_modules" && !s.name.startsWith(".") && await i(o) : r(o) && (n[o] = await t.read(`${e}/${o}`));
 		}
 	};
-	return await i(""), r;
+	return await i(""), n;
 };
 //#endregion
-export { e as FUNCTION_ROUTES_PREFIX, t as isFunctionRoutePath, n as isFunctionsSourcePath, r as readFunctionsSource };
+export { t as DEFAULT_FUNCTION_TIME_LIMITS, e as FUNCTION_ROUTES_PREFIX, n as isFunctionRoutePath, r as isFunctionsSourcePath, i as readFunctionsSource };

package/dist/actions/index.d.ts

@@ -1,7 +1,7 @@
 export { accessRefusal } from './access';
 export { cronFiresBetween, cronMatches, cronNextFire, isKnownTimeZone, parseCron, zonedClock } from './cron';
 export { FAILURE_HANDLER_TASK } from './failureHandler';
-export { FUNCTION_ROUTES_PREFIX, isFunctionRoutePath, isFunctionsSourcePath, readFunctionsSource } from './functions';
+export { DEFAULT_FUNCTION_TIME_LIMITS, FUNCTION_ROUTES_PREFIX, isFunctionRoutePath, isFunctionsSourcePath, readFunctionsSource } from './functions';
 export { triggerAccess, triggerCacheMs, triggerHasStaleVerify, triggerInput, triggerVerify } from './triggerParams';
 export { actionName, actionTriggers, isActionEnabled } from './triggers';
 export { validateActionDocument } from './validateDocument';

package/dist/actions/index.mjs

@@ -1,9 +1,9 @@
 import { accessRefusal as e } from "./access.mjs";
 import { cronFiresBetween as t, cronMatches as n, cronNextFire as r, isKnownTimeZone as i, parseCron as a, zonedClock as o } from "./cron.mjs";
 import { FAILURE_HANDLER_TASK as s } from "./failureHandler.mjs";
-import { FUNCTION_ROUTES_PREFIX as c, isFunctionRoutePath as l, isFunctionsSourcePath as u, readFunctionsSource as d } from "./functions.mjs";
-import { triggerAccess as f, triggerCacheMs as p, triggerHasStaleVerify as m, triggerInput as h, triggerVerify as g } from "./triggerParams.mjs";
-import { actionName as _, actionTriggers as v, isActionEnabled as y } from "./triggers.mjs";
-import { validateActionDocument as b } from "./validateDocument.mjs";
-import { SMTP_CREDENTIAL_KEYS as x, isSingleEmailAddress as S, readSmtpCredential as C } from "./smtp.mjs";
-export { s as FAILURE_HANDLER_TASK, c as FUNCTION_ROUTES_PREFIX, x as SMTP_CREDENTIAL_KEYS, e as accessRefusal, _ as actionName, v as actionTriggers, t as cronFiresBetween, n as cronMatches, r as cronNextFire, y as isActionEnabled, l as isFunctionRoutePath, u as isFunctionsSourcePath, i as isKnownTimeZone, S as isSingleEmailAddress, a as parseCron, d as readFunctionsSource, C as readSmtpCredential, f as triggerAccess, p as triggerCacheMs, m as triggerHasStaleVerify, h as triggerInput, g as triggerVerify, b as validateActionDocument, o as zonedClock };
+import { DEFAULT_FUNCTION_TIME_LIMITS as c, FUNCTION_ROUTES_PREFIX as l, isFunctionRoutePath as u, isFunctionsSourcePath as d, readFunctionsSource as f } from "./functions.mjs";
+import { triggerAccess as p, triggerCacheMs as m, triggerHasStaleVerify as h, triggerInput as g, triggerVerify as _ } from "./triggerParams.mjs";
+import { actionName as v, actionTriggers as y, isActionEnabled as b } from "./triggers.mjs";
+import { validateActionDocument as x } from "./validateDocument.mjs";
+import { SMTP_CREDENTIAL_KEYS as S, isSingleEmailAddress as C, readSmtpCredential as w } from "./smtp.mjs";
+export { c as DEFAULT_FUNCTION_TIME_LIMITS, s as FAILURE_HANDLER_TASK, l as FUNCTION_ROUTES_PREFIX, S as SMTP_CREDENTIAL_KEYS, e as accessRefusal, v as actionName, y as actionTriggers, t as cronFiresBetween, n as cronMatches, r as cronNextFire, b as isActionEnabled, u as isFunctionRoutePath, d as isFunctionsSourcePath, i as isKnownTimeZone, C as isSingleEmailAddress, a as parseCron, f as readFunctionsSource, w as readSmtpCredential, p as triggerAccess, m as triggerCacheMs, h as triggerHasStaleVerify, g as triggerInput, _ as triggerVerify, x as validateActionDocument, o as zonedClock };

package/dist/auth/failureChannel.d.ts

@@ -4,13 +4,19 @@ export type AuthFailureSignal = {
     /** The request that was refused. Auth listens only to refusals from its own backend — see `sameRegistrableDomain`. */
     url?: string;
 };
-export type AuthFailureListener = (signal: AuthFailureSignal) => void;
+/** Hears a refusal, and answers whether it renewed the session because of it — or nothing, for a listener that did not. */
+export type AuthFailureListener = (signal: AuthFailureSignal) => Promise<boolean> | boolean | undefined;
 /**
  * Says that a backend refused a credential. A session can end between two checks — revoked from another device, an
  * account deactivated — and the first thing that notices is whatever request got refused, not a timer. Reporting it
  * here is how the network layers tell auth that reality moved on, without either knowing about the other.
+ *
+ * Answers whether the session was renewed because of it: a refusal that only meant "this credential expired" — a tab
+ * coming back after its token's life — is answered by a renewal, and the request that was refused can be asked again,
+ * once, instead of leaving its section in an error a reload would have cleared. A refused request never ran, so asking
+ * it again repeats nothing.
  */
-export declare const reportAuthFailure: (signal: AuthFailureSignal) => void;
+export declare const reportAuthFailure: (signal: AuthFailureSignal) => Promise<boolean>;
 export declare const onAuthFailure: (listener: AuthFailureListener) => (() => void);
 /**
  * What an HTTP refusal means for the session. Stated once, because the provider and the network layers must not

package/dist/auth/failureChannel.mjs

@@ -1,7 +1,5 @@
 //#region src/auth/failureChannel.ts
-var e = /* @__PURE__ */ new Set(), t = (t) => {
-	for (let n of e) n(t);
-}, n = (t) => (e.add(t), () => e.delete(t)), r = [
+var e = /* @__PURE__ */ new Set(), t = async (t) => (await Promise.all([...e].map(async (e) => e(t)))).some((e) => e === !0), n = (t) => (e.add(t), () => e.delete(t)), r = [
 	"missing",
 	"expired",
 	"revoked",

package/dist/builder/contexts/BuilderContext.d.ts

@@ -1,7 +1,7 @@
 import { ComponentPluginWithHOC, DropPosition, Element, EventBridgeEvent, PluginBuilder, Schema, Style } from '../../types';
 import { Dispatch, SetStateAction } from 'react';
 export type BuilderContextValue = {
-    mode: 'normal' | 'template' | 'segment';
+    mode: 'normal' | 'template';
     schemaName: string;
     setMultiPagesMode: Dispatch<SetStateAction<boolean>>;
     multiPagesMode: boolean;

package/dist/builder/contexts/BuilderContext.mjs

@@ -1,5 +1,4 @@
-import { createContext as e } from "react";
-var t = e({});
-t.displayName = "BuilderContext";
+import { sharedContext as e } from "../../helpers/sharedContext.mjs";
+var t = e("BuilderContext", {});
 //#endregion
 export { t as default };

package/dist/devTools/DevToolsContext.mjs

@@ -1,8 +1,7 @@
-import { createContext as e } from "react";
-var t = e({
+import { sharedContext as e } from "../helpers/sharedContext.mjs";
+var t = e("DevToolsContext", {
 	logs: [],
 	providers: {}
 });
-t.displayName = "DevToolsContext";
 //#endregion
 export { t as default };

package/dist/elements/ComponentContext.mjs

@@ -1,5 +1,4 @@
-import { createContext as e } from "react";
-var t = e({});
-t.displayName = "ComponentContext";
+import { sharedContext as e } from "../helpers/sharedContext.mjs";
+var t = e("ComponentContext", {});
 //#endregion
 export { t as default };

package/dist/helpers/sharedContext.d.ts

@@ -0,0 +1,14 @@
+import { Context } from 'react';
+/**
+ * A React context every copy of the Plitzi runtime on a page agrees on.
+ *
+ * One page can hold more than one copy. The builder carries its own and renders a space's elements with it, while a
+ * remote plugin imports `@plitzi/plitzi-sdk` — the SDK's copy — through the page's import map; the builder embedded in
+ * Plitzi's own site is a third, the site's. A context made with `createContext` belongs to the copy that made it, so a
+ * plugin in the builder's canvas read none of the canvas's providers: it fell through to the site around the builder,
+ * took its element for the plugin's own, its live mode for the editor's and its store for the space's.
+ *
+ * Made once per page, under `name`, by whichever copy asks first, and handed to every other: a provider from any copy
+ * is then seen by a consumer from any copy, and the nearest one wins as it should.
+ */
+export declare const sharedContext: <T>(name: string, defaultValue: T) => Context<T>;

package/dist/helpers/sharedContext.mjs

@@ -0,0 +1,9 @@
+import { createContext as e } from "react";
+var t = Symbol.for("plitzi.sharedContexts.v1"), n = (e) => (e[t] ??= /* @__PURE__ */ new Map(), e[t]), r = (t, r) => {
+	let i = n(globalThis), a = i.get(t);
+	if (a) return a;
+	let o = e(r);
+	return o.displayName = t, i.set(t, o), o;
+};
+//#endregion
+export { r as sharedContext };

package/dist/helpers/twigWrapper/Evaluator/Evaluator.d.ts

@@ -1,4 +1,12 @@
 import { ASTNode, Expression } from '../AST';
+/**
+ * Which empty tokens a render hands back as their own text, for a later pass that knows more: none, every one, or
+ * every one but those reading a SETTLED source — one whose value is final when the render runs, so that nothing later
+ * will fill it in. A component's `props` is one: every declared prop is in it, and an empty one is an answer.
+ */
+export type KeepEmptyTokens = boolean | {
+    settled: ReadonlySet<string>;
+};
 export type EvalResult = {
     readonly output: string;
     readonly variables: Record<string, unknown>;
@@ -12,6 +20,6 @@ export type EvalResult = {
  * that document, not text the reader has to give up on. A value printed anywhere else is printed as always: it IS the
  * JSON value there (`"seen": {{ count }}`).
  */
-export declare const evaluate: (nodes: readonly ASTNode[], context: Record<string, unknown>, keepEmptyTokens?: boolean, jsonStrings?: boolean) => EvalResult;
+export declare const evaluate: (nodes: readonly ASTNode[], context: Record<string, unknown>, keepEmptyTokens?: KeepEmptyTokens, jsonStrings?: boolean) => EvalResult;
 /** One expression's value, as it is — not rendered to text. What `processTwigValue` answers a `{{ expr }}` with. */
 export declare const evaluateExpression: (expression: Expression, context: Record<string, unknown>) => unknown;

package/dist/helpers/twigWrapper/Evaluator/Evaluator.mjs

@@ -10,14 +10,14 @@ var l = {
 	iterable: (e) => Array.isArray(e) || typeof e == "object" && !!e,
 	even: (e) => typeof e == "number" && e % 2 == 0,
 	odd: (e) => typeof e == "number" && Math.abs(e % 2) === 1
-}, u = (e) => e.type === "path" || e.type === "filter" && u(e.subject), d = (e, t) => t == null || t === "" && u(e), f = (e) => e.type === "path" && e.segments.length === 1 ? e.segments[0] : e.type === "literal" && e.value === null ? "null" : void 0, p = [], m = (e, t, n = !1, r = !1) => {
-	let i = new g(t, n, r);
+}, u = (e) => e.type === "path" || e.type === "filter" && u(e.subject), d = (e, t) => t == null || t === "" && u(e), f = (e) => e.type === "path" ? e.segments[0] : e.type === "filter" ? f(e.subject) : void 0, p = (e) => e.type === "path" && e.segments.length === 1 ? e.segments[0] : e.type === "literal" && e.value === null ? "null" : void 0, m = [], h = (e, t, n = !1, r = !1) => {
+	let i = new _(t, n, r);
 	return {
 		output: i.evalNodes(e),
 		variables: i.variables,
 		hasSet: i.hasSet
 	};
-}, h = (e, t) => new g(t).evalExpression(e), g = class u {
+}, g = (e, t) => new _(t).evalExpression(e), _ = class u {
 	variables;
 	keepEmptyTokens;
 	jsonStrings;
@@ -29,6 +29,11 @@ var l = {
 	constructor(e, t = !1, n = !1) {
 		this.variables = { ...e }, this.keepEmptyTokens = t, this.jsonStrings = n;
 	}
+	keeps(e) {
+		if (typeof this.keepEmptyTokens == "boolean") return this.keepEmptyTokens;
+		let t = f(e);
+		return t === void 0 || !this.keepEmptyTokens.settled.has(t);
+	}
 	evalNodes(e) {
 		let t = e.length;
 		if (t === 0) return "";
@@ -51,7 +56,7 @@ var l = {
 	}
 	evalVariable(e) {
 		let t = this.evalExpression(e.expression);
-		return this.keepEmptyTokens && d(e.expression, t) ? e.source : o(t) ? String(s(t)) : typeof t == "function" ? "" : t != null && typeof t != "object" ? String(t) : e.raw ? t == null ? "" : String(t) : typeof t == "object" && t ? JSON.stringify(t) : "";
+		return this.keeps(e.expression) && d(e.expression, t) ? e.source : o(t) ? String(s(t)) : typeof t == "function" ? "" : t != null && typeof t != "object" ? String(t) : e.raw ? t == null ? "" : String(t) : typeof t == "object" && t ? JSON.stringify(t) : "";
 	}
 	followQuotes(e) {
 		for (let t = 0; t < e.length; t++) {
@@ -66,7 +71,7 @@ var l = {
 	}
 	evalFor(e) {
 		let r = this.evalExpression(e.collection);
-		if (e.source !== void 0 && r === void 0) return e.source;
+		if (e.source !== void 0 && r === void 0 && this.keeps(e.collection)) return e.source;
 		let i, a = null;
 		if (e.keyVar !== null) {
 			let t = n(r);
@@ -112,7 +117,7 @@ var l = {
 		let n = e;
 		for (let e of t) {
 			let t = a[e.name];
-			t !== void 0 && (n = t(n, e.args.length === 0 ? p : this.evalArgs(e.args)));
+			t !== void 0 && (n = t(n, e.args.length === 0 ? m : this.evalArgs(e.args)));
 		}
 		return n;
 	}
@@ -221,7 +226,7 @@ var l = {
 		return a;
 	}
 	evalBinary(t, n, i) {
-		let a = f(i);
+		let a = p(i);
 		if ((t === "is" || t === "is not") && a !== void 0) {
 			let e = l[a];
 			if (e) {
@@ -262,4 +267,4 @@ var l = {
 	}
 };
 //#endregion
-export { m as evaluate, h as evaluateExpression };
+export { h as evaluate, g as evaluateExpression };

package/dist/helpers/twigWrapper/Evaluator/index.d.ts

@@ -1,2 +1,2 @@
 export { evaluate, evaluateExpression } from './Evaluator';
-export type { EvalResult } from './Evaluator';
+export type { EvalResult, KeepEmptyTokens } from './Evaluator';

package/dist/helpers/twigWrapper/index.d.ts

@@ -6,5 +6,6 @@ export { inspectTemplate } from './inspectTemplate';
 export { templatePaths, templateRootNames } from './templateRoots';
 export { filters } from './filters/filters';
 export type { ASTNode, Expression } from './AST';
+export type { KeepEmptyTokens } from './Evaluator';
 export type { TemplateInspection } from './inspectTemplate';
 export type { TwigFilter } from './filters/filters';

package/dist/helpers/twigWrapper/processTwig/processTwig.d.ts

@@ -1,4 +1,5 @@
-export declare const processTwig: (template: string, variables?: Record<string, unknown>, keepEmptyTokens?: boolean, asRaw?: boolean) => unknown;
+import { KeepEmptyTokens } from '../Evaluator';
+export declare const processTwig: (template: string, variables?: Record<string, unknown>, keepEmptyTokens?: KeepEmptyTokens, asRaw?: boolean) => unknown;
 /**
  * A template's VALUE, where it has one: `{{ rows|filter(r => r.open) }}` is the filtered array, `{{ count > 0 }}` a
  * boolean, `{{ total }}` the number it holds.

package/dist/helpers/twigWrapper/processTwig/processTwig.mjs

@@ -8,14 +8,14 @@ var s = (i, s = {}, c = !1, l = !1) => {
 		if (i.indexOf("{%") === -1 && i.indexOf("{{") === -1) return i;
 		let u = "variables" in s ? t(s) : s, d = o(i);
 		if (!d) return i;
-		if (!c && !d.hasTags && d.allSimpleOrDotted) {
+		if (c === !1 && !d.hasTags && d.allSimpleOrDotted) {
 			let t = n(d, u);
 			return l ? e(t) : t;
 		}
-		let f = a(d, c);
+		let f = a(d, c !== !1);
 		if (!f) return i;
 		let { output: p, variables: m, hasSet: h } = r(f, u, c);
-		return h && Object.assign(s, m), c && p === i ? i : l ? e(p) : p;
+		return h && Object.assign(s, m), c !== !1 && p === i ? i : l ? e(p) : p;
 	} catch {
 		return i;
 	}

package/dist/helpers/utils.mjs

@@ -8,7 +8,7 @@ Object.freeze(n);
 var r = (e, t = "", n = ".", i = !1) => !e || typeof e != "object" ? [] : Object.keys(e).reduce((a, o) => {
 	o = o.replaceAll(n, "").replaceAll(".", "");
 	let s = `${t}${t ? n : ""}${o}`;
-	return typeof e[o] != "object" || Array.isArray(e[o]) && i ? [...a, s] : [
+	return typeof e[o] != "object" || Array.isArray(e[o]) && (i || e[o].length > 5) ? [...a, s] : [
 		...a,
 		s,
 		...r(e[o], s, n, i)
@@ -29,7 +29,9 @@ function a(t, n) {
 	} catch {
 		return 0;
 	}
-	return n ? e(r, "data.spaceId", 0) : r;
+	if (!n) return r;
+	let i = Number(e(r, "sub", 0));
+	return Number.isInteger(i) && i > 0 ? i : 0;
 }
 function o(e) {
 	!e && typeof window < "u" && (e = window.location.search);

package/dist/history/describe.mjs

@@ -25,6 +25,7 @@ var e = (e) => typeof e == "object" && !!e && !Array.isArray(e), t = (n, r, i =
 	};
 	return Object.hasOwn(i, r) ? i[r] : r;
 }, s = (e, t = 3) => e.length > t ? `${e.slice(0, t).join(", ")} and ${e.length - t} more` : e.join(", "), c = {
+	component: "component",
 	folder: "folder",
 	variable: "variable",
 	setting: "setting",

package/dist/history/diff.d.ts

@@ -16,7 +16,7 @@ export declare const sameValue: (a: unknown, b: unknown) => boolean;
  */
 export declare const jsonCopy: <T>(value: T) => T;
 /** The part of a schema a history reads: what is stored, never what the runtime derives from it. */
-export type HistorySchema = Pick<Schema, 'flat' | 'pages' | 'pageFolders' | 'variables' | 'settings' | 'definition'>;
+export type HistorySchema = Pick<Schema, 'flat' | 'pages' | 'pageFolders' | 'variables' | 'settings' | 'definition' | 'components'>;
 /**
  * What changed between two versions of a schema, entity by entity.
  *