efficient-easel 18.2.0 → 19.0.0

package/README.md

@@ -48,7 +48,7 @@ efficient-shell's components (`efficient-shell/ui`): they draw in the shell's
 Tailwind classes, which **the host's Tailwind compiles from the shell's dist**
 (the `@source` lines in its `ui.css`). Easel itself emits no Tailwind class.
 The exported names hosts import (`EaselIconButton`, `SettingsSwitch`,
-`SettingsSegmented`, `SettingsTabs`, `FieldText`, `FieldNumber`, …) stay, as
+`SettingsSegmented`, `FieldText`, `FieldNumber`, …) stay, as
 thin wrappers with the props they had.
 
 `tests/own-ui-ratchet.test.ts` holds the named primitives: since 1.0.0 none
@@ -307,6 +307,12 @@ it, so a **server-rendered** editor writes the widths through the CSSOM instead:
 Until that runs, chrome.css draws the panels at `DEFAULT_PANEL_W`. See
 [Server rendering and a strict Content-Security-Policy](#server-rendering-and-a-strict-content-security-policy).
 
+**Each side panel has its own floor (ruling A4g).** `MIN_PANEL_W_BY_SIDE`
+is `{ left: 240, right: 220 }`; the ceiling is `MAX_PANEL_W` (560) on both.
+Clamp with the side, `clampPanelWidth(width, 'left')`, and hand each
+`PanelResizeHandle` its side's `min`. `MIN_PANEL_W` (220) is `@deprecated`: it
+is only the right floor now.
+
 **The inspector head's words, and the body's inset (9.0.0).** `headWords()`
 gives the head's two lines the same way in both editors: line 1 is the thing's
 own name (its Layers row's word), line 2 its level.
@@ -1125,6 +1131,25 @@ backend (`defaultBackend`) and its own reading of its client's errors
 by the host a field asks through; the Add panel lists its own session's saved
 sections.
 
+The media library is the host's, shown as ONE popup (harness UI-20, owner
+decision 2026-10-23; `screen/lib/media-panel`, `components/MediaPopup`). The
+host hands its component to `MediaPanelProvider` (`panel`); the screen draws it
+once at its root with `{ pick, browsing, onPick, onClose }` and the host draws
+it as its popup. A field's `requestMediaPick` opens it for that field; the
+rail's Media opens it to browse (`useOpenMediaBrowse`); `onClose` leaves the
+field as it was. There is no media view in the left panel. A host with no
+popup still gets `storefront-editor:open-media-picker`.
+
+A file dragged out of that popup (the shell's `MEDIA_FILE_DRAG_TYPE`) is a
+drag in the screen's own session, like an Add tile, when the layer says what a
+picture is (`ScreenCanvasDrag.media`, a `ScreenMediaDrop`): between things it
+becomes `create(file, maker)` at the places Add offers `adds`; held over a
+node the layer `takes`, that node is outlined ("Replace image") and the drop
+writes `replace(node, file)`. Before either, the file goes through the host's
+pick path when the host gives one (`MediaPanelProvider` `place`): a website
+takes a file another website holds by copying it in, as a pick of it does.
+`CanvasDragLayer` takes the drop on a node through `dropOn`.
+
 Its Layers tree is the layer's to frame (0.103.0). `pinned.isFirst` and
 `isLast` say which node is pinned where the type alone does not (the campaign
 designer's Header and Footer are sections, told apart by `_region`);

package/dist/{CanvasDragLayer-dZCPbQCP.d.ts → CanvasDragLayer-ARfaivCu.d.ts}

@@ -122,9 +122,13 @@ declare function canvasTarget(zones: readonly CanvasZone[], x: number, y: number
  * two, and after its last (owner 2026-10-14) — for a list that HAS children
  * (an empty one draws its cell instead). Across a 'y' list, down an 'x' one.
  * Between two children the band is the room they leave. At an end it is the
- * room between the list's edge and its child, centred there but never closer
- * than `inset` to the edge: a ➕ half outside its list is cut by the canvas, and
- * focusing it scrolls the canvas to show it.
+ * room between the list's edge and its child, centred there and pushed toward
+ * `inset` from the edge (a ➕ half outside its list can be cut by the canvas) —
+ * but never past the child's own edge. A list only as tall as its blocks (an
+ * email column, a centred row) has no room at its ends: the ➕ sits ON the
+ * block's edge, never across the block (Lewis 2026-10-23: the line drawn
+ * through a button's words). Across the list, the band spans the block or
+ * blocks it sits next to, never the empty room beside them.
  */
 declare function insertSeams(zone: CanvasZone, label?: string, inset?: number): CanvasSeam[];
 declare function seamsBetween(zone: CanvasZone, keyPrefix?: string): CanvasSeam[];
@@ -178,6 +182,20 @@ type CanvasDragLayerProps<I> = {
      * its answer may have changed: the handle is picked again with it.
      */
     choose?: (under: readonly CanvasSource<I>[]) => CanvasSource<I> | null;
+    /**
+     * A drop ON a thing rather than between things (the editors' media popup,
+     * harness UI-20, 2026-10-23: a picture dropped on an image replaces it).
+     * While a drag is over a thing under the pointer that `accepts` the item —
+     * the innermost one that does — its box is outlined with `label` and the
+     * drop goes to `onDrop` with it; anywhere else the drop is the ordinary one
+     * between things. Absent: every drop is between things, as before.
+     */
+    dropOn?: {
+        accepts: (item: I, source: CanvasSource<I>) => boolean;
+        onDrop: (item: I, source: CanvasSource<I>) => void;
+        /** What the outline says the drop does ("Replace image"). */
+        label?: (item: I, source: CanvasSource<I>) => string;
+    };
     /** The handle CLICKED, not dragged: select what it names. Absent: a click does nothing. */
     onPick?: (item: I) => void;
     /** "+ Add section" in a seam: open the Add panel at that place. */

package/dist/{host-epHo7r8P.d.ts → ScreenDocumentContext-D55vIrG3.d.ts}

@@ -1,12 +1,12 @@
 import * as react from 'react';
-import { RefObject, ReactNode } from 'react';
+import { ReactNode, RefObject } from 'react';
 import { Data } from './blocks/index.js';
 import { EaselDocumentAdapter, EaselCapabilities } from './screen/lib/document-contract.js';
-import { SessionBackend, SessionBlocks } from './screen/lib/session.js';
 import { SaveStatus } from './screen/lib/document-switch.js';
 import { BridgedCapabilities } from './screen/lib/admin-bridge.js';
 import { EditAccess, SaveConflict } from './edit-lock/index.js';
 import { A as AutosaveSnapshot } from './engine-CvXpFE86.js';
+import { SessionBackend, SessionBlocks } from './screen/lib/session.js';
 
 /**
  * lib/document-addressing.ts — HOW A DOCUMENT IS ADDRESSED: what the
@@ -138,212 +138,6 @@ type AnyDocumentAddressing = DocumentAddressing<ScreenTarget> | DocumentAddressi
  */
 declare const NO_DOCUMENT_ADDRESSING: DocumentAddressing<AnyScreenTarget>;
 
-type ScreenTarget = {
-    kind: "page";
-    slug: string;
-    siteId?: string;
-} | {
-    kind: "template";
-    id: string;
-    pageSlug?: string;
-};
-/**
- * A DOCUMENT OF A HOST'S OWN — not a website's page or template: what the
- * campaign designer opens (0.103.0). `record` is the record that stores it (a
- * campaign's id), and `slug` the document within that record (one of its
- * variants), the empty slug when it names none.
- *
- * The provider asks no more of it than that. One record is one adapter (it
- * re-keys on `record`, as a page target re-keys on its site); two of these are
- * the same document when record and slug match; and a document that has gone
- * is reported, never replaced by a Home, which is a website's.
- *
- * Beside `ScreenTarget` and not in it: that union is the website's two kinds,
- * as its hosts name and build them (and as the storefront publishes them), and
- * its host messages carry one. A host's own document reaches the host through
- * its address (`EaselHostAddress.show`), and never as `navigated`.
- */
-type DocumentTarget = {
-    kind: "document";
-    record: string;
-    slug?: string;
-};
-/** Every target the document's provider opens: a website's page or template
- *  (`ScreenTarget`), or a document of a host's own (`DocumentTarget`). */
-type AnyScreenTarget = ScreenTarget | DocumentTarget;
-
-type ScreenDocumentValue = {
-    /** The document the editor is currently pointed at (runtime, retargetable). */
-    target: AnyScreenTarget;
-    /** Record-type plumbing (load/save/list/create/delete) for the pointed-at
-     *  document. Chrome and panels consult `capabilities`, never the record type. */
-    adapter: EaselDocumentAdapter;
-    /** What this document type supports — the ONLY sanctioned mode switch. */
-    capabilities: EaselCapabilities;
-    /** Id of the website template being edited (template mode only). */
-    templateId: string | null;
-    /** Slug of the page being edited — the template page's slug in template mode,
-     *  and a host's own document's `slug` (or the empty slug) for one of those. */
-    currentSlug: string;
-    /** Kind of the loaded page (`dynamic` drives the product-binding controls), or
-     *  null while loading / in template mode where the record carries no kind. */
-    currentKind: string | null;
-    /** Id of the website this page belongs to (page mode only; null in template
-     *  mode or when the editor was opened without a site). The list/save paths and
-     *  the page switcher scope to this so they act on one site's pages, not the
-     *  whole tenant's. */
-    siteId: string | null;
-    /** Whether the editor's backend may be called yet. Under the EFFICIENT backend
-     *  that is "the console's token has arrived"; an embedder's own backend
-     *  authorises its calls itself and is ready from the first render. THE gate
-     *  for anything that goes through the backend — never `token`, which an
-     *  embedder's backend does not have. */
-    ready: boolean;
-    /** The bridged admin JWT once it arrives (null while waiting, and always null
-     *  under an embedder's own backend). Only for the callers that still pass it
-     *  to the EFFICIENT client themselves. */
-    token: string | null;
-    /** Latest token for imperative reads (custom fields, pickers, panels). */
-    tokenRef: RefObject<string | null>;
-    /** Bridge editor events to the embedding admin portal. */
-    notifyParent: SendToHost;
-    /** Operator capabilities the ADMIN CONSOLE granted over the origin-gated
-     *  bridge. Distinct from `capabilities` above: those describe the DOCUMENT
-     *  (can it publish, has it site settings), these describe the PERSON, and the
-     *  editor is never allowed to infer them for itself. */
-    bridgeCapabilities: BridgedCapabilities;
-    /** Run an authed op; on 401 ask the parent for a fresh token and retry once. */
-    runAuthed: (op: (token: string) => Promise<unknown>) => Promise<boolean>;
-    /** Backend id of the loaded document — the identity of what the editor is
-     *  editing right now. Null while loading and between retargets, so it also
-     *  keys any once-per-document work (e.g. the pinned-chrome seed). */
-    docId: string | null;
-    /** The document exactly as it was LOADED from the backend: Puck's initial
-     *  state, and the persisted snapshot a load-time seed must measure itself
-     *  against. Null while loading. Edits live in Puck's own store, so this does
-     *  NOT track them — it stays the last-loaded layout for the whole session. */
-    data: Data | null;
-    /** The freshest layout the merchant is actually viewing — the latest edit made
-     *  since load (tracked on every onChange, even after the autosave settles), else
-     *  the last-loaded `data`. Lets a feature snapshot the live view (e.g. the
-     *  read-only origin backdrop in footer focus) without reaching into Puck's store.
-     *  Lean accessor (ISP) — never exposes the ref. */
-    getLiveData: () => Data | null;
-    error: string | null;
-    /** True while the template-entry bounce is redirecting to the Home page. */
-    redirecting: boolean;
-    /** The pinned-seed gate's four words for where the autosave stands. */
-    saveStatus: SaveStatus;
-    /** The autosave's state (efficient-easel/autosave) — what the toolbar pill
-     *  draws, through `saveIndicator`. */
-    saveState: AutosaveSnapshot;
-    /** Whether autosave is running. The toolbar pill is a switch: clicking it
-     *  flips this. OFF = edits are HELD (kept in memory, still flushable by Publish
-     *  / navigation / re-enabling) but never written on a timer. Session-scoped —
-     *  survives in-place page switches. */
-    autoSaveEnabled: boolean;
-    /** Auto-save stopped because a save was REFUSED, not because the operator
-     *  paused it — so a stopped auto-save can never read as a switch somebody
-     *  flicked themselves. */
-    autoSaveStoppedByConflict: boolean;
-    /** True when an edit hasn't been persisted yet — including one held while the
-     *  claim is in flight. Drives the guard that prompts before an in-place
-     *  navigation would abandon held-but-unsaved edits. */
-    hasUnsavedEdits: boolean;
-    /** Flip autosave on/off. Turning it back ON writes any held edits at once, so
-     *  "on" always means caught up. */
-    toggleAutoSave: () => void;
-    /** "Retry now": a failed save goes again at once instead of waiting out its
-     *  backoff. */
-    retrySave: () => void;
-    /** Autosave — hand every Puck onChange to this. */
-    onChange: (next: Data) => void;
-    /** Persist the pending edit immediately; resolves to whether nothing is left
-     *  unsaved. */
-    flushSave: () => Promise<boolean>;
-    /** Persist + publish the current document (Save for templates). */
-    onPublish: (next: Data) => Promise<void>;
-    /** Whether this editor may write the open page, and why not when it may not.
-     *  `editing` is the only writable state; the gate is on the save path itself,
-     *  so hiding or showing chrome from this can't be the thing that protects the
-     *  document. Always `editing` in template mode (no lock there). */
-    access: EditAccess;
-    /** SOMEBODY ELSE holds this page, so this editor is read-only: it may look and
-     *  select, but not move, add, duplicate or delete anything — until they take
-     *  control themselves. The ONE answer the chrome asks; no panel re-derives it,
-     *  so none of them can drift.
-     *
-     *  NOT what protects the document — `persistLayout` refuses the write, and it
-     *  refuses it in more cases than this (while the claim is still `checking`, and
-     *  after a refused save). This is the narrower question the CHROME asks, and it
-     *  is narrower on purpose: during `checking` nobody is named yet, and the
-     *  pinned Header/Footer seed runs in the chrome's mount commit and must still
-     *  land. Its write is held by `onChange` and released by the claim if it is
-     *  granted, or never released if it is not — card 1096.
-     *
-     *  …or the document itself is FROZEN (`readOnlyReason`): nobody holds it, and
-     *  nobody may write it, ever.
-     *
-     *  …or a save was REFUSED (`saveConflict`, 0.106.0): the stored document moved
-     *  on under somebody else's save, the autosave has stopped, and nothing this
-     *  editor does is written again until the operator reloads. Until 0.106.0 the
-     *  canvas, the tree and the inspector went on taking edits nothing would save,
-     *  and Undo / Redo went on rewinding them; the old campaign designer locked
-     *  the canvas there, and owner ruling R5 (Victor Mau, 2026-10-09) says the
-     *  screen's Undo / Redo are DISABLED, not hidden, while this is true. The
-     *  operator still reads, selects and copies from the screen the notice warns
-     *  them about. */
-    readOnly: boolean;
-    /** Why the open document may never be written, as the backend said it
-     *  (`EaselDocument.readOnlyReason`: a campaign that has been sent), or null
-     *  for every document that may. Such a document is read-only for good: its
-     *  saves are refused, its lock is never claimed, and the save pill's place
-     *  says this instead. Optional for a context built by hand, where it is
-     *  absent and means null. */
-    readOnlyReason?: string | null;
-    /** Take the page: from the "someone else is editing" choice, or back after
-     *  somebody took it from you. */
-    takeOverEditing: () => void;
-    /** Choose to look without touching (keeps the holder for the ribbon). */
-    viewReadOnly: () => void;
-    /** A save the backend REFUSED because the stored page moved on. Non-null means
-     *  autosave has stopped and the operator's work is still only on their screen.
-     *  Told in a bar under the top bar (efficient-easel/chrome `EditNotice`),
-     *  never a dialog, so there is nothing to dismiss: the operator reads and
-     *  copies from the screen it is warning them about. */
-    saveConflict: SaveConflict | null;
-    /** The last save failed because the server could not be REACHED (no answer
-     *  at all), not because it answered no (8.0.0). With a failed save, the bar
-     *  says "You're offline" where it would say "Not saved". Optional for a
-     *  context built by hand, where it is absent and means false. */
-    saveUnreachable?: boolean;
-    /** Abandon this editor's version and reload what is stored. The ONLY path that
-     *  throws the operator's work away, and only they can ask for it. */
-    reloadFromServer: () => void;
-    /** Retarget the editor in place (guards unsaved changes before it swaps). */
-    navigate: (target: AnyScreenTarget) => void;
-    /** A retarget held behind the unsaved-changes prompt (null = no prompt). */
-    pendingNav: AnyScreenTarget | null;
-    cancelPendingNav: () => void;
-    discardAndNavigate: () => void;
-    saveAndNavigate: () => Promise<void>;
-};
-declare const ScreenDocumentContext: react.Context<ScreenDocumentValue | null>;
-declare function useScreenDocument(): ScreenDocumentValue;
-declare function ScreenDocumentProvider({ target, addressing: handed, onHostMessage, children, }: {
-    target: AnyScreenTarget;
-    /** How this editor's documents are ADDRESSED — the layer's rules, handed in
-     *  by whoever mounts the provider (the website's entry hands the website's:
-     *  lib/website-document-addressing). Without them there is one document that
-     *  nothing stores. ONE object for the life of the mount, like the session. */
-    addressing?: AnyDocumentAddressing;
-    /** The layer's own host messages, asked before the ones every editor answers
-     *  (lib/host-inbound): the website's are lib/website-host-inbound.
-     *  Returns true when it handled one. */
-    onHostMessage?: (raw: unknown) => boolean;
-    children: ReactNode;
-}): react.JSX.Element;
-
 /**
  * The editor's HOST — whatever embeds the storefront editor, and the one way the
  * editor talks to it.
@@ -615,4 +409,210 @@ declare function createEaselHost(options: {
     deliver: (message: HostToEaselMessage) => void;
 };
 
+type ScreenTarget = {
+    kind: "page";
+    slug: string;
+    siteId?: string;
+} | {
+    kind: "template";
+    id: string;
+    pageSlug?: string;
+};
+/**
+ * A DOCUMENT OF A HOST'S OWN — not a website's page or template: what the
+ * campaign designer opens (0.103.0). `record` is the record that stores it (a
+ * campaign's id), and `slug` the document within that record (one of its
+ * variants), the empty slug when it names none.
+ *
+ * The provider asks no more of it than that. One record is one adapter (it
+ * re-keys on `record`, as a page target re-keys on its site); two of these are
+ * the same document when record and slug match; and a document that has gone
+ * is reported, never replaced by a Home, which is a website's.
+ *
+ * Beside `ScreenTarget` and not in it: that union is the website's two kinds,
+ * as its hosts name and build them (and as the storefront publishes them), and
+ * its host messages carry one. A host's own document reaches the host through
+ * its address (`EaselHostAddress.show`), and never as `navigated`.
+ */
+type DocumentTarget = {
+    kind: "document";
+    record: string;
+    slug?: string;
+};
+/** Every target the document's provider opens: a website's page or template
+ *  (`ScreenTarget`), or a document of a host's own (`DocumentTarget`). */
+type AnyScreenTarget = ScreenTarget | DocumentTarget;
+
+type ScreenDocumentValue = {
+    /** The document the editor is currently pointed at (runtime, retargetable). */
+    target: AnyScreenTarget;
+    /** Record-type plumbing (load/save/list/create/delete) for the pointed-at
+     *  document. Chrome and panels consult `capabilities`, never the record type. */
+    adapter: EaselDocumentAdapter;
+    /** What this document type supports — the ONLY sanctioned mode switch. */
+    capabilities: EaselCapabilities;
+    /** Id of the website template being edited (template mode only). */
+    templateId: string | null;
+    /** Slug of the page being edited — the template page's slug in template mode,
+     *  and a host's own document's `slug` (or the empty slug) for one of those. */
+    currentSlug: string;
+    /** Kind of the loaded page (`dynamic` drives the product-binding controls), or
+     *  null while loading / in template mode where the record carries no kind. */
+    currentKind: string | null;
+    /** Id of the website this page belongs to (page mode only; null in template
+     *  mode or when the editor was opened without a site). The list/save paths and
+     *  the page switcher scope to this so they act on one site's pages, not the
+     *  whole tenant's. */
+    siteId: string | null;
+    /** Whether the editor's backend may be called yet. Under the EFFICIENT backend
+     *  that is "the console's token has arrived"; an embedder's own backend
+     *  authorises its calls itself and is ready from the first render. THE gate
+     *  for anything that goes through the backend — never `token`, which an
+     *  embedder's backend does not have. */
+    ready: boolean;
+    /** The bridged admin JWT once it arrives (null while waiting, and always null
+     *  under an embedder's own backend). Only for the callers that still pass it
+     *  to the EFFICIENT client themselves. */
+    token: string | null;
+    /** Latest token for imperative reads (custom fields, pickers, panels). */
+    tokenRef: RefObject<string | null>;
+    /** Bridge editor events to the embedding admin portal. */
+    notifyParent: SendToHost;
+    /** Operator capabilities the ADMIN CONSOLE granted over the origin-gated
+     *  bridge. Distinct from `capabilities` above: those describe the DOCUMENT
+     *  (can it publish, has it site settings), these describe the PERSON, and the
+     *  editor is never allowed to infer them for itself. */
+    bridgeCapabilities: BridgedCapabilities;
+    /** Run an authed op; on 401 ask the parent for a fresh token and retry once. */
+    runAuthed: (op: (token: string) => Promise<unknown>) => Promise<boolean>;
+    /** Backend id of the loaded document — the identity of what the editor is
+     *  editing right now. Null while loading and between retargets, so it also
+     *  keys any once-per-document work (e.g. the pinned-chrome seed). */
+    docId: string | null;
+    /** The document exactly as it was LOADED from the backend: Puck's initial
+     *  state, and the persisted snapshot a load-time seed must measure itself
+     *  against. Null while loading. Edits live in Puck's own store, so this does
+     *  NOT track them — it stays the last-loaded layout for the whole session. */
+    data: Data | null;
+    /** The freshest layout the merchant is actually viewing — the latest edit made
+     *  since load (tracked on every onChange, even after the autosave settles), else
+     *  the last-loaded `data`. Lets a feature snapshot the live view (e.g. the
+     *  read-only origin backdrop in footer focus) without reaching into Puck's store.
+     *  Lean accessor (ISP) — never exposes the ref. */
+    getLiveData: () => Data | null;
+    error: string | null;
+    /** True while the template-entry bounce is redirecting to the Home page. */
+    redirecting: boolean;
+    /** The pinned-seed gate's four words for where the autosave stands. */
+    saveStatus: SaveStatus;
+    /** The autosave's state (efficient-easel/autosave) — what the toolbar pill
+     *  draws, through `saveIndicator`. */
+    saveState: AutosaveSnapshot;
+    /** Whether autosave is running. The toolbar pill is a switch: clicking it
+     *  flips this. OFF = edits are HELD (kept in memory, still flushable by Publish
+     *  / navigation / re-enabling) but never written on a timer. Session-scoped —
+     *  survives in-place page switches. */
+    autoSaveEnabled: boolean;
+    /** Auto-save stopped because a save was REFUSED, not because the operator
+     *  paused it — so a stopped auto-save can never read as a switch somebody
+     *  flicked themselves. */
+    autoSaveStoppedByConflict: boolean;
+    /** True when an edit hasn't been persisted yet — including one held while the
+     *  claim is in flight. Drives the guard that prompts before an in-place
+     *  navigation would abandon held-but-unsaved edits. */
+    hasUnsavedEdits: boolean;
+    /** Flip autosave on/off. Turning it back ON writes any held edits at once, so
+     *  "on" always means caught up. */
+    toggleAutoSave: () => void;
+    /** "Retry now": a failed save goes again at once instead of waiting out its
+     *  backoff. */
+    retrySave: () => void;
+    /** Autosave — hand every Puck onChange to this. */
+    onChange: (next: Data) => void;
+    /** Persist the pending edit immediately; resolves to whether nothing is left
+     *  unsaved. */
+    flushSave: () => Promise<boolean>;
+    /** Persist + publish the current document (Save for templates). */
+    onPublish: (next: Data) => Promise<void>;
+    /** Whether this editor may write the open page, and why not when it may not.
+     *  `editing` is the only writable state; the gate is on the save path itself,
+     *  so hiding or showing chrome from this can't be the thing that protects the
+     *  document. Always `editing` in template mode (no lock there). */
+    access: EditAccess;
+    /** SOMEBODY ELSE holds this page, so this editor is read-only: it may look and
+     *  select, but not move, add, duplicate or delete anything — until they take
+     *  control themselves. The ONE answer the chrome asks; no panel re-derives it,
+     *  so none of them can drift.
+     *
+     *  NOT what protects the document — `persistLayout` refuses the write, and it
+     *  refuses it in more cases than this (while the claim is still `checking`, and
+     *  after a refused save). This is the narrower question the CHROME asks, and it
+     *  is narrower on purpose: during `checking` nobody is named yet, and the
+     *  pinned Header/Footer seed runs in the chrome's mount commit and must still
+     *  land. Its write is held by `onChange` and released by the claim if it is
+     *  granted, or never released if it is not — card 1096.
+     *
+     *  …or the document itself is FROZEN (`readOnlyReason`): nobody holds it, and
+     *  nobody may write it, ever.
+     *
+     *  …or a save was REFUSED (`saveConflict`, 0.106.0): the stored document moved
+     *  on under somebody else's save, the autosave has stopped, and nothing this
+     *  editor does is written again until the operator reloads. Until 0.106.0 the
+     *  canvas, the tree and the inspector went on taking edits nothing would save,
+     *  and Undo / Redo went on rewinding them; the old campaign designer locked
+     *  the canvas there, and owner ruling R5 (Victor Mau, 2026-10-09) says the
+     *  screen's Undo / Redo are DISABLED, not hidden, while this is true. The
+     *  operator still reads, selects and copies from the screen the notice warns
+     *  them about. */
+    readOnly: boolean;
+    /** Why the open document may never be written, as the backend said it
+     *  (`EaselDocument.readOnlyReason`: a campaign that has been sent), or null
+     *  for every document that may. Such a document is read-only for good: its
+     *  saves are refused, its lock is never claimed, and the save pill's place
+     *  says this instead. Optional for a context built by hand, where it is
+     *  absent and means null. */
+    readOnlyReason?: string | null;
+    /** Take the page: from the "someone else is editing" choice, or back after
+     *  somebody took it from you. */
+    takeOverEditing: () => void;
+    /** Choose to look without touching (keeps the holder for the ribbon). */
+    viewReadOnly: () => void;
+    /** A save the backend REFUSED because the stored page moved on. Non-null means
+     *  autosave has stopped and the operator's work is still only on their screen.
+     *  Told in a bar under the top bar (efficient-easel/chrome `EditNotice`),
+     *  never a dialog, so there is nothing to dismiss: the operator reads and
+     *  copies from the screen it is warning them about. */
+    saveConflict: SaveConflict | null;
+    /** The last save failed because the server could not be REACHED (no answer
+     *  at all), not because it answered no (8.0.0). With a failed save, the bar
+     *  says "You're offline" where it would say "Not saved". Optional for a
+     *  context built by hand, where it is absent and means false. */
+    saveUnreachable?: boolean;
+    /** Abandon this editor's version and reload what is stored. The ONLY path that
+     *  throws the operator's work away, and only they can ask for it. */
+    reloadFromServer: () => void;
+    /** Retarget the editor in place (guards unsaved changes before it swaps). */
+    navigate: (target: AnyScreenTarget) => void;
+    /** A retarget held behind the unsaved-changes prompt (null = no prompt). */
+    pendingNav: AnyScreenTarget | null;
+    cancelPendingNav: () => void;
+    discardAndNavigate: () => void;
+    saveAndNavigate: () => Promise<void>;
+};
+declare const ScreenDocumentContext: react.Context<ScreenDocumentValue | null>;
+declare function useScreenDocument(): ScreenDocumentValue;
+declare function ScreenDocumentProvider({ target, addressing: handed, onHostMessage, children, }: {
+    target: AnyScreenTarget;
+    /** How this editor's documents are ADDRESSED — the layer's rules, handed in
+     *  by whoever mounts the provider (the website's entry hands the website's:
+     *  lib/website-document-addressing). Without them there is one document that
+     *  nothing stores. ONE object for the life of the mount, like the session. */
+    addressing?: AnyDocumentAddressing;
+    /** The layer's own host messages, asked before the ones every editor answers
+     *  (lib/host-inbound): the website's are lib/website-host-inbound.
+     *  Returns true when it handled one. */
+    onHostMessage?: (raw: unknown) => boolean;
+    children: ReactNode;
+}): react.JSX.Element;
+
 export { type AnyDocumentAddressing as A, DETACHED_EASEL_HOST as D, type EaselHost as E, type HostPickedMedia as H, type InboundHostMessage as I, NO_DOCUMENT_ADDRESSING as N, type PickedMediaSource as P, type SectionScreenTarget as S, type DocumentAddressing as a, type EaselHostAddress as b, EaselHostContext as c, EaselHostProvider as d, type EaselMessageType as e, type EaselToHostMessage as f, type HostToEaselMessage as g, type SendToHost as h, createEaselHost as i, useHostEscape as j, type AnyScreenTarget as k, type DocumentTarget as l, ScreenDocumentContext as m, ScreenDocumentProvider as n, type ScreenDocumentValue as o, type ScreenTarget as p, useScreenDocument as q, useEaselHost as u };

package/dist/autosave/index.d.ts

@@ -1,13 +1,13 @@
 import { a as Autosave, A as AutosaveSnapshot, b as AutosaveOptions } from '../engine-CvXpFE86.js';
 export { c as AutosaveClock, d as createAutosave } from '../engine-CvXpFE86.js';
-import { S as SaveIndicator } from '../words-DkWcK1rh.js';
-export { a as SaveWords, s as saveIndicator } from '../words-DkWcK1rh.js';
-import '../types-DT8ywrFQ.js';
+import { S as SaveIndicator } from '../words-Cm8PMYn0.js';
+export { a as SaveWords, s as saveIndicator } from '../words-Cm8PMYn0.js';
+import '../types-B3iSHX-w.js';
 import '../types-Cy7rdmXt.js';
 import '../wordFit-7XpmhcaW.js';
 import 'react';
 import '../edit-lock/index.js';
-import '../panelWidths-D9hTLR25.js';
+import '../panelWidths-DgQXiPXU.js';
 
 type UseAutosaveOptions<T> = Omit<AutosaveOptions<T>, 'save' | 'onFailure'> & {
     /** Write one document. Read at call time, so it may close over current props. */

package/dist/{canvas-typing-BsNigaCa.d.ts → canvas-typing-Be4FO4q7.d.ts}

@@ -1,8 +1,8 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 import { MarkStyle, WrapResult, InlineRule, MarkupTool } from 'efficient-shell/markup';
-import { C as CopyWords, a as CopyAlign } from './words-D-yhjdOg.js';
-import { TextToolbarCase, TextToolbarMark } from 'efficient-shell/ui';
+import { TextAlign, TextToolbarCase, TextToolbarMark } from 'efficient-shell/ui';
+import { C as CopyWords } from './words-BpTjCfqO.js';
 
 type CellWords = NonNullable<CopyWords['cells']>;
 interface CopyCell {
@@ -177,13 +177,13 @@ interface CopyBoxLastTool {
  * `A` is inferred from `allow`, so nothing has to be spelled at the call site.
  *
  * ⚠️ IT DOES NOT FORBID A WIDER HANDLER, and cannot: a function taking the
- * whole `CopyAlign` is assignable where one taking three is wanted, because
+ * whole `TextAlign` is assignable where one taking three is wanted, because
  * parameters are contravariant — and that direction is SAFE, since only the
  * three can ever arrive. What this buys is that the narrow handler now
  * type-checks without a cast, which is what makes writing the safe one the
  * path of least resistance.
  */
-interface CopyBoxAlign<A extends CopyAlign = CopyAlign> {
+interface CopyBoxAlign<A extends TextAlign = TextAlign> {
     value: A | '';
     onChange: (next: A) => void;
     /**
@@ -241,7 +241,7 @@ interface CopyBoxProps {
      */
     actions?: ReactNode;
     /** The alignment strip. Omitted = no strip. */
-    align?: CopyBoxAlign<CopyAlign>;
+    align?: CopyBoxAlign<TextAlign>;
     /** @deprecated Not drawn: the toolbar's drawings are the shell set's.
      *  Removed in 12.0.0. */
     glyphs?: Partial<Record<MarkStyle, ReactNode>>;

package/dist/chrome/chrome.css

@@ -248,8 +248,8 @@
   background: var(--es-panel);
   overflow: hidden;
   position: relative;
-  /* A size container: a panel is DRAGGED between 220 and 560, so its contents
-     ask the panel's width, never the screen's. */
+  /* A size container: a panel is DRAGGED between its floor (left 240, right
+     220) and 560, so its contents ask the panel's width, never the screen's. */
   container-type: inline-size;
 }
 /* THE PANEL'S SIDE INSET, ONE HOME: 16, AND 12 UNDER A 260px PANEL (one
@@ -403,9 +403,6 @@ span:has(> .es-insp-up-btn) {
     grid-column: 2;
     justify-self: start;
   }
-  .es-insp-head:has(.es-insp-textbtn) .es-insp-divider {
-    display: none;
-  }
 }
 .es-insp-chip {
   width: 26px;
@@ -474,19 +471,6 @@ span:has(> .es-insp-up-btn) {
   flex: none;
   margin-left: auto;
 }
-/* A side panel's head has two pieces besides its glyph buttons (MediaPanelHead,
-   card [MERGE] One Media Panel Head, 2026-10-06; until then each editor's own
-   sheet drew them, as `.sf-head-*` and `.cd-head-*`). A MODE's way out is a
-   word ("Cancel", "Done") on the shell's small Button (`.es-insp-textbtn`
-   names it for the narrow layout above); the hairline parts the
-   panel's own tools from the Hide panel button that ends every head. */
-.es-insp-divider {
-  width: 1px;
-  height: 16px;
-  margin: 0 4px;
-  background: var(--es-line);
-  flex: none;
-}
 
 /* ── Edit notice — somebody else is in here, or a save was refused ───────── */
 /* A bar under the top bar, never a dialog (blueprint 2.5): the operator has to