paneltir 0.8.0 → 0.10.0

package/dist/style.css

@@ -841,6 +841,128 @@
   color: var(--pt-color-success);
 }
 
+/* src/components/Setup/SetupWizard.css */
+.pt-wizard {
+  display: flex;
+  flex-direction: column;
+  gap: var(--pt-space-lg);
+}
+.pt-wizard__head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: var(--pt-space-sm);
+  flex-wrap: wrap;
+}
+.pt-wizard__progress {
+  margin: 0;
+  font-family: var(--pt-font-mono);
+  font-size: 12px;
+  color: var(--pt-color-ink-faint);
+}
+.pt-wizard__step {
+  padding: var(--pt-space-lg);
+  border: var(--pt-border-width) solid var(--pt-color-line);
+  border-radius: var(--pt-radius-panel);
+  background: var(--pt-color-panel);
+}
+.pt-wizard__step--done {
+  border-color: var(--pt-color-success);
+}
+.pt-wizard__now {
+  margin: 0 0 var(--pt-space-xs);
+  font-size: 11px;
+  letter-spacing: var(--pt-label-tracking);
+  text-transform: uppercase;
+  color: var(--pt-color-ink-faint);
+}
+.pt-wizard__label {
+  margin: 0 0 var(--pt-space-xs);
+  font-size: 16px;
+  color: var(--pt-color-ink);
+}
+.pt-wizard__var {
+  margin: 0 0 var(--pt-space-sm);
+  font-family: var(--pt-font-mono);
+  font-size: 12.5px;
+  color: var(--pt-color-accent);
+  overflow-wrap: anywhere;
+}
+.pt-wizard__enables {
+  margin: 0 0 var(--pt-space-sm);
+  font-size: 13px;
+  line-height: 1.5;
+  color: var(--pt-color-ink-dim);
+}
+.pt-wizard__fix {
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--pt-color-ink-dim);
+}
+.pt-wizard__fix ol,
+.pt-wizard__fix ul {
+  margin: 0;
+  padding-left: 18px;
+}
+.pt-wizard__fix li {
+  margin-bottom: 4px;
+}
+.pt-wizard__fix code,
+.pt-wizard__prompt {
+  font-family: var(--pt-font-mono);
+  background: var(--pt-color-raised);
+  color: var(--pt-color-ink);
+  border-radius: var(--pt-radius-square);
+  overflow-wrap: anywhere;
+}
+.pt-wizard__fix code {
+  font-size: 12px;
+  padding: 1px 5px;
+}
+.pt-wizard__actions {
+  display: flex;
+  align-items: center;
+  gap: var(--pt-space-sm);
+  flex-wrap: wrap;
+  margin-top: var(--pt-space-md);
+}
+.pt-wizard__said {
+  margin: 0;
+  font-size: 12.5px;
+  color: var(--pt-color-warning);
+}
+.pt-wizard__verify {
+  margin: var(--pt-space-sm) 0 0;
+  padding-left: 18px;
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--pt-color-ink-dim);
+}
+.pt-wizard__done-title {
+  margin: 0 0 var(--pt-space-xs);
+  font-size: 11px;
+  letter-spacing: var(--pt-label-tracking);
+  text-transform: uppercase;
+  color: var(--pt-color-ink-faint);
+}
+.pt-wizard__done ul {
+  margin: 0;
+  padding-left: 18px;
+  font-size: 13px;
+  color: var(--pt-color-ink-dim);
+}
+.pt-wizard__stuck {
+  padding-top: var(--pt-space-md);
+  border-top: var(--pt-border-width) solid var(--pt-color-line-faint);
+}
+.pt-wizard__prompt {
+  margin: 0 0 var(--pt-space-sm);
+  padding: var(--pt-space-sm);
+  font-size: 12px;
+  line-height: 1.5;
+  white-space: pre-wrap;
+}
+
 /* src/components/Notifications/Notifications.css */
 .pt-bell {
   position: relative;

package/fingerprint.json

@@ -1,7 +1,8 @@
 {
   "name": "paneltir",
-  "version": "0.8.0",
-  "hash": "sha256:a252ef2a015240e0e8463c0ebb0ef7a8af80ad7ade66f2c48e71657500d506d5",
-  "fileCount": 153,
-  "generatedAt": "2026-09-07T12:59:14.850Z"
+  "version": "0.10.0",
+  "hash": "sha256:4de7ef7076563e4c3118ac16b645737a44c4c0675115d9a9d7bbff562d5ecb74",
+  "fileCount": 163,
+  "templateHash": "sha256:7f9accd11920a0c189dd683bdb96635a606960afeca71e02c2a26a0257acefd8",
+  "generatedAt": "2026-09-11T02:49:51.562Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paneltir",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "A React UI kit for admin panels: page frame, a board with touch-ready drag and drop, detail sheets, and a whole panel in one component. Structure and behaviour are fixed; colour and brand belong to each project.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "DFKlabs (https://DFKlabs.com)",
@@ -64,7 +64,7 @@
     "check:boards": "node scripts/check-boards.mjs",
     "demo:install": "npm --prefix examples/demo ci",
     "demo:build": "npm --prefix examples/demo run build",
-    "verify": "npm run typecheck && npm run build && npm run icons:check && npm run seo:check && npm run test:auth && npm run test:marketplace && npm run test:init && npm run test:board && npm run test:updates && npm run check:boards && npm run check:docs && npm run check:package && npm run fingerprint:check",
+    "verify": "npm run typecheck && npm run build && npm run icons:check && npm run seo:check && npm run test:auth && npm run test:marketplace && npm run test:init && npm run test:board && npm run test:gate && npm run test:move && npm run test:theme && npm run test:setup && npm run test:updates && npm run release-notes:check && npm run check:boards && npm run check:docs && npm run check:package && npm run fingerprint:check",
     "site:install": "npm --prefix site ci",
     "site:dev": "npm --prefix site run dev",
     "site:build": "npm --prefix site run build",
@@ -72,8 +72,14 @@
     "check:docs": "node scripts/check-docs.mjs",
     "check:package": "node scripts/check-package.mjs",
     "test:init": "node scripts/test-init.mjs",
+    "release-notes": "node scripts/release-notes.mjs",
+    "release-notes:check": "node scripts/release-notes.mjs --check",
     "test:updates": "node scripts/test-updates.mjs",
-    "test:board": "node scripts/test-board.mjs"
+    "test:board": "node scripts/test-board.mjs",
+    "test:move": "node scripts/test-move.mjs",
+    "test:theme": "node scripts/test-theme.mjs",
+    "test:setup": "node scripts/test-setup.mjs",
+    "test:gate": "node scripts/test-gate.mjs"
   },
   "peerDependencies": {
     "react": ">=18",
@@ -91,5 +97,46 @@
   },
   "engines": {
     "node": ">=20"
+  },
+  "paneltirRelease": {
+    "version": "0.10.0",
+    "date": "2026-09-11",
+    "entries": [
+      {
+        "kind": "feature",
+        "text": {
+          "en": "`paneltir doctor` says whether the files this project copied are still the ones the installed kit ships — and separates \"you edited it\" from \"we changed it underneath you\", which a diff cannot.",
+          "es": "`paneltir doctor` dice si los archivos que copió este proyecto siguen siendo los del kit instalado — y separa «lo editaste tú» de «lo cambiamos nosotros debajo», que un diff no puede."
+        }
+      },
+      {
+        "kind": "feature",
+        "text": {
+          "en": "The setup list can carry a row for the copied gate. Import `.paneltir/gate.json` and pass it as `gate`; without it the panel says nothing about those files rather than guessing.",
+          "es": "La lista de configuración puede llevar una fila para la puerta copiada. Importa `.paneltir/gate.json` y pásalo como `gate`; sin él el panel no dice nada de esos archivos en vez de suponer."
+        }
+      },
+      {
+        "kind": "feature",
+        "text": {
+          "en": "`paneltir run \"what this pass did\"` appends to the board's revisions, so the record does not depend on anyone remembering at the end of a session.",
+          "es": "`paneltir run \"qué hizo esta pasada\"` añade una entrada a las revisiones del tablero, así el registro no depende de que alguien se acuerde al final de la sesión."
+        }
+      },
+      {
+        "kind": "fix",
+        "text": {
+          "en": "`paneltir init` and `paneltir doctor` no longer need React installed. They loaded the component bundle at startup, so they failed in a project that had not installed it yet — which is exactly when `init` is run.",
+          "es": "`paneltir init` y `paneltir doctor` ya no necesitan React instalado. Cargaban el bundle de componentes al arrancar, así que fallaban en un proyecto que aún no lo tenía — que es justo cuando se ejecuta `init`."
+        }
+      },
+      {
+        "kind": "chore",
+        "text": {
+          "en": "The rules a project needs are checked to actually reach it: the documents a project keeps must name `extraThemes` and `paneltir doctor`, or the build fails saying why.",
+          "es": "Se comprueba que las reglas que un proyecto necesita le lleguen de verdad: los documentos que el proyecto conserva tienen que nombrar `extraThemes` y `paneltir doctor`, o la build falla diciendo por qué."
+        }
+      }
+    ]
   }
 }

package/template/.claude/skills/panel/SKILL.md

@@ -132,6 +132,76 @@ Never invent a palette. If the project has no colours of its own, say so and
 leave the theme alone — the kit ships presets for exactly that case, and one
 of them is a light theme.
 
+And when you hand this project's own theme to `PanelApp`, it goes in
+**`extraThemes`** and never in `themes`. `extraThemes` offers it as well as the
+kit's four; `themes` means "exactly these", so one theme passed there deletes
+every preset and the settings sheet shows a single row. Two projects were
+installed that way before the distinction existed, and the symptom reads as the
+kit having no themes rather than as a prop being wrong.
+
+## When the panel behaves oddly for no visible reason
+
+The gate — `middleware.ts`, `lib/session.ts`, `api/*.ts` — was copied into this
+project once and does **not** update when the kit does. So a fix released
+upstream can be missing here while every version number on the screen looks
+current, and nothing says so: the `HTTP 500` on saving lived in
+`api/panel-state.ts` and stayed in projects installed before the fix.
+
+    npx paneltir doctor
+
+`.paneltir/gate.json` is what makes that answer sharp, and it belongs in git:
+it records what `init` copied and from where. Ignored, it vanishes on the next
+clone and every file degrades to "differs" — the one answer that cannot say
+whether you moved it or we did.
+
+It separates the three answers that need different actions: *yours* (you edited
+it), *BEHIND* (you did not touch it and the template moved), and *BOTH*. The
+middle one is invisible to `git diff`, because there is nothing in this
+project's history to compare against. `paneltir init --force` replaces the gate
+and never the board — read the diff first when a file is marked BOTH, or the
+edit is lost.
+
+## Setting the panel up in the first place
+
+The panel is asked for this by name: its walkthrough carries a line the owner
+can paste into a session here, and it points at this file. So when somebody
+arrives asking you to set up the Paneltir panel, this is the answer, and the
+job is to walk them through it rather than to hand them a list.
+
+Four things live in the **hosting environment** — never in this repository, and
+never in the board.
+
+| | What it is | Without it |
+| --- | --- | --- |
+| `ADMIN_PASSWORD` | The panel's password. | The gate answers 503 rather than letting anyone in. It fails closed on purpose: a panel with no password must not become a public one. |
+| `GH_TOKEN` | A GitHub fine-grained token, **Contents: read and write, on this repository only**. | Everything works and Save fails. |
+| `PANEL_REPO` | This project's `owner/repo`. | Save has nowhere to write. There is no default, because writing to the wrong repository is worse than not writing. |
+| `SESSION_SECRET` | Optional; signs the session cookie. Defaults to `ADMIN_PASSWORD`. | Nothing, until the password changes — at which point every session already issued ends, which is usually what was wanted. |
+
+`PANEL_FILE` is there too, and only matters when the board is somewhere other
+than `src/data/panel-state.json`.
+
+Three things are worth saying while you walk somebody through it:
+
+- **Environment variables are read at deploy time.** Adding one to a running
+  deployment changes nothing until it redeploys. More than half of "I added it
+  and it still says missing" is this.
+- **Scope the token to this repository alone.** A token that can write to
+  everything is a token whose blast radius is everything, and this one only
+  ever commits one file.
+- **Check, do not assume.** The panel's Help screen asks the server what is
+  actually set and reports *whether*, never the value. That answer is worth
+  more than a screenshot of a settings page.
+
+Then two things to try before the gate is trusted, because a door nobody has
+pushed is not known to be shut:
+
+1. Open `/admin` signed out. It must land on the sign-in screen.
+2. Signed out, request the panel's own JavaScript bundle. It must answer 401.
+   A page that is protected while its bundle is not leaves the board readable
+   by anyone who opens the HTML — and that is the failure that looks exactly
+   like everything working.
+
 ## When the board will not open
 
 Run `npx paneltir board`. It reads the file and names every problem by