v0.15.0

Added

• Editor views for assets, favicon and fonts, at /assets, /favicon and /fonts. They need the admin.access permission. The pages themselves stay public, so their files keep serving.
• The admin tree follows the preview as it browses, and rows carry inline page actions.
• theme-picker UI component: lists themes with a swatch of each, posts the choice to action and switches theme in place, fading over duration milliseconds (600 by default).
• code.theme config key sets the highlight theme for code fields. It defaults to one-dark-pro.
• Res::xml($body, $code = 200) sends an XML response.
• A view can name itself in the new-page View picker with a label in its _index.json. It falls back to the view ref.

Changed

• Signed-out visitors hold the guest role, so $app->session->can() and requirePermission() resolve against it. The built-in guest role no longer grants pages.view. A site that wants to grant a permission to guests adds a guest role under site/roles/.
• Highlighted code is cached by its content. Phiki costs about 150 ms a file, and a content write no longer flushes the cache.
• Sessions are read once and released at once. Each write takes the session lock only for as long as it changes the file, so a slow request no longer blocks the visitor's other requests. Ses::isActive() now means the session is open for writing. Use Ses::isStarted() to ask whether the request has read it. $_SESSION is a snapshot, so a direct write to it is never saved. See Upgrading.
• A session write happens at most once a minute to record activity.
• prefs posts from htmx get an empty 204 instead of a redirect.

Fixed

• The first view in the new-page View picker is preselected.