@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.10

package/CHANGELOG.md

@@ -8,12 +8,458 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.90.0-m7.10
+
+- Code & tracking drafts survive a refetch. A background reload replaced the
+  table under the administrator's hands: a brand new profile, a duplicate made
+  from an existing one, and edits typed but not yet saved all disappeared
+  without a word. What the server sends is merged into what is on screen
+  instead of replacing it.
+- Tracking profiles apply in global, then language, then domain order, so a
+  domain profile refines the language one rather than replacing it. Hostname
+  matching is consistent throughout: an apex and its single `www.` are the same
+  site everywhere the decision is made.
+- GTM, GA4, Meta Pixel, TikTok Pixel, verification meta tags and raw
+  head / body-start / body-end code all reach the server-rendered HTML at the
+  position each one requires, rather than depending on a client-side step to
+  fire.
+- Raw custom code is injected byte for byte. `$&`, `` $` ``, `$'` and `$$` in a
+  snippet were read as replacement patterns and rewrote the markup around them;
+  a profile now reaches the page exactly as it was typed.
+- Tracking is excluded from the configured backoffice path, preview routes, API
+  routes and server-function routes, so pixels no longer fire on administrative
+  traffic or on responses that are not pages.
+- A tracking read that fails leaves the public site standing. The page renders
+  without injection, the failure is reported through an injectable logger, and
+  it is not cached — the next request retries instead of serving a fabricated
+  empty configuration for the rest of the cache window. A backend that answers
+  with an error rather than throwing counts as a failure; treating it as "no
+  profiles" made a broken deployment indistinguishable from an unconfigured one.
+- The tracking cache is bounded rather than growing one entry per hostname
+  seen, and a successful create, update or delete drops it, so a change goes
+  live within the TTL instead of sitting behind whatever was cached first.
+- A failed audit entry or a failed log line cannot undo a write that already
+  happened. Both are best-effort in both directions: the mutation stands and is
+  reported as the success it was, rather than coming back as an error whose
+  obvious retry inserts a second profile. That now holds even when the
+  host-supplied logger is itself what throws.
+- A newly created profile whose id the server cannot establish is held until the
+  page is reloaded. The insert may well have landed, so pressing Save again
+  would create a duplicate firing every pixel twice; the screen says to reload,
+  and saving existing profiles is unaffected.
+- Languages & domains has moved out of the main sidebar into System
+  administration, alongside the other installation-level screens.
+- Code & tracking and Languages & domains require the `admin` role, matching the
+  authorization their server functions already enforce. Staff without it get a
+  plain no-access screen instead of a form that fails on Save.
+- Storing a hostname and matching a request against one are now separate
+  questions. Canonical output carries the exact hostname the deployment
+  configured; matching still folds an apex and one `www.` together. A page is no
+  longer canonical on two of its own addresses.
+- Canonical URLs, `og:url`, hreflang, `og:locale:alternate` and both sitemaps
+  are built from the configured canonical hostnames.
+- Rows written before the domain validator existed are ignored for matching and
+  for every generated URL, instead of being normalized into a plausible-looking
+  address. `ftp://example.com` no longer reduces to `example.com` and wins a
+  request for it — which had decided the locale, the tracking profiles that fire
+  and the backoffice hostname alike.
+- In explicit domain-mapping mode a supported language with no configured domain
+  is left out of hreflang and sitemap alternates, instead of borrowing another
+  locale's origin — or the origin of the current request — and advertising a URL
+  this deployment may not serve.
+- Single-origin multilingual sites are supported by the sitemap helpers.
+  `sitemapEntries` and `sitemapIndexEntries` take the public origin and emit
+  absolute URLs only. Previously a locale sitemap could come out carrying
+  relative URLs, while the sitemap index had no domain mappings from which to
+  build entries at all.
+- Public locale-domain projections omit `isAdminDomain`. Which hostname serves
+  the backoffice is not something an anonymous reader needs to be told.
+- `SITE_URL` is validated before it can become the authoritative admin hostname,
+  and as configured rather than after normalizing — normalizing strips the
+  scheme, so a value nobody can serve validated cleanly and was allowed to
+  override the database and switch off the check that stops an unreachable
+  admin domain being saved.
+- Admin-host resolution fails open. An unusable flagged row falls through to the
+  next source instead of stranding the backoffice, the screen names which source
+  the hostname came from, and the banner refreshes when a domain is saved.
+- **Host integration required after upgrading.** Nothing below is done by this
+  package on the host's behalf:
+  - expose the shared Languages & domains screen at the host's canonical
+    `/admin/domains` route;
+  - keep the old `/domains` route as a compatibility redirect where applicable;
+  - register `getEffectiveAdminHost` among the backoffice host functions, so
+    the screen can say where the backoffice actually is;
+  - use `siteCanonicalHost()` when passing `SITE_URL` authority, not the raw
+    environment value;
+  - pass the public origin to `sitemapEntries` and `sitemapIndexEntries` on
+    single-origin sites;
+  - pass the configured `backofficePath` into `createServerEntry`, or tracking
+    will be injected into the backoffice;
+  - split public-safe locale-domain reads from authenticated admin reads; and
+  - ensure the tracking-create server function returns the newly created
+    profile id, which the screen now requires before it will treat a create as
+    complete.
+- No database migration is included in this release, and no database data is
+  changed by it.
+- Not included and not yet verified: Voyara's own integration is not part of
+  this package release, and neither staging nor production has been verified
+  with `0.90.0-m7.10`.
+
+## 0.90.0-m7.9
+
+- The email settings screen says where provider credentials actually go. An
+  administrator told only that "passwords are stored as server secrets" does the
+  one thing the sentence was meant to prevent and pastes the password into the
+  CMS field in front of them, so the screen names the configuration file, the
+  environment-variable names and the secret-name convention for that
+  installation instead. It stays value-free: no secret is read, returned or
+  rendered, and hosts supply their own deployment root through
+  `secretsLocation` — including `/`, which stays absolute.
+- Optional block content whose localized value is empty is no longer rendered.
+  A heading or paragraph written in one locale and left blank in another used to
+  leave its empty markup behind in the locale that had nothing to say.
+- Nested navigation items are editable. Only top-level entries could be changed,
+  so fixing a typo in a child link meant deleting it and building it again.
+- Rich text holds up at length, and a block chooses how it appears. Each block
+  carries its own reveal mode; `Reveal` still defaults to `fade`, so every
+  already-published page looks exactly as it did.
+- Cooperative editing locks stop two administrators overwriting each other. A
+  lock is taken when an editor opens a resource, renewed while it stays open and
+  released when it closes, and a second editor is told who holds it instead of
+  silently losing the earlier write. Pages, global sections, shared content,
+  navigation, contact details, forms, form defaults, form history and page SEO
+  are covered, and the refusal is enforced in the server cores — not only by
+  disabling controls in the interface.
+- The lock's session token is private and the session match is exact.
+  `session_id` is never returned by any read: authenticated callers hold column
+  grants that omit it, the JSON shape drops it, and the administrator listing
+  returns a redacted row. A write against a live lock succeeds only for the
+  exact, non-empty session that holds it. Empty or malformed lock responses fail
+  closed rather than reading as "free", a stale asynchronous reply cannot revive
+  a lock that was already released, reopening an editor can no longer let its
+  own release overtake its next acquire, and a duplicated browser tab is given
+  its own session identity — Web Locks where the browser provides them, a
+  best-effort BroadcastChannel fallback where it does not.
+- Lock storage is a host port, not a provider. `editLockActionCore` and
+  `assertEditable` reach the database only through `EditLockAdapter`
+  (`@bygghammar/cms-platform/server/edit-lock-adapter`) — five methods covering
+  acquire, status, release, list and the staff check — so an application on
+  ordinary PostgreSQL implements it with the SQL it already writes, with no
+  PostgREST client and no `supabase` object to imitate. Hosts that already build
+  `{ supabase: { rpc }, userId, claims }` for their other cores keep passing
+  exactly that: `createSupabaseEditLockAdapter` is applied for them
+  automatically and nothing on an existing host changes.
+- Locks require a migration and host wiring, and change nothing until both are
+  done. `migrations/20260902090000_dc072b25-8467-46ae-aef3-0ccdf40aa7eb.sql`
+  creates the table and its functions; `docs/EDIT-LOCKS.md` is the host
+  contract: one authenticated server endpoint through `editLockActionCore`, one
+  `EditLockProvider` built with `createEditLockApi`, the non-empty
+  `editSessionId` forwarded to every protected write, `pageKey` passed to
+  `PageSeoPanelView`, and the `edit_locked:` message prefix preserved across the
+  host's own transport. Until then every screen behaves exactly as it did before
+  locks existed.
+- The lock is a cooperative server preflight, not a transaction-atomic write
+  fence. The check and the mutation are separate statements, so a host needing
+  strict exclusion must put both in one transaction or RPC. Full-document exits
+  deliberately let the lock lapse by TTL — 120 seconds by default — rather than
+  race a reload against its own release.
+- Verified on PostgreSQL 16 and 17: the migration applies in a single
+  transaction against a throwaway container carrying a host's real role,
+  authentication and user objects; the grants, the RLS policy and the
+  `SECURITY DEFINER` `search_path` come out as written; twenty simultaneous
+  acquires of one resource leave exactly one holder and no errors; and a
+  shadowing `pg_temp` object cannot reach inside a definer body.
+- Not verified in this release: the migration has not been applied to any real
+  staging or production database, and the two-user real-browser lock behaviour
+  has not been exercised against a live host. Both remain required before
+  production use.
+
+## 0.90.0-m7.8
+
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.8`. `m7.6` and `m7.7` were
+  tagged and never published: two defects in the release workflow stopped them
+  after every gate had passed. The form-identity work they were meant to carry
+  is unchanged and ships here.
+- The release workflow gets both corrections, proven in lightweight-popup:
+  the redundant post-checkout `git fetch` is gone (checkout already brings
+  every branch, and its credentials are removed on the way out), and
+  `npm pack`'s destination is created before it is packed into, with the same
+  directory carried to the tarball verification rather than spelled twice.
+- `ops/verify-release-tag.mjs` checks `refs/remotes/origin/main` is present
+  before asking `merge-base` about it, so a checkout that fetched too little no
+  longer reports itself as a tag on an unmerged branch.
+
+## 0.90.0-m7.6
+
+- A form submitted from inside a popup now says so. `FormRenderer` and
+  `ManagedForm` take an opaque `context` that is merged into the submission,
+  and the popup module fills it with `{ popupKey }` — the form system keeps
+  knowing nothing about the features that use it. Without this the request was
+  indistinguishable from the same form filled on an ordinary page, so the
+  server stored an ordinary entry and every delivery configured on the popup
+  silently did nothing.
+- `HostSubmitFormInput` gains `popupKey?: string`, the only popup-shaped value
+  the browser sends. Destination, endpoint, signing secret and which fields may
+  leave are all read on the server from the popup's stored configuration.
+- Drafts and the builder preview carry no context, so a part-filled form and an
+  editor checking a layout cannot fire a campaign's webhook.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.6`, which is where the
+  identity comes from.
+
+## 0.90.0-m7.5
+
+- `BackofficeHost.pages.fns.listPages` is declared. It was what
+  `cmsPageDirectory` had always looked for, read through an index cast because
+  the contract did not name it — so a site could not register it without a type
+  error, and every site that had not silently got a picker with nothing in it.
+  The top-level lookup stays for anyone who registered it there anyway.
+
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.5`. In `m7.4` an advanced
+  path rule could not be typed: the row was reclassified after the first
+  keystroke and disappeared. No change here beyond the floor — a site pairing
+  this with `m7.4` would get a picker whose rules field does not work.
+
+## 0.90.0-m7.4
+
+- `cmsPageDirectory` takes the site's routing engine and asks it for each
+  page's public path, instead of assuming the page key is the path. The home
+  page is why: its key is `home` and its address is `/`, so the popup page
+  picker would have offered an address that matches nothing.
+- The Popups screen supplies that resolver from the `usePageUrl` hook the
+  backoffice already registers — no new host field, no second pages query. The
+  hook is called from its own component so it stays unconditional while the
+  page group remains optional.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.4`, which is where the
+  page picker itself lives.
+
+## 0.90.0-m7.3
+
+- Popup exclusions are derived from the configured `backofficePath`, so a site
+  that mounts its office at `/admin` or `/cms/backoffice` is covered without
+  naming it twice. Both the tree and its landing page are excluded: `/admin/**`
+  does not match `/admin`.
+- `registerPopupPublicHost` accepts `excludedPaths` for a site's own private
+  routes — a checkout, a members' area. The CMS adds to that list and never
+  replaces it, and drops duplicates rather than repeating a path.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.3`, whose defaults no
+  longer name anyone's backoffice.
+
+## 0.90.0-m7.2
+
+- `backofficePaths` gains `popups` and `popupDestinations`, and both popup
+  mount points supply them to the package's navigation. The destinations screen
+  was reachable only by typing its address.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.2`, which is where the
+  navigation itself lives.
+
+## 0.90.0-m7.1
+
+First version published to npm rather than vendored as a tarball. Same code as
+`0.80.2-popup.15`, renumbered for a real prerelease: the minor moves because the
+popup integration gained form-field discovery, and the `m7` prerelease says this
+is still waiting on staging acceptance. Published under the `m7` dist-tag, so
+`latest` keeps pointing at 0.80.1.
+
+- The optional `@bygghammar/lightweight-popup` peer range now names a
+  prerelease. `>=0.0.0` does not accept `0.2.0-m7.1` — a prerelease only
+  satisfies a range that mentions one at the same version — so the peer would
+  have read as unmet on every install.
+
+## 0.80.2-popup.15
+
+- `cmsFormDirectory` can describe a form's fields, so the popup builder offers
+  real fields to tick instead of asking an administrator to type column names.
+  Built from the listing the forms screen already reads — no second host
+  contract and no second query.
+- Disabled fields, removed ones and the spam trap never reach the selector; a
+  field's own label is shown while its stable key is what gets stored.
+- Vendors popup 0.1.0-dev.9.
+
+## 0.80.2-popup.14
+
+- A test delivery that failed before any request was made is no longer reported
+  as "The endpoint refused it". The bridge defaulted an absent category to
+  `http-error`; a missing signing secret arrives exactly that way, so the screen
+  sent administrators to debug a receiver that had never been contacted. An
+  unnamed failure is now `config-error`.
+
+## 0.80.2-popup.13
+
+- The destinations screen imports the popup admin stylesheet. It is a sibling
+  route rather than a child of the builder, so it loads on its own and nothing
+  else pulled the styling in — the first time anyone could reach it, twelve
+  `lwp-` elements rendered as plain text.
+- A test now requires every module that mounts one of the package's admin
+  screens to import that stylesheet beside it.
+
+## 0.80.2-popup.12
+
+- Documents the popup bridges in `docs/POPUPS.md`: which port each CMS system
+  fills, why an unfilled port is not an integration, what crosses the media
+  boundary, and which webhook responsibility sits in which layer.
+
+## 0.80.2-popup.11
+
+- A destinations screen for popup opt-in webhooks: `popups/destinations` binds
+  the package's provider-neutral `DestinationsAdmin` to the host's own server
+  functions. A site that registers none gets an honest empty screen.
+- The backoffice host contract gains the remaining optional webhook slots
+  (save, delete, send test, list deliveries).
+- Vendors popup 0.1.0-dev.5.
+
+## 0.80.2-popup.10
+
+- The popup builder now gets the site's media library. `cmsMediaPicker()`
+  renders the same `MediaPickerDialog` every other backoffice screen uses, and
+  is passed into the popup admin adapters — the line whose absence left
+  administrators typing storage URLs by hand.
+- Only a stable public address, a filename and any stored alt text cross into
+  the popup package. Uploading, listing and deleting stay with the library.
+- Vendors popup 0.1.0-dev.4.
+
+## 0.80.2-popup.9
+
+- The backoffice host contract gains an optional , so
+  a site can offer opt-in destinations to the popup editor. A site without one
+  registers nothing and the picker does not appear.
+
+## 0.80.2-popup.8
+
+- Vendors popup 0.1.0-dev.3, which adds the opt-in destination picker this
+  version bridges to.
+
+## 0.80.2-popup.7
+
+- Server-only popup opt-in webhooks. `server/popup-optin-webhook-core` signs a
+  versioned payload with HMAC-SHA256 over a timestamped string, re-validates
+  the endpoint on every redirect hop, bounds the response it will read, and
+  categorises failures without ever echoing the receiver's own words.
+- `server/webhook-url-guard` refuses anything that is not public https:
+  loopback, private, link-local, carrier-grade NAT, unique-local, multicast and
+  cloud-metadata addresses, including the IPv4 forms hidden inside IPv6, plus
+  credentials embedded in the URL.
+- `server/popup-optin-trigger` is the single predicate deciding what counts as
+  a genuine opt-in. The honeypot's `{ok: true, skipped: true}` is not one, and
+  neither is a Yes click, a dismissal, a preview or a test-mode popup.
+- CMS bridges for the popup editor's opt-in destination picker and media
+  picker. Only an identifier, a name and a warning cross the boundary — never
+  an endpoint or a secret.
+- Vendors popup 0.1.0-dev.2 (image layouts, four presentation formats).
+
+## 0.80.2-popup.6
+
+- Vendors popup development build 0.0.0-dev.11: two fixes found by using the
+  redesigned backoffice in a browser — a false "unsaved changes" state
+  immediately after saving, and bottom-anchored presentations rendering at the
+  top of the builder's preview frame.
+
+## 0.80.2-popup.5
+
+- Vendors popup development build 0.0.0-dev.10: the design and usability
+  sprint over the popup backoffice and the public popup. No CMS-side code
+  changes were needed — the module host, the form and page bridges and the
+  lazy admin/runtime split all carry the new screen unchanged, which is the
+  layering working as intended.
+
+## 0.80.2-popup.4
+
+- The popup backoffice screen imports `@bygghammar/lightweight-popup/admin.css`
+  itself, from inside the lazily loaded admin module. The screen was rendering
+  unstyled because nothing imported the stylesheet; importing it here lets the
+  consumer's bundler attach it to the admin chunk, keeping every byte of it out
+  of public bundles.
+- Vendored popup development build 0.0.0-dev.9: live step switching in the
+  builder, draft-until-valid-save creation, strict schema validation in the
+  reference storage adapter.
+
+## 0.80.2-popup.3
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Changed
+
+- Rebuilt against the popup package's `0.0.0-dev.8`, which default-exports the
+  administration app so the module host's lazy loader resolves to it.
+
+## 0.80.2-popup.2
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Added
+
+- The Popups backoffice now mounts the popup package's full administration
+  screen — list, builder, rules, appearance, statistics, import and export —
+  instead of a read-only summary.
+- `./popups/cms-bridges`: form and page discovery adapted from the platform's
+  own host contract, so every site gets working pickers without writing them.
+  Only a key and a display name cross into the builder; the full form row
+  carries private settings a popup builder has no business seeing. A host with
+  no page listing gets no picker rather than a screen that fails to render.
+
+## 0.80.2-popup.1
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Added
+
+- **CMS module table** (`config/modules`, exported as `./modules`). Modules were
+  described in four places that had to agree by hand — the flag type, the
+  defaults, the Modules screen labels and the sidebar definitions. All four now
+  derive from one table, so a new first-party module is one entry plus one key
+  in `SiteFeatureFlags`. The key space stays a closed typed union and the
+  settings parser still drops anything it does not recognise, on read and on
+  write. Every pre-existing module keeps its default, label, path and sidebar
+  position.
+- **Lazy public module runtimes** (`CmsModuleRuntimes`, `registerModuleRuntime`)
+  and **lazy backoffice screens** (`CmsModuleAdmin`, `registerModuleAdmin`). A
+  module registers loader functions rather than components, so defining one
+  costs nothing: a site with the module off never evaluates its code and the
+  browser never requests its chunk. Loading happens in an effect, which is
+  itself the hydration gate — the server renders nothing, the first client pass
+  renders nothing. Public and admin loaders live in separate registries.
+- **Generic successful-submission seam for forms** (`./forms/success`,
+  `./forms/submission-result`). `FormRenderer` reads the submit result instead
+  of assuming success, and announces only submissions the host actually stored:
+  a honeypot answers `{ ok: true, skipped: true }` after storing nothing, and
+  counting that is how a bot inflates every conversion figure a site reports.
+  The event is emitted *before* a thank-you redirect assigns
+  `window.location.href`, because that tears the page down. Subscribers are
+  isolated, and the form system names no module. `ManagedForm` and
+  `FormRenderer` also take an optional `onSuccess`.
+- **Popups module** (`popups: false` by default), split across `./popups/host`,
+  `./popups/register`, `./popups/runtime` and `./popups/admin`. The public
+  bridge imports only the popup package's runtime entry, and the admin screen
+  stays out of the eagerly-imported backoffice barrel.
+  `@bygghammar/lightweight-popup` is an optional peer dependency.
+
+### Changed
+
+- `DEFAULT_FEATURE_FLAGS`, the Modules screen and the backoffice sidebar now
+  derive from the module table.
+- The lazy module host uses its component-loading effect as the hydration gate;
+  an earlier separate `hydrated` flag could be deleted without a single test
+  noticing, which meant it was guarding nothing.
+
 ## 0.80.1
 
 - Release pipeline verification: first version published from the canonical
   `byggis79/cms-platform` repository via the tag-triggered GitHub Actions
   release workflow. No source or behaviour changes.
 
+### Changed
+
+- Module public runtimes and backoffice screens are now **lazily loaded**.
+  A module registers loader functions (`() => import(...)`) instead of
+  components, through `@bygghammar/cms-platform/popups/register` for popups.
+  Defining a module therefore costs nothing: a site with the module switched off
+  never evaluates its code and the browser never requests its chunk. Loading
+  happens in an effect after hydration, so nothing runs during SSR and the first
+  client render matches the server's markup.
+- The public and admin loaders live in separate registries, so a public page
+  never pulls the backoffice screen and vice versa. `CmsModuleAdmin` mounts a
+  module's screen, loading it on first visit.
+
+
 ## 0.80.0
 
 - Search engines status card: the help text now explicitly tells admins which
@@ -32,6 +478,49 @@ from the published npm tarballs.
   screens instead of its own inline card, so the status and help text stay
   identical in both places.
 
+### Fixed
+
+- The Popups module now registers through an exported `registerPopupModule()`
+  instead of a module-scope side effect. A host whose `package.json`
+  `sideEffects` field is an allowlist tree-shakes a bare
+  `import "@bygghammar/cms-platform/popups/runtime"` away, taking the
+  registration and the entire popup runtime with it — a silent failure where the
+  build succeeds and no popup ever appears.
+
+### Added
+
+- **CMS module table** (`config/modules`, exported as `./modules`). Modules were
+  previously described in four places that had to agree by hand — the flag type,
+  the defaults, the Modules screen labels and the sidebar definitions. All four
+  now derive from one table, so a new first-party module is one entry plus one
+  key in `SiteFeatureFlags`. The key space stays a closed typed union, and the
+  settings parser still drops anything it does not recognise.
+- **Public module runtimes** (`CmsModuleRuntimes`, `registerModuleRuntime`). A
+  site renders the host once in its root layout; enabled modules that registered
+  a component are mounted. Registration happens by import, so a module a site
+  never imports is never bundled, and a module whose flag is off never runs.
+- **Generic successful-submission seam for forms** (`./forms/success`,
+  `./forms/submission-result`). `FormRenderer` now reads the submit result
+  instead of assuming success, and announces only submissions the host actually
+  stored: a honeypot answer of `{ ok: true, skipped: true }` stored nothing and
+  must never be counted. The event is emitted *before* a thank-you redirect
+  assigns `window.location.href`, because that tears the page down. Subscribers
+  are isolated — one that throws cannot break a form — and the form system names
+  no module, so it keeps working with none subscribed. `ManagedForm` and
+  `FormRenderer` also take an optional `onSuccess`.
+- **Popups module** (`popups: false` by default), with its CMS integration split
+  across `./popups/host`, `./popups/runtime` (public) and `./popups/admin`. The
+  public bridge imports only the popup package's runtime entry, so a site with
+  popups on never pulls the builder, the statistics screen or the validator into
+  its public bundle. `@bygghammar/lightweight-popup` is an optional peer
+  dependency: sites without the module need not install it.
+
+### Changed
+
+- `DEFAULT_FEATURE_FLAGS`, the Modules screen and the backoffice sidebar are now
+  derived from the module table. Every existing module keeps its previous
+  default, label, path and sidebar position.
+
 ## 0.78.0
 
 - Countdown block: the unit tiles now always stay on a single row on mobile.

package/README.md

@@ -25,6 +25,14 @@ apply the canonical schema with `bunx cms-platform-migrations`, import
 `theme.css`, register host components / platform data / translations, wrap the
 server cores and mount the shared backoffice views.
 
+## Editing locks
+
+`docs/EDIT-LOCKS.md` is what a host wires so two administrators cannot
+overwrite each other: run the migration, expose one server endpoint through
+`editLockActionCore`, mount `EditLockProvider` with `createEditLockApi`, and
+forward `editSessionId` to the saves. Until that is done every screen behaves
+exactly as it did before locks existed.
+
 ## Compatibility policy
 
 - `CHANGELOG.md` records every release; read it before upgrading.
@@ -119,8 +127,14 @@ bun run check   # typecheck + tests + package verification
 
 The package ships TypeScript sources; there is no build output. Every change
 goes through a pull request, and every release is triggered by pushing a
-`vX.Y.Z` tag that matches `package.json`, which publishes to npm from GitHub
-Actions using the repository secret `NPM_TOKEN`. Never publish manually.
+`vX.Y.Z` tag that matches `package.json`. That tag runs
+`.github/workflows/publish.yml`, which publishes to npm using **Trusted
+Publishing**: GitHub mints a short-lived OIDC token scoped to that single
+workflow run, and npm exchanges it for publish rights through the package's
+Trusted Publisher configuration. No long-lived npm credential takes part — no
+`NPM_TOKEN`, no `NODE_AUTH_TOKEN`, no OTP. [RELEASING.md](./RELEASING.md) is
+what the workflow checks and the npm settings it has to match. Never publish
+manually.
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full workflow and changelog
 conventions. Consumers install an explicit released version such as