@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.2

package/CHANGELOG.md

@@ -8,12 +8,222 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.90.0-m7.2
+
+- `backofficePaths` gains `popups` and `popupDestinations`, and both popup
+  mount points supply them to the package's navigation. The destinations screen
+  was reachable only by typing its address.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.2`, which is where the
+  navigation itself lives.
+
+## 0.90.0-m7.1
+
+First version published to npm rather than vendored as a tarball. Same code as
+`0.80.2-popup.15`, renumbered for a real prerelease: the minor moves because the
+popup integration gained form-field discovery, and the `m7` prerelease says this
+is still waiting on staging acceptance. Published under the `m7` dist-tag, so
+`latest` keeps pointing at 0.80.1.
+
+- The optional `@bygghammar/lightweight-popup` peer range now names a
+  prerelease. `>=0.0.0` does not accept `0.2.0-m7.1` — a prerelease only
+  satisfies a range that mentions one at the same version — so the peer would
+  have read as unmet on every install.
+
+## 0.80.2-popup.15
+
+- `cmsFormDirectory` can describe a form's fields, so the popup builder offers
+  real fields to tick instead of asking an administrator to type column names.
+  Built from the listing the forms screen already reads — no second host
+  contract and no second query.
+- Disabled fields, removed ones and the spam trap never reach the selector; a
+  field's own label is shown while its stable key is what gets stored.
+- Vendors popup 0.1.0-dev.9.
+
+## 0.80.2-popup.14
+
+- A test delivery that failed before any request was made is no longer reported
+  as "The endpoint refused it". The bridge defaulted an absent category to
+  `http-error`; a missing signing secret arrives exactly that way, so the screen
+  sent administrators to debug a receiver that had never been contacted. An
+  unnamed failure is now `config-error`.
+
+## 0.80.2-popup.13
+
+- The destinations screen imports the popup admin stylesheet. It is a sibling
+  route rather than a child of the builder, so it loads on its own and nothing
+  else pulled the styling in — the first time anyone could reach it, twelve
+  `lwp-` elements rendered as plain text.
+- A test now requires every module that mounts one of the package's admin
+  screens to import that stylesheet beside it.
+
+## 0.80.2-popup.12
+
+- Documents the popup bridges in `docs/POPUPS.md`: which port each CMS system
+  fills, why an unfilled port is not an integration, what crosses the media
+  boundary, and which webhook responsibility sits in which layer.
+
+## 0.80.2-popup.11
+
+- A destinations screen for popup opt-in webhooks: `popups/destinations` binds
+  the package's provider-neutral `DestinationsAdmin` to the host's own server
+  functions. A site that registers none gets an honest empty screen.
+- The backoffice host contract gains the remaining optional webhook slots
+  (save, delete, send test, list deliveries).
+- Vendors popup 0.1.0-dev.5.
+
+## 0.80.2-popup.10
+
+- The popup builder now gets the site's media library. `cmsMediaPicker()`
+  renders the same `MediaPickerDialog` every other backoffice screen uses, and
+  is passed into the popup admin adapters — the line whose absence left
+  administrators typing storage URLs by hand.
+- Only a stable public address, a filename and any stored alt text cross into
+  the popup package. Uploading, listing and deleting stay with the library.
+- Vendors popup 0.1.0-dev.4.
+
+## 0.80.2-popup.9
+
+- The backoffice host contract gains an optional , so
+  a site can offer opt-in destinations to the popup editor. A site without one
+  registers nothing and the picker does not appear.
+
+## 0.80.2-popup.8
+
+- Vendors popup 0.1.0-dev.3, which adds the opt-in destination picker this
+  version bridges to.
+
+## 0.80.2-popup.7
+
+- Server-only popup opt-in webhooks. `server/popup-optin-webhook-core` signs a
+  versioned payload with HMAC-SHA256 over a timestamped string, re-validates
+  the endpoint on every redirect hop, bounds the response it will read, and
+  categorises failures without ever echoing the receiver's own words.
+- `server/webhook-url-guard` refuses anything that is not public https:
+  loopback, private, link-local, carrier-grade NAT, unique-local, multicast and
+  cloud-metadata addresses, including the IPv4 forms hidden inside IPv6, plus
+  credentials embedded in the URL.
+- `server/popup-optin-trigger` is the single predicate deciding what counts as
+  a genuine opt-in. The honeypot's `{ok: true, skipped: true}` is not one, and
+  neither is a Yes click, a dismissal, a preview or a test-mode popup.
+- CMS bridges for the popup editor's opt-in destination picker and media
+  picker. Only an identifier, a name and a warning cross the boundary — never
+  an endpoint or a secret.
+- Vendors popup 0.1.0-dev.2 (image layouts, four presentation formats).
+
+## 0.80.2-popup.6
+
+- Vendors popup development build 0.0.0-dev.11: two fixes found by using the
+  redesigned backoffice in a browser — a false "unsaved changes" state
+  immediately after saving, and bottom-anchored presentations rendering at the
+  top of the builder's preview frame.
+
+## 0.80.2-popup.5
+
+- Vendors popup development build 0.0.0-dev.10: the design and usability
+  sprint over the popup backoffice and the public popup. No CMS-side code
+  changes were needed — the module host, the form and page bridges and the
+  lazy admin/runtime split all carry the new screen unchanged, which is the
+  layering working as intended.
+
+## 0.80.2-popup.4
+
+- The popup backoffice screen imports `@bygghammar/lightweight-popup/admin.css`
+  itself, from inside the lazily loaded admin module. The screen was rendering
+  unstyled because nothing imported the stylesheet; importing it here lets the
+  consumer's bundler attach it to the admin chunk, keeping every byte of it out
+  of public bundles.
+- Vendored popup development build 0.0.0-dev.9: live step switching in the
+  builder, draft-until-valid-save creation, strict schema validation in the
+  reference storage adapter.
+
+## 0.80.2-popup.3
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Changed
+
+- Rebuilt against the popup package's `0.0.0-dev.8`, which default-exports the
+  administration app so the module host's lazy loader resolves to it.
+
+## 0.80.2-popup.2
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Added
+
+- The Popups backoffice now mounts the popup package's full administration
+  screen — list, builder, rules, appearance, statistics, import and export —
+  instead of a read-only summary.
+- `./popups/cms-bridges`: form and page discovery adapted from the platform's
+  own host contract, so every site gets working pickers without writing them.
+  Only a key and a display name cross into the builder; the full form row
+  carries private settings a popup builder has no business seeing. A host with
+  no page listing gets no picker rather than a screen that fails to render.
+
+## 0.80.2-popup.1
+
+Not yet published. Local development artifact for the Popups module only.
+
+### Added
+
+- **CMS module table** (`config/modules`, exported as `./modules`). Modules were
+  described in four places that had to agree by hand — the flag type, the
+  defaults, the Modules screen labels and the sidebar definitions. All four now
+  derive from one table, so a new first-party module is one entry plus one key
+  in `SiteFeatureFlags`. The key space stays a closed typed union and the
+  settings parser still drops anything it does not recognise, on read and on
+  write. Every pre-existing module keeps its default, label, path and sidebar
+  position.
+- **Lazy public module runtimes** (`CmsModuleRuntimes`, `registerModuleRuntime`)
+  and **lazy backoffice screens** (`CmsModuleAdmin`, `registerModuleAdmin`). A
+  module registers loader functions rather than components, so defining one
+  costs nothing: a site with the module off never evaluates its code and the
+  browser never requests its chunk. Loading happens in an effect, which is
+  itself the hydration gate — the server renders nothing, the first client pass
+  renders nothing. Public and admin loaders live in separate registries.
+- **Generic successful-submission seam for forms** (`./forms/success`,
+  `./forms/submission-result`). `FormRenderer` reads the submit result instead
+  of assuming success, and announces only submissions the host actually stored:
+  a honeypot answers `{ ok: true, skipped: true }` after storing nothing, and
+  counting that is how a bot inflates every conversion figure a site reports.
+  The event is emitted *before* a thank-you redirect assigns
+  `window.location.href`, because that tears the page down. Subscribers are
+  isolated, and the form system names no module. `ManagedForm` and
+  `FormRenderer` also take an optional `onSuccess`.
+- **Popups module** (`popups: false` by default), split across `./popups/host`,
+  `./popups/register`, `./popups/runtime` and `./popups/admin`. The public
+  bridge imports only the popup package's runtime entry, and the admin screen
+  stays out of the eagerly-imported backoffice barrel.
+  `@bygghammar/lightweight-popup` is an optional peer dependency.
+
+### Changed
+
+- `DEFAULT_FEATURE_FLAGS`, the Modules screen and the backoffice sidebar now
+  derive from the module table.
+- The lazy module host uses its component-loading effect as the hydration gate;
+  an earlier separate `hydrated` flag could be deleted without a single test
+  noticing, which meant it was guarding nothing.
+
 ## 0.80.1
 
 - Release pipeline verification: first version published from the canonical
   `byggis79/cms-platform` repository via the tag-triggered GitHub Actions
   release workflow. No source or behaviour changes.
 
+### Changed
+
+- Module public runtimes and backoffice screens are now **lazily loaded**.
+  A module registers loader functions (`() => import(...)`) instead of
+  components, through `@bygghammar/cms-platform/popups/register` for popups.
+  Defining a module therefore costs nothing: a site with the module switched off
+  never evaluates its code and the browser never requests its chunk. Loading
+  happens in an effect after hydration, so nothing runs during SSR and the first
+  client render matches the server's markup.
+- The public and admin loaders live in separate registries, so a public page
+  never pulls the backoffice screen and vice versa. `CmsModuleAdmin` mounts a
+  module's screen, loading it on first visit.
+
+
 ## 0.80.0
 
 - Search engines status card: the help text now explicitly tells admins which
@@ -32,6 +242,49 @@ from the published npm tarballs.
   screens instead of its own inline card, so the status and help text stay
   identical in both places.
 
+### Fixed
+
+- The Popups module now registers through an exported `registerPopupModule()`
+  instead of a module-scope side effect. A host whose `package.json`
+  `sideEffects` field is an allowlist tree-shakes a bare
+  `import "@bygghammar/cms-platform/popups/runtime"` away, taking the
+  registration and the entire popup runtime with it — a silent failure where the
+  build succeeds and no popup ever appears.
+
+### Added
+
+- **CMS module table** (`config/modules`, exported as `./modules`). Modules were
+  previously described in four places that had to agree by hand — the flag type,
+  the defaults, the Modules screen labels and the sidebar definitions. All four
+  now derive from one table, so a new first-party module is one entry plus one
+  key in `SiteFeatureFlags`. The key space stays a closed typed union, and the
+  settings parser still drops anything it does not recognise.
+- **Public module runtimes** (`CmsModuleRuntimes`, `registerModuleRuntime`). A
+  site renders the host once in its root layout; enabled modules that registered
+  a component are mounted. Registration happens by import, so a module a site
+  never imports is never bundled, and a module whose flag is off never runs.
+- **Generic successful-submission seam for forms** (`./forms/success`,
+  `./forms/submission-result`). `FormRenderer` now reads the submit result
+  instead of assuming success, and announces only submissions the host actually
+  stored: a honeypot answer of `{ ok: true, skipped: true }` stored nothing and
+  must never be counted. The event is emitted *before* a thank-you redirect
+  assigns `window.location.href`, because that tears the page down. Subscribers
+  are isolated — one that throws cannot break a form — and the form system names
+  no module, so it keeps working with none subscribed. `ManagedForm` and
+  `FormRenderer` also take an optional `onSuccess`.
+- **Popups module** (`popups: false` by default), with its CMS integration split
+  across `./popups/host`, `./popups/runtime` (public) and `./popups/admin`. The
+  public bridge imports only the popup package's runtime entry, so a site with
+  popups on never pulls the builder, the statistics screen or the validator into
+  its public bundle. `@bygghammar/lightweight-popup` is an optional peer
+  dependency: sites without the module need not install it.
+
+### Changed
+
+- `DEFAULT_FEATURE_FLAGS`, the Modules screen and the backoffice sidebar are now
+  derived from the module table. Every existing module keeps its previous
+  default, label, path and sidebar position.
+
 ## 0.78.0
 
 - Countdown block: the unit tiles now always stay on a single row on mobile.

package/docs/POPUPS.md

@@ -0,0 +1,102 @@
+# Popups: what this package supplies
+
+`@bygghammar/lightweight-popup` is deliberately host-agnostic. It knows nothing
+about Supabase, about this CMS, or about any particular site. Everything it
+needs from the outside arrives through ports.
+
+This package is the adapter that fills those ports with the CMS's own systems,
+so a site gets a working popup builder by registering one module instead of
+reimplementing a media library, a form renderer and a page picker.
+
+## The bridges
+
+| Port | Filled with | File |
+| --- | --- | --- |
+| `MediaPickerPort` | The CMS media library dialog | `src/popups/media-bridge.tsx` |
+| `FormRenderPort` | The CMS form renderer | `src/popups/cms-bridges.ts` |
+| `PagePickerPort` | The CMS page list | `src/popups/cms-bridges.ts` |
+| `OptInDestinationAdminPort` | The host's webhook server functions | `src/popups/destinations.tsx` |
+
+All of them are assembled in `src/popups/admin.tsx`. **An unfilled port is not
+an integration.** `cmsMediaPicker` existed for weeks and was never placed on the
+adapters object, so `adapters.media` was permanently `undefined`, the builder
+took its no-picker fallback branch, and every administrator pasted storage URLs
+by hand. The failure was invisible because the fallback is a legitimate state
+for a host without a media library.
+
+`tests/popup-media-bridge.test.ts` now asserts against the source of
+`admin.tsx` that the key is present. Deleting the line fails the suite.
+
+## The media bridge
+
+`MediaPickerPort` is a render seam:
+
+```ts
+renderPicker(props: { onPick(item): void; onClose(): void }): ReactNode
+```
+
+The bridge returns the CMS's own `MediaPickerDialog` with `accept="image"`. Not
+a wrapper around it and not a reimplementation — the same component every other
+inspector uses, so browsing, searching, folders and **upload** all come along
+for free. The popup package never uploads anything and never learns which
+storage provider the site uses.
+
+What crosses the boundary is `{ src, name?, alt? }`: the stable public URL the
+library already serves to the site, the filename to show, and the library's own
+description when it has one. `toHostMediaItem` returns `null` for a row with no
+address rather than passing an empty string on.
+
+The URL must be the **public** one. A signed or expiring link renders in the
+builder and 404s a month later on the live site, which is why the popup package
+refuses those shapes itself in `checkMediaReference`.
+
+## The webhook layers
+
+Opt-in delivery is split across all three layers, and the split is the security
+model rather than a tidiness preference.
+
+| Layer | Has |
+| --- | --- |
+| lightweight-popup | The destinations screen and the delivery log. No fetch, no crypto, no database |
+| **this package** | `webhook-url-guard.ts`, `popup-optin-webhook-core.ts`, `popup-optin-trigger.ts` — validation, signing, the retry schedule, the genuine-opt-in predicate, field selection |
+| The site | Tables, server functions, `process.env` secret resolution, routing |
+
+Everything here is pure and host-agnostic: it is handed a row and a secret and
+returns an outcome. It never reads an environment variable and never opens a
+database connection, so the same code is testable without either.
+
+`src/server/*` is server-only by convention **and** by reachability: nothing in
+`src/backoffice` or `src/popups` imports it, which is what keeps delivery code
+out of every client bundle. The host's own chunk-boundary test proves that on
+the built assets.
+
+### The one rule that matters
+
+**Delivery is triggered from the stored submission, on the server.** The
+browser contributes a popup key and nothing else. There is no parameter that
+carries a payload, an endpoint or a recipient, so a crafted request cannot make
+the server send anything anywhere.
+
+`shouldDeliverOptIn` is the only predicate. A honeypot's
+`{ ok: true, skipped: true }` — the deliberate lie the form system tells a bot —
+is **not** an opt-in. Neither is a "yes" click, a preview, or a test-mode popup.
+
+### Secrets
+
+A destination stores the **name** of an environment variable, never a value.
+The host resolves it at delivery time. The admin port's `DestinationRecord`
+carries `secretConfigured: boolean` and an `endpointDisplay` with the query
+string removed; there is no field on it that could hold a credential, and the
+form that creates one has nowhere to type a secret.
+
+## Registering it on a site
+
+```ts
+import { registerPopupModule } from "@bygghammar/cms-platform/popups";
+```
+
+The host supplies its `fns` object. The webhook slots on it —
+`listWebhookDestinations`, `saveWebhookDestination`, `deleteWebhookDestination`,
+`sendTestWebhook`, `listWebhookDeliveries` — are **optional**. A site with no
+webhook tables simply omits them and the destinations screen is not offered;
+nothing breaks and no dead menu item appears.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.80.1",
+  "version": "0.90.0-m7.2",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -49,6 +49,8 @@
     "./trips/TripSectionEditor": "./src/trips/TripSectionEditor.tsx",
     "./navigation": "./src/navigation/index.ts",
     "./forms/FormRenderer": "./src/forms/FormRenderer.tsx",
+    "./forms/success": "./src/forms/success-listeners.ts",
+    "./forms/submission-result": "./src/forms/submission-result.ts",
     "./forms/conditions": "./src/forms/conditions.ts",
     "./forms/field-sets": "./src/forms/field-sets.ts",
     "./forms/form-audit": "./src/forms/form-audit.ts",
@@ -179,6 +181,12 @@
     "./site/font-bundle": "./src/site/font-bundle.ts",
     "./admin/version-core": "./src/admin/version-core.ts",
     "./config/package-owned-modules": "./src/config/package-owned-modules.ts",
+    "./modules": "./src/modules/index.ts",
+    "./popups/host": "./src/popups/host.ts",
+    "./popups/cms-bridges": "./src/popups/cms-bridges.ts",
+    "./popups/register": "./src/popups/register.ts",
+    "./popups/runtime": "./src/popups/runtime.tsx",
+    "./popups/admin": "./src/popups/admin.tsx",
     "./server/schema-drift": "./src/server/schema-drift.ts",
     "./server/media-focus-core": "./src/server/media-focus-core.ts",
     "./server/media-meta-core": "./src/server/media-meta-core.ts",
@@ -222,7 +230,11 @@
     "./site/routes/section-preview": "./src/site/routes/section-preview.tsx",
     "./media/priority": "./src/media/priority.tsx",
     "./media/preload": "./src/media/preload.ts",
-    "./ui/NearViewport": "./src/ui/NearViewport.tsx"
+    "./ui/NearViewport": "./src/ui/NearViewport.tsx",
+    "./server/webhook-url-guard": "./src/server/webhook-url-guard.ts",
+    "./server/popup-optin-webhook-core": "./src/server/popup-optin-webhook-core.ts",
+    "./server/popup-optin-trigger": "./src/server/popup-optin-trigger.ts",
+    "./popups/destinations": "./src/popups/destinations.tsx"
   },
   "dependencies": {
     "fflate": "^0.8.3"
@@ -250,7 +262,8 @@
     "@dnd-kit/core": ">=6",
     "@dnd-kit/sortable": ">=3",
     "@dnd-kit/utilities": ">=3",
-    "zod": ">=3"
+    "zod": ">=3",
+    "@bygghammar/lightweight-popup": ">=0.2.0-m7.2"
   },
   "peerDependenciesMeta": {
     "@supabase/supabase-js": {
@@ -294,6 +307,9 @@
     },
     "@tiptap/extension-table": {
       "optional": true
+    },
+    "@bygghammar/lightweight-popup": {
+      "optional": true
     }
   },
   "bin": {
@@ -312,6 +328,7 @@
     "check": "bun run typecheck && bun run test && bun run verify:pack"
   },
   "devDependencies": {
+    "@bygghammar/lightweight-popup": "file:./vendor/bygghammar-lightweight-popup-0.2.0-m7.2.tgz",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -319,6 +336,8 @@
     "@tanstack/react-query": "^5.101.1",
     "@tanstack/react-router": "1.170.18",
     "@tanstack/react-start": "1.168.32",
+    "@testing-library/dom": "^10.4.0",
+    "@testing-library/react": "^16.3.0",
     "@tiptap/extension-highlight": "^3.29.2",
     "@tiptap/extension-image": "^3.29.2",
     "@tiptap/extension-subscript": "^3.29.2",
@@ -333,6 +352,7 @@
     "@types/node": "^22.10.2",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
+    "jsdom": "^26.1.0",
     "lucide-react": "^0.575.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/src/backoffice/SiteSettingsView.tsx

@@ -11,6 +11,7 @@ import {
   type SiteFeatureFlags,
   type SiteSettingOverrides,
 } from "../config/site-config";
+import { CMS_MODULE_LIST, CMS_MODULE_LABELS } from "../config/modules";
 import type { IndexingPolicy } from "../site/indexing";
 import { IndexingStatusCard } from "./IndexingStatusCard";
 
@@ -48,16 +49,9 @@ export type SiteSettingsDeps = {
   MediaField?: (props: any) => ReactNode;
 };
 
-const FEATURE_LABELS: Record<keyof SiteFeatureFlags, string> = {
-  trips: "Trips & departures",
-  courses: "Courses",
-  reviews: "Reviews",
-  email: "Transactional email",
-  tracking: "Code & tracking",
-  backup: "Backup & restore",
-  domains: "Custom domains",
-  forms: "Forms",
-};
+// Labels and order come from the module table, so a new module appears here
+// without a second list to keep in step.
+const FEATURE_LABELS = CMS_MODULE_LABELS;
 
 const COMPANY_LABELS: Record<keyof typeof EMPTY_COMPANY, string> = {
   legalName: "Legal name",
@@ -275,14 +269,19 @@ export function SiteSettingsView({ deps }: { deps: SiteSettingsDeps }) {
           busy={busy === "features"}
         />
         <div className="mt-4 grid gap-3 md:grid-cols-2">
-          {(Object.keys(DEFAULT_FEATURE_FLAGS) as (keyof SiteFeatureFlags)[]).map((flag) => (
-            <label key={flag} className="flex items-center gap-3 text-sm text-ink">
+          {CMS_MODULE_LIST.map((module) => (
+            <label key={module.key} className="flex items-center gap-3 text-sm text-ink">
               <input
                 type="checkbox"
-                checked={features[flag]}
-                onChange={(e) => setFeatures({ ...features, [flag]: e.target.checked })}
+                checked={features[module.key]}
+                onChange={(e) => setFeatures({ ...features, [module.key]: e.target.checked })}
               />
-              {FEATURE_LABELS[flag]}
+              <span>
+                {FEATURE_LABELS[module.key]}
+                {module.description ? (
+                  <span className="block text-xs text-ink/60">{module.description}</span>
+                ) : null}
+              </span>
             </label>
           ))}
         </div>

package/src/backoffice/routes/host.ts

@@ -78,6 +78,18 @@ export type BackofficeHost = {
     // locale domains
     saveLocaleDomain: HostServerFn;
     deleteLocaleDomain: HostServerFn;
+    /*
+     * Popup opt-in destinations, for the popup editor's picker.
+     *
+     * Optional: a site with no delivery integration simply does not register
+     * it, and the popup editor then shows no picker at all rather than an
+     * empty control. Returns names and ids — never an endpoint or a secret.
+     */
+    listWebhookDestinations?: HostServerFn;
+    saveWebhookDestination?: HostServerFn;
+    deleteWebhookDestination?: HostServerFn;
+    sendTestWebhook?: HostServerFn;
+    listWebhookDeliveries?: HostServerFn;
   };
   /** Site-specific example values shown as input placeholders. */
   placeholders?: {
@@ -105,7 +117,10 @@ export type BackofficeHost = {
   /** Editor components a site wires with its own locales, media and forms. */
   components: {
     /** Recursive shared-content editor. */
-    SectionForm: (props: { value: unknown; onChange: (next: unknown) => void }) => ReactNode;
+    SectionForm: (props: {
+      value: unknown;
+      onChange: (next: unknown) => void;
+    }) => ReactNode;
     /** Single media field used by the reviews editor. */
     MediaField: MediaFieldComponent;
     /** Review portrait uploader. */
@@ -200,7 +215,10 @@ export type BackofficeHost = {
      * React hook returning a resolver for a page's public URL. Implemented as a
      * hook so a site can read its slug overrides and locale domains.
      */
-    usePageUrl: () => (pageKey: string, locale: string) => { path: string; host: string };
+    usePageUrl: () => (
+      pageKey: string,
+      locale: string,
+    ) => { path: string; host: string };
     /** Persists unsaved shared-content drafts; returns the keys it saved. */
     flushSharedDrafts?: () => Promise<string[]>;
     /** Renders the block canvas for the builder. */
@@ -211,7 +229,12 @@ export type BackofficeHost = {
       blocks: any[];
       setBlocks: (next: any[]) => void;
       globals: Record<string, any[]>;
-      globalSections: { key: string; name: string; kind: "block" | "section"; blocks: any[] }[];
+      globalSections: {
+        key: string;
+        name: string;
+        kind: "block" | "section";
+        blocks: any[];
+      }[];
       locale: string;
       setLocale: (next: string) => void;
       setDirty: (next: boolean) => void;
@@ -248,7 +271,6 @@ export type BackofficeHost = {
   /* eslint-enable @typescript-eslint/no-explicit-any */
 };
 
-
 let current: BackofficeHost | null = null;
 
 /** Registers the host adapters. Call once, from a module the routes import. */
@@ -295,13 +317,16 @@ export function backofficePaths(host: BackofficeHost = backofficeHost()) {
     formDeliveries: `${base}/forms/deliveries`,
     pagesBuilder: `${base}/pages-builder`,
     resetPassword: `${base}/reset-password`,
+    popups: `${base}/popups`,
+    popupDestinations: `${base}/popups/destinations`,
   };
 }
 
 /** Reads a required optional host group, failing loudly when it is missing. */
-export function requireHostGroup<K extends "media" | "forms" | "pages" | "sections" | "dashboard" | "authAdapters">(
-  key: K,
-): NonNullable<BackofficeHost[K]> {
+export function requireHostGroup<
+  K extends
+    "media" | "forms" | "pages" | "sections" | "dashboard" | "authAdapters",
+>(key: K): NonNullable<BackofficeHost[K]> {
   const group = backofficeHost()[key];
   if (!group) {
     throw new Error(