@orion-studios/cms 0.5.1 → 0.5.2

package/README.md

@@ -62,7 +62,8 @@ root for the full procedure.
 Four tiers, enforced in the API (`src/server/permissions.ts`), UI adapts:
 
 - `content` — edit text/images on existing sections (no add/remove/reorder)
-- `editor` — full content control: structure, new pages, publish
+- `editor`: full content control including structure, new pages, exact-version publish,
+  submissions, detailed analytics, and replacement of existing media
 - `admin` — everything + user management (Users panel in the Studio)
 - `developer` — full access; the tier Orion Studios keeps for itself
 
@@ -81,6 +82,28 @@ own role, never delete yourself.
 | `CMS_STATIC=true` | optional | static mode (no CMS) |
 | `CMS_MEMORY=true` | optional | force memory mode |
 
+The memory backend is privileged only outside production. In production it
+can serve public ephemeral forms and events, but it rejects Studio and guarded
+routes, the fixed development token, preview fallback, sync, publish cron,
+notification email, and user management. `NEXT_PUBLIC_CMS_MEMORY` and other
+public flags cannot enable the development credential.
+
+## Publication contract
+
+Draft title, SEO, and layout are saved together as one immutable page version.
+Manual publish requires that version's current `draft_version_id`. Scheduling
+stores the selected version ID and later draft edits do not change what will go
+live. A missing, stale, foreign, or already-published version fails with `409`.
+Content roles may create media and edit its metadata. Only editor, admin, and
+developer roles may replace an existing file or read submissions and detailed
+analytics.
+
+Run the additive SQL migrations in filename order before deploying code that
+calls the exact-version RPCs. `bootstrap.sql` has the same final schema,
+functions, grants, and published-metadata backfill for new projects. If a
+release fails after the migration, keep the fail-closed RPCs and roll forward.
+Do not restore the old mutable publish signature.
+
 ## Development
 
 ```bash

package/dist/{chunk-HVJCF2IZ.js → chunk-AYV6KYDP.js}

@@ -5,8 +5,8 @@ var toPublicPage = (row) => ({
   id: String(row.id),
   slug: String(row.slug),
   path: String(row.path),
-  title: String(row.title ?? ""),
-  seo: row.seo ?? {},
+  title: String(row.published_title ?? ""),
+  seo: row.published_seo ?? {},
   layout: row.published_layout ?? []
 });
 function createContentClient(options = {}) {
@@ -20,7 +20,7 @@ function createContentClient(options = {}) {
   const client = createClient(supabaseUrl, anonKey, {
     auth: { persistSession: false, autoRefreshToken: false }
   });
-  const selectPage = "id, slug, path, title, seo, published_layout";
+  const selectPage = "id, slug, path, published_title, published_seo, published_layout";
   return {
     async getPageByPath(path) {
       const { data } = await client.from("cms_pages").select(selectPage).eq("path", path).eq("status", "published").maybeSingle();

package/dist/content/index.js

@@ -1,7 +1,7 @@
 import {
   CONTENT_CACHE_TAG,
   createContentClient
-} from "../chunk-HVJCF2IZ.js";
+} from "../chunk-AYV6KYDP.js";
 export {
   CONTENT_CACHE_TAG,
   createContentClient

package/dist/forms/react.d.ts

@@ -1,4 +1,4 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as react from 'react';
 import { ReactNode } from 'react';
 import { F as FormConfig } from '../submission-CzrfXu17.js';
 
@@ -40,6 +40,6 @@ type FormRendererProps = {
     preview?: boolean;
     onSuccess?: () => void;
 };
-declare function FormRenderer({ slug, config, successMessage, basePath, classNames, title, intro, submitLabel, preview, onSuccess, }: FormRendererProps): react_jsx_runtime.JSX.Element;
+declare function FormRenderer({ slug, config, successMessage, basePath, classNames, title, intro, submitLabel, preview, onSuccess, }: FormRendererProps): react.JSX.Element;
 
 export { FormRenderer, type FormRendererClassNames, type FormRendererProps };

package/dist/server/index.d.ts

@@ -303,7 +303,7 @@ declare function resolveUser(request: Request, client?: SupabaseClient): Promise
  * of what the Studio UI shows.
  */
 type CmsRole = CmsUser['role'];
-type CmsAction = 'pages.read' | 'pages.saveDraft' | 'pages.changeStructure' | 'pages.publish' | 'pages.create' | 'pages.delete' | 'pages.restore' | 'globals.read' | 'globals.write' | 'media.read' | 'media.upload' | 'media.update' | 'media.delete' | 'forms.read' | 'forms.write' | 'forms.delete' | 'submissions.read' | 'submissions.manage' | 'redirects.manage' | 'activity.read' | 'analytics.read' | 'sync.run' | 'users.manage';
+type CmsAction = 'pages.read' | 'pages.saveDraft' | 'pages.changeStructure' | 'pages.publish' | 'pages.create' | 'pages.delete' | 'pages.restore' | 'globals.read' | 'globals.write' | 'media.read' | 'media.upload' | 'media.update' | 'media.replace' | 'media.delete' | 'forms.read' | 'forms.write' | 'forms.delete' | 'submissions.read' | 'submissions.manage' | 'redirects.manage' | 'activity.read' | 'analytics.read' | 'sync.run' | 'users.manage';
 declare function can(user: CmsUser | null, action: CmsAction): boolean;
 /**
  * Structural change detection for the content tier: `content` users may edit
@@ -379,8 +379,9 @@ declare function runContentSync(client: SupabaseClient, registry: BlockRegistry,
  * route factory only enables it when explicitly passed.
  *
  * Emulates exactly the supabase-js surface the CMS uses: filtered selects,
- * insert/upsert/delete, the four cms_* RPC functions, storage, and
- * auth.getUser.
+ * insert/upsert/delete, the cms_* RPC functions, storage, and
+ * auth.getUser. The fixed development credential is accepted only when the
+ * process is not running in production.
  */
 type Row = Record<string, unknown>;
 declare const MEMORY_DEV_TOKEN = "orion-dev-token";

package/dist/server/index.js

@@ -1,11 +1,11 @@
+import {
+  CONTENT_CACHE_TAG
+} from "../chunk-AYV6KYDP.js";
 import {
   createMemoryRateLimitStore,
   isOriginAllowed,
   processSubmission
 } from "../chunk-VPUODCNH.js";
-import {
-  CONTENT_CACHE_TAG
-} from "../chunk-HVJCF2IZ.js";
 
 // src/server/routes.ts
 import { createHash as createHash2 } from "crypto";
@@ -393,15 +393,16 @@ var MIN_ROLE = {
   "media.read": "content",
   "media.upload": "content",
   "media.update": "content",
+  "media.replace": "editor",
   "media.delete": "editor",
   "forms.read": "content",
   "forms.write": "editor",
   "forms.delete": "admin",
-  "submissions.read": "content",
+  "submissions.read": "editor",
   "submissions.manage": "editor",
   "redirects.manage": "editor",
   "activity.read": "editor",
-  "analytics.read": "content",
+  "analytics.read": "editor",
   "sync.run": "admin",
   "users.manage": "admin"
 };
@@ -755,10 +756,14 @@ function createDurableRateLimitStore(getClient, options) {
 function createCmsRoutes(options) {
   const { registry, allowedOrigins, syncToken, knownGoodEmailDomains } = options;
   const db = () => options.client ?? getServiceClient();
+  const hostedMemoryMode = options.memoryMode === true && process.env.NODE_ENV === "production";
   const rateLimit = options.rateLimitStore === null ? null : options.rateLimitStore || (options.memoryMode ? createMemoryRateLimitStore() : createDurableRateLimitStore(db, { max: 5, windowMs: 6e4, bucket: "submit" }));
-  const sendEmail = options.sendEmail === null ? null : options.sendEmail || createResendSender();
+  const sendEmail = hostedMemoryMode || options.sendEmail === null ? null : options.sendEmail || createResendSender();
   const maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
-  const previewSecret = () => options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
+  const previewSecret = () => {
+    if (hostedMemoryMode) return "";
+    return options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
+  };
   const eventsRateLimit = options.memoryMode ? createMemoryRateLimitStore({ max: 120, windowMs: 6e4 }) : createDurableRateLimitStore(db, { max: 120, windowMs: 6e4, bucket: "events" });
   const analyticsRetentionDays = options.analyticsRetentionDays ?? 90;
   const requestSessionKey = (request) => {
@@ -766,6 +771,7 @@ function createCmsRoutes(options) {
     return sessionKeyFor(clientKey(request), request.headers.get("user-agent") || "", secret);
   };
   const guard = async (request, action) => {
+    if (hostedMemoryMode) return errors.unauthorized();
     const user = await resolveUser(request, db());
     if (!user) return errors.unauthorized();
     if (!can(user, action)) return errors.forbidden();
@@ -784,19 +790,21 @@ function createCmsRoutes(options) {
   };
   const hasDraftChanges = (page) => {
     if (page.status !== "published") return true;
-    return JSON.stringify(page.draft_layout ?? []) !== JSON.stringify(page.published_layout ?? []);
+    return page.title !== page.published_title || JSON.stringify(page.seo ?? {}) !== JSON.stringify(page.published_seo ?? {}) || JSON.stringify(page.draft_layout ?? []) !== JSON.stringify(page.published_layout ?? []);
   };
   const listPages = async (request) => {
     const auth = await guard(request, "pages.read");
     if (auth instanceof Response) return auth;
     const { data, error } = await db().from("cms_pages").select(
-      "id, slug, path, title, status, builder_owned, updated_at, published_at, publish_at, draft_layout, published_layout"
+      "id, slug, path, title, status, builder_owned, updated_at, published_at, publish_at, draft_version_id, published_version_id, scheduled_version_id, published_title, published_seo, draft_layout, published_layout"
     ).order("path");
     if (error) return errors.badRequest(error.message);
     const pages = (data || []).map((page) => {
-      const { draft_layout, published_layout, ...summary } = page;
+      const { draft_layout, published_layout, published_title, published_seo, ...summary } = page;
       void draft_layout;
       void published_layout;
+      void published_title;
+      void published_seo;
       return { ...summary, has_draft_changes: hasDraftChanges(page) };
     });
     return json({ pages });
@@ -824,13 +832,22 @@ function createCmsRoutes(options) {
     if (!PATH_PATTERN.test(path)) {
       return errors.badRequest("Path must look like /about or /services/pest-control.");
     }
-    const { data, error } = await db().from("cms_pages").insert({ slug, path, title: body.title, seo: isRecord2(body.seo) ? body.seo : {} }).select("*").single();
+    const { data: created, error } = await db().from("cms_pages").insert({ slug, path, title: body.title, seo: isRecord2(body.seo) ? body.seo : {} }).select("*").single();
     if (error) {
       if (error.message.includes("duplicate")) {
         return errors.badRequest("A page with this slug or path already exists.");
       }
       return errors.badRequest(error.message);
     }
+    if (!created) return errors.badRequest("Could not create page.");
+    const { data, error: versionError } = await db().rpc("cms_save_page_draft", {
+      p_page_id: created.id,
+      p_title: body.title,
+      p_seo: isRecord2(body.seo) ? body.seo : {},
+      p_layout: [],
+      p_actor: auth.user.id
+    });
+    if (versionError) return errors.badRequest(versionError.message);
     await logActivity(auth.user, "page.create", path);
     return json({ page: data }, 201);
   };
@@ -900,6 +917,7 @@ function createCmsRoutes(options) {
         }
       }
     }
+    const hasContentChange = body.title !== void 0 || body.seo !== void 0 || layout !== null;
     if (wantsSchedule) {
       if (!can(auth.user, "pages.publish")) return errors.forbidden();
       let publishAt = null;
@@ -908,15 +926,27 @@ function createCmsRoutes(options) {
         if (Number.isNaN(parsed)) return errors.badRequest("publishAt must be a valid date.");
         publishAt = new Date(parsed).toISOString();
       }
-      const { error: error2 } = await db().from("cms_pages").update({ publish_at: publishAt }).eq("id", id);
-      if (error2) return errors.badRequest(error2.message);
+      const expectedVersionId = Number(body.expectedVersionId);
+      if (publishAt && (!Number.isSafeInteger(expectedVersionId) || expectedVersionId <= 0)) {
+        return errors.conflict("Page version conflict: save the draft again before scheduling.");
+      }
+      const { data: data2, error: error2 } = await db().rpc("cms_schedule_page_publish", {
+        p_page_id: id,
+        p_expected_version_id: publishAt ? expectedVersionId : null,
+        p_publish_at: publishAt,
+        p_actor: auth.user.id
+      });
+      if (error2) {
+        if (/page version conflict/i.test(error2.message)) return errors.conflict(error2.message);
+        return errors.badRequest(error2.message);
+      }
       await logActivity(
         auth.user,
         publishAt ? "page.schedule" : "page.unschedule",
         `${current?.path ?? id}${publishAt ? ` @ ${publishAt}` : ""}`
       );
+      if (!hasContentChange) return json({ page: data2 });
     }
-    const hasContentChange = body.title !== void 0 || body.seo !== void 0 || layout !== null;
     if (!hasContentChange) {
       const { data: data2 } = await db().from("cms_pages").select("*").eq("id", id).maybeSingle();
       return json({ page: data2 });
@@ -934,12 +964,20 @@ function createCmsRoutes(options) {
   const publishPage = async (request, id) => {
     const auth = await guard(request, "pages.publish");
     if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    const expectedVersionId = Number(body?.expectedVersionId);
+    if (!Number.isSafeInteger(expectedVersionId) || expectedVersionId <= 0) {
+      return errors.conflict("Page version conflict: save the draft again before publishing.");
+    }
     const { data, error } = await db().rpc("cms_publish_page", {
       p_page_id: id,
+      p_expected_version_id: expectedVersionId,
       p_actor: auth.user.id
     });
-    if (error) return errors.badRequest(error.message);
-    await db().from("cms_pages").update({ publish_at: null }).eq("id", id);
+    if (error) {
+      if (/page version conflict/i.test(error.message)) return errors.conflict(error.message);
+      return errors.badRequest(error.message);
+    }
     await logActivity(auth.user, "page.publish", String(data?.path ?? id));
     await revalidateContent();
     return json({ page: data });
@@ -947,7 +985,12 @@ function createCmsRoutes(options) {
   const unpublishPage = async (request, id) => {
     const auth = await guard(request, "pages.publish");
     if (auth instanceof Response) return auth;
-    const { data, error } = await db().from("cms_pages").update({ status: "draft", publish_at: null, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).select("*").single();
+    const { data, error } = await db().from("cms_pages").update({
+      status: "draft",
+      publish_at: null,
+      scheduled_version_id: null,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }).eq("id", id).select("*").single();
     if (error) return errors.badRequest(error.message);
     await logActivity(auth.user, "page.unpublish", String(data?.path ?? id));
     await revalidateContent();
@@ -965,7 +1008,7 @@ function createCmsRoutes(options) {
       if (!existing) break;
       slug = `${baseSlug}-${attempt}`;
     }
-    const { data, error } = await db().from("cms_pages").insert({
+    const { data: created, error } = await db().from("cms_pages").insert({
       slug,
       path: `/${slug}`,
       title: `${source.title} (copy)`,
@@ -975,6 +1018,15 @@ function createCmsRoutes(options) {
       builder_owned: true
     }).select("*").single();
     if (error) return errors.badRequest(error.message);
+    if (!created) return errors.badRequest("Could not duplicate page.");
+    const { data, error: versionError } = await db().rpc("cms_save_page_draft", {
+      p_page_id: created.id,
+      p_title: created.title,
+      p_seo: created.seo ?? {},
+      p_layout: created.draft_layout ?? [],
+      p_actor: auth.user.id
+    });
+    if (versionError) return errors.badRequest(versionError.message);
     await logActivity(auth.user, "page.duplicate", `${source.path} \u2192 /${slug}`);
     return json({ page: data }, 201);
   };
@@ -999,6 +1051,7 @@ function createCmsRoutes(options) {
     return json({ token, path: data.path, url: `${data.path}?preview=${encodeURIComponent(token)}` });
   };
   const previewPage = async (request) => {
+    if (hostedMemoryMode) return errors.notFound();
     const secret = previewSecret();
     if (!secret) return errors.notFound();
     const token = new URL(request.url).searchParams.get("token") || "";
@@ -1186,7 +1239,7 @@ function createCmsRoutes(options) {
     return json({ usage: await findMediaUsage(id) });
   };
   const replaceMedia = async (request, id) => {
-    const auth = await guard(request, "media.upload");
+    const auth = await guard(request, "media.replace");
     if (auth instanceof Response) return auth;
     const { data: doc } = await db().from("cms_media").select("*").eq("id", id).maybeSingle();
     if (!doc) return errors.notFound();
@@ -1244,6 +1297,7 @@ function createCmsRoutes(options) {
     if (auth instanceof Response) return auth;
     const { data: forms, error } = await db().from("cms_forms").select("id, slug, title, config, success_message, updated_at").order("title");
     if (error) return errors.badRequest(error.message);
+    if (!can(auth.user, "submissions.read")) return json({ forms: forms || [] });
     const { data: submissions } = await db().from("cms_form_submissions").select("form_id, read_at").limit(1e4);
     const counts = /* @__PURE__ */ new Map();
     for (const submission of submissions || []) {
@@ -1346,7 +1400,7 @@ function createCmsRoutes(options) {
     return json({ submissions: rows.slice(0, limit), hasMore });
   };
   const updateSubmission = async (request, id) => {
-    const auth = await guard(request, "submissions.read");
+    const auth = await guard(request, "submissions.manage");
     if (auth instanceof Response) return auth;
     const body = await readJson(request);
     if (!body || typeof body.read !== "boolean") return errors.badRequest("read boolean required.");
@@ -1580,6 +1634,7 @@ function createCmsRoutes(options) {
     return published;
   };
   const cronPublishDue = async (request) => {
+    if (hostedMemoryMode) return errors.forbidden();
     const bearer = (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, "");
     let authorized = tokenEquals(bearer, syncToken || "") || tokenEquals(bearer, process.env.CRON_SECRET || "");
     if (!authorized) {
@@ -1596,19 +1651,29 @@ function createCmsRoutes(options) {
     if (auth instanceof Response) return auth;
     await publishDuePages().catch(() => void 0);
     const { data: pages } = await db().from("cms_pages").select(
-      "id, title, path, status, updated_at, published_at, publish_at, draft_layout, published_layout"
+      "id, title, path, status, updated_at, published_at, publish_at, published_title, published_seo, draft_layout, published_layout"
     );
     const allPages = pages || [];
     const pendingDrafts = allPages.filter((page) => hasDraftChanges(page));
-    const recentPages = [...allPages].sort((a, b) => String(b.updated_at).localeCompare(String(a.updated_at))).slice(0, 5).map(({ draft_layout, published_layout, ...summary }) => {
+    const recentPages = [...allPages].sort((a, b) => String(b.updated_at).localeCompare(String(a.updated_at))).slice(0, 5).map(({ draft_layout, published_layout, published_title, published_seo, ...summary }) => {
       void draft_layout;
       void published_layout;
+      void published_title;
+      void published_seo;
       return summary;
     });
     const lastPublishedAt = allPages.map((page) => page.published_at).filter(Boolean).sort().pop();
-    const { data: submissions } = await db().from("cms_form_submissions").select("id, form_id, data, read_at, created_at").order("created_at", { ascending: false }).limit(200);
-    const allSubmissions = submissions || [];
-    const unread = allSubmissions.filter((submission) => !submission.read_at);
+    let submissionsSummary;
+    if (can(auth.user, "submissions.read")) {
+      const { data: submissions } = await db().from("cms_form_submissions").select("id, form_id, data, read_at, created_at").order("created_at", { ascending: false }).limit(200);
+      const allSubmissions = submissions || [];
+      const unread = allSubmissions.filter((submission) => !submission.read_at);
+      submissionsSummary = {
+        total: allSubmissions.length,
+        unread: unread.length,
+        recent: allSubmissions.slice(0, 5)
+      };
+    }
     let activity = [];
     if (can(auth.user, "activity.read")) {
       const { data: events } = await db().from("cms_activity").select("id, actor_name, action, subject, created_at").order("created_at", { ascending: false }).limit(12);
@@ -1627,11 +1692,7 @@ function createCmsRoutes(options) {
         recent: recentPages,
         lastPublishedAt: lastPublishedAt ?? null
       },
-      submissions: {
-        total: allSubmissions.length,
-        unread: unread.length,
-        recent: allSubmissions.slice(0, 5)
-      },
+      ...submissionsSummary ? { submissions: submissionsSummary } : {},
       activity
     });
   };
@@ -1747,6 +1808,7 @@ function createCmsRoutes(options) {
     return json({ success: true });
   };
   const runSync = async (request) => {
+    if (hostedMemoryMode) return errors.forbidden();
     const bearer = (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, "");
     let authorized = tokenEquals(bearer, syncToken || "");
     if (!authorized) {
@@ -1859,6 +1921,7 @@ function createCmsRoutes(options) {
     }
     if (head === "sync" && method === "POST") return runSync(request);
     if (head === "me" && method === "GET") {
+      if (hostedMemoryMode) return errors.unauthorized();
       const user = await resolveUser(request, db());
       if (!user) return errors.unauthorized();
       return json({ user });
@@ -1995,6 +2058,12 @@ var MemoryQuery = class _MemoryQuery {
       }
       values.draft_layout = values.draft_layout ?? [];
       values.published_layout = values.published_layout ?? null;
+      values.published_title = values.published_title ?? null;
+      values.published_seo = values.published_seo ?? null;
+      values.draft_version_id = values.draft_version_id ?? null;
+      values.published_version_id = values.published_version_id ?? null;
+      values.scheduled_version_id = values.scheduled_version_id ?? null;
+      values.publish_at = values.publish_at ?? null;
       values.status = values.status ?? "draft";
       values.builder_owned = values.builder_owned ?? false;
       values.seo = values.seo ?? {};
@@ -2059,15 +2128,19 @@ var MemoryStore = class {
     return this.serial;
   }
 };
+var versionConflict = (message) => ({
+  data: null,
+  error: { message: `Page version conflict: ${message}` }
+});
 function runRpc(store, fn, args = {}) {
   const pages = store.table("cms_pages");
   const versions = store.table("cms_page_versions");
   const snapshot = (page, kind, layout) => {
     const latest = [...versions].filter((v) => v.page_id === page.id).pop();
     if ((kind === "draft" || kind === "sync") && latest && JSON.stringify(latest.title) === JSON.stringify(page.title ?? "") && JSON.stringify(latest.seo) === JSON.stringify(page.seo ?? {}) && JSON.stringify(latest.layout) === JSON.stringify(layout ?? [])) {
-      return;
+      return latest;
     }
-    versions.push({
+    const version = {
       id: store.nextSerial(),
       page_id: page.id,
       kind,
@@ -2076,7 +2149,17 @@ function runRpc(store, fn, args = {}) {
       layout: layout ?? [],
       created_by: args.p_actor ?? null,
       created_at: nowIso()
-    });
+    };
+    versions.push(version);
+    return version;
+  };
+  const reviewedVersion = (page, expectedVersionId) => {
+    const id = Number(expectedVersionId);
+    if (!Number.isSafeInteger(id) || id <= 0 || page.draft_version_id !== id) return null;
+    const version = versions.find((row) => row.id === id && row.page_id === page.id);
+    if (!version) return null;
+    if (version.title !== (page.title ?? "") || JSON.stringify(version.seo ?? {}) !== JSON.stringify(page.seo ?? {}) || JSON.stringify(version.layout ?? []) !== JSON.stringify(page.draft_layout ?? [])) return null;
+    return version;
   };
   switch (fn) {
     case "cms_save_page_draft": {
@@ -2087,17 +2170,43 @@ function runRpc(store, fn, args = {}) {
       if (args.p_layout != null) page.draft_layout = args.p_layout;
       page.builder_owned = Boolean(page.builder_owned) || args.p_mark_builder_owned !== false;
       page.updated_at = nowIso();
-      snapshot(page, "draft", page.draft_layout);
+      const version = snapshot(page, "draft", page.draft_layout);
+      page.draft_version_id = version.id;
       return { data: page, error: null };
     }
     case "cms_publish_page": {
       const page = pages.find((row) => row.id === args.p_page_id);
       if (!page) return { data: null, error: { message: `page ${args.p_page_id} not found` } };
-      page.published_layout = page.draft_layout;
+      const version = reviewedVersion(page, args.p_expected_version_id);
+      if (!version) return versionConflict("the expected draft is missing or stale");
+      if (page.status === "published" && page.published_version_id === version.id) {
+        return versionConflict("the expected draft is already published");
+      }
+      page.published_title = version.title;
+      page.published_seo = version.seo;
+      page.published_layout = version.layout;
+      page.published_version_id = version.id;
       page.status = "published";
       page.published_at = nowIso();
+      page.publish_at = null;
+      page.scheduled_version_id = null;
+      page.updated_at = nowIso();
+      return { data: page, error: null };
+    }
+    case "cms_schedule_page_publish": {
+      const page = pages.find((row) => row.id === args.p_page_id);
+      if (!page) return { data: null, error: { message: `page ${args.p_page_id} not found` } };
+      if (args.p_publish_at == null) {
+        page.publish_at = null;
+        page.scheduled_version_id = null;
+        page.updated_at = nowIso();
+        return { data: page, error: null };
+      }
+      const version = reviewedVersion(page, args.p_expected_version_id);
+      if (!version) return versionConflict("the expected draft is missing or stale");
+      page.publish_at = args.p_publish_at;
+      page.scheduled_version_id = version.id;
       page.updated_at = nowIso();
-      snapshot(page, "publish", page.published_layout);
       return { data: page, error: null };
     }
     case "cms_update_global": {
@@ -2146,12 +2255,19 @@ function runRpc(store, fn, args = {}) {
       for (const page of pages) {
         const at = typeof page.publish_at === "string" ? Date.parse(page.publish_at) : NaN;
         if (Number.isNaN(at) || at > nowMs) continue;
-        page.published_layout = page.draft_layout;
+        const version = versions.find(
+          (row) => row.id === page.scheduled_version_id && row.page_id === page.id
+        );
+        if (!version) continue;
+        page.published_title = version.title;
+        page.published_seo = version.seo;
+        page.published_layout = version.layout;
+        page.published_version_id = version.id;
         page.status = "published";
         page.published_at = nowIso();
         page.publish_at = null;
+        page.scheduled_version_id = null;
         page.updated_at = nowIso();
-        snapshot(page, "publish", page.published_layout);
         published.push(String(page.path));
       }
       return { data: published, error: null };
@@ -2166,7 +2282,8 @@ function runRpc(store, fn, args = {}) {
       page.seo = version.seo;
       page.builder_owned = true;
       page.updated_at = nowIso();
-      snapshot(page, "restore", version.layout);
+      const restored = snapshot(page, "restore", version.layout);
+      page.draft_version_id = restored.id;
       return { data: page, error: null };
     }
     case "cms_sync_page": {
@@ -2179,12 +2296,18 @@ function runRpc(store, fn, args = {}) {
           title: args.p_title,
           seo: args.p_seo ?? {},
           draft_layout: args.p_layout ?? [],
+          published_title: args.p_title,
+          published_seo: args.p_seo ?? {},
           published_layout: args.p_layout ?? [],
           status: "published",
           builder_owned: false,
           created_at: nowIso(),
           updated_at: nowIso(),
-          published_at: nowIso()
+          published_at: nowIso(),
+          draft_version_id: null,
+          published_version_id: null,
+          scheduled_version_id: null,
+          publish_at: null
         };
         pages.push(page);
       } else if (!page.builder_owned) {
@@ -2192,10 +2315,16 @@ function runRpc(store, fn, args = {}) {
         page.title = args.p_title;
         page.seo = args.p_seo ?? {};
         page.draft_layout = args.p_layout ?? [];
+        page.published_title = args.p_title;
+        page.published_seo = args.p_seo ?? {};
         page.published_layout = args.p_layout ?? [];
         page.updated_at = nowIso();
       }
-      snapshot(page, "sync", page.draft_layout);
+      const version = snapshot(page, "sync", page.draft_layout);
+      if (!page.builder_owned) {
+        page.draft_version_id = version.id;
+        page.published_version_id = version.id;
+      }
       return { data: page, error: null };
     }
     default:
@@ -2214,7 +2343,7 @@ function createMemoryCms() {
     from: (table) => new MemoryQuery(store, table),
     rpc: async (fn, args) => runRpc(store, fn, args),
     auth: {
-      getUser: async (token) => token === MEMORY_DEV_TOKEN ? { data: { user: { id: DEV_USER_ID, email: "dev@local" } }, error: null } : { data: { user: null }, error: { message: "invalid token" } },
+      getUser: async (token) => process.env.NODE_ENV !== "production" && token === MEMORY_DEV_TOKEN ? { data: { user: { id: DEV_USER_ID, email: "dev@local" } }, error: null } : { data: { user: null }, error: { message: "invalid token" } },
       admin: {
         listUsers: async () => ({ data: { users: [...store.table("auth_users")] }, error: null }),
         createUser: async (attributes) => {

package/dist/studio/index.d.ts

@@ -1,4 +1,4 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as react from 'react';
 import { ComponentType, InputHTMLAttributes } from 'react';
 import { z } from 'zod';
 import { SupabaseClient, Session } from '@supabase/supabase-js';
@@ -138,7 +138,7 @@ type StudioConfig = {
     /** Supabase project URL used for media transform URLs. Defaults to env. */
     supabaseUrl?: string;
 };
-declare function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }: StudioConfig): react_jsx_runtime.JSX.Element;
+declare function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }: StudioConfig): react.JSX.Element;
 
 declare function getBrowserSupabase(): SupabaseClient;
 declare function useStudioSession(): {
@@ -149,7 +149,7 @@ declare function useStudioSession(): {
 };
 
 type PasswordInputProps = Omit<InputHTMLAttributes<HTMLInputElement>, 'type'>;
-declare function PasswordInput({ className, ...props }: PasswordInputProps): react_jsx_runtime.JSX.Element;
+declare function PasswordInput({ className, ...props }: PasswordInputProps): react.JSX.Element;
 
 type AnalyticsKpis = {
     visitors: number;
@@ -228,11 +228,16 @@ type StudioPageSummary = {
     updated_at: string;
     published_at: string | null;
     publish_at: string | null;
+    draft_version_id: number | null;
+    published_version_id: number | null;
+    scheduled_version_id: number | null;
     /** Computed by GET /pages: draft layout differs from the live one. */
     has_draft_changes?: boolean;
 };
 type StudioPage = StudioPageSummary & {
     seo: Record<string, unknown>;
+    published_title: string | null;
+    published_seo: Record<string, unknown> | null;
     draft_layout: PageLayout;
     published_layout: PageLayout | null;
 };
@@ -314,7 +319,7 @@ type StudioDashboard = {
         recent: StudioPageSummary[];
         lastPublishedAt: string | null;
     };
-    submissions: {
+    submissions?: {
         total: number;
         unread: number;
         recent: StudioSubmission[];
@@ -370,10 +375,14 @@ declare function createStudioApi(options: {
         slug?: string;
         path?: string;
         publishAt?: string | null;
+        expectedVersionId?: number;
     }) => Promise<{
         page: StudioPage;
     }>;
-    publish: (id: string) => Promise<{
+    publish: (id: string, expectedVersionId: number) => Promise<{
+        page: StudioPage;
+    }>;
+    schedulePublish: (id: string, publishAt: string | null, expectedVersionId?: number) => Promise<{
         page: StudioPage;
     }>;
     unpublish: (id: string) => Promise<{