create-smoodly-app 0.0.29 → 0.0.31

package/README.md

@@ -15,8 +15,8 @@ sign in. Spec: `docs/superpowers/specs/2026-09-04-create-smoodly-app-design.md`.
    `proxy.ts`, translated URLs per locale. Flag: `--locales en,fi`.
 3. Where content lives: a **local Supabase stack** (`supabase init` +
    `supabase start` inside the app, with the services Smoodly never uses
-   excluded — the image proxy, edge functions, analytics, realtime, the
-   pooler — so the stack stays small beside any other you run; needs
+   excluded — the image proxy, edge functions, analytics, the pooler —
+   so the stack stays small beside any other you run; needs
    the Supabase CLI and Docker; when
    another project holds the default `543xx` ports the new one moves to the
    next free block, `553xx` and so on, and says so) or a
@@ -82,6 +82,37 @@ Posts and the Site item, a post with a Button element published and
 served at `/posts/<slug>` in both locales; blank single-language
 scaffolded in hosted mode against the repo stack and `next build` only.
 
+## Follow-ups (logged 2026-09-28, fresh-install proof of 0.0.30)
+
+Walked 2026-09-28: `npx create-smoodly-app@0.0.30 proof-0030 --supabase
+local --yes --editor-email …` from the published package, in a scratch
+directory beside three running stacks (the new one took the `563xx`
+block). `smoodly` 0.0.30 installed, `tsc` and `next build` clean, `/`,
+`/posts`, `/posts/<slug>`, `/company/about-us` and `/admin` 200, the
+admin document's `<html lang="en">` present, the editor signed in, an
+SEO title edit saved and published and served on `/`. Found:
+
+- **Local mode left Realtime out (0.0.26–0.0.30).** `LOCAL_START_ARGS`
+  excluded `realtime` from before the concurrency spec, whose presence
+  channel and `saved` events ride it; the admin retried the WebSocket
+  forever (a console error per attempt) and a local install had no
+  presence or stale-page notice. CI's repo stack already kept Realtime.
+  Fixed 2026-09-28: the list no longer excludes it; restarted with the new
+  flags, a script signed in as the editor joined `space:<id>` and saw both
+  open admin tabs tracked on Home. The live job does not catch this
+  (it requests `/admin` once, no browser); an existing local install
+  restarts with `supabase stop && supabase start -x imgproxy,edge-runtime,logflare,vector,supavisor`.
+- **The Lorem home's custom-section CTA linked `/articles`**, a 404 —
+  the articles collection lives at `/posts`. `examples/site/scripts/seed.ts`
+  hardcoded the href; fixed 2026-09-28 to `paths(locale).articles` like
+  every other starter link (Finnish gets its own segment too).
+- **`--editor-email` without `SMOODLY_EDITOR_PASSWORD` fails late.** The
+  check lives in `askEditorWith`, which runs after the copy, install,
+  `git init` and `supabase start`, so the run stops at `ensureEditor`
+  with a half-made app. It has to be late for hosted mode (the email may
+  name an existing Auth user, no password needed), but a local stack is
+  always fresh, so local mode could refuse up front. Not fixed.
+
 ## Follow-ups (logged 2026-09-25, docs walk)
 
 - **Single-language `/admin` had no root `<html>` (0.0.15–0.0.20).** The

package/dist/index.js

@@ -413,7 +413,7 @@ function parseStatusEnv(output) {
 }
 
 // src/run.ts
-var LOCAL_START_ARGS = ["start", "-x", "imgproxy,edge-runtime,logflare,vector,realtime,supavisor"];
+var LOCAL_START_ARGS = ["start", "-x", "imgproxy,edge-runtime,logflare,vector,supavisor"];
 async function run(answers2, deps) {
   if (answers2.supabase === "hosted" && !answers2.hosted) {
     throw new Error("hosted answers need the project's keys");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-smoodly-app",
-  "version": "0.0.29",
+  "version": "0.0.31",
   "description": "Create a Smoodly site: a fresh Next.js app with the admin mounted, a Supabase schema, an env file and a first editor.",
   "license": "MIT",
   "repository": {

package/templates/blank/AGENTS.md

@@ -22,8 +22,12 @@ where things are.
   written through the page and entry stores, never raw SQL. It is
   idempotent; run it with `npm run seed`.
 - **Never import the admin into the site.** Nothing under `app/(site)`,
-  `app/[locale]` or `components/` may import `@/smoodly/admin` or
-  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+  `app/[locale]` or `components/`, and nothing they import
+  (`smoodly/server.ts` included), may import `@/smoodly/admin` or
+  `smoodly/admin/next`: Next ships every client module a route imports,
+  rendered or not, and the admin's chunk must not reach visitors. The
+  package's `smoodly/admin` entry has no client code; server-side
+  admin glue such as `supabaseAdminAuth` comes from there.
 - **Two root layouts.** The site's layout lives in its route group or
   locale segment and is never the admin's parent; `app/(smoodly)/admin`
   is a second root layout. Do not add an `app/layout.tsx`.

package/templates/blank/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.29"
+    "smoodly": "0.0.31"
   },
   "devDependencies": {
     "@next/env": "^16.3.4",

package/templates/blank/smoodly/server.ts

@@ -11,7 +11,10 @@
 import {
   createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
-import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
+// The admin gate from `smoodly/admin`, which holds no client code: the site
+// routes import this file, and `smoodly/admin/next` would put the admin
+// shell in every live page's JavaScript.
+import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { collections, config, elements, sections, globals } from "./config";

package/templates/blank-intl/AGENTS.md

@@ -22,8 +22,12 @@ where things are.
   written through the page and entry stores, never raw SQL. It is
   idempotent; run it with `npm run seed`.
 - **Never import the admin into the site.** Nothing under `app/(site)`,
-  `app/[locale]` or `components/` may import `@/smoodly/admin` or
-  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+  `app/[locale]` or `components/`, and nothing they import
+  (`smoodly/server.ts` included), may import `@/smoodly/admin` or
+  `smoodly/admin/next`: Next ships every client module a route imports,
+  rendered or not, and the admin's chunk must not reach visitors. The
+  package's `smoodly/admin` entry has no client code; server-side
+  admin glue such as `supabaseAdminAuth` comes from there.
 - **Two root layouts.** The site's layout lives in its route group or
   locale segment and is never the admin's parent; `app/(smoodly)/admin`
   is a second root layout. Do not add an `app/layout.tsx`.

package/templates/blank-intl/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.29",
+    "smoodly": "0.0.31",
     "next-intl": "^4.14.2"
   },
   "devDependencies": {

package/templates/blank-intl/smoodly/server.ts

@@ -11,7 +11,10 @@
 import {
   createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
-import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
+// The admin gate from `smoodly/admin`, which holds no client code: the site
+// routes import this file, and `smoodly/admin/next` would put the admin
+// shell in every live page's JavaScript.
+import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { getPathname } from "@/i18n/navigation";

package/templates/lorem/AGENTS.md

@@ -22,8 +22,12 @@ where things are.
   written through the page and entry stores, never raw SQL. It is
   idempotent; run it with `npm run seed`.
 - **Never import the admin into the site.** Nothing under `app/(site)`,
-  `app/[locale]` or `components/` may import `@/smoodly/admin` or
-  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+  `app/[locale]` or `components/`, and nothing they import
+  (`smoodly/server.ts` included), may import `@/smoodly/admin` or
+  `smoodly/admin/next`: Next ships every client module a route imports,
+  rendered or not, and the admin's chunk must not reach visitors. The
+  package's `smoodly/admin` entry has no client code; server-side
+  admin glue such as `supabaseAdminAuth` comes from there.
 - **Two root layouts.** The site's layout lives in its route group or
   locale segment and is never the admin's parent; `app/(smoodly)/admin`
   is a second root layout. Do not add an `app/layout.tsx`.

package/templates/lorem/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.29"
+    "smoodly": "0.0.31"
   },
   "devDependencies": {
     "@next/env": "^16.3.4",

package/templates/lorem/scripts/seed.ts

@@ -255,7 +255,7 @@ const favourites = (heading: string): Node => ({
 
 // The custom section (spec 2026-09-14 §6): the editor's own rows of
 // richtext columns, widths in twelfths; Smoodly renders its layout CSS.
-const customSection = (): Node => ({
+const customSection = (locale: string): Node => ({
   id: "node-custom",
   type: "custom",
   fields: { rows: [
@@ -263,7 +263,7 @@ const customSection = (): Node => ({
       doc(h2("Sed ut perspiciatis"), p("Unde omnis iste natus error sit voluptatem accusantium doloremque laudantium.")),
       doc(p("Totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo."), callout("Nemo enim", "Ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit.", "info")),
     ] },
-    { spans: [12], gap: "md", align: "top", reverse: false, columns: [doc(cta("Neque porro quisquam", "Qui dolorem ipsum quia dolor sit amet.", "Read the articles", "/articles"))] },
+    { spans: [12], gap: "md", align: "top", reverse: false, columns: [doc(cta("Neque porro quisquam", "Qui dolorem ipsum quia dolor sit amet.", "Read the articles", paths(locale).articles))] },
   ] },
   styles: { spacingBottom: "lg" },
 });
@@ -288,7 +288,7 @@ const homeTree = (locale: string, t: { kicker: string; buttons: [string, string]
         image: img.hero,
       },
     }],
-    body: [imageText(locale, t.link), quote, points, customSection(), favourites(t.favourites)],
+    body: [imageText(locale, t.link), quote, points, customSection(locale), favourites(t.favourites)],
   },
 });
 

package/templates/lorem/smoodly/server.ts

@@ -11,7 +11,10 @@
 import {
   createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
-import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
+// The admin gate from `smoodly/admin`, which holds no client code: the site
+// routes import this file, and `smoodly/admin/next` would put the admin
+// shell in every live page's JavaScript.
+import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { collections, config, elements, sections, globals } from "./config";

package/templates/lorem-intl/AGENTS.md

@@ -22,8 +22,12 @@ where things are.
   written through the page and entry stores, never raw SQL. It is
   idempotent; run it with `npm run seed`.
 - **Never import the admin into the site.** Nothing under `app/(site)`,
-  `app/[locale]` or `components/` may import `@/smoodly/admin` or
-  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+  `app/[locale]` or `components/`, and nothing they import
+  (`smoodly/server.ts` included), may import `@/smoodly/admin` or
+  `smoodly/admin/next`: Next ships every client module a route imports,
+  rendered or not, and the admin's chunk must not reach visitors. The
+  package's `smoodly/admin` entry has no client code; server-side
+  admin glue such as `supabaseAdminAuth` comes from there.
 - **Two root layouts.** The site's layout lives in its route group or
   locale segment and is never the admin's parent; `app/(smoodly)/admin`
   is a second root layout. Do not add an `app/layout.tsx`.

package/templates/lorem-intl/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.29",
+    "smoodly": "0.0.31",
     "next-intl": "^4.14.2"
   },
   "devDependencies": {

package/templates/lorem-intl/scripts/seed.ts

@@ -255,7 +255,7 @@ const favourites = (heading: string): Node => ({
 
 // The custom section (spec 2026-09-14 §6): the editor's own rows of
 // richtext columns, widths in twelfths; Smoodly renders its layout CSS.
-const customSection = (): Node => ({
+const customSection = (locale: string): Node => ({
   id: "node-custom",
   type: "custom",
   fields: { rows: [
@@ -263,7 +263,7 @@ const customSection = (): Node => ({
       doc(h2("Sed ut perspiciatis"), p("Unde omnis iste natus error sit voluptatem accusantium doloremque laudantium.")),
       doc(p("Totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo."), callout("Nemo enim", "Ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit.", "info")),
     ] },
-    { spans: [12], gap: "md", align: "top", reverse: false, columns: [doc(cta("Neque porro quisquam", "Qui dolorem ipsum quia dolor sit amet.", "Read the articles", "/articles"))] },
+    { spans: [12], gap: "md", align: "top", reverse: false, columns: [doc(cta("Neque porro quisquam", "Qui dolorem ipsum quia dolor sit amet.", "Read the articles", paths(locale).articles))] },
   ] },
   styles: { spacingBottom: "lg" },
 });
@@ -288,7 +288,7 @@ const homeTree = (locale: string, t: { kicker: string; buttons: [string, string]
         image: img.hero,
       },
     }],
-    body: [imageText(locale, t.link), quote, points, customSection(), favourites(t.favourites)],
+    body: [imageText(locale, t.link), quote, points, customSection(locale), favourites(t.favourites)],
   },
 });
 

package/templates/lorem-intl/smoodly/server.ts

@@ -11,7 +11,10 @@
 import {
   createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
-import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
+// The admin gate from `smoodly/admin`, which holds no client code: the site
+// routes import this file, and `smoodly/admin/next` would put the admin
+// shell in every live page's JavaScript.
+import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { getPathname } from "@/i18n/navigation";