includio-cms 0.25.0 → 0.26.0

package/API.md

@@ -1,8 +1,8 @@
-# includio-cms — Public API v0.25.0
+# includio-cms — Public API v0.26.0
 
 > Auto-generated by `scripts/generate-api-md.ts`. Do not edit by hand.
 
-Entry points: **15** · Stable: **369** · Experimental: **2**
+Entry points: **18** · Stable: **413** · Experimental: **2**
 
 Tags:
 - `@public` — frozen for v1.0; semver-protected.
@@ -17,7 +17,9 @@ Tags:
 - `getAuth(): <inferred>` — Returns the underlying `better-auth` instance from the initialized CMS.
 - `getCMS(): CMS` — Returns the singleton CMS instance. Must be called after `includioCMS()`
 - `interface ResolvedMedia` — Resolved media file plus its image styles + blur placeholder. Returned by
+- `type ResolvedSeo = { [K in keyof SeoFieldData]: K extends 'ogImage' ? string | MediaFile | undefined : string | unde...` — Normalized SEO data — localized values flattened by `language`. A stable
 - `resolveMediaWithStyles(mediaIds: string[], styles?: ImageFieldStyle[]): Promise<Record<string, ResolvedMedia>>` — Resolve media files by IDs and generate image styles. Useful for plugins or
+- `resolveSeo(entry: { seo?: Record<string, unknown> } | Record<string,..., language?: string): ResolvedSeo` — Resolve `entry.seo` into flat fields, flattening localized objects by
 
 ### `includio-cms/core`
 
@@ -25,7 +27,9 @@ Tags:
 - `getAuth(): <inferred>` — Returns the underlying `better-auth` instance from the initialized CMS.
 - `getCMS(): CMS` — Returns the singleton CMS instance. Must be called after `includioCMS()`
 - `interface ResolvedMedia` — Resolved media file plus its image styles + blur placeholder. Returned by
+- `type ResolvedSeo = { [K in keyof SeoFieldData]: K extends 'ogImage' ? string | MediaFile | undefined : string | unde...` — Normalized SEO data — localized values flattened by `language`. A stable
 - `resolveMediaWithStyles(mediaIds: string[], styles?: ImageFieldStyle[]): Promise<Record<string, ResolvedMedia>>` — Resolve media files by IDs and generate image styles. Useful for plugins or
+- `resolveSeo(entry: { seo?: Record<string, unknown> } | Record<string,..., language?: string): ResolvedSeo` — Resolve `entry.seo` into flat fields, flattening localized objects by
 
 ### `includio-cms/types`
 
@@ -77,8 +81,8 @@ Tags:
 - `interface ImageStyle`
 - `type Language = 'en' | 'pl'`
 - `type Layout = LayoutPreset | LayoutNode[]`
-- `type LayoutNode = SectionNode | ColumnsNode | CardNode | AccordionNode | StackNode`
-- `type LayoutNodeType = 'section' | 'columns' | 'card' | 'accordion' | 'stack'`
+- `type LayoutNode = | SectionNode | ColumnsNode | CardNode | AccordionNode | StackNode | TabsNode | TabNode`
+- `type LayoutNodeType = | 'section' | 'columns' | 'card' | 'accordion' | 'stack' | 'tabs' | 'tab'`
 - `type LayoutPreset = | 'sidebar-right' | 'two-column' | { preset: 'sidebar-right'; sidebar: string[] } | { preset: 'tw...`
 - `type Localized = Partial<Record<InterfaceLanguage, string>> | string`
 - `interface MediaField`
@@ -109,6 +113,8 @@ Tags:
 - `interface SlugField`
 - `interface StackNode`
 - `interface StructuredContentDoc`
+- `interface TabNode` — A single tab. Only valid as a direct child of {@link TabsNode}.
+- `interface TabsNode` — Tab strip. Renders an accessible tablist; each child `tab` becomes a panel.
 - `interface TextField`
 - `interface TypographyConfig`
 - `interface UrlField`
@@ -233,6 +239,8 @@ Tags:
 - `const reorderEntriesCommand: <inferred>`
 - `const reorderShippingMethodsCmd: <inferred>`
 - `const resendOrderEmailCmd: <inferred>`
+- `const searchEntries: <inferred>`
+- `const searchLinkableEntries: <inferred>`
 - `const setFocalPoint: <inferred>`
 - `const setMediaFileAlt: <inferred>`
 - `const setMediaFileTags: <inferred>`
@@ -336,6 +344,51 @@ Tags:
 - `const verification: <inferred>`
 - `const videoStylesTable: <inferred>`
 
+### `includio-cms/db-postgres/schema-core`
+
+- `const consentLogsTable: <inferred>`
+- `const entriesTable: <inferred>`
+- `const entryVersionsTable: <inferred>`
+- `const formSubmissionsTable: <inferred>`
+- `const imageStylesTable: <inferred>`
+- `const mediaFilesTable: <inferred>`
+- `const mediaFileTagsTable: <inferred>`
+- `const mediaTagsTable: <inferred>`
+- `const videoStylesTable: <inferred>`
+
+### `includio-cms/db-postgres/schema-shop`
+
+- `type InpostParcelSize = 'A' | 'B' | 'C'`
+- `type InpostServiceType = | 'inpost_locker_standard' | 'inpost_locker_express' | 'inpost_courier_standard' | 'inpost_courie...`
+- `interface ShippingCarrierConfig`
+- `type ShopCarrierType = 'none' | 'inpost' | string`
+- `const shopCouponRedemptionsTable: <inferred>`
+- `const shopCouponsTable: <inferred>`
+- `type ShopCouponType = 'percent' | 'fixed'`
+- `const shopOrderItemsTable: <inferred>`
+- `const shopOrdersTable: <inferred>`
+- `const shopOrderStatusHistoryTable: <inferred>`
+- `const shopPaymentsTable: <inferred>`
+- `type ShopPaymentStatus = 'pending' | 'paid' | 'failed' | 'refunded' | 'cancelled'`
+- `const shopProductsTable: <inferred>`
+- `const shopProductVariantsTable: <inferred>`
+- `const shopRefundsTable: <inferred>`
+- `type ShopRefundStatus = 'pending' | 'succeeded' | 'failed'`
+- `const shopShippingMethodsTable: <inferred>`
+- `const shopStockReservationsTable: <inferred>`
+- `const shopWebhookEventsTable: <inferred>`
+
+### `includio-cms/auth-schema`
+
+- `const account: <inferred>`
+- `const accountRelations: <inferred>`
+- `const invitation: <inferred>`
+- `const session: <inferred>`
+- `const sessionRelations: <inferred>`
+- `const user: <inferred>`
+- `const userRelations: <inferred>`
+- `const verification: <inferred>`
+
 ### `includio-cms/shop`
 
 - `interface CarrierAdapter`

package/CHANGELOG.md

@@ -3,6 +3,59 @@
 All notable changes to includio-cms are documented here.
 Generated from `src/lib/updates/` — do not edit manually.
 
+## 0.26.0 — 2026-05-26
+
+UI Normalization → release readiness: slug regex camelCase + S8 detail/edit + S9 fields a11y polish + S10 a11y final audit + S10b/S10c mobile responsiveness full pass (sticky first column DataTable, Dialog fullscreenMobile prop, media library Sheet drawers, entry hybrid preview drawer toggle, dashboard mobile layout flip). 43/43 mobile Playwright pass (3 viewports × 12 widoków, 0 critical axe).
+
+### Added
+- `getFieldA11yProps({ id, hasDescription, hasError, required })` (`src/lib/admin/utils/field-a11y.ts`) — buduje `aria-describedby` chain, `aria-invalid`, `aria-required` dla pól w `ui/form` (formsnap) — bridge bez breaking migracji ui/form ↔ ui/field koegzystencji z S3.
+- `<LiveRegion>` (`src/lib/components/ui/live-region/`) — prosty primitive (`sr-only` + `role="status"` + `aria-live`) zastąpił inline duplicates w relation-field i blocks-field; gotowy do reuse.
+- `field-renderer.svelte` propaguje `Form.Control` `props` (formsnap snippet `children({ props })`) do wszystkich field components (boolean, number, date, datetime, select, media, file, blocks, array, object, slug, seo, shop, url, relation). Dotąd tylko text/radio/checkboxes dostawały aria — reszta była niewired.
+- Blocks field — keyboard reorder/add/remove/duplicate ogłasza przez `<LiveRegion>` ("Przeniesiono X na pozycję Y", "Dodano blok X" itp.). Block picker modal — `aria-labelledby` z Dialog.Title + `aria-live` na search results count.
+- Slug field — live preview slugify'd wartości pod inputem (gdy user typuje wielką literą), copy button z `UseClipboard` + toast "Skopiowano slug". Description default w demo blog-post.
+- Relation field — combobox a11y wzmocnione: `aria-busy` na Command.List podczas async search, picker dialog `Dialog.Title`/`Dialog.Description` (sr-only), reorder LiveRegion przeniesione na primitive.
+- Media + File fields — `Dialog.Title` + `Dialog.Description` (sr-only) na picker dialogs (eliminuje bits-ui ostrzeżenie o brakujących aria-labelledby).
+- Shop field — `aria-pressed` na price mode toggle (Netto/Brutto), `role="group"` + `aria-label` na toggle group, `aria-label="Usuń wariant N"` na trash buttons.
+- SEO field — `aria-live="polite"` na char counter (50/60, 120/160) — SR słyszy zmianę gdy user wpisuje.
+- Storybook fields — nowe `file.stories.svelte` (4 warianty) i `shop.stories.svelte` (4 warianty). Slug stories rozszerzone o WithPreview/ClipboardCopy. Text stories — Required wariant. Slug ma już `tags: ['autodocs']` (zdjęty `no-test`).
+- Slugi pól, kolekcji, singles i form akceptują camelCase (`/^[a-z][a-zA-Z0-9-]*$/`). Można pisać `slug: 'siteName'` zamiast `'site-name'` i odczytywać `entry.data.siteName` bez bracket notation. Walidacja blokuje nadal PascalCase, prefix `_` i digit-leading.
+- Helper `quoteKey()` w `src/lib/core/server/generator/utils.ts` — opakowuje slugi nie-spełniające JS identifier shape w cudzysłowy w wygenerowanym TS.
+- Nowy węzeł layoutu `tabs`/`tab` (`src/lib/types/layout.ts`) — taby konfigurowane per kolekcja w `layout[]`, renderowane przez `LayoutRenderer` (bits-ui Tabs: `role=tab/tablist/tabpanel`, strzałki/Home/End, `aria-selected`). Wszystkie panele pozostają zamontowane (walidacja/dirty-tracking/`showWhen` działają na nieaktywnych tabach), error-summary i klik-w-preview (hybrid) automatycznie przełączają tab i fokusują pole (`activateContainingTabs`), trigger taba z błędem ma wskaźnik (kropka + tekst dla SR, nie sam kolor). Aktywny tab najwyższego poziomu utrwalany w `?tab` (deep-link, przeżywa reload). `tab` przyjmuje `fields` (płaski) lub `children` (sekcje/karty w środku); zakaz zagnieżdżonych tabów + walidacja struktury w `validateLayout`. Stary sztywny tab Content/SEO w `entry.svelte` usunięty — SEO to teraz zwykły `tab` w configu (demo blog-post).
+- `<FormErrorSummary>` (`src/lib/admin/components/forms/`) — banner z listą błędów, anchor links scroll do `[data-field-path]`, focus pierwszego błędnego pola, `role="alert"` + `aria-live="assertive"`. Adoptowany w entry, coupon-form, shipping-method-form, shop-order-detail.
+- `<ConfirmationDialog>` (`src/lib/admin/components/dialogs/`) — typed wrapper na bits-ui AlertDialog z destructive/default variant, default focus na Cancel (bezpieczniejszy), loading state. Zastąpił 5× `confirm()` (form-submissions, entry, shop-order-detail, coupons-list, dashboard) + dodany dla Archive entry.
+- `<DetailPageShell>` (`src/lib/admin/components/layout/`) — wspólny layout (PageHeader + body + opcjonalny sidebar) dla coupon-edit / shipping-method-edit. Skip-link target `#detail-main`.
+- Coupon edit form zmigrowany na sveltekit-superforms + formsnap (jak account/profile-section) — schema zod (`coupon-schema.ts`), SPA mode, error summary + per-field errors.
+- Entry SaveIndicator: nowe stany + COGA copy (`Niezapisane zmiany`, `Zapisuję…`, `Zapisano X temu` z `formatRelativeDate` recompute co 30s, `Błąd zapisu`), `aria-atomic` + role flip alert/status. `<svelte:window>` `beforeunload` guard gdy unsaved.
+- `<A11yHeaderBadge>` (`src/lib/admin/client/entry/header/a11y-header-badge.svelte`) — persistent warning chip w entry-header pokazujący liczbę a11y issues (images bez alt, heading hierarchy, generic link text). Reuse `validateA11y` z `a11y-validator.ts`. Strong-warning UX (B.1) — nie blokuje save, prowadzi autora. Kolumna a11y w collection-entries.svelte (S5) + persistent header badge (S10) + publish-panel sheet detail = pełna ścieżka widoczności.
+- `scripts/lighthouse-audit.ts` (`pnpm audit:lighthouse`) — ad-hoc CLI runner po 11 URL admin (login, dashboard, collections, users, media, forms, account, maintenance, shop ×3). Lighthouse 13 + chrome-launcher + auth cookie z `e2e/.auth/admin.json`. Output `.tmp/lighthouse/<view>.json` + `summary.md`, target a11y ≥95.
+- `e2e/admin/a11y-baseline.spec.ts` rozszerzone 4 → 14 widoków: 10 page-level (login, dashboard, collections-list, entry-edit, users-list, media-library, forms-detail, account, maintenance, user-create-dialog) + 4 shop best-effort (skip jeśli moduł nie configured). Per spec 0 critical violations enforced.
+- TipTap link-dialog `aria-expanded` na 2 collapsible sections (Dostępność + Indeksowanie) — uzupełnia ATAG B.3 author tool a11y. FigureNodeView/image-dialog/publish-panel: `:focus-visible` fallback z `var(--ring)` outline (focus indicator widoczny zawsze, nawet gdy `:focus` zmienia tylko border-color).
+- Publiczny `resolveSeo(entry, language?)` (`includio-cms/core`) — stabilny znormalizowany read-path nad zamrożonym kontraktem `entry.seo.*` (wartości localized spłaszczane po języku; `ogImage` przepuszczany jako string lub MediaFile) do budowy własnego `<head>` lub zasilenia komponentu `<Seo>`. `SlugField`/`SeoField`/`SeoFieldData` oznaczone `@public` + v1.0-frozen.
+- Wewnętrzny `seoFieldDescriptor` — pojedyncze źródło prawdy kształtu pola SEO dla generatorów Zod + TS (wyjście bit-identyczne, pilnowane snapshotami i testami drift-guard). Przygotowuje przyszły plugin-rehoming SEO bez breaking change. Istniejąca niespójność Zod(required)/TS(optional) dla `description`/`ogImage` udokumentowana i zachowana 1:1 (do rozstrzygnięcia post-1.0).
+- Mobile responsiveness full pass (S10c) — pełny mobile UX panelu admina: `DataTable` sticky first column + edge-bleed scroll wrapper (1 fix → wszystkie 8+ list pages, w tym shop), `Dialog.Content` `fullscreenMobile` prop (media/file picker + tiptap image/video dialogi), media library tags sidebar + FileDetails jako Sheet drawer na <md (`hidden md:flex` aside), entry hybrid preview Sheet drawer toggle z `IsMobile(1024)` (<lg pokazuje tylko form + floating "Podgląd" button), shop-order detail items table z `min-w-[640px]` + horizontal scroll, char counter w `text-field-wrapper` na mobile stackowany pod polem zamiast `absolute right`, EntryHeader padding + SaveIndicator text `max-sm:sr-only`, PageHeader text-scale `text-2xl sm:text-3xl lg:text-4xl`, breadcrumb truncacja middle segments `/…/` na <sm, table-toolbar search `w-full min-w-0` na mobile, tiptap toolbar separatory `hidden sm:block`, relation popover `w-[var(--bits-popover-anchor-width)] max-w-[calc(100vw-1rem)]`. Playwright `e2e/admin/mobile-responsive.spec.ts` rozszerzony o iPad portrait (768×1024) + shop-shipping view + `scrollWidth <= window.innerWidth` page-overflow assertion: 43/43 testów pass, 0 critical, 0-2 serious axe per (3 viewports × 12 widoków).
+- Dashboard mobile layout flip (S10c follow-up) — `dashboard-page.svelte`: main wrapper `flex gap-5` → `flex flex-col gap-5 lg:flex-row` + sub-grid `grid-cols-2` → `grid-cols-1 sm:grid-cols-2` + sidebar `max-w-80 flex-1 shrink-0` → `w-full shrink-0 lg:max-w-80 lg:flex-1`. Side-by-side 2-col layout aktywowany dopiero od `lg` (1024px); poniżej stack vertically, sub-grid kolumna pojedyncza do `sm` (640px). Eliminuje cramped 2-col scroll na 375-768px.
+
+### Fixed
+- `runtime/types.ts` generuje poprawny TypeScript dla kebab-case slugów (np. `'published-at'?: string` zamiast gołego `published-at?: string`, który był syntaks błędem). Naprawione w `generateTsTypeFromFields`, `generateFlatTsTypeFromFields`, `generateInlineBlockTypeString`, object/blocks variants oraz form fields generator.
+- Shop order detail: `bg-red-50` / `bg-green-50` zamienione na tokenized `bg-destructive-bg` / `bg-success-bg` z `role="alert"`/`role="status"`. Status form ma teraz SaveIndicator + FormErrorSummary.
+- Shipping-method form: `<fieldset>/<legend>` na payment methods (poprawne grouping dla SR), `aria-live="polite"` na carrier config panel, FormErrorSummary zamiast `bg-red-50` div, `text-amber-700` zamienione na `text-warning` token.
+- Coupons list: delete dialog A11y (focus trap, ESC, return focus) zamiast browser `confirm()`.
+- Form submissions bulk delete: AlertDialog zamiast `confirm()`, plural PL forms ("3 zgłoszenia" vs "5 zgłoszeń").
+- Dashboard delete-orphaned: AlertDialog z liczbą wpisów w description zamiast `confirm()`.
+- `pnpm demo` seed (`scripts/seed-demo.ts`) — twarda bramka walidacji: każdy `entry_version` przed surowym INSERT-em przechodzi przez realny schemat CMS (`generateZodSchemaFromFields(..., { localized: false })` — ten sam oracle co admin/publish). Niezgodne dane przerywają seed z czytelnym `collection/lang/entry: path: message`. Dane demo doprowadzone do zgodności: blog-post `title` bez nierealnego `minLength: 50` (+ usunięte śmieciowe debugowe pole `test`/`dupa` z kolekcji), media jako UUID-string zamiast `{id,url,alt}` (cover/thumbnail/image/logo/favicon/photo), daty pełne ISO, dołożone wymagane obiekty `seo`, `url` jako obiekt, bloki z `_slug` zamiast `_type`, `localizedTags`/`links` w kształcie schematu.
+- Lista entries w kolekcji pokazuje "(bez tytułu)"/"(untitled)" zamiast surowego UUID gdy wpis nie ma tytułu — spójne z breadcrumbem na ekranie edycji. Wspólny helper `getCollectionEntryDisplayLabel` (`src/lib/admin/utils/entryLabel.ts`) używany przez list/grid i breadcrumb (fallback wykrywany po `language === null`, odporny na tytuł = id).
+- Slug first-class: podgląd URL wpisu w adminie (`collection-entries.svelte`) odhardkodowany z wymogu pola typu `seo` — kolekcja ze standalone polem slug + skonfigurowanym `slugField` pokazuje URL; bez `slugField`/`pathTemplate` świadomie brak `_url` (np. kolekcje atrybutów), bez błędu. Wydzielony czysty resolver `slugPath.ts` (bez `getCMS`) współdzielony przez admin client i server.
+
+### Breaking
+- **Entry autosave usunięty** — wcześniej 30s timeout + Ctrl/Cmd+S manual. Teraz tylko manual save (button "Zapisz szkic" zawsze widoczny + Ctrl/Cmd+S shortcut). Powód: stara impl mogła w niejasnych sytuacjach modyfikować published data; bezpieczniejsza re-introdukcja z draft-only guard zaplanowana w ROADMAP backlog. Migracja: użytkownicy muszą explicit zapisać przed nawigacją (jest `beforeunload` guard).
+- EntryHeader props: nowy `lastSavedAt?: Date | null` (default `null`). Niezbędny dla SaveIndicator "Zapisano X temu". Konsumenci niestandardowi (entry-header-story-demo, custom integracje) muszą propagować z entry.svelte.
+- EntryForm props: usunięty hardcoded podział Content/SEO (`tabFilter` nigdy nie trafił do release'u — zastąpiony węzłem layoutu `tabs`). Grupowanie w taby = teraz config `layout[]`. Kolekcje bez `tabs` bez zmian; SEO w demo blog-post wyrażone jako `tab`. Dodany prop `errorPaths?: Set<string>` (EntryForm/LayoutRenderer) do wskaźnika błędu na tabie.
+- `coupon-form.svelte` przepisane od zera na sveltekit-superforms — props identyczne (`initial`, `submitLabel`, `onSubmit`, `onCancel`), ale wewnętrzny mechanizm walidacji zmieniony (zod schema zamiast hand-rolled). Call-sites bez zmian.
+
+### Notes
+
+V1-DECISIONS.md sekcja "Sesja 8" zawiera pełny audit decyzji + grep gates. Pełna superForm migracja shipping-method-form odłożona do backlogu (skomplikowany state: net/gross toggle + dynamic carrier + multi-lang record). Storybook entry-page story też w backlogu (wymaga mock setRemotes + RawEntry fixtures — robione w S10 a11y sweep). VoiceOver smoke test (manual user-delegated) — checklist w `V1-UI-AUDIT.md` sekcja "VoiceOver smoke (manual)". Kompatybilność z istniejącymi danymi: pełna (zero schema changes; coupon zachowuje stary kontrakt API).
+
 ## 0.25.0 — 2026-05-06
 
 Faza 11.5 — Shop polish. Stripe payment adapter (Checkout Session flow z native webhook signature verify), refund infrastructure (full + partial, cross-adapter Stripe + PayU), webhook idempotency table (`shop_webhook_events` z UNIQUE(provider, event_id)), coupons (% / fixed PLN, expiresAt, maxUses, minOrderAmount, OCC race-safe redemption), low-stock email alert (per-product `lowStockThreshold`), order export CSV w admin, default email templates rozszerzone o `refunded` status, SDK `applyCoupon`/`removeCoupon` + JSDoc body + `@public` tagi, pełna dokumentacja shopa (DOCS.md + adapter guides + cURL examples + Stripe/Coupons/Refund pages). Shop = `@public` w v1.0.

package/DOCS.md

@@ -1,4 +1,4 @@
-# Includio CMS Documentation (v0.25.0)
+# Includio CMS Documentation (v0.26.0)
 
 > This file is auto-generated from the docs site. For the latest version, update the package.
 

package/README.md

@@ -1,6 +1,7 @@
 # includio-cms
 
 [![CI](https://github.com/includio/includio-cms/actions/workflows/ci.yml/badge.svg)](https://github.com/includio/includio-cms/actions/workflows/ci.yml)
+[![Storybook](https://img.shields.io/badge/Storybook-deployed-ff4785?logo=storybook&logoColor=white)](https://includio.github.io/includio-cms/)
 
 A headless CMS built for SvelteKit. Type-safe, extensible, with a modern admin interface and pluggable adapters for database, files, email, and AI.
 
@@ -211,6 +212,7 @@ Global flags: `--help, -h` and `--version, -v`.
 - [Changelog](./CHANGELOG.md)
 - [Roadmap](./ROADMAP.md)
 - [Known risks](./KNOWN-RISKS.md)
+- [Storybook](https://includio.github.io/includio-cms/) — visual reference for all 86 UI components (designer source-of-truth)
 
 ## For AI assistants
 

package/ROADMAP.md

@@ -20,6 +20,8 @@
 - [x] `[chore]` `[P1]` Faza 11 — Performance Pass (0.24.0): N+1 elimination (`getImageStyle` batch IN query, `getRawEntries` batch entry versions), Sharp srcset `Promise.allSettled` (one timeout doesn't kill batch), background maintenance in-process lock verified + tested, bench infra (`pnpm bench` + representative benchmarks), lazy adapter imports verified <!-- files: src/lib/core/server/media/styles/operations/, src/lib/core/server/fields/resolveImageFields.ts, src/lib/core/server/entries/operations/get.ts, src/lib/db-postgres/index.ts, src/lib/core/server/media/operations/backgroundMaintenance.spec.ts, src/lib/updates/0.24.0/ -->
 - [x] `[feature]` `[P0]` Faza 11.5 — Shop polish (0.25.0): Stripe adapter (Checkout Session, sig verify, idempotency), refund infra (full + partial cross-adapter), webhook idempotency table (`shop_webhook_events`), coupons (% / fixed, expiresAt, maxUses, minOrder), low-stock email alert, order export CSV, default email templates (PL/EN), SDK JSDoc + `@public`, pełna dokumentacja shopa <!-- files: src/lib/shop/adapters/stripe/, src/lib/shop/server/{refund,coupons}.ts, src/lib/db-postgres/schema/shop/{refunds,webhookEvents,coupons,couponRedemptions}.ts, src/lib/admin/client/shop/, src/lib/updates/0.25.0/ -->
 - [ ] `[fix]` `[P1]` Select field — `defaultValue` propagacja do zod schema (full repro: `ideas/post-v1/select-field-defaultvalue-bug.md`); fix planowany w Fazie 12 (RC)
+- [x] `[chore]` `[P2]` Demo orchestrator — `pnpm demo` startuje czystą instancję na tmpfs DB :5436, seeduje 12 blog postów / 6 projektów / 5 contact submissions / 8 gradient PNG-ów, włącza `demo-site` frontend pod `/demo-site`, każdy start = czysty stan <!-- files: scripts/demo.ts, scripts/seed-demo.ts, src/routes/demo-site/, docker-compose.yml, .env.demo -->
+- [x] `[feature]` `[P1]` Slug first-class + SEO v1.0 freeze (0.26.0) — `resolveSeo` public (`includio-cms/core`), `seoFieldDescriptor` SSOT (Zod+TS drift-guard), admin URL un-hardcode (`slugPath.ts` pure resolver, no `seo`-field requirement), `SlugField`/`SeoField`/`SeoFieldData` `@public` v1.0-frozen <!-- files: src/lib/core/fields/slugPath.ts, src/lib/core/fields/seoFieldDescriptor.ts, src/lib/core/fields/resolveSeo.ts, src/lib/types/fields.ts, src/lib/admin/client/collection/collection-entries.svelte, src/lib/updates/0.26.0/ -->
 
 ## v1.x — Post-v1.0 deferred
 
@@ -45,6 +47,10 @@
 
 ## Backlog
 
+- [ ] `[feature]` `[P2]` Date/datetime field — przebudowa na shadcn-svelte (bits-ui Calendar/DatePicker) zamiast natywnego inputu. Zgłoszone w QA Etap 5a (4/5); funkcjonalnie OK, odłożone jako osobny redesign pola daty. <!-- files: src/lib/admin/components/fields/date-field.svelte, datetime-field.svelte -->
+- [ ] `[feature]` `[P1]` Re-introduce entry autosave with strict draft-only guard (opt-in via `cms.config.ts`, never touch published versions, debounced + visual countdown). Removed in 0.26.0 / S8 because old impl could touch published data ambiguously.
+- [ ] `[feature]` `[P2]` Migrate `shipping-method-form` na sveltekit-superforms + formsnap (S8 zostawił hand-rolled validation + FormErrorSummary; pełna migracja wymaga schema dla multi-lang record + dynamic carrier config + price net/gross toggle).
+- [ ] `[feature]` `[P2]` Storybook story dla `entry-page` (Default/Saving/Saved/Error/Draft/WithErrors/Confirmation) — wymaga mock context: `setRemotes` (5 commands), `setBreadcrumbs`, `setContentLanguage`, RawEntry/DbEntryVersion fixtures. S8 odłożone do S10 a11y sweep.
 - [ ] `[feature]` `[P1]` Server-side pagination API (formalize 0.1.0 fix)
 - [x] `[feature]` `[P1]` Improved type generation — union types for select/checkboxes, defaultValue makes fields non-optional <!-- files: src/lib/core/server/generator/ -->
 - [ ] `[feature]` `[P1]` Proper filtering API (SQL-level, not JS post-query)

package/dist/admin/client/account/lang.d.ts

@@ -24,6 +24,7 @@ export declare const accountLang: Record<string, {
         strengthStrong: string;
         strengthVeryStrong: string;
         strengthLabel: string;
+        generatePassword: string;
     };
     language: {
         title: string;

package/dist/admin/client/account/lang.js

@@ -24,7 +24,8 @@ export const accountLang = {
             strengthMedium: 'Średnie',
             strengthStrong: 'Silne',
             strengthVeryStrong: 'Bardzo silne',
-            strengthLabel: 'Siła hasła'
+            strengthLabel: 'Siła hasła',
+            generatePassword: 'Wygeneruj hasło'
         },
         language: {
             title: 'Język interfejsu',
@@ -75,7 +76,8 @@ export const accountLang = {
             strengthMedium: 'Medium',
             strengthStrong: 'Strong',
             strengthVeryStrong: 'Very strong',
-            strengthLabel: 'Password strength'
+            strengthLabel: 'Password strength',
+            generatePassword: 'Generate password'
         },
         language: {
             title: 'Interface language',

package/dist/admin/client/account/profile-section.svelte

@@ -88,10 +88,10 @@
 
 					<!-- Email readonly -->
 					<div class="flex flex-col gap-1">
-						<!-- svelte-ignore a11y_label_has_associated_control -->
-						<label class="text-sm font-medium">{lang.profile.email}</label>
+						<label for="account-email" class="text-sm font-medium">{lang.profile.email}</label>
 						<div class="acct-input-wrap">
 							<Input
+								id="account-email"
 								type="email"
 								value={$session.data.user.email}
 								readonly

package/dist/admin/client/account/security-section.svelte

@@ -9,6 +9,8 @@
 	import { accountLang } from './lang.js';
 	import { useInterfaceLanguage } from '../../state/interface-language.svelte.js';
 	import { authClient } from '../../auth-client.js';
+	import { errorMessages, pickError } from '../../i18n/errors.js';
+	import { generatePassword } from '../../shared/password-generate.js';
 	import { toast } from 'svelte-sonner';
 
 	const interfaceLanguage = useInterfaceLanguage();
@@ -31,7 +33,9 @@
 					newPassword: form.data.newPassword
 				});
 				if (error) {
-					toast.error(error.message || 'Failed to update password');
+					toast.error(
+						error.message || pickError(errorMessages.server.saveFailed, interfaceLanguage.current),
+					);
 				} else {
 					toast.success(lang.security.passwordUpdated);
 					$passwordFormData.currentPassword = '';
@@ -73,6 +77,14 @@
 		return labels[strength.level];
 	});
 
+	function handleGeneratePassword() {
+		const pw = generatePassword();
+		$passwordFormData.newPassword = pw;
+		$passwordFormData.confirmPassword = pw;
+		showNew = true;
+		showConfirm = true;
+	}
+
 </script>
 
 <!-- Password Card -->
@@ -150,9 +162,20 @@
 								{lang.security.strengthLabel}: {strengthLabel}
 							</p>
 						{/if}
-						<p id="pw-hint" class="text-text-light mt-1 text-xs">
-							{lang.security.passwordHint}
-						</p>
+						<div class="mt-1 flex items-center justify-between gap-2">
+							<p id="pw-hint" class="text-text-light text-xs">
+								{lang.security.passwordHint}
+							</p>
+							<Button
+								variant="link"
+								size="sm"
+								type="button"
+								class="h-auto shrink-0 p-0 text-xs"
+								onclick={handleGeneratePassword}
+							>
+								{lang.security.generatePassword}
+							</Button>
+						</div>
 					{/snippet}
 				</Form.Control>
 				<Form.FieldErrors class="text-sm text-red-500" />

package/dist/admin/client/account/sessions-section.svelte

@@ -2,7 +2,7 @@
 	import * as Card from '../../../components/ui/card/index.js';
 	import { accountLang } from './lang.js';
 	import { useInterfaceLanguage } from '../../state/interface-language.svelte.js';
-	import { toLocaleCode } from '../../utils/formatDate.js';
+	import { toLocaleCode } from '../../utils/formatters.js';
 	import { authClient } from '../../auth-client.js';
 	import { toast } from 'svelte-sonner';
 	import Button from '../../../components/ui/button/button.svelte';

package/dist/admin/client/admin/admin-after-login-layout-content.svelte

@@ -26,7 +26,7 @@
 <Sidebar.Provider style="--sidebar-width: 16rem;  --header-height: calc(var(--spacing) * 13);">
 	<AppSidebar />
 
-	<Sidebar.Inset class="h-screen overflow-hidden">
+	<Sidebar.Inset id="main-content" tabindex={-1} class="h-screen overflow-hidden outline-none">
 		<SiteHeader />
 		<div class="flex grow flex-col overflow-auto">
 			{@render children()}

package/dist/admin/client/admin/dashboard-page.svelte

@@ -6,6 +6,7 @@
 	import RecentActivity from '../../components/dashboard/recent-activity.svelte';
 	import A11yGauge from '../../components/dashboard/a11y-gauge.svelte';
 	import TipOfTheDay from '../../components/dashboard/tip-of-the-day.svelte';
+	import ConfirmationDialog from '../../components/dialogs/confirmation-dialog.svelte';
 	import { sidebarLang } from '../../components/layout/lang.js';
 	import { getBreadcrumbs } from '../../state/breadcrumbs.svelte.js';
 	import { useInterfaceLanguage } from '../../state/interface-language.svelte.js';
@@ -20,6 +21,23 @@
 	let orphanedEntries = $state<OrphanedEntry[]>([]);
 	let loadingOrphaned = $state(true);
 	let deletingOrphaned = $state(false);
+	let confirmDeleteOpen = $state(false);
+
+	const confirmText: Record<
+		InterfaceLanguage,
+		{ title: string; description: (n: number) => string }
+	> = {
+		pl: {
+			title: 'Usunąć osierocone wpisy?',
+			description: (n) =>
+				`${n} ${n === 1 ? 'wpis zostanie' : 'wpisy zostaną'} trwale usunięty z bazy. Tej akcji nie cofniesz.`
+		},
+		en: {
+			title: 'Delete orphaned entries?',
+			description: (n) =>
+				`${n} ${n === 1 ? 'entry' : 'entries'} will be permanently removed. This cannot be undone.`
+		}
+	};
 
 	async function fetchOrphanedEntries() {
 		try {
@@ -34,13 +52,11 @@
 		}
 	}
 
-	async function deleteOrphaned() {
-		const msg: Record<InterfaceLanguage, string> = {
-			pl: 'Czy na pewno chcesz usunąć te wpisy? Tej operacji nie można cofnąć.',
-			en: 'Are you sure you want to delete these entries? This cannot be undone.'
-		};
-		if (!confirm(msg[interfaceLanguage.current])) return;
+	function deleteOrphaned() {
+		confirmDeleteOpen = true;
+	}
 
+	async function performDeleteOrphaned() {
 		deletingOrphaned = true;
 		try {
 			const res = await fetch('/admin/api/orphaned', { method: 'DELETE' });
@@ -67,6 +83,14 @@
 	});
 </script>
 
+<ConfirmationDialog
+	bind:open={confirmDeleteOpen}
+	title={confirmText[interfaceLanguage.current].title}
+	description={confirmText[interfaceLanguage.current].description(orphanedEntries.length)}
+	loading={deletingOrphaned}
+	onConfirm={performDeleteOrphaned}
+/>
+
 <main class="dash-main">
 	{#if !loadingOrphaned}
 		<OrphanedEntriesNotice
@@ -78,9 +102,9 @@
 
 	<WelcomeHeader />
 
-	<div class="flex gap-5">
-		<div class="flex-1">
-			<div class="grid grid-cols-2 gap-5">
+	<div class="flex flex-col gap-5 lg:flex-row">
+		<div class="min-w-0 flex-1">
+			<div class="grid grid-cols-1 gap-5 sm:grid-cols-2">
 				<RecentEntries />
 				<FormSubmissionsWidget />
 			</div>
@@ -88,7 +112,7 @@
 				<RecentActivity />
 			</div>
 		</div>
-		<div class="max-w-80 flex-1 shrink-0">
+		<div class="w-full shrink-0 lg:max-w-80 lg:flex-1">
 			<A11yGauge />
 			<div class="mt-5">
 				<TipOfTheDay />

package/dist/admin/client/collection/bulk-actions-bar.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { tick, type Snippet } from 'svelte';
 	import Archive from '@tabler/icons-svelte/icons/archive';
 	import ArchiveOff from '@tabler/icons-svelte/icons/archive-off';
 	import Trash from '@tabler/icons-svelte/icons/trash';
@@ -10,93 +11,134 @@
 
 	type Props = {
 		selectedCount: number;
-		onArchive: () => void;
+		onArchive?: () => void;
 		onDelete?: () => void;
 		onClear: () => void;
 		onRestore?: () => void;
+		actions?: Snippet;
 	};
 
-	let { selectedCount, onArchive, onDelete, onClear, onRestore }: Props = $props();
+	let { selectedCount, onArchive, onDelete, onClear, onRestore, actions }: Props = $props();
 
 	const interfaceLanguage = useInterfaceLanguage();
 
-	const lang: Record<InterfaceLanguage, {
-		selected: (n: number) => string;
-		archive: string;
-		restore: string;
-		delete: string;
-	}> = {
+	const lang: Record<
+		InterfaceLanguage,
+		{
+			selected: (n: number) => string;
+			archive: string;
+			restore: string;
+			delete: string;
+			bulkActions: string;
+			clearSelection: string;
+		}
+	> = {
 		en: {
 			selected: (n) => `${n} selected`,
 			archive: 'Archive',
 			restore: 'Restore',
-			delete: 'Delete'
+			delete: 'Delete',
+			bulkActions: 'Bulk actions',
+			clearSelection: 'Clear selection'
 		},
 		pl: {
 			selected: (n) => `Zaznaczono: ${n}`,
 			archive: 'Archiwizuj',
 			restore: 'Przywróć',
-			delete: 'Usuń'
+			delete: 'Usuń',
+			bulkActions: 'Akcje masowe',
+			clearSelection: 'Wyczyść zaznaczenie'
 		}
 	};
 
 	const t = $derived(lang[interfaceLanguage.current]);
+
+	let toolbarRef = $state<HTMLElement | null>(null);
+	let prevCount = 0;
+
+	$effect(() => {
+		const count = selectedCount;
+		if (prevCount === 0 && count > 0) {
+			tick().then(() => {
+				const first = toolbarRef?.querySelector<HTMLElement>('button:not([aria-label])');
+				first?.focus();
+			});
+		}
+		prevCount = count;
+	});
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Escape') {
+			e.stopPropagation();
+			onClear();
+		}
+	}
 </script>
 
 {#if selectedCount > 0}
 	<div
+		bind:this={toolbarRef}
 		class="fixed bottom-6 left-1/2 z-50 -translate-x-1/2"
 		transition:fly={{ y: 40, duration: 200 }}
-		role="status"
-		aria-live="polite"
+		role="toolbar"
+		aria-label={t.bulkActions}
+		tabindex="-1"
+		onkeydown={handleKeydown}
 	>
 		<div
-			class="flex items-center gap-3 rounded-xl bg-plum-darker px-5 py-3 text-white shadow-xl"
+			class="flex max-w-[calc(100vw-2rem)] flex-wrap items-center justify-center gap-3 rounded-xl bg-plum-darker px-5 py-3 text-white shadow-xl"
 		>
-			<span class="text-sm font-medium">{t.selected(selectedCount)}</span>
+			<span class="text-sm font-medium" aria-hidden="true">{t.selected(selectedCount)}</span>
 
-			<div class="h-5 w-px bg-white/20"></div>
+			<div class="h-5 w-px bg-white/20" aria-hidden="true"></div>
 
 			{#if onRestore}
-			<Button
-				variant="ghost"
-				size="sm"
-				class="text-white hover:bg-white/10 hover:text-white"
-				onclick={onRestore}
-			>
-				<ArchiveOff class="mr-1.5 size-3.5" />
-				{t.restore}
-			</Button>
-			{:else}
-			<Button
-				variant="ghost"
-				size="sm"
-				class="text-white hover:bg-white/10 hover:text-white"
-				onclick={onArchive}
-			>
-				<Archive class="mr-1.5 size-3.5" />
-				{t.archive}
-			</Button>
+				<Button
+					variant="ghost"
+					size="sm"
+					class="text-white hover:bg-white/10 hover:text-white"
+					onclick={onRestore}
+				>
+					<ArchiveOff class="mr-1.5 size-3.5" />
+					{t.restore}
+				</Button>
+			{:else if onArchive}
+				<Button
+					variant="ghost"
+					size="sm"
+					class="text-white hover:bg-white/10 hover:text-white"
+					onclick={onArchive}
+				>
+					<Archive class="mr-1.5 size-3.5" />
+					{t.archive}
+				</Button>
 			{/if}
 			{#if onDelete}
-			<Button
-				variant="ghost"
-				size="sm"
-				class="text-white border border-white/20 hover:bg-white/10 hover:text-white"
-				onclick={onDelete}
-			>
-				<Trash class="mr-1.5 size-3.5" />
-				{t.delete}
-			</Button>
+				<Button
+					variant="ghost"
+					size="sm"
+					class="text-white border border-white/20 hover:bg-white/10 hover:text-white"
+					onclick={onDelete}
+				>
+					<Trash class="mr-1.5 size-3.5" />
+					{t.delete}
+				</Button>
+			{/if}
+			{#if actions}
+				{@render actions()}
 			{/if}
 
 			<button
+				type="button"
 				class="ml-1 rounded-md p-1 text-white/60 hover:bg-white/10 hover:text-white"
 				onclick={onClear}
-				aria-label="Clear selection"
+				aria-label={t.clearSelection}
 			>
 				<X class="size-4" />
 			</button>
 		</div>
 	</div>
+	<div aria-live="polite" aria-atomic="true" class="sr-only">
+		{t.selected(selectedCount)}
+	</div>
 {/if}

package/dist/admin/client/collection/bulk-actions-bar.svelte.d.ts

@@ -1,9 +1,11 @@
+import { type Snippet } from 'svelte';
 type Props = {
     selectedCount: number;
-    onArchive: () => void;
+    onArchive?: () => void;
     onDelete?: () => void;
     onClear: () => void;
     onRestore?: () => void;
+    actions?: Snippet;
 };
 declare const BulkActionsBar: import("svelte").Component<Props, {}, "">;
 type BulkActionsBar = ReturnType<typeof BulkActionsBar>;