smoodly 0.0.1

package/dist/admin/serialize.js

@@ -0,0 +1,49 @@
+function serializeDescriptor(d) {
+    const out = { type: d.type };
+    for (const [key, value] of Object.entries(d)) {
+        if (key === "target" && typeof value === "function") {
+            out.target = value().name;
+        }
+        else if (key === "fields" && d.type === "object") {
+            out.fields = serializeMap(value);
+        }
+        else if (typeof value !== "function") {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+function serializeMap(map) {
+    return Object.fromEntries(Object.entries(map ?? {}).map(([k, d]) => [k, serializeDescriptor(d)]));
+}
+export function serializeAdminConfig(config) {
+    return {
+        sections: (config.registry.sections ?? []).map(({ schema }) => {
+            const s = schema;
+            return {
+                name: s.name,
+                title: s.title ?? s.name,
+                icon: s.icon,
+                description: s.description,
+                fields: serializeMap(s.fields),
+                styles: serializeMap(config.resolvedStyles(s.name)),
+                meta: serializeMap(s.meta),
+                sample: s.sample,
+            };
+        }),
+        collections: (config.registry.collections ?? []).map((c) => ({
+            name: c.name, title: c.title, titleField: c.titleField, fields: serializeMap(c.fields),
+        })),
+        pages: (config.registry.pages ?? []).map(({ schema }) => {
+            const p = schema;
+            return {
+                name: p.name,
+                title: p.title ?? p.name,
+                ...(p.slug !== undefined ? { slug: p.slug } : {}),
+                zones: p.zones ?? {},
+            };
+        }),
+        locales: config.locales,
+        homePageSlug: config.homePageSlug,
+    };
+}

package/dist/admin/shell/AdminApp.d.ts

@@ -0,0 +1,9 @@
+import type { AdminOpAction } from "../ops.ts";
+import type { AdminRegistry } from "../serialize.ts";
+import { type AuthConfig } from "./session.ts";
+export declare function AdminApp({ registry, segments, op, auth }: {
+    registry: AdminRegistry;
+    segments: string[];
+    op: AdminOpAction;
+    auth: AuthConfig;
+}): import("react").JSX.Element;

package/dist/admin/shell/AdminApp.js

@@ -0,0 +1,122 @@
+// packages/smoodly/src/admin/shell/AdminApp.tsx
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// The admin shell: registry-derived nav (never separately configured),
+// list views in the main area, editor/entry views mounted by segment.
+// Internal routing = the catch-all's segments; plain <a> navigation.
+import { useEffect, useState } from "react";
+import { makeClientOps } from "../client-ops.js";
+import { ListView, StatusChip } from "./ListView.js";
+import { openTemplates, pagesRows } from "./pages-list.js";
+import { pagePath } from "../page-path.js";
+import { EntryForm } from "./EntryForm.js";
+import { EditorView } from "../editor/EditorView.js";
+import { LoginView } from "./LoginView.js";
+import { useAdminSession } from "./session.js";
+const BASE = "/admin";
+function Nav({ registry, active, onSignOut }) {
+    const item = (href, label, isActive) => (_jsx("a", { href: href ?? undefined, "aria-disabled": href ? undefined : true, style: {
+            display: "block", padding: "9px 14px", borderRadius: 9, marginBottom: 2, textDecoration: "none",
+            color: href ? "#17141f" : "#a7a1b8", fontWeight: isActive ? 700 : 500, fontSize: 14,
+            background: isActive ? "#e7e2f6" : "transparent", cursor: href ? "pointer" : "default",
+        }, children: label }, label));
+    return (_jsxs("nav", { style: { width: 210, flexShrink: 0, padding: 18, borderRight: "1px solid #e7e4f0", background: "#faf9fd", minHeight: "100vh", boxSizing: "border-box" }, children: [_jsxs("div", { style: { fontWeight: 800, fontSize: 17, margin: "4px 0 22px" }, children: ["smoodly", _jsx("span", { style: { color: "#6d4aff" }, children: "." })] }), item(`${BASE}/pages`, "Pages", active === "pages"), registry.collections.map((c) => item(`${BASE}/${c.name}`, c.title, active === c.name)), _jsx("div", { style: { borderTop: "1px solid #e7e4f0", margin: "14px 0" } }), item(null, "Global Content", false), item(null, "Media", false), item(null, "Settings", false), _jsx("div", { style: { borderTop: "1px solid #e7e4f0", margin: "14px 0" } }), _jsx("button", { onClick: onSignOut, style: { display: "block", width: "100%", textAlign: "left", padding: "9px 14px", borderRadius: 9, border: 0, background: "transparent", color: "#6b7280", fontSize: 14, cursor: "pointer" }, children: "Sign out" })] }));
+}
+function PagesList({ ops, registry }) {
+    const [pages, setPages] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        ops.pages.list()
+            .then((r) => (r.ok ? setPages(r.data) : setError(r.message)))
+            .catch(() => setError("Couldn't reach the server."));
+    }, [ops]);
+    const rows = pages ? pagesRows(pages, registry.pages) : [];
+    const creatable = openTemplates(registry.pages);
+    const noOpen = creatable.length === 0;
+    /** Create a page, then open it in the editor — or surface the op's message. */
+    const createAndOpen = async (slug, template) => {
+        const result = await ops.pages.create({ slug, template });
+        if (result.ok)
+            window.location.href = `${BASE}/pages/${encodeURIComponent(slug)}`;
+        else
+            window.alert(result.message);
+    };
+    const newPage = async () => {
+        if (noOpen)
+            return;
+        const slug = window.prompt("Slug for the new page (e.g. about):");
+        if (!slug)
+            return;
+        const template = creatable.length === 1
+            ? creatable[0].name
+            : window.prompt(`Template? (${creatable.map((p) => p.name).join(", ")})`) ?? "";
+        await createAndOpen(slug, template);
+    };
+    if (error)
+        return _jsx("p", { style: { padding: 32, color: "#b91c1c" }, children: error });
+    return (_jsx(ListView, { title: "Pages", actions: _jsx("button", { onClick: newPage, disabled: noOpen, title: noOpen ? "Every page registration is fixed to its own route file — add an open one (a page schema with no `slug`) to create pages here." : undefined, style: { background: "#6d4aff", color: "#fff", border: 0, borderRadius: 9, padding: "9px 16px", fontWeight: 600, cursor: noOpen ? "not-allowed" : "pointer", opacity: noOpen ? 0.5 : 1 }, children: "New page" }), columns: ["Slug", "Template", "Status"], rows: rows.map((row) => row.kind === "missing"
+            ? {
+                key: `missing:${row.slug}`,
+                onClick: () => createAndOpen(row.slug, row.template),
+                cells: [
+                    _jsx("strong", { children: pagePath(row.slug, registry.homePageSlug) }, "s"),
+                    row.templateTitle,
+                    _jsx("em", { style: { color: "#6b7280" }, children: "not created" }, "c"),
+                ],
+            }
+            : {
+                key: row.record.id,
+                href: `${BASE}/pages/${encodeURIComponent(row.record.slug)}`,
+                cells: [
+                    _jsx("strong", { children: pagePath(row.record.slug, registry.homePageSlug) }, "s"),
+                    row.templateTitle,
+                    _jsx(StatusChip, { status: row.record.publishedVersionId ? (row.record.publishedVersionId === row.record.draftVersionId ? "published" : "draft edits") : "draft" }, "c"),
+                ],
+            }) }));
+}
+function EntriesList({ ops, registry, collection }) {
+    const meta = registry.collections.find((c) => c.name === collection);
+    const [rows, setRows] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        ops.entries.list(collection)
+            .then((r) => (r.ok ? setRows(r.data) : setError(r.message)))
+            .catch(() => setError("Couldn't reach the server."));
+    }, [ops, collection]);
+    if (!meta)
+        return _jsx("p", { style: { padding: 32 }, children: "No such collection." });
+    if (error)
+        return _jsx("p", { style: { padding: 32, color: "#b91c1c" }, children: error });
+    const title = (e) => String((meta.titleField && e.fields[meta.titleField]) ?? Object.values(e.fields).find((v) => typeof v === "string") ?? e.id);
+    return (_jsx(ListView, { title: meta.title, actions: _jsx("a", { href: `${BASE}/${collection}/new`, style: { background: "#6d4aff", color: "#fff", borderRadius: 9, padding: "9px 16px", fontWeight: 600, textDecoration: "none" }, children: "New entry" }), columns: ["Title", "Status", "Updated"], rows: (rows ?? []).map((e) => ({
+            key: e.id,
+            href: `${BASE}/${collection}/${encodeURIComponent(e.id)}`,
+            cells: [
+                _jsx("strong", { children: title(e) }, "t"),
+                _jsx(StatusChip, { status: e.status }, "c"),
+                new Date(e.updatedAt).toLocaleString(),
+            ],
+        })) }));
+}
+export function AdminApp({ registry, segments, op, auth }) {
+    const session = useAdminSession(auth);
+    const [ops] = useState(() => makeClientOps(op, session.token));
+    const [head = "pages", tail] = segments.length ? segments : ["pages"];
+    const isCollection = registry.collections.some((c) => c.name === head);
+    if (session.state.status === "loading")
+        return _jsx("p", { style: { padding: 32, color: "#6b7280" }, children: "Loading\u2026" });
+    if (session.state.status === "signed_out")
+        return _jsx(LoginView, { client: session.client, providers: auth.providers });
+    let main;
+    if (head === "pages" && !tail)
+        main = _jsx(PagesList, { ops: ops, registry: registry });
+    else if (head === "pages" && tail)
+        main = _jsx(EditorView, { ops: ops, registry: registry, slug: decodeURIComponent(tail) });
+    else if (isCollection && !tail)
+        main = _jsx(EntriesList, { ops: ops, registry: registry, collection: head });
+    else if (isCollection && tail)
+        main = _jsx(EntryForm, { ops: ops, registry: registry, collection: head, id: tail === "new" ? "new" : decodeURIComponent(tail) });
+    else
+        main = _jsxs("p", { style: { padding: 32 }, children: ["Not found. ", _jsx("a", { href: `${BASE}/pages`, children: "Back to pages" }), "."] });
+    return (_jsxs("div", { style: { display: "flex", alignItems: "stretch" }, children: [_jsx(Nav, { registry: registry, active: head, onSignOut: () => session.client.auth.signOut() }), _jsx("main", { style: { flex: 1, minWidth: 0 }, children: main })] }));
+}

package/dist/admin/shell/EntryForm.d.ts

@@ -0,0 +1,8 @@
+import type { AdminOps } from "../ops.ts";
+import type { AdminRegistry } from "../serialize.ts";
+export declare function EntryForm({ ops, registry, collection, id }: {
+    ops: AdminOps;
+    registry: AdminRegistry;
+    collection: string;
+    id: string;
+}): import("react").JSX.Element;

package/dist/admin/shell/EntryForm.js

@@ -0,0 +1,96 @@
+// packages/smoodly/src/admin/shell/EntryForm.tsx
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// The classic field view: same FieldWidget renderer as the editor sidebar,
+// no tabs (collections are fields-only by design). The safe-delete guard's
+// message renders verbatim — it is product surface, not an error detail.
+import { useEffect, useMemo, useState } from "react";
+import { FieldWidget } from "../forms/FieldWidget.js";
+import { StatusChip } from "./ListView.js";
+export function EntryForm({ ops, registry, collection, id }) {
+    const meta = registry.collections.find((c) => c.name === collection);
+    const isNew = id === "new";
+    const [fields, setFields] = useState({});
+    const [status, setStatus] = useState("draft");
+    const [refOptions, setRefOptions] = useState({});
+    const [banner, setBanner] = useState(null);
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [loaded, setLoaded] = useState(isNew);
+    const refTargets = useMemo(() => {
+        const out = {};
+        for (const [key, d] of Object.entries(meta?.fields ?? {})) {
+            if ((d.type === "ref" || d.type === "refList") && typeof d.target === "string")
+                out[key] = d.target;
+        }
+        return out;
+    }, [meta]);
+    useEffect(() => {
+        if (!isNew) {
+            ops.entries.get(collection, id).then((r) => {
+                if (r.ok) {
+                    setFields(r.data.fields);
+                    setStatus(r.data.status);
+                    setLoaded(true);
+                }
+                else
+                    setBanner({ tone: "error", text: r.message });
+            }).catch(() => setBanner({ tone: "error", text: "Couldn't reach the server." }));
+        }
+        for (const target of new Set(Object.values(refTargets))) {
+            const targetMeta = registry.collections.find((c) => c.name === target);
+            ops.entries.list(target).then((r) => {
+                if (!r.ok)
+                    return;
+                const options = r.data.map((e) => ({
+                    id: e.id,
+                    title: String((targetMeta?.titleField && e.fields[targetMeta.titleField]) ?? e.id),
+                    status: e.status,
+                }));
+                setRefOptions((prev) => ({ ...prev, [target]: options }));
+            }).catch(console.error);
+        }
+    }, [ops, collection, id, isNew, refTargets, registry]);
+    if (!meta)
+        return _jsx("p", { style: { padding: 32 }, children: "No such collection." });
+    const applyResult = (r, okText) => {
+        if (r.ok) {
+            setBanner({ tone: "ok", text: okText });
+            setFieldErrors({});
+            return true;
+        }
+        setBanner({ tone: "error", text: r.message });
+        setFieldErrors(Object.fromEntries((r.fields ?? []).map((f) => [f.field, f.message])));
+        return false;
+    };
+    const save = async () => {
+        if (isNew) {
+            const r = await ops.entries.create(collection, fields);
+            if (applyResult(r, "Created.") && r.ok) {
+                window.location.href = `/admin/${collection}/${encodeURIComponent(r.data.id)}`;
+            }
+        }
+        else {
+            applyResult(await ops.entries.save(collection, id, fields), "Saved.");
+        }
+    };
+    const flipStatus = async () => {
+        const next = status === "published" ? "draft" : "published";
+        const r = await ops.entries.setStatus(collection, id, next);
+        if (applyResult(r, next === "published" ? "Published." : "Unpublished."))
+            setStatus(next);
+    };
+    const destroy = async () => {
+        if (!window.confirm("Delete this entry?"))
+            return;
+        const r = await ops.entries.delete(collection, id);
+        if (r.ok)
+            window.location.href = `/admin/${collection}`;
+        else
+            setBanner({ tone: "error", text: r.message });
+    };
+    const btn = (bg, fg = "#fff", disabled = false) => ({
+        background: bg, color: fg, border: 0, borderRadius: 9, padding: "9px 16px", fontWeight: 600,
+        cursor: disabled ? "default" : "pointer", opacity: disabled ? 0.5 : 1,
+    });
+    return (_jsxs("section", { style: { maxWidth: 640, margin: "0 auto", padding: "32px 24px" }, children: [_jsxs("header", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 6 }, children: [_jsx("h1", { style: { fontSize: 22, margin: 0 }, children: isNew ? `New ${meta.title}` : `Edit ${meta.title}` }), !isNew && _jsx(StatusChip, { status: status })] }), _jsx("p", { style: { margin: "0 0 20px" }, children: _jsxs("a", { href: `/admin/${collection}`, style: { fontSize: 13, opacity: 0.6 }, children: ["\u2190 ", meta.title] }) }), banner && (_jsx("p", { style: { padding: "10px 14px", borderRadius: 9, fontSize: 14, background: banner.tone === "ok" ? "#e5f6ec" : "#fdecec", color: banner.tone === "ok" ? "#116b38" : "#b91c1c" }, children: banner.text })), loaded && (_jsx("div", { style: { background: "#fff", borderRadius: 12, border: "1px solid #e7e4f0", padding: 20 }, children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: fields[key], error: fieldErrors[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] ?? [] : undefined, onChange: (value) => setFields((f) => ({ ...f, [key]: value })) }, key))) })), _jsxs("footer", { style: { display: "flex", gap: 10, marginTop: 18 }, children: [_jsx("button", { onClick: save, disabled: !loaded, style: btn("#6d4aff", "#fff", !loaded), children: isNew ? "Create" : "Save" }), !isNew && _jsx("button", { onClick: flipStatus, disabled: !loaded, style: btn("#17141f", "#fff", !loaded), children: status === "published" ? "Unpublish" : "Publish" }), !isNew && _jsx("button", { onClick: destroy, disabled: !loaded, style: btn("#fdecec", "#b91c1c", !loaded), children: "Delete" })] })] }));
+}

package/dist/admin/shell/ListView.d.ts

@@ -0,0 +1,15 @@
+import type { ReactNode } from "react";
+export declare function ListView({ title, actions, columns, rows }: {
+    title: string;
+    actions?: ReactNode;
+    columns: string[];
+    rows: {
+        key: string;
+        href?: string;
+        onClick?: () => void;
+        cells: ReactNode[];
+    }[];
+}): import("react").JSX.Element;
+export declare function StatusChip({ status }: {
+    status: string;
+}): import("react").JSX.Element;

package/dist/admin/shell/ListView.js

@@ -0,0 +1,14 @@
+// packages/smoodly/src/admin/shell/ListView.tsx
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+export function ListView({ title, actions, columns, rows }) {
+    return (_jsxs("section", { style: { maxWidth: 780, margin: "0 auto", padding: "32px 24px" }, children: [_jsxs("header", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 18 }, children: [_jsx("h1", { style: { fontSize: 22, margin: 0 }, children: title }), _jsx("div", { children: actions })] }), _jsx("div", { style: { background: "#fff", borderRadius: 12, border: "1px solid #e7e4f0", overflow: "hidden" }, children: _jsxs("table", { style: { width: "100%", borderCollapse: "collapse", fontSize: 14 }, children: [_jsx("thead", { children: _jsx("tr", { children: columns.map((c) => (_jsx("th", { style: { textAlign: "left", padding: "10px 14px", fontSize: 11, letterSpacing: "0.08em", textTransform: "uppercase", opacity: 0.5, borderBottom: "1px solid #e7e4f0" }, children: c }, c))) }) }), _jsxs("tbody", { children: [rows.map((r) => (_jsx("tr", { style: { borderBottom: "1px solid #f0eef6", cursor: r.href || r.onClick ? "pointer" : "default" }, onClick: r.onClick ?? (r.href ? () => (window.location.href = r.href) : undefined), children: r.cells.map((cell, i) => _jsx("td", { style: { padding: "12px 14px" }, children: cell }, i)) }, r.key))), rows.length === 0 && (_jsx("tr", { children: _jsx("td", { colSpan: columns.length, style: { padding: 24, opacity: 0.5 }, children: "Nothing here yet." }) }))] })] }) })] }));
+}
+export function StatusChip({ status }) {
+    const palette = {
+        published: { bg: "#e5f6ec", fg: "#116b38" },
+        draft: { bg: "#f1eefb", fg: "#5b3df0" },
+    };
+    const c = palette[status] ?? { bg: "#eee", fg: "#444" };
+    return (_jsx("span", { style: { background: c.bg, color: c.fg, borderRadius: 99, padding: "3px 10px", fontSize: 12, fontWeight: 600 }, children: status }));
+}

package/dist/admin/shell/LoginView.d.ts

@@ -0,0 +1,5 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export declare function LoginView({ client, providers }: {
+    client: SupabaseClient;
+    providers?: ("google" | "github")[];
+}): import("react").JSX.Element;

package/dist/admin/shell/LoginView.js

@@ -0,0 +1,47 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// The admin's front door (spec 2026-09-04 §5): email+password always;
+// Google/GitHub when the auth project has them. Errors come from
+// Supabase Auth verbatim. Being an editor is checked by the server on
+// the first op — a signed-in non-editor sees that message in the shell.
+import { useState } from "react";
+const LABELS = { google: "Continue with Google", github: "Continue with GitHub" };
+export function LoginView({ client, providers = [] }) {
+    const [email, setEmail] = useState("");
+    const [password, setPassword] = useState("");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const submit = async (e) => {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await client.auth.signInWithPassword({ email, password });
+            if (res.error)
+                setError(res.error.message);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : String(e));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const oauth = async (provider) => {
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await client.auth.signInWithOAuth({ provider, options: { redirectTo: window.location.href } });
+            if (res.error)
+                setError(res.error.message);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : String(e));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const field = { display: "block", width: "100%", boxSizing: "border-box", padding: "10px 12px", border: "1px solid #d9d5e6", borderRadius: 9, marginBottom: 12, fontSize: 14 };
+    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center" }, children: _jsxs("form", { onSubmit: submit, style: { width: 340, background: "#fff", padding: 28, borderRadius: 14, border: "1px solid #e7e4f0" }, children: [_jsxs("div", { style: { fontWeight: 800, fontSize: 20, marginBottom: 18 }, children: ["smoodly", _jsx("span", { style: { color: "#6d4aff" }, children: "." })] }), _jsxs("label", { style: { fontSize: 13, fontWeight: 600 }, children: ["Email", _jsx("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "email", style: field })] }), _jsxs("label", { style: { fontSize: 13, fontWeight: 600 }, children: ["Password", _jsx("input", { type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, autoComplete: "current-password", style: field })] }), error && _jsx("p", { style: { color: "#b91c1c", fontSize: 13, margin: "0 0 12px" }, children: error }), _jsx("button", { type: "submit", disabled: busy, style: { width: "100%", background: "#6d4aff", color: "#fff", border: 0, borderRadius: 9, padding: "10px 16px", fontWeight: 600, cursor: "pointer" }, children: busy ? "Signing in…" : "Sign in" }), providers.map((p) => (_jsx("button", { type: "button", disabled: busy, onClick: () => oauth(p), style: { width: "100%", marginTop: 10, background: "#fff", border: "1px solid #d9d5e6", borderRadius: 9, padding: "10px 16px", fontWeight: 600, cursor: "pointer" }, children: LABELS[p] }, p)))] }) }));
+}

package/dist/admin/shell/pages-list.d.ts

@@ -0,0 +1,22 @@
+import type { PageRecord } from "../../store.ts";
+import type { AdminPageTemplate } from "../serialize.ts";
+/** Registrations editors may create pages against. A fixed-slug
+ * registration is a singleton owned by one route file, so it is never
+ * offered — and with exactly one open template left, the New Page flow
+ * needs no template prompt at all. */
+export declare function openTemplates(templates: AdminPageTemplate[]): AdminPageTemplate[];
+export type PagesRow = {
+    kind: "record";
+    record: PageRecord;
+    templateTitle: string;
+    fixed: boolean;
+} | {
+    kind: "missing";
+    slug: string;
+    template: string;
+    templateTitle: string;
+};
+/** Fixed registrations always get a row, even before their record
+ * exists: otherwise a fresh install's "/" is a 404 the admin offers no
+ * way to fix, since New Page filters singletons out. */
+export declare function pagesRows(records: PageRecord[], templates: AdminPageTemplate[]): PagesRow[];

package/dist/admin/shell/pages-list.js

@@ -0,0 +1,31 @@
+/** Registrations editors may create pages against. A fixed-slug
+ * registration is a singleton owned by one route file, so it is never
+ * offered — and with exactly one open template left, the New Page flow
+ * needs no template prompt at all. */
+export function openTemplates(templates) {
+    return templates.filter((t) => t.slug === undefined);
+}
+/** Fixed registrations always get a row, even before their record
+ * exists: otherwise a fresh install's "/" is a 404 the admin offers no
+ * way to fix, since New Page filters singletons out. */
+export function pagesRows(records, templates) {
+    const titleOf = (name) => templates.find((t) => t.name === name)?.title ?? name;
+    const bySlug = new Map(records.map((r) => [r.slug, r]));
+    const fixedSlugs = new Set();
+    const rows = [];
+    for (const t of templates) {
+        if (t.slug === undefined)
+            continue;
+        fixedSlugs.add(t.slug);
+        const record = bySlug.get(t.slug);
+        rows.push(record
+            ? { kind: "record", record, templateTitle: titleOf(record.template), fixed: true }
+            : { kind: "missing", slug: t.slug, template: t.name, templateTitle: t.title });
+    }
+    for (const record of records) {
+        if (fixedSlugs.has(record.slug))
+            continue;
+        rows.push({ kind: "record", record, templateTitle: titleOf(record.template), fixed: false });
+    }
+    return rows;
+}

package/dist/admin/shell/session.d.ts

@@ -0,0 +1,19 @@
+import { type Session, type SupabaseClient } from "@supabase/supabase-js";
+export type AuthConfig = {
+    url: string;
+    key: string;
+    providers?: ("google" | "github")[];
+};
+export type SessionState = {
+    status: "loading";
+} | {
+    status: "signed_out";
+} | {
+    status: "signed_in";
+    session: Session;
+};
+export declare function useAdminSession(auth: AuthConfig): {
+    client: SupabaseClient;
+    state: SessionState;
+    token: () => string | null;
+};

package/dist/admin/shell/session.js

@@ -0,0 +1,37 @@
+"use client";
+// The editor's session, browser side: one Supabase client for the AUTH
+// project (smoodly.io's in the cloud, the customer's own in self-host —
+// the app passes the URL and publishable key). The token getter reads a
+// ref so the ops facade, created once, always sends the current token.
+import { useEffect, useRef, useState } from "react";
+import { createClient } from "@supabase/supabase-js";
+export function useAdminSession(auth) {
+    const browser = typeof window !== "undefined";
+    const [client] = useState(() => createClient(auth.url, auth.key, {
+        auth: { autoRefreshToken: browser, persistSession: browser, detectSessionInUrl: browser },
+    }));
+    const [state, setState] = useState({ status: "loading" });
+    const current = useRef(null);
+    useEffect(() => {
+        let active = true;
+        const apply = (session) => {
+            current.current = session;
+            setState(session ? { status: "signed_in", session } : { status: "signed_out" });
+        };
+        client.auth.getSession().then(({ data }) => {
+            if (!active)
+                return;
+            apply(data.session);
+        }).catch(() => {
+            if (!active)
+                return;
+            apply(null);
+        });
+        const { data } = client.auth.onAuthStateChange((_event, session) => apply(session));
+        return () => {
+            active = false;
+            data.subscription.unsubscribe();
+        };
+    }, [client]);
+    return { client, state, token: () => current.current?.access_token ?? null };
+}

package/dist/admin/supabase-auth.d.ts

@@ -0,0 +1,7 @@
+import { type SupabaseClient } from "@supabase/supabase-js";
+import type { AdminAuth } from "./auth.ts";
+export declare function supabaseAdminAuth(input: {
+    authUrl: string;
+    authKey: string;
+    db: SupabaseClient;
+}): AdminAuth;

package/dist/admin/supabase-auth.js

@@ -0,0 +1,23 @@
+// The Supabase-backed AdminAuth: the session is verified against the
+// AUTH project (smoodly.io's in the cloud, the customer's own in self-
+// host — same code, different SMOODLY_AUTH_URL), the editors row is read
+// from the CONTENT project with the write key. No space filter: the
+// policy set scopes the write key, and self-host has one space.
+import { createClient } from "@supabase/supabase-js";
+export function supabaseAdminAuth(input) {
+    const auth = createClient(input.authUrl, input.authKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+    return {
+        async verify(token) {
+            const res = await auth.auth.getUser(token);
+            return res.data.user ? { userId: res.data.user.id } : null;
+        },
+        async isEditor(userId) {
+            const res = await input.db.from("editors").select("user_id").eq("user_id", userId).limit(1);
+            if (res.error)
+                throw new Error(`smoodly: ${res.error.message}`);
+            return res.data.length > 0;
+        },
+    };
+}

package/dist/admin/tree-ops.d.ts

@@ -0,0 +1,19 @@
+import type { PageTree, TreeNode } from "../render.tsx";
+import type { ZonePolicy } from "../zones.ts";
+import type { AdminSection } from "./serialize.ts";
+export declare function zoneOf(tree: PageTree, id: string): string | null;
+export declare function findNode(tree: PageTree, id: string): TreeNode | null;
+export declare function insertNode(tree: PageTree, zone: string, index: number, node: TreeNode): PageTree;
+export declare function removeNode(tree: PageTree, id: string): PageTree;
+export declare function moveNode(tree: PageTree, id: string, dir: -1 | 1): PageTree;
+export declare function patchNode(tree: PageTree, id: string, ns: "fields" | "styles" | "meta", key: string, value: unknown): PageTree;
+export declare function canInsert(policy: ZonePolicy | undefined, count: number): boolean;
+export declare function allowedSections(policy: ZonePolicy | undefined, all: AdminSection[]): AdminSection[];
+export declare function nodeFromSample(section: AdminSection, id: string): TreeNode;
+/** A locked zone holds exactly one node the editor can never insert or
+ * remove — so someone has to put it there. This does, from the component's
+ * sample, for every locked zone that is empty or missing. Runs when the
+ * editor loads a draft, which also covers pages that predate a locked zone
+ * being added to their schema. Returns the same tree when nothing changed. */
+export declare function fillLockedZones(tree: PageTree, policies: Record<string, ZonePolicy>, sections: AdminSection[]): PageTree;
+export declare function newNodeId(type: string): string;