smoodly 0.0.19 → 0.0.20

package/README.md

@@ -497,9 +497,6 @@ after both are on the registry. From the repo root:
 
 ## Follow-ups (logged 2026-09-17, admin path spec)
 
-- A root page slugged like the admin path (or `api`) is unreachable:
-  Next's static segment wins over the site catch-all. Refuse it in the
-  slug check once `config.admin.path` exists.
 - A robots `Disallow` for the admin path from `next/meta`.
 
 ## Follow-ups (logged 2026-09-17, reference picker and tags spec)

package/dist/admin/ops-impl.js

@@ -1,7 +1,7 @@
 import { entryFieldsIn, entryTitleIn } from "../entry-store.js";
 import { distinctTags } from "../tags.js";
 import { ASSET_COLLECTION } from "../media.js";
-import { adminHref } from "../admin-path.js";
+import { adminHref, adminSlugTaken, isAdminSlug } from "../admin-path.js";
 import { affectedTargets, collectionTag, entryTag, pageTag, pagesTreeTag, globalTag } from "../revalidate.js";
 import { ensureFixedNodes, fixedNodeOf } from "./fixed-nodes.js";
 import { ensureGlobalItems } from "./global-items.js";
@@ -226,6 +226,10 @@ export function createAdminOps(deps) {
      *  its slug: the config's homePageSlug is what routes it. Judged by the
      *  DEFAULT locale's slug (paths.ts isHomeNode, the same rule). */
     const isHomeNode = (r) => r.parentId === null && r.locales[def]?.slug === config.homePageSlug;
+    /** A ROOT page at the admin's segment can never be opened: Next serves
+     *  the static admin folder first (spec 2026-09-17 slug guard §4). */
+    const adminSlug = (slug) => isAdminSlug(slug, config.admin.path);
+    const slugTaken = () => err("validation", adminSlugTaken(config.admin.path));
     const supportedLocale = (locale) => typeof locale === "string" && config.locales.supported.includes(locale)
         ? null
         : err("validation", `smoodly: "${String(locale)}" is not a supported locale.`);
@@ -268,6 +272,8 @@ export function createAdminOps(deps) {
                 const unsupported = supportedLocale(input.locale);
                 if (unsupported)
                     return unsupported;
+                if (input.parentId === null && adminSlug(input.slug))
+                    return slugTaken();
                 if (input.template !== null) {
                     const registration = openTemplate(input.template);
                     if (!registration)
@@ -441,6 +447,8 @@ export function createAdminOps(deps) {
                 const unsupported = supportedLocale(patch.locale);
                 if (unsupported)
                     return unsupported;
+                if (record.parentId === null && patch.slug !== undefined && adminSlug(patch.slug))
+                    return slugTaken();
                 const renamed = await pages.rename(id, patch, by);
                 // Every descendant's path changed with this segment; the parent
                 // lists this node's title and path.
@@ -452,6 +460,8 @@ export function createAdminOps(deps) {
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
+                if (to.parentId === null && Object.values(record.locales).some((row) => adminSlug(row.slug)))
+                    return slugTaken();
                 if (to.parentId !== null) {
                     // Code owns a fixed node's URL, never the root's listing order:
                     // reparenting is refused, reordering among the root siblings is not.

package/dist/admin-path.d.ts

@@ -1,6 +1,14 @@
 export declare const DEFAULT_ADMIN_PATH = "/admin";
-/** One or more `/segment`s: no trailing slash, never "/". */
+/** `/` plus exactly one segment (spec 2026-09-17 slug guard §1): with one
+ *  segment only a ROOT slug can collide with the admin, so the guard is a
+ *  string comparison. */
 export declare function assertAdminPath(path: unknown): asserts path is string;
+/** True when `slug` is the admin's own segment: Next serves the static
+ *  admin folder before the site catch-all, so a root page, a collection
+ *  path or a fixed slug that takes it can never be opened. */
+export declare const isAdminSlug: (slug: string, adminPath: string) => boolean;
+/** What an editor reads when a root page would take the admin's segment. */
+export declare const adminSlugTaken: (adminPath: string) => string;
 /** `path` is "" or starts with "/": adminHref("/studio", "/pages") → "/studio/pages". */
 export declare const adminHref: (base: string, path: string) => string;
 /** The message for a shell mounted outside its base — the route folder

package/dist/admin-path.js

@@ -4,13 +4,21 @@
 // all read it from here.
 import { isSegment } from "./paths.js";
 export const DEFAULT_ADMIN_PATH = "/admin";
-/** One or more `/segment`s: no trailing slash, never "/". */
+/** `/` plus exactly one segment (spec 2026-09-17 slug guard §1): with one
+ *  segment only a ROOT slug can collide with the admin, so the guard is a
+ *  string comparison. */
 export function assertAdminPath(path) {
-    const ok = typeof path === "string" && path.startsWith("/") && path.slice(1).split("/").every(isSegment);
+    const ok = typeof path === "string" && path.startsWith("/") && isSegment(path.slice(1));
     if (!ok) {
-        throw new Error(`smoodly: admin.path "${String(path)}" is not a valid path — use one or more /segments of lowercase letters, digits and single hyphens, like "/admin" or "/cms/admin".`);
+        throw new Error(`smoodly: admin.path "${String(path)}" is not a valid path — use one /segment of lowercase letters, digits and single hyphens, like "/admin" or "/studio".`);
     }
 }
+/** True when `slug` is the admin's own segment: Next serves the static
+ *  admin folder before the site catch-all, so a root page, a collection
+ *  path or a fixed slug that takes it can never be opened. */
+export const isAdminSlug = (slug, adminPath) => slug === adminPath.slice(1);
+/** What an editor reads when a root page would take the admin's segment. */
+export const adminSlugTaken = (adminPath) => `smoodly: "${adminPath}" is where the admin lives (admin.path) — pick another slug.`;
 /** `path` is "" or starts with "/": adminHref("/studio", "/pages") → "/studio/pages". */
 export const adminHref = (base, path) => `${base}${path}`;
 /** The message for a shell mounted outside its base — the route folder

package/dist/config.js

@@ -1,6 +1,6 @@
 import { assertSegment, fixedPageSegments, perLocaleSegments } from "./paths.js";
 import { DEFAULT_MEDIA } from "./media.js";
-import { DEFAULT_ADMIN_PATH, assertAdminPath } from "./admin-path.js";
+import { DEFAULT_ADMIN_PATH, assertAdminPath, isAdminSlug } from "./admin-path.js";
 import { resolveStyleValues, styleDescriptors } from "./styles.js";
 import { resolveCustom } from "./custom/index.js";
 /** `global`: the placement node type and an admin route; `asset`: the refs
@@ -56,8 +56,9 @@ function assertGlobalSections(config) {
 /** Every root-level segment a registration claims, per locale: fixed page
  *  slugs and collection paths. Two claims on one (locale, segment) are a
  *  conflict — except a fixed page sitting at a collection's segment in
- *  EVERY locale of that path, which is the collection's index page. */
-function assertRootSegments(config) {
+ *  EVERY locale of that path, which is the collection's index page. The
+ *  admin's own segment is refused outright (spec 2026-09-17 slug guard §5). */
+function assertRootSegments(config, adminPath) {
     const { default: def, supported } = config.locales;
     // Mounts claim exactly the locales their path names; fixed pages fill an
     // omitted locale from the default one, so the check must fill the same
@@ -73,6 +74,9 @@ function assertRootSegments(config) {
         }
         for (const [locale, segment] of Object.entries(pageSegments(slug))) {
             assertSegment(segment, `page "${p.schema.name}" fixed slug`);
+            if (isAdminSlug(segment, adminPath)) {
+                throw new Error(`smoodly: page "${p.schema.name}" has the fixed slug "${segment}", where the admin lives — change its slug or admin.path.`);
+            }
             const owner = owners.get(`${locale} ${segment}`);
             if (owner) {
                 throw new Error(`smoodly: page registrations "${owner}" and "${p.schema.name}" both claim the fixed slug "${segment}" (${locale}).`);
@@ -94,6 +98,9 @@ function assertRootSegments(config) {
         const segments = perLocale(c.path);
         for (const [locale, segment] of Object.entries(segments)) {
             assertSegment(segment, `collection "${c.name}" path`);
+            if (isAdminSlug(segment, adminPath)) {
+                throw new Error(`smoodly: collection "${c.name}" is mounted at "${adminPath}", where the admin lives — change its path or admin.path.`);
+            }
             const other = collectionOwners.get(`${locale} ${segment}`);
             if (other) {
                 throw new Error(`smoodly: collections "${other}" and "${c.name}" both claim the root segment "${segment}" (${locale}).`);
@@ -170,7 +177,9 @@ export function defineConfig(config) {
     assertUniqueNames(config);
     assertGlobalSections(config);
     assertToolsetElements(config);
-    assertRootSegments(config);
+    const adminPath = config.admin?.path ?? DEFAULT_ADMIN_PATH;
+    assertAdminPath(adminPath);
+    assertRootSegments(config, adminPath);
     const depth = config.pages?.tree?.depth ?? 1;
     if (!Number.isInteger(depth) || depth < 1)
         throw new Error("smoodly: pages.tree.depth must be a positive integer.");
@@ -196,8 +205,6 @@ export function defineConfig(config) {
     if (!Number.isInteger(media.maxSize) || media.maxSize <= 0) {
         throw new Error("smoodly: media.maxSize must be a positive integer of bytes.");
     }
-    const adminPath = config.admin?.path ?? DEFAULT_ADMIN_PATH;
-    assertAdminPath(adminPath);
     return {
         ...config,
         homePageSlug,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {