smoodly 0.0.24 → 0.0.26

package/dist/admin/next/bridge.js

@@ -1,16 +1,32 @@
 "use client";
+import { jsx as _jsx } from "react/jsx-runtime";
 // Runs INSIDE the draft-route iframe (glue adds it only when draft mode +
 // the editor param are on). Reports geometry — section nodes, empty zones
 // and, since spec 2026-09-10, every marked field with its resolved path —
 // forwards select/hover with the field under the pointer, executes
 // refresh/scroll, and says when a render has committed. The admin overlay
-// draws all chrome. Rects are in document coordinates: the iframe is sized
+// draws all chrome — bar one rule this component renders: a section that
+// renders nothing (a fresh custom section, an all-optional section left
+// empty) is stamped blank and takes a min-height, so the editor can see
+// and select it; the live site never mounts the bridge, so it keeps its
+// true height. Rects are in document coordinates: the iframe is sized
 // to the full document height by the editor, so client rects + scroll
 // offsets map 1:1 onto the overlay.
 import { useEffect } from "react";
 import { useRouter } from "next/navigation";
-import { EDITOR_ATTR, FIELD_ATTR, NODE_ATTR, ZONE_ATTR, resolveMarkPath } from "../../marks.js";
+import { BLANK_ATTR, EDITOR_ATTR, FIELD_ATTR, NODE_ATTR, ZONE_ATTR, resolveMarkPath } from "../../marks.js";
 const post = (m) => window.parent.postMessage(m, "*");
+/** The height of an md-spaced section with nothing inside (3.5rem + 3.5rem). */
+// The editor sizes the iframe to the reported height; the document's own
+// viewport must never scroll (2026-09-26): a fractional content height
+// (4595.3px in a 4595px frame) left it scrollable by a hair, and a
+// trackpad scroll over the canvas showed the frame's overlay scrollbar.
+// Hidden overflow drops no layout — programmatic scrollIntoView still
+// works, and the live site never mounts this.
+const BRIDGE_CSS = `html{overflow:hidden}[${NODE_ATTR}][${BLANK_ATTR}]{min-height:7rem}`;
+const MEDIA = "img,picture,video,audio,svg,canvas,iframe,object";
+/** No visible text (innerText skips <style> and hidden content) and no media. */
+const isBlank = (el) => el.innerText.trim() === "" && el.querySelector(MEDIA) === null;
 export function EditorBridge() {
     const router = useRouter();
     // Every commit of this component — the mount, then each RSC refresh,
@@ -28,7 +44,19 @@ export function EditorBridge() {
         const report = () => {
             // Array.from, not spread: the package's lib set is ES2020 + DOM
             // (no DOM.Iterable), so a NodeList isn't statically iterable here.
-            const nodes = all(`[${NODE_ATTR}]`).map((el) => ({ id: el.getAttribute(NODE_ATTR), ...docRect(el) }));
+            const roots = all(`[${NODE_ATTR}]`);
+            // Stamp before measuring, so the min-height is in the rects; only on a
+            // change, so the attribute mutation this causes converges instead of looping.
+            for (const el of roots) {
+                const blank = isBlank(el);
+                if (blank !== el.hasAttribute(BLANK_ATTR)) {
+                    if (blank)
+                        el.setAttribute(BLANK_ATTR, "");
+                    else
+                        el.removeAttribute(BLANK_ATTR);
+                }
+            }
+            const nodes = roots.map((el) => ({ id: el.getAttribute(NODE_ATTR), ...docRect(el) }));
             const emptyZones = all(`[${ZONE_ATTR}]`).map((el) => ({ zone: el.getAttribute(ZONE_ATTR), ...docRect(el) }));
             const fields = [];
             for (const el of all(`[${FIELD_ATTR}]`)) {
@@ -39,7 +67,9 @@ export function EditorBridge() {
                 if (mark)
                     fields.push({ ...mark, ...docRect(el) });
             }
-            post({ source: "smoodly", kind: "rects", nodes, emptyZones, fields, docH: document.documentElement.scrollHeight });
+            // Rounded up from the fractional box, so the frame is never a hair too short.
+            const docH = Math.ceil(Math.max(document.documentElement.scrollHeight, document.documentElement.getBoundingClientRect().height));
+            post({ source: "smoodly", kind: "rects", nodes, emptyZones, fields, docH });
         };
         const raf = () => requestAnimationFrame(report);
         const ro = new ResizeObserver(raf);
@@ -93,5 +123,5 @@ export function EditorBridge() {
             window.removeEventListener("message", onMessage);
         };
     }, [router]);
-    return null;
+    return _jsx("style", { "data-smoodly-bridge": "", children: BRIDGE_CSS });
 }

package/dist/admin/next/create-admin.d.ts

@@ -2,10 +2,14 @@ import type { ReactNode } from "react";
 import type { ResolvedConfig } from "../../config.ts";
 import type { AdminOpAction } from "../ops.ts";
 import type { AuthConfig } from "../shell/session.ts";
+import type { ContentConfig } from "../../env.ts";
+/** `content` (optional) is the content project's public config for editing presence (spec 2026-09-26
+ *  concurrency §5); absent — an app wired before it — presence is off and everything else works. */
 export declare function createSmoodlyAdmin(input: {
     config: ResolvedConfig;
     op: AdminOpAction;
     auth: () => AuthConfig;
+    content?: () => ContentConfig;
 }): {
     AdminPage: () => null;
     AdminLayout: ({ children }: {

package/dist/admin/next/create-admin.js

@@ -2,6 +2,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { serializeAdminConfig } from "../serialize.js";
 import { AdminApp } from "../shell/AdminApp.js";
 import { AdminStyles } from "../ui/theme.js";
+/** `content` (optional) is the content project's public config for editing presence (spec 2026-09-26
+ *  concurrency §5); absent — an app wired before it — presence is off and everything else works. */
 export function createSmoodlyAdmin(input) {
     const registry = serializeAdminConfig(input.config);
     /** The catch-all page only makes every /admin URL exist. The shell is
@@ -22,7 +24,7 @@ export function createSmoodlyAdmin(input) {
      *  on this element before React hydrates, on purpose (no white flash
      *  for a dark-mode editor), so the attribute differs from the server's. */
     function AdminLayout({ children }) {
-        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth() }), children] }));
+        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth(), content: input.content?.() }), children] }));
     }
     return { AdminPage, AdminLayout };
 }

package/dist/admin/next/index.d.ts

@@ -4,5 +4,6 @@ export type { AdminOpCall, AdminOpAction, AdminOps, OpResult, MembersListResult
 export type { InviteInput, InviteResult, MemberRecord } from "../../member-store.ts";
 export type { MemberRole } from "../../permissions.ts";
 export type { AuthConfig } from "../shell/session.ts";
+export type { ContentConfig } from "../../env.ts";
 export type { AdminAuth } from "../auth.ts";
 export { supabaseAdminAuth } from "../supabase-auth.ts";

package/dist/admin/ops-impl.js

@@ -11,10 +11,16 @@ import { CUSTOM_NODE_TYPE, customSchema } from "../custom/index.js";
 import { SETTINGS_KEY, CSS_KEY } from "../global.js";
 import { withDefaults } from "../field-defaults.js";
 import { elementSchemas } from "../richtext-walk.js";
+import { SCHEMA_VERSION } from "../schema-version.js";
+import { draftToken, isDraftToken, StaleDraftError } from "../draft-token.js";
 const ok = (data) => ({ ok: true, data });
 /** A history row without its content (spec 2026-09-13 history §6). */
 const summary = ({ id, savedAt }) => ({ id, savedAt });
 const err = (code, message, fields) => ({ ok: false, code, message, ...(fields ? { fields } : {}) });
+/** The client's token is untrusted data: undefined skips, null is "no draft", the shape is the token, anything else is refused. */
+const BAD_TOKEN = Symbol("bad token");
+const tokenArg = (v) => v === undefined ? undefined : v === null ? null : isDraftToken(v) ? v : BAD_TOKEN;
+const badToken = () => err("validation", "smoodly: malformed draft token.");
 /** Own-property, non-array plain object — same shape guard the tree checks
  * below and `runAdminOp`'s envelope check both lean on. */
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -41,6 +47,9 @@ function isPageTree(tree) {
 }
 /** Store throws are stringly-typed; classify the known guards, default to internal. */
 const classify = (e) => {
+    // The guard's refusal (spec 2026-09-26 concurrency §2): typed, so it never depends on message matching.
+    if (e instanceof StaleDraftError)
+        return { ok: false, code: "conflict", stale: true, by: e.by, at: e.at, message: e.message };
     const message = e instanceof Error ? e.message : String(e);
     if (message.includes("already exists in locale"))
         return err("conflict", message);
@@ -323,20 +332,28 @@ export function createAdminOps(deps) {
                 expireTree();
                 return ok(created);
             }),
-            saveDraft: (id, locale, tree) => guard(async () => {
+            saveDraft: (id, locale, tree, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
                 if (!isPageTree(tree))
                     return err("validation", "smoodly: malformed page tree.");
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!(await pages.getPage(id)))
                     return err("not_found", `smoodly: no page "${id}".`);
-                return ok({ versionId: (await pages.saveDraft(id, locale, tree, by)).id });
+                const version = await pages.saveDraft(id, locale, tree, by, token);
+                const after = await pages.getPage(id);
+                return ok({ versionId: version.id, draft: after?.locales[locale] ? draftToken(after.locales[locale]) : null });
             }),
-            publish: (id, locale) => guard(async () => {
+            publish: (id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -372,7 +389,7 @@ export function createAdminOps(deps) {
                 if (fieldErrors.length > 0) {
                     return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed fields first.`, fieldErrors);
                 }
-                const published = await pages.publish(id, locale, by);
+                const published = await pages.publish(id, locale, by, token);
                 // The parent's cached unit lists its published children.
                 expirePages([published.id, published.parentId]);
                 expireTree();
@@ -397,10 +414,13 @@ export function createAdminOps(deps) {
                 expireTree();
                 return ok(off);
             }),
-            discardDraft: (id, locale) => guard(async () => {
+            discardDraft: (id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -410,7 +430,7 @@ export function createAdminOps(deps) {
                 if (!row.publishedVersionId) {
                     return err("blocked", `smoodly: "${nameOf(record)}" has nothing published in ${locale} — there is no version to restore.`);
                 }
-                const restored = await pages.discardDraft(id, locale, by);
+                const restored = await pages.discardDraft(id, locale, by, token);
                 expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
@@ -422,10 +442,13 @@ export function createAdminOps(deps) {
                     return err("not_found", `smoodly: no page "${id}".`);
                 return ok((await pages.listVersions(id, locale)).map(summary));
             }),
-            restore: (id, locale, versionId) => guard(async () => {
+            restore: (id, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -437,7 +460,7 @@ export function createAdminOps(deps) {
                 if (!version || version.pageId !== id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of this page in ${locale}.`);
                 }
-                const restored = await pages.restore(id, locale, versionId, by);
+                const restored = await pages.restore(id, locale, versionId, by, token);
                 expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
@@ -597,22 +620,28 @@ export function createAdminOps(deps) {
                 expireCollection(collection);
                 return ok(created);
             }),
-            save: (collection, id, locale, fields) => guard(async () => {
+            save: (collection, id, locale, fields, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const descriptors = collectionFields(collection);
                 if (!descriptors)
                     return err("not_found", `smoodly: no collection named "${collection}".`);
-                const entry = await entries.update(collection, id, locale, fields, by);
+                const entry = await entries.update(collection, id, locale, fields, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
             }),
-            setStatus: (collection, id, locale, status) => guard(async () => {
+            setStatus: (collection, id, locale, status, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (status === "published") {
                     // A draft may be incomplete; what goes live may not (spec 2026-09-14 §2).
                     const descriptors = collectionFields(collection);
@@ -627,16 +656,19 @@ export function createAdminOps(deps) {
                     if (fieldErrors.length > 0)
                         return err("validation", "Some fields need attention.", fieldErrors);
                 }
-                const entry = await entries.setStatus(collection, id, locale, status, by);
+                const entry = await entries.setStatus(collection, id, locale, status, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
             }),
-            discardDraft: (collection, id, locale) => guard(async () => {
+            discardDraft: (collection, id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
-                const restored = await entries.discardDraft(collection, id, locale, by);
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
+                const restored = await entries.discardDraft(collection, id, locale, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(restored);
@@ -656,15 +688,18 @@ export function createAdminOps(deps) {
                 }
                 return ok({ ...summary(version), fields: version.fields });
             }),
-            restore: (collection, id, locale, versionId) => guard(async () => {
+            restore: (collection, id, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const version = typeof versionId === "string" ? await entries.getVersion(collection, versionId) : null;
                 if (!version || version.entryId !== id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of entry "${id}" in "${collection}", locale ${locale}.`);
                 }
-                const restored = await entries.restore(collection, id, locale, versionId, by);
+                const restored = await entries.restore(collection, id, locale, versionId, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(restored);
@@ -719,25 +754,31 @@ export function createAdminOps(deps) {
                 const usage = await entries.referencesTo(name, record.id);
                 return ok({ name, record, locale, fields: entryFieldsIn(record, locale), usage });
             }),
-            save: (name, locale, fields) => guard(async () => {
+            save: (name, locale, fields, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const item = globalItem(name);
                 if (!item)
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
                 if (!record)
                     return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const saved = await entries.update(name, record.id, locale, fields, by);
+                const saved = await entries.update(name, record.id, locale, fields, by, token);
                 // fanOut expires `global:<name>` itself — this row IS the item's.
                 await fanOut(record.id);
                 return ok(saved);
             }),
-            setStatus: (name, locale, status) => guard(async () => {
+            setStatus: (name, locale, status, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const item = globalItem(name);
                 if (!item)
                     return err("not_found", `smoodly: no global item named "${name}".`);
@@ -756,21 +797,24 @@ export function createAdminOps(deps) {
                     if (fieldErrors.length > 0)
                         return err("validation", "Some fields need attention.", fieldErrors);
                 }
-                const changed = await entries.setStatus(name, record.id, locale, status, by);
+                const changed = await entries.setStatus(name, record.id, locale, status, by, token);
                 // see save: the fan-out carries the item's own tag.
                 await fanOut(record.id);
                 return ok(changed);
             }),
-            discardDraft: (name, locale) => guard(async () => {
+            discardDraft: (name, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!globalItem(name))
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
                 if (!record)
                     return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const restored = await entries.discardDraft(name, record.id, locale, by);
+                const restored = await entries.discardDraft(name, record.id, locale, by, token);
                 await fanOut(record.id);
                 return ok(restored);
             }),
@@ -797,10 +841,13 @@ export function createAdminOps(deps) {
                 }
                 return ok({ ...summary(version), fields: version.fields });
             }),
-            restore: (name, locale, versionId) => guard(async () => {
+            restore: (name, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!globalItem(name))
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
@@ -810,7 +857,7 @@ export function createAdminOps(deps) {
                 if (!version || version.entryId !== record.id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of global item "${name}" in ${locale}.`);
                 }
-                const restored = await entries.restore(name, record.id, locale, versionId, by);
+                const restored = await entries.restore(name, record.id, locale, versionId, by, token);
                 await fanOut(record.id);
                 return ok(restored);
             }),
@@ -926,6 +973,9 @@ export function createAdminOps(deps) {
                 return ok(null);
             }),
         },
+        schema: {
+            status: () => guard(async () => ok({ database: await pages.schemaVersion(), required: SCHEMA_VERSION })),
+        },
         preview: {
             enable: () => guard(async () => (await effects?.draft?.enable(), ok(null))),
             disable: () => guard(async () => (await effects?.draft?.disable(), ok(null))),

package/dist/admin/ops.d.ts

@@ -6,11 +6,17 @@ import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-
 import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
+import type { DraftToken } from "../draft-token.ts";
 export type OpError = {
     ok: false;
     code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized";
     message: string;
     fields?: FieldError[];
+    /** A `conflict` from the token guard (spec 2026-09-26 concurrency §2): the draft moved since the client loaded it. */
+    stale?: true;
+    /** Who wrote it last and when — the freeze notice's two facts. */
+    by?: string | null;
+    at?: number;
 };
 export type OpResult<T> = {
     ok: true;
@@ -98,6 +104,11 @@ export type MembersListResult = {
     members: MemberRecord[];
     consoleUrl: string | null;
 };
+/** `database` null = no smoodly_meta table (older than v1). Behind blocks the shell; ahead is silent (spec 2026-09-26 §5). */
+export type SchemaStatus = {
+    database: number | null;
+    required: number;
+};
 export type AdminOps = {
     pages: {
         /** Lists every node, materializing fixed pages and collection mounts (in every supported locale) first. */
@@ -105,14 +116,16 @@ export type AdminOps = {
         /** not_found only when the page is missing; an absent locale comes back with `draft: null`. */
         get(id: string, locale: string): Promise<OpResult<PageGetResult>>;
         create(input: PageCreateInput): Promise<OpResult<PageRecord>>;
-        saveDraft(id: string, locale: string, tree: PageTree): Promise<OpResult<{
+        /** `expected` is the token the client last saw (spec 2026-09-26 concurrency §1); `undefined` skips the check — the admin always sends one. */
+        saveDraft(id: string, locale: string, tree: PageTree, expected?: DraftToken | null): Promise<OpResult<{
             versionId: string;
+            draft: DraftToken | null;
         }>>;
-        publish(id: string, locale: string): Promise<OpResult<PageRecord>>;
+        publish(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         /** Takes the locale off the site; status draft, pointers kept. Never the site root or a fixed node (spec 2026-09-13 publish flow §5). */
         unpublish(id: string, locale: string): Promise<OpResult<PageRecord>>;
         /** The draft back to the published version (§4); `blocked` when nothing is published in the locale. */
-        discardDraft(id: string, locale: string): Promise<OpResult<PageRecord>>;
+        discardDraft(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         delete(id: string): Promise<OpResult<null>>;
         rename(id: string, patch: {
             locale: string;
@@ -134,7 +147,7 @@ export type AdminOps = {
         /** The locale's versions newest first, without their trees. */
         listVersions(id: string, locale: string): Promise<OpResult<VersionSummary[]>>;
         /** The version's tree becomes the draft (spec 2026-09-13 history §6); `not_found` for a version of another page or locale, `blocked` on a folder. */
-        restore(id: string, locale: string, versionId: string): Promise<OpResult<PageRecord>>;
+        restore(id: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
     };
     entries: {
         list(collection: string): Promise<OpResult<EntryRecord[]>>;
@@ -145,10 +158,11 @@ export type AdminOps = {
         /** not_found only when the entry is missing; an absent locale comes back with `fields: null`. */
         get(collection: string, id: string, locale: string): Promise<OpResult<EntryGetResult>>;
         create(collection: string, input: EntryCreateInput): Promise<OpResult<EntryRecord>>;
-        save(collection: string, id: string, locale: string, fields: Record<string, unknown>): Promise<OpResult<EntryRecord>>;
-        setStatus(collection: string, id: string, locale: string, status: "draft" | "published"): Promise<OpResult<EntryRecord>>;
+        /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
+        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        setStatus(collection: string, id: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The live row back to the published snapshot (§4); `blocked` when the locale has no published version. */
-        discardDraft(collection: string, id: string, locale: string): Promise<OpResult<EntryRecord>>;
+        discardDraft(collection: string, id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         delete(collection: string, id: string): Promise<OpResult<null>>;
         move(collection: string, id: string, to: {
             parentId: string | null;
@@ -165,19 +179,20 @@ export type AdminOps = {
         /** One snapshot's fields; `not_found` unless it belongs to `id`. */
         getVersion(collection: string, id: string, versionId: string): Promise<OpResult<EntryVersionResult>>;
         /** The snapshot becomes the draft (§6); `not_found` for a foreign version. Fans out like a save. */
-        restore(collection: string, id: string, locale: string, versionId: string): Promise<OpResult<EntryRecord>>;
+        restore(collection: string, id: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
     };
     globals: {
         /** Materializes every registered item in every supported locale, then lists them in registry order. */
         list(): Promise<OpResult<GlobalListItem[]>>;
         get(name: string, locale: string): Promise<OpResult<GlobalGetResult>>;
-        save(name: string, locale: string, fields: Record<string, unknown>): Promise<OpResult<EntryRecord>>;
-        setStatus(name: string, locale: string, status: "draft" | "published"): Promise<OpResult<EntryRecord>>;
+        /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
+        save(name: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        setStatus(name: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The item's live row back to its published snapshot (§4); `blocked` before the first publish. */
-        discardDraft(name: string, locale: string): Promise<OpResult<EntryRecord>>;
+        discardDraft(name: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         listVersions(name: string, locale: string): Promise<OpResult<VersionSummary[]>>;
         getVersion(name: string, versionId: string): Promise<OpResult<EntryVersionResult>>;
-        restore(name: string, locale: string, versionId: string): Promise<OpResult<EntryRecord>>;
+        restore(name: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
     };
     assets: {
         /** Ready assets, newest first, paged by cursor; `kind` and `search` filter. */
@@ -210,6 +225,10 @@ export type AdminOps = {
         /** Admins only, self-host only; the same two guards. The Auth account stays. */
         remove(userId: string): Promise<OpResult<null>>;
     };
+    schema: {
+        /** Every member. The shell calls it once on mount and blocks when behind. */
+        status(): Promise<OpResult<SchemaStatus>>;
+    };
     preview: {
         enable(): Promise<OpResult<null>>;
         disable(): Promise<OpResult<null>>;

package/dist/admin/serialize.d.ts

@@ -74,6 +74,8 @@ export type AdminRegistry = {
         default: string;
         supported: string[];
     };
+    /** The site's time zone when configured (spec 2026-09-25 date pickers §5); the datetime widget edits in it. */
+    timeZone?: string;
     /** The project's custom-CSS flag (spec 2026-09-14 §4). */
     css: boolean;
     /** Which slug the site root serves. */

package/dist/admin/serialize.js

@@ -104,6 +104,7 @@ export function serializeAdminConfig(config) {
         },
         css: config.css,
         locales: config.locales,
+        ...(config.timeZone !== undefined ? { timeZone: config.timeZone } : {}),
         homePageSlug: config.homePageSlug,
         pageDepth: config.pageDepth,
         media: { maxSize: config.media.maxSize, accept: [...config.media.accept] },

package/dist/admin/shell/AdminApp.d.ts

@@ -1,8 +1,10 @@
 import type { AdminOpAction } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
 import { type AuthConfig } from "./session.ts";
-export declare function AdminApp({ registry, op, auth }: {
+import type { ContentConfig } from "../../env.ts";
+export declare function AdminApp({ registry, op, auth, content }: {
     registry: AdminRegistry;
     op: AdminOpAction;
     auth: AuthConfig;
+    content?: ContentConfig;
 }): import("react").JSX.Element;

package/dist/admin/shell/AdminApp.js

@@ -24,6 +24,7 @@ import { LoginView } from "./LoginView.js";
 import { SetPasswordView } from "./SetPasswordView.js";
 import { useAdminSession } from "./session.js";
 import { IconRail } from "./IconRail.js";
+import { ConfirmHost } from "../ui/ConfirmDialog.js";
 import { useRoute } from "./router.js";
 import { AdminPathProvider } from "./base.js";
 import { mountMismatch } from "../../admin-path.js";
@@ -33,7 +34,13 @@ import { MediaScreen } from "./MediaScreen.js";
 import { SettingsView } from "./SettingsView.js";
 import { AssetsProvider } from "../forms/assets-context.js";
 import { ElementsProvider } from "../forms/elements-context.js";
-export function AdminApp({ registry, op, auth }) {
+import { TimeZoneProvider } from "../forms/time-zone-context.js";
+import { SchemaNotice } from "./SchemaNotice.js";
+import { schemaBehind } from "../../schema-version.js";
+import { createPresence } from "./presence.js";
+import { connectRealtime } from "./presence-realtime.js";
+import { PresenceProvider } from "./presence-context.js";
+export function AdminApp({ registry, op, auth, content }) {
     const session = useAdminSession(auth);
     const [ops] = useState(() => makeClientOps(op, session.token));
     const route = useRoute(registry.adminPath);
@@ -57,7 +64,38 @@ export function AdminApp({ registry, op, auth }) {
             setRole("editor"); });
         return () => { live = false; };
     }, [signedIn, ops]);
+    // The one version check (spec 2026-09-26 §5): behind blocks the shell,
+    // equal or ahead renders as usual. Unknown until it answers; a failed
+    // call renders as usual too — the notice is for a known-behind schema.
+    const [schema, setSchema] = useState(null);
+    useEffect(() => {
+        if (!signedIn) {
+            setSchema(null);
+            return;
+        }
+        let live = true;
+        ops.schema.status()
+            .then((r) => { if (live && r.ok)
+            setSchema(r.data); })
+            .catch(() => { });
+        return () => { live = false; };
+    }, [signedIn, ops]);
     const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
+    // Presence (spec 2026-09-26 concurrency §5): one channel per signed-in session,
+    // joined with the content project's public config; absent config = presence off.
+    const [presence, setPresence] = useState(null);
+    const contentUrl = content?.url, contentKey = content?.key, contentSpace = content?.spaceId;
+    useEffect(() => {
+        if (!signedIn || !contentUrl || !contentKey || !contentSpace || !email) {
+            setPresence(null);
+            return;
+        }
+        const config = { url: contentUrl, key: contentKey, spaceId: contentSpace };
+        const p = createPresence({ email, connect: () => connectRealtime(config, email) });
+        p.join();
+        setPresence(p);
+        return () => { p.dispose(); setPresence(null); };
+    }, [signedIn, contentUrl, contentKey, contentSpace, email]);
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }
@@ -70,6 +108,8 @@ export function AdminApp({ registry, op, auth }) {
     // An invite or reset link signed the person in: Set password before the shell (members management §6).
     if (session.arrival)
         return _jsx(SetPasswordView, { client: session.client, mode: session.arrival, onDone: session.clearArrival });
+    if (schema && schemaBehind(schema.database, schema.required))
+        return _jsx(SchemaNotice, { status: schema });
     let main;
     if (head === "pages" && !tail)
         main = _jsx(PagesList, { ops: ops, registry: registry });
@@ -89,5 +129,5 @@ export function AdminApp({ registry, op, auth }) {
         main = _jsx(MediaScreen, {});
     else
         main = _jsx(ErrorPane, { message: "Not found." });
-    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(AssetsProvider, { ops: ops, media: registry.media, children: _jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }) }) }) }));
+    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(PresenceProvider, { value: presence, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(TimeZoneProvider, { zone: registry.timeZone, children: _jsxs(AssetsProvider, { ops: ops, media: registry.media, children: [_jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }), _jsx(ConfirmHost, {})] }) }) }) }) }));
 }