smoodly 0.0.25 → 0.0.27

package/README.md

@@ -468,6 +468,28 @@ Implemented:
   The media and refs walks descend into documents against the element
   schemas (`elements` beside `sections` in the store, resolve and site
   options).
+- The token guard and presence (spec 2026-09-26 concurrency): every
+  draft write carries `{ versionId, savedAt }` from the locale row's
+  `draftSavedAt` and is refused as `conflict` + `stale` when the draft
+  moved (the write itself is conditional in Supabase); the admin freezes
+  under a notice naming who saved and when and reloads through "Load
+  their version"; one private Realtime channel per space shows who edits
+  what (a lock in the lists, a line under the top bar) and announces
+  saves so a clean view refreshes and a dirty one freezes early. Schema
+  version 2 adds the draft-pointer foreign keys and the channel policies.
+- The security pass over the database boundary (spec 2026-09-26 security
+  pass): the presence channel admits a signed-in member of the topic's
+  space (`smoodly_presence_member()`, the socket carries the session
+  token through the client's `accessToken` callback, re-sent on refresh);
+  every function pins `search_path`; the three mutation RPCs are revoked
+  from `anon`/`public`. Schema version 3. The threat table, one test per
+  cell: content, `refs`/`members`, `spaces`/`smoodly_meta` and storage
+  columns — `test/isolation.supabase.test.ts` ("space isolation", "read
+  keys", "cloud state rows") and `test/rls.supabase.test.ts`; presence
+  and RPC columns — `isolation.supabase.test.ts` ("signed-in users and
+  the public keys"); admin ops — `test/admin-auth.test.ts`,
+  `test/admin-auth.supabase.test.ts`, `test/admin-ops.test.ts` ("members
+  ops").
 
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
@@ -495,6 +517,48 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-26, security pass)
+
+- The bridge posts with `"*"` on both sides. Safe today: the admin
+  accepts a message only when `e.source` is its own iframe's window, and
+  the canvas acts on two kinds, refresh and scroll. The target-origin
+  pass belongs to the content-surface sweep (spec §Out of scope).
+- The invite's `redirectTo` is a client-supplied string bounded by the
+  auth project's redirect allow-list; a same-origin check in the op is
+  one line when wanted.
+- Every op call with a junk token costs one `auth.getUser` against the
+  auth project; rate limiting is the session-model spec's (OQ 20).
+- The content-surface sweep: `f.link` values reach section components
+  unfiltered, uploads allow SVG and PDF on a public bucket (SVG served
+  with `?download=`), the custom CSS refusal list, richtext hrefs.
+- A refused private-channel join surfaces as `CHANNEL_ERROR` (about 80
+  ms on the local stack); the suite asserts "not SUBSCRIBED".
+- The isolation suite's `join` helper still uses a bare
+  `realtime.setAuth(key)`: its positive cases resolve on the first
+  SUBSCRIBED, before realtime-js re-asks the default `accessToken`
+  callback and the server closes the channel. Fine for proving the
+  policy; a client that must stay joined passes `accessToken` (what
+  `connectRealtime` does since 3ed8931).
+
+## Follow-ups (logged 2026-09-26, concurrency spec)
+
+- A hard lock with takeover, if a real team asks: presence has the facts.
+- Presence on the members and media screens; today only pages, entries and
+  global items track.
+- Postgres Changes for live list refresh; the lists still load on navigation.
+- Field-level merging of two editors' changes; the guard refuses whole documents.
+- Publish, discard and restore compare the token, then move the pointer under a
+  pointer filter: a save that rewrites the same draft row in place between the
+  two is published unseen (one round trip wide). A SQL function would close it.
+- Publish leaves the token unchanged (the pointer and its saved time do not move),
+  so a publish with a token from before another person's publish of the same
+  draft succeeds — the content is the same. Recorded, not a bug.
+- The read client over the read key (DESIGN.md OQ 31) can reuse `publicContent()`.
+- A dropped socket clears presence on Realtime's timeout (tens of seconds); the
+  lock outlives a closed tab by that much.
+- The live suites wipe `members` and the content tables; a pane walk after
+  them needs `npm run reseed` (or `scripts/demo-editor.ts`) first.
+
 ## Follow-ups (logged 2026-09-26, browser suite)
 
 - Drag and drop has no browser test (spec §4): the outline, the pages
@@ -1812,8 +1876,8 @@ the toolbar instead of pushing the content.
 - Once the policy-based published read exists, decide whether it becomes the canonical headless read path and the generated per-collection views turn optional (cloud has no views).
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
-- Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- **Verified and kept 2026-09-26 (security pass §3)** — Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
+- **Verified and kept 2026-09-26 (security pass §3)** — `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/editor/EditorView.js

@@ -60,6 +60,12 @@ import { ResizeHandle } from "../ui/ResizeHandle.js";
 import { PublishControl } from "../ui/PublishControl.js";
 import { confirm, DISCARD_CONFIRM } from "../ui/confirm.js";
 import { HistoryModal, historyRows } from "../ui/HistoryModal.js";
+import { draftToken } from "../../draft-token.js";
+import { isStale, staleInfoOf } from "../shell/stale.js";
+import { StaleBanner } from "../ui/StaleBanner.js";
+import { usePresence, usePresenceState, useSavedElsewhere, useTrackPresence } from "../shell/presence-context.js";
+import { editorsOf } from "../shell/presence.js";
+import { PresenceLine } from "../ui/PresenceLine.js";
 import { Banner as BannerBox, Breadcrumb, Button, FieldErrorList, IconButton, LinkButton, SaveIndicator, Tabs, TopBar, } from "../ui/primitives.js";
 export const withEditorParam = (url) => (url.includes("?") ? `${url}&smoodly-editor=1` : `${url}?smoodly-editor=1`);
 /** The site URL of a stored version — History's iframe (spec 2026-09-13 history §5); no editor parameter, so no bridge. */
@@ -67,6 +73,10 @@ export const withVersionParam = (url, versionId) => `${url}${url.includes("?") ?
 export function EditorView({ ops, registry, id }) {
     const adminHref = useAdminHref();
     const [record, setRecord] = useState(null);
+    const recordRef = useRef(record);
+    recordRef.current = record;
+    /** The guard's refusal (spec 2026-09-26 concurrency §4): the view freezes under the banner until Load their version. */
+    const [stale, setStale] = useState(null);
     const [tree, setTree] = useState(null);
     const [loadError, setLoadError] = useState(null);
     const [ready, setReady] = useState(false);
@@ -77,6 +87,8 @@ export function EditorView({ ops, registry, id }) {
     // The locales the parent exists in — "Add locale" offers only these.
     const [parentLocales, setParentLocales] = useState([]);
     const [selectedId, setSelectedId] = useState(null);
+    /** A reload after someone else's save (spec 2026-09-26 concurrency §5) keeps what is selected; every other reload clears it. */
+    const keepSelectionRef = useRef(false);
     const [hoverId, setHoverId] = useState(null);
     const [hoverField, setHoverField] = useState(null);
     const [revealReq, setRevealReq] = useState(null);
@@ -112,21 +124,26 @@ export function EditorView({ ops, registry, id }) {
     // (Read once: localeFromUrl also remembers the locale.)
     const [openedLocale] = useState(() => localeFromUrl(registry));
     const treeLocaleRef = useRef(openedLocale);
+    /** The token of the row the tree belongs to — what every guarded op sends (spec 2026-09-26 concurrency §1). */
+    const token = () => { const row = recordRef.current?.locales[treeLocaleRef.current]; return row ? draftToken(row) : null; };
     // Every edit marks the draft dirty; a debounced saveDraft persists, with
     // retry on failure, and the bridge refreshes the iframe on the save ack —
     // now, or once an inline session ends (spec 2026-09-10 §7).
-    const { saveState, mark, flush } = useDraftAutosave({
+    const { saveState, mark, flush, reset } = useDraftAutosave({
         read: () => treeRef.current,
         persist: async (t) => {
             const target = treeLocaleRef.current;
-            const r = await ops.pages.saveDraft(id, target, t);
+            const r = await ops.pages.saveDraft(id, target, t, token());
             if (r.ok) {
-                // The badge and Publish follow each save without a re-get: saveDraft answers with the version id.
+                // The badge and Publish follow each save without a re-get: saveDraft answers with the version id and the new token.
                 setRecord((rec) => rec?.locales[target]
-                    ? { ...rec, locales: { ...rec.locales, [target]: { ...rec.locales[target], draftVersionId: r.data.versionId } } }
+                    ? { ...rec, locales: { ...rec.locales, [target]: { ...rec.locales[target], draftVersionId: r.data.versionId, draftSavedAt: r.data.draft?.savedAt ?? null } } }
                     : rec);
                 setDirty(false);
+                presence?.announce(pageTarget(target), r.data.draft?.savedAt ?? null);
             }
+            else if (isStale(r))
+                setStale(staleInfoOf(r));
             return r;
         },
         onSaved: () => inlineRef.current?.onSaved(),
@@ -134,7 +151,7 @@ export function EditorView({ ops, registry, id }) {
     // Edits to a global block go to the global entry through their own
     // autosave (spec 2026-09-13 §4); the save ack refreshes the canvas
     // through the same inline-session deferral as the page's.
-    const globalEdit = useGlobalEdit({ ops, onSaved: () => { setGlobalDirty(false); inlineRef.current?.onSaved(); } });
+    const globalEdit = useGlobalEdit({ ops, onSaved: (name) => { setGlobalDirty(false); inlineRef.current?.onSaved(); presence?.announce({ kind: "global", id: name, locale }, null); } });
     const patchGlobal = (name, path, value) => {
         globalEdit.patch(name, path, value);
         setGlobalDirty(true);
@@ -148,6 +165,12 @@ export function EditorView({ ops, registry, id }) {
         clearBanner: () => setBanner(null),
         reload: () => setReloadKey((k) => k + 1),
     });
+    // Presence (spec 2026-09-26 concurrency §5): tracked once the record exists, the others on it, every ack announced.
+    const target = record ? { kind: "page", id, locale } : null;
+    useTrackPresence(target);
+    const { others } = usePresenceState();
+    const presence = usePresence();
+    const pageTarget = (forLocale) => ({ kind: "page", id, locale: forLocale });
     // The URL that serves this page, per locale, from the store's paths
     // index — the label is the CMS path, the canvas and "View live" take
     // the site URL (href applied server-side by pages.get).
@@ -177,11 +200,18 @@ export function EditorView({ ops, registry, id }) {
             setReady(false);
             setTree(null);
             treeRef.current = null;
-            setSelectedId(null);
-            setHoverId(null);
+            const keepSelection = keepSelectionRef.current;
+            keepSelectionRef.current = false;
+            if (!keepSelection) {
+                setSelectedId(null);
+                setHoverId(null);
+            }
             setFolder(false);
             globalEdit.reset(); // a new locale or a reload is a new canvas; the switch flushed first
+            if (keepSelection && selectedItemName)
+                void globalEdit.load(selectedItemName, locale); // the kept selection is a global item: load it again
             setDirty(false);
+            setStale(null);
             setTouched(false);
             setGlobalDirty(false);
             setGlobalTouched(false);
@@ -350,6 +380,24 @@ export function EditorView({ ops, registry, id }) {
         if (globalEdit.loadError)
             setBanner({ text: globalEdit.loadError });
     }, [globalEdit.loadError]);
+    // A global item's autosave refused by the guard freezes the whole editor too (§4).
+    useEffect(() => {
+        if (globalEdit.stale)
+            setStale(globalEdit.stale);
+    }, [globalEdit.stale]);
+    /** Load their version (§4): drop the frozen state; the load effect resets the tree, the globals and the flags. */
+    const loadTheirs = () => { setStale(null); reset(); setReloadKey((k) => k + 1); };
+    // Someone else saved this page (§5): clean → their version silently; unsaved edits anywhere → the freeze at once.
+    useSavedElsewhere(target, (event) => {
+        if (stale)
+            return;
+        if (dirty || globalDirty || saveState !== "saved" || globalEdit.saveState !== "saved")
+            setStale({ by: event.email, at: Date.now() });
+        else {
+            keepSelectionRef.current = true;
+            setReloadKey((k) => k + 1);
+        }
+    });
     // Selecting from the outline must reveal the block. The canvas column is
     // the scroller now (the iframe has no scrollbar of its own — it is sized to
     // the full document), so scroll it to the rect the bridge reported.
@@ -541,7 +589,7 @@ export function EditorView({ ops, registry, id }) {
         }
         let result;
         try {
-            result = await ops.pages.publish(id, locale);
+            result = await ops.pages.publish(id, locale, token());
         }
         catch (e) {
             console.error(e);
@@ -552,9 +600,13 @@ export function EditorView({ ops, registry, id }) {
         setPageBusy(null);
         if (result.ok) {
             setRecord(result.data);
+            presence?.announce(pageTarget(locale), result.data.locales[locale]?.draftSavedAt ?? null);
             setPublished(true);
             setTimeout(() => setPublished(false), 1600);
         }
+        else if (isStale(result)) {
+            setStale(staleInfoOf(result));
+        }
         else {
             setBanner({ text: result.message, fields: result.fields });
         }
@@ -573,17 +625,21 @@ export function EditorView({ ops, registry, id }) {
         }
         let result;
         try {
-            result = await ops.pages.discardDraft(id, locale);
+            result = await ops.pages.discardDraft(id, locale, token());
         }
         catch {
             result = { ok: false, code: "internal", message: "Couldn't reach the server." };
         }
         setPageBusy(null);
         if (!result.ok) {
-            setBanner({ text: result.message });
+            if (isStale(result))
+                setStale(staleInfoOf(result));
+            else
+                setBanner({ text: result.message });
             return;
         }
         setRecord(result.data);
+        presence?.announce(pageTarget(locale), result.data.locales[locale]?.draftSavedAt ?? null);
         setReloadKey((k) => k + 1); // the tree and the canvas come back from the store
     };
     /** Unpublish (§5): the locale goes off the site; the draft stays for a later Publish. */
@@ -631,16 +687,20 @@ export function EditorView({ ops, registry, id }) {
     const doRestore = async (versionId) => {
         let result;
         try {
-            result = await ops.pages.restore(id, locale, versionId);
+            result = await ops.pages.restore(id, locale, versionId, token());
         }
         catch {
             result = { ok: false, code: "internal", message: "Couldn't reach the server." };
         }
         if (!result.ok) {
-            setBanner({ text: result.message });
+            if (isStale(result))
+                setStale(staleInfoOf(result));
+            else
+                setBanner({ text: result.message });
             return false;
         }
         setRecord(result.data);
+        presence?.announce(pageTarget(locale), result.data.locales[locale]?.draftSavedAt ?? null);
         setReloadKey((k) => k + 1);
         return true;
     };
@@ -650,8 +710,8 @@ export function EditorView({ ops, registry, id }) {
         setGlobalBusy("publish");
         const r = await globalEdit.setStatus(name, "published");
         setGlobalBusy(null);
-        if (!r.ok)
-            setBanner({ text: r.message, fields: r.fields });
+        if (!r.ok && !isStale(r))
+            setBanner({ text: r.message, fields: r.fields }); // a stale refusal arrives through globalEdit.stale
     };
     const doUnpublishGlobal = async (name) => {
         setBanner(null);
@@ -673,15 +733,19 @@ export function EditorView({ ops, registry, id }) {
             return;
         }
         let r;
+        const itemRow = globalEdit.items[name]?.record.locales[locale];
         try {
-            r = await ops.globals.discardDraft(name, locale);
+            r = await ops.globals.discardDraft(name, locale, itemRow ? draftToken(itemRow) : null);
         }
         catch {
             r = { ok: false, code: "internal", message: "Couldn't reach the server." };
         }
         setGlobalBusy(null);
         if (!r.ok) {
-            setBanner({ text: r.message });
+            if (isStale(r))
+                setStale(staleInfoOf(r));
+            else
+                setBanner({ text: r.message });
             return;
         }
         // The item reloads from the store; the canvas refreshes through the same path as a save ack.
@@ -765,7 +829,7 @@ export function EditorView({ ops, registry, id }) {
                                 trailing: registry.locales.supported.length > 1 && (_jsx(LocaleSwitcher, { registry: registry, present: record ? registry.locales.supported.filter((l) => record.locales[l]) : [locale], parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => { void doAddLocale(l); } })),
                             },
                             { label },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
                                     setSelectedId(null); }, children: _jsxs("div", { className: "sm-page", style: { overflow: "hidden" }, children: [iframeSrc ? (_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: "Page canvas", style: { width: "100%", height: docH, border: 0, display: "block" } })) : (_jsx("div", { className: "sm-canvas__loading", children: "Loading canvas\u2026" })), _jsx(CanvasOverlay, { emptyZones: emptyZones, hoverRect: hoverRect, hoverGlobal: hoverGlobal, selection: selection, fieldHover: fieldHover, editing: editing, plusButtons: plusButtons, onPlus: (p, x, y) => setPicker({ zone: p.zone, index: p.index, x: x - 150, y: y + 12 }), onMove: doMove, onDuplicate: doDuplicate, onRemove: doRemove }), inline.richtext && (() => {
                                             const { session } = inline.richtext;
                                             const item = globalItemOf(session.node);
@@ -781,7 +845,7 @@ export function EditorView({ ops, registry, id }) {
                                                     else
                                                         mutate((t) => patchNodePath(t, session.node, session.path, doc));
                                                 }, onEscape: inline.end }));
-                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
+                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState, pending: globalDirty })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
                                             !isFixedNode(record, registry) &&
                                             !(record.parentId === null && record.locales[registry.locales.default]?.slug === registry.homePageSlug)
                                             ? () => { void doRemoveLocale(); }

package/dist/admin/editor/autosave.d.ts

@@ -1,5 +1,5 @@
 import type { OpResult } from "../ops.ts";
-export type SaveState = "saved" | "saving" | "error";
+export type SaveState = "saved" | "saving" | "error" | "stale";
 export type DraftAutosave = {
     /** Record a local change; a debounced save follows. */
     mark(): void;
@@ -11,6 +11,8 @@ export type DraftAutosave = {
     subscribe(listener: () => void): () => void;
     /** Cancel pending timers; call on unmount. */
     dispose(): void;
+    /** Leave `stale` after the record was reloaded: timers cleared, the reloaded value counts as saved. */
+    reset(): void;
 };
 export declare function createDraftAutosave<T>(opts: {
     read: () => T | null;
@@ -28,4 +30,5 @@ export declare function useDraftAutosave<T>(opts: DraftAutosaveOptions<T>): {
     saveState: SaveState;
     mark: () => void;
     flush: () => Promise<boolean>;
+    reset: () => void;
 };

package/dist/admin/editor/autosave.js

@@ -46,6 +46,12 @@ export function createDraftAutosave(opts) {
             opts.onSaved?.();
             return true;
         }
+        else if (result.code === "conflict" && result.stale) {
+            // The guard refused (spec 2026-09-26 concurrency §4): terminal, never retried —
+            // the view freezes and only a reload (reset) brings the controller back.
+            setState("stale");
+            return false;
+        }
         else {
             // Keep local state; retry with a doubling, capped delay.
             setState("error");
@@ -62,12 +68,16 @@ export function createDraftAutosave(opts) {
             return () => { listeners.delete(listener); };
         },
         mark() {
+            if (state === "stale")
+                return;
             revision += 1;
             if (debounceTimer)
                 clearTimeout(debounceTimer);
             debounceTimer = setTimeout(() => { debounceTimer = null; void save(); }, debounceMs);
         },
         flush() {
+            if (state === "stale")
+                return Promise.resolve(false);
             if (revision === savedRevision)
                 return Promise.resolve(true);
             if (debounceTimer) {
@@ -86,6 +96,19 @@ export function createDraftAutosave(opts) {
                 retryTimer = null;
             }
         },
+        reset() {
+            if (debounceTimer) {
+                clearTimeout(debounceTimer);
+                debounceTimer = null;
+            }
+            if (retryTimer) {
+                clearTimeout(retryTimer);
+                retryTimer = null;
+            }
+            savedRevision = revision;
+            retryDelay = retryBaseMs;
+            setState("saved");
+        },
     };
 }
 /** React glue: one controller per mount, always calling the latest
@@ -104,5 +127,5 @@ export function useDraftAutosave(opts) {
     }));
     useEffect(() => () => controller.dispose(), [controller]);
     const saveState = useSyncExternalStore(controller.subscribe, controller.getState, controller.getState);
-    return { saveState, mark: controller.mark, flush: controller.flush };
+    return { saveState, mark: controller.mark, flush: controller.flush, reset: controller.reset };
 }

package/dist/admin/editor/global-edit.d.ts

@@ -1,6 +1,7 @@
 import type { EntryRecord, EntryUsage } from "../../entry-store.ts";
 import type { AdminOps, OpResult } from "../ops.ts";
 import { type SaveState } from "./autosave.ts";
+import { type StaleInfo } from "../shell/stale.ts";
 export type GlobalEditItem = {
     name: string;
     locale: string;
@@ -15,6 +16,8 @@ export type GlobalEditState = {
     items: Record<string, GlobalEditItem>;
     saveState: SaveState;
     loadError: string | null;
+    /** The guard's refusal (spec 2026-09-26 concurrency §4): set once, cleared only by reset(). */
+    stale: StaleInfo | null;
 };
 export type GlobalEdit = {
     getState(): GlobalEditState;
@@ -32,7 +35,8 @@ export type GlobalEdit = {
 };
 export declare function createGlobalEdit(opts: {
     ops: Pick<AdminOps, "globals">;
-    onSaved?: () => void;
+    /** Per saved item, with its name (presence announces each; spec 2026-09-26 concurrency §5). */
+    onSaved?: (name: string) => void;
     debounceMs?: number;
     retryBaseMs?: number;
     retryCapMs?: number;

package/dist/admin/editor/global-edit.js

@@ -1,8 +1,11 @@
 import { setAtPath } from "../field-paths.js";
 import { createDraftAutosave } from "./autosave.js";
+import { draftToken } from "../../draft-token.js";
+import { isStale, staleInfoOf } from "../shell/stale.js";
 export function createGlobalEdit(opts) {
     let items = {};
     let loadError = null;
+    let stale = null;
     let generation = 0;
     const loading = new Set();
     const rev = new Map();
@@ -20,7 +23,7 @@ export function createGlobalEdit(opts) {
                 const at = rev.get(item.name) ?? 0;
                 let r;
                 try {
-                    r = await opts.ops.globals.save(item.name, item.locale, item.fields);
+                    r = await opts.ops.globals.save(item.name, item.locale, item.fields, draftToken(item.record.locales[item.locale]));
                 }
                 catch {
                     r = { ok: false, code: "internal", message: "Couldn't reach the server." };
@@ -30,8 +33,11 @@ export function createGlobalEdit(opts) {
                     savedRev.set(item.name, at);
                     if (current)
                         items = { ...items, [item.name]: { ...current, record: r.data, errors: {} } };
+                    opts.onSaved?.(item.name);
                 }
                 else {
+                    if (isStale(r))
+                        stale = staleInfoOf(r);
                     failed ?? (failed = r);
                     if (current) {
                         items = { ...items, [item.name]: { ...current, errors: Object.fromEntries((r.fields ?? []).map((f) => [f.field, f.message])) } };
@@ -41,13 +47,12 @@ export function createGlobalEdit(opts) {
             emit();
             return failed ?? { ok: true, data: null };
         },
-        onSaved: opts.onSaved,
         debounceMs: opts.debounceMs,
         retryBaseMs: opts.retryBaseMs,
         retryCapMs: opts.retryCapMs,
     });
     autosave.subscribe(emit);
-    const getState = () => (snapshot ?? (snapshot = { items, saveState: autosave.getState(), loadError }));
+    const getState = () => (snapshot ?? (snapshot = { items, saveState: autosave.getState(), loadError, stale }));
     return {
         getState,
         subscribe(listener) {
@@ -98,7 +103,7 @@ export function createGlobalEdit(opts) {
             }
             let r;
             try {
-                r = await opts.ops.globals.setStatus(name, item.locale, status);
+                r = await opts.ops.globals.setStatus(name, item.locale, status, draftToken(item.record.locales[item.locale]));
             }
             catch {
                 r = { ok: false, code: "internal", message: "Couldn't reach the server." };
@@ -107,6 +112,10 @@ export function createGlobalEdit(opts) {
                 items = { ...items, [name]: { ...items[name], record: r.data } };
                 emit();
             }
+            else if (isStale(r)) {
+                stale = staleInfoOf(r);
+                emit();
+            }
             return r;
         },
         reset() {
@@ -116,7 +125,8 @@ export function createGlobalEdit(opts) {
             savedRev.clear();
             loading.clear();
             loadError = null;
-            autosave.dispose();
+            stale = null;
+            autosave.reset(); // timers cleared, and a stale controller comes back for the new canvas
             emit();
         },
         dispose: autosave.dispose,

package/dist/admin/editor/useGlobalEdit.d.ts

@@ -2,5 +2,5 @@ import type { AdminOps } from "../ops.ts";
 import { type GlobalEdit, type GlobalEditState } from "./global-edit.ts";
 export declare function useGlobalEdit({ ops, onSaved }: {
     ops: Pick<AdminOps, "globals">;
-    onSaved?: () => void;
+    onSaved?: (name: string) => void;
 }): GlobalEditState & Pick<GlobalEdit, "load" | "patch" | "flush" | "setStatus" | "reset">;

package/dist/admin/editor/useGlobalEdit.js

@@ -7,7 +7,7 @@ import { createGlobalEdit } from "./global-edit.js";
 export function useGlobalEdit({ ops, onSaved }) {
     const latest = useRef(onSaved);
     latest.current = onSaved;
-    const [controller] = useState(() => createGlobalEdit({ ops, onSaved: () => latest.current?.() }));
+    const [controller] = useState(() => createGlobalEdit({ ops, onSaved: (name) => latest.current?.(name) }));
     useEffect(() => () => { void controller.flush(); controller.dispose(); }, [controller]);
     const state = useSyncExternalStore(controller.subscribe, controller.getState, controller.getState);
     return {

package/dist/admin/next/create-admin.d.ts

@@ -2,10 +2,14 @@ import type { ReactNode } from "react";
 import type { ResolvedConfig } from "../../config.ts";
 import type { AdminOpAction } from "../ops.ts";
 import type { AuthConfig } from "../shell/session.ts";
+import type { ContentConfig } from "../../env.ts";
+/** `content` (optional) is the content project's public config for editing presence (spec 2026-09-26
+ *  concurrency §5); absent — an app wired before it — presence is off and everything else works. */
 export declare function createSmoodlyAdmin(input: {
     config: ResolvedConfig;
     op: AdminOpAction;
     auth: () => AuthConfig;
+    content?: () => ContentConfig;
 }): {
     AdminPage: () => null;
     AdminLayout: ({ children }: {

package/dist/admin/next/create-admin.js

@@ -2,6 +2,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { serializeAdminConfig } from "../serialize.js";
 import { AdminApp } from "../shell/AdminApp.js";
 import { AdminStyles } from "../ui/theme.js";
+/** `content` (optional) is the content project's public config for editing presence (spec 2026-09-26
+ *  concurrency §5); absent — an app wired before it — presence is off and everything else works. */
 export function createSmoodlyAdmin(input) {
     const registry = serializeAdminConfig(input.config);
     /** The catch-all page only makes every /admin URL exist. The shell is
@@ -22,7 +24,7 @@ export function createSmoodlyAdmin(input) {
      *  on this element before React hydrates, on purpose (no white flash
      *  for a dark-mode editor), so the attribute differs from the server's. */
     function AdminLayout({ children }) {
-        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth() }), children] }));
+        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth(), content: input.content?.() }), children] }));
     }
     return { AdminPage, AdminLayout };
 }

package/dist/admin/next/index.d.ts

@@ -4,5 +4,6 @@ export type { AdminOpCall, AdminOpAction, AdminOps, OpResult, MembersListResult
 export type { InviteInput, InviteResult, MemberRecord } from "../../member-store.ts";
 export type { MemberRole } from "../../permissions.ts";
 export type { AuthConfig } from "../shell/session.ts";
+export type { ContentConfig } from "../../env.ts";
 export type { AdminAuth } from "../auth.ts";
 export { supabaseAdminAuth } from "../supabase-auth.ts";