smoodly 0.0.25 → 0.0.27

package/dist/admin/ops-impl.js

@@ -12,10 +12,15 @@ import { SETTINGS_KEY, CSS_KEY } from "../global.js";
 import { withDefaults } from "../field-defaults.js";
 import { elementSchemas } from "../richtext-walk.js";
 import { SCHEMA_VERSION } from "../schema-version.js";
+import { draftToken, isDraftToken, StaleDraftError } from "../draft-token.js";
 const ok = (data) => ({ ok: true, data });
 /** A history row without its content (spec 2026-09-13 history §6). */
 const summary = ({ id, savedAt }) => ({ id, savedAt });
 const err = (code, message, fields) => ({ ok: false, code, message, ...(fields ? { fields } : {}) });
+/** The client's token is untrusted data: undefined skips, null is "no draft", the shape is the token, anything else is refused. */
+const BAD_TOKEN = Symbol("bad token");
+const tokenArg = (v) => v === undefined ? undefined : v === null ? null : isDraftToken(v) ? v : BAD_TOKEN;
+const badToken = () => err("validation", "smoodly: malformed draft token.");
 /** Own-property, non-array plain object — same shape guard the tree checks
  * below and `runAdminOp`'s envelope check both lean on. */
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -42,6 +47,9 @@ function isPageTree(tree) {
 }
 /** Store throws are stringly-typed; classify the known guards, default to internal. */
 const classify = (e) => {
+    // The guard's refusal (spec 2026-09-26 concurrency §2): typed, so it never depends on message matching.
+    if (e instanceof StaleDraftError)
+        return { ok: false, code: "conflict", stale: true, by: e.by, at: e.at, message: e.message };
     const message = e instanceof Error ? e.message : String(e);
     if (message.includes("already exists in locale"))
         return err("conflict", message);
@@ -324,20 +332,28 @@ export function createAdminOps(deps) {
                 expireTree();
                 return ok(created);
             }),
-            saveDraft: (id, locale, tree) => guard(async () => {
+            saveDraft: (id, locale, tree, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
                 if (!isPageTree(tree))
                     return err("validation", "smoodly: malformed page tree.");
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!(await pages.getPage(id)))
                     return err("not_found", `smoodly: no page "${id}".`);
-                return ok({ versionId: (await pages.saveDraft(id, locale, tree, by)).id });
+                const version = await pages.saveDraft(id, locale, tree, by, token);
+                const after = await pages.getPage(id);
+                return ok({ versionId: version.id, draft: after?.locales[locale] ? draftToken(after.locales[locale]) : null });
             }),
-            publish: (id, locale) => guard(async () => {
+            publish: (id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -373,7 +389,7 @@ export function createAdminOps(deps) {
                 if (fieldErrors.length > 0) {
                     return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed fields first.`, fieldErrors);
                 }
-                const published = await pages.publish(id, locale, by);
+                const published = await pages.publish(id, locale, by, token);
                 // The parent's cached unit lists its published children.
                 expirePages([published.id, published.parentId]);
                 expireTree();
@@ -398,10 +414,13 @@ export function createAdminOps(deps) {
                 expireTree();
                 return ok(off);
             }),
-            discardDraft: (id, locale) => guard(async () => {
+            discardDraft: (id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -411,7 +430,7 @@ export function createAdminOps(deps) {
                 if (!row.publishedVersionId) {
                     return err("blocked", `smoodly: "${nameOf(record)}" has nothing published in ${locale} — there is no version to restore.`);
                 }
-                const restored = await pages.discardDraft(id, locale, by);
+                const restored = await pages.discardDraft(id, locale, by, token);
                 expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
@@ -423,10 +442,13 @@ export function createAdminOps(deps) {
                     return err("not_found", `smoodly: no page "${id}".`);
                 return ok((await pages.listVersions(id, locale)).map(summary));
             }),
-            restore: (id, locale, versionId) => guard(async () => {
+            restore: (id, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const record = await pages.getPage(id);
                 if (!record)
                     return err("not_found", `smoodly: no page "${id}".`);
@@ -438,7 +460,7 @@ export function createAdminOps(deps) {
                 if (!version || version.pageId !== id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of this page in ${locale}.`);
                 }
-                const restored = await pages.restore(id, locale, versionId, by);
+                const restored = await pages.restore(id, locale, versionId, by, token);
                 expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
@@ -598,22 +620,28 @@ export function createAdminOps(deps) {
                 expireCollection(collection);
                 return ok(created);
             }),
-            save: (collection, id, locale, fields) => guard(async () => {
+            save: (collection, id, locale, fields, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const descriptors = collectionFields(collection);
                 if (!descriptors)
                     return err("not_found", `smoodly: no collection named "${collection}".`);
-                const entry = await entries.update(collection, id, locale, fields, by);
+                const entry = await entries.update(collection, id, locale, fields, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
             }),
-            setStatus: (collection, id, locale, status) => guard(async () => {
+            setStatus: (collection, id, locale, status, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (status === "published") {
                     // A draft may be incomplete; what goes live may not (spec 2026-09-14 §2).
                     const descriptors = collectionFields(collection);
@@ -628,16 +656,19 @@ export function createAdminOps(deps) {
                     if (fieldErrors.length > 0)
                         return err("validation", "Some fields need attention.", fieldErrors);
                 }
-                const entry = await entries.setStatus(collection, id, locale, status, by);
+                const entry = await entries.setStatus(collection, id, locale, status, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
             }),
-            discardDraft: (collection, id, locale) => guard(async () => {
+            discardDraft: (collection, id, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
-                const restored = await entries.discardDraft(collection, id, locale, by);
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
+                const restored = await entries.discardDraft(collection, id, locale, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(restored);
@@ -657,15 +688,18 @@ export function createAdminOps(deps) {
                 }
                 return ok({ ...summary(version), fields: version.fields });
             }),
-            restore: (collection, id, locale, versionId) => guard(async () => {
+            restore: (collection, id, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const version = typeof versionId === "string" ? await entries.getVersion(collection, versionId) : null;
                 if (!version || version.entryId !== id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of entry "${id}" in "${collection}", locale ${locale}.`);
                 }
-                const restored = await entries.restore(collection, id, locale, versionId, by);
+                const restored = await entries.restore(collection, id, locale, versionId, by, token);
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(restored);
@@ -720,25 +754,31 @@ export function createAdminOps(deps) {
                 const usage = await entries.referencesTo(name, record.id);
                 return ok({ name, record, locale, fields: entryFieldsIn(record, locale), usage });
             }),
-            save: (name, locale, fields) => guard(async () => {
+            save: (name, locale, fields, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const item = globalItem(name);
                 if (!item)
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
                 if (!record)
                     return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const saved = await entries.update(name, record.id, locale, fields, by);
+                const saved = await entries.update(name, record.id, locale, fields, by, token);
                 // fanOut expires `global:<name>` itself — this row IS the item's.
                 await fanOut(record.id);
                 return ok(saved);
             }),
-            setStatus: (name, locale, status) => guard(async () => {
+            setStatus: (name, locale, status, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 const item = globalItem(name);
                 if (!item)
                     return err("not_found", `smoodly: no global item named "${name}".`);
@@ -757,21 +797,24 @@ export function createAdminOps(deps) {
                     if (fieldErrors.length > 0)
                         return err("validation", "Some fields need attention.", fieldErrors);
                 }
-                const changed = await entries.setStatus(name, record.id, locale, status, by);
+                const changed = await entries.setStatus(name, record.id, locale, status, by, token);
                 // see save: the fan-out carries the item's own tag.
                 await fanOut(record.id);
                 return ok(changed);
             }),
-            discardDraft: (name, locale) => guard(async () => {
+            discardDraft: (name, locale, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!globalItem(name))
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
                 if (!record)
                     return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const restored = await entries.discardDraft(name, record.id, locale, by);
+                const restored = await entries.discardDraft(name, record.id, locale, by, token);
                 await fanOut(record.id);
                 return ok(restored);
             }),
@@ -798,10 +841,13 @@ export function createAdminOps(deps) {
                 }
                 return ok({ ...summary(version), fields: version.fields });
             }),
-            restore: (name, locale, versionId) => guard(async () => {
+            restore: (name, locale, versionId, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
+                const token = tokenArg(expected);
+                if (token === BAD_TOKEN)
+                    return badToken();
                 if (!globalItem(name))
                     return err("not_found", `smoodly: no global item named "${name}".`);
                 const record = await globalRecord(name);
@@ -811,7 +857,7 @@ export function createAdminOps(deps) {
                 if (!version || version.entryId !== record.id || version.locale !== locale) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of global item "${name}" in ${locale}.`);
                 }
-                const restored = await entries.restore(name, record.id, locale, versionId, by);
+                const restored = await entries.restore(name, record.id, locale, versionId, by, token);
                 await fanOut(record.id);
                 return ok(restored);
             }),

package/dist/admin/ops.d.ts

@@ -6,11 +6,17 @@ import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-
 import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
+import type { DraftToken } from "../draft-token.ts";
 export type OpError = {
     ok: false;
     code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized";
     message: string;
     fields?: FieldError[];
+    /** A `conflict` from the token guard (spec 2026-09-26 concurrency §2): the draft moved since the client loaded it. */
+    stale?: true;
+    /** Who wrote it last and when — the freeze notice's two facts. */
+    by?: string | null;
+    at?: number;
 };
 export type OpResult<T> = {
     ok: true;
@@ -110,14 +116,16 @@ export type AdminOps = {
         /** not_found only when the page is missing; an absent locale comes back with `draft: null`. */
         get(id: string, locale: string): Promise<OpResult<PageGetResult>>;
         create(input: PageCreateInput): Promise<OpResult<PageRecord>>;
-        saveDraft(id: string, locale: string, tree: PageTree): Promise<OpResult<{
+        /** `expected` is the token the client last saw (spec 2026-09-26 concurrency §1); `undefined` skips the check — the admin always sends one. */
+        saveDraft(id: string, locale: string, tree: PageTree, expected?: DraftToken | null): Promise<OpResult<{
             versionId: string;
+            draft: DraftToken | null;
         }>>;
-        publish(id: string, locale: string): Promise<OpResult<PageRecord>>;
+        publish(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         /** Takes the locale off the site; status draft, pointers kept. Never the site root or a fixed node (spec 2026-09-13 publish flow §5). */
         unpublish(id: string, locale: string): Promise<OpResult<PageRecord>>;
         /** The draft back to the published version (§4); `blocked` when nothing is published in the locale. */
-        discardDraft(id: string, locale: string): Promise<OpResult<PageRecord>>;
+        discardDraft(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         delete(id: string): Promise<OpResult<null>>;
         rename(id: string, patch: {
             locale: string;
@@ -139,7 +147,7 @@ export type AdminOps = {
         /** The locale's versions newest first, without their trees. */
         listVersions(id: string, locale: string): Promise<OpResult<VersionSummary[]>>;
         /** The version's tree becomes the draft (spec 2026-09-13 history §6); `not_found` for a version of another page or locale, `blocked` on a folder. */
-        restore(id: string, locale: string, versionId: string): Promise<OpResult<PageRecord>>;
+        restore(id: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
     };
     entries: {
         list(collection: string): Promise<OpResult<EntryRecord[]>>;
@@ -150,10 +158,11 @@ export type AdminOps = {
         /** not_found only when the entry is missing; an absent locale comes back with `fields: null`. */
         get(collection: string, id: string, locale: string): Promise<OpResult<EntryGetResult>>;
         create(collection: string, input: EntryCreateInput): Promise<OpResult<EntryRecord>>;
-        save(collection: string, id: string, locale: string, fields: Record<string, unknown>): Promise<OpResult<EntryRecord>>;
-        setStatus(collection: string, id: string, locale: string, status: "draft" | "published"): Promise<OpResult<EntryRecord>>;
+        /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
+        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        setStatus(collection: string, id: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The live row back to the published snapshot (§4); `blocked` when the locale has no published version. */
-        discardDraft(collection: string, id: string, locale: string): Promise<OpResult<EntryRecord>>;
+        discardDraft(collection: string, id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         delete(collection: string, id: string): Promise<OpResult<null>>;
         move(collection: string, id: string, to: {
             parentId: string | null;
@@ -170,19 +179,20 @@ export type AdminOps = {
         /** One snapshot's fields; `not_found` unless it belongs to `id`. */
         getVersion(collection: string, id: string, versionId: string): Promise<OpResult<EntryVersionResult>>;
         /** The snapshot becomes the draft (§6); `not_found` for a foreign version. Fans out like a save. */
-        restore(collection: string, id: string, locale: string, versionId: string): Promise<OpResult<EntryRecord>>;
+        restore(collection: string, id: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
     };
     globals: {
         /** Materializes every registered item in every supported locale, then lists them in registry order. */
         list(): Promise<OpResult<GlobalListItem[]>>;
         get(name: string, locale: string): Promise<OpResult<GlobalGetResult>>;
-        save(name: string, locale: string, fields: Record<string, unknown>): Promise<OpResult<EntryRecord>>;
-        setStatus(name: string, locale: string, status: "draft" | "published"): Promise<OpResult<EntryRecord>>;
+        /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
+        save(name: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        setStatus(name: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The item's live row back to its published snapshot (§4); `blocked` before the first publish. */
-        discardDraft(name: string, locale: string): Promise<OpResult<EntryRecord>>;
+        discardDraft(name: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         listVersions(name: string, locale: string): Promise<OpResult<VersionSummary[]>>;
         getVersion(name: string, versionId: string): Promise<OpResult<EntryVersionResult>>;
-        restore(name: string, locale: string, versionId: string): Promise<OpResult<EntryRecord>>;
+        restore(name: string, locale: string, versionId: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
     };
     assets: {
         /** Ready assets, newest first, paged by cursor; `kind` and `search` filter. */

package/dist/admin/shell/AdminApp.d.ts

@@ -1,8 +1,10 @@
 import type { AdminOpAction } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
 import { type AuthConfig } from "./session.ts";
-export declare function AdminApp({ registry, op, auth }: {
+import type { ContentConfig } from "../../env.ts";
+export declare function AdminApp({ registry, op, auth, content }: {
     registry: AdminRegistry;
     op: AdminOpAction;
     auth: AuthConfig;
+    content?: ContentConfig;
 }): import("react").JSX.Element;

package/dist/admin/shell/AdminApp.js

@@ -12,7 +12,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (shell/IconRail.tsx), then the main column whose views own their own
 // 48px top bar (the editor adds the third, its inspector). The shell is
 // viewport-height; every column scrolls inside itself.
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { makeClientOps } from "../client-ops.js";
 import { PagesList } from "./PagesList.js";
 import { EntriesList } from "./EntriesList.js";
@@ -37,7 +37,10 @@ import { ElementsProvider } from "../forms/elements-context.js";
 import { TimeZoneProvider } from "../forms/time-zone-context.js";
 import { SchemaNotice } from "./SchemaNotice.js";
 import { schemaBehind } from "../../schema-version.js";
-export function AdminApp({ registry, op, auth }) {
+import { createPresence, followTokenRefresh } from "./presence.js";
+import { connectRealtime } from "./presence-realtime.js";
+import { PresenceProvider } from "./presence-context.js";
+export function AdminApp({ registry, op, auth, content }) {
     const session = useAdminSession(auth);
     const [ops] = useState(() => makeClientOps(op, session.token));
     const route = useRoute(registry.adminPath);
@@ -78,6 +81,36 @@ export function AdminApp({ registry, op, auth }) {
         return () => { live = false; };
     }, [signedIn, ops]);
     const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
+    // Presence (spec 2026-09-26 concurrency §5; gated 2026-09-26 security pass §1):
+    // one channel per signed-in session, the content project's public config as the
+    // gateway and the SESSION token on the socket; absent config = presence off.
+    // The token getter is a new closure every render — read it through a ref so
+    // the effect keys on the session, not on the render.
+    const [presence, setPresence] = useState(null);
+    const tokenRef = useRef(session.token);
+    tokenRef.current = session.token;
+    const authClient = session.client;
+    const contentUrl = content?.url, contentKey = content?.key, contentSpace = content?.spaceId;
+    useEffect(() => {
+        if (!signedIn || !contentUrl || !contentKey || !contentSpace || !email) {
+            setPresence(null);
+            return;
+        }
+        const config = { url: contentUrl, key: contentKey, spaceId: contentSpace };
+        const p = createPresence({
+            email,
+            connect: () => {
+                const token = tokenRef.current();
+                if (!token)
+                    throw new Error("smoodly: no session token for presence");
+                return connectRealtime(config, email, token);
+            },
+        });
+        p.join();
+        setPresence(p);
+        const stop = followTokenRefresh(authClient.auth, p);
+        return () => { stop(); p.dispose(); setPresence(null); };
+    }, [signedIn, contentUrl, contentKey, contentSpace, email, authClient]);
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }
@@ -111,5 +144,5 @@ export function AdminApp({ registry, op, auth }) {
         main = _jsx(MediaScreen, {});
     else
         main = _jsx(ErrorPane, { message: "Not found." });
-    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(TimeZoneProvider, { zone: registry.timeZone, children: _jsxs(AssetsProvider, { ops: ops, media: registry.media, children: [_jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }), _jsx(ConfirmHost, {})] }) }) }) }));
+    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(PresenceProvider, { value: presence, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(TimeZoneProvider, { zone: registry.timeZone, children: _jsxs(AssetsProvider, { ops: ops, media: registry.media, children: [_jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }), _jsx(ConfirmHost, {})] }) }) }) }) }));
 }

package/dist/admin/shell/EntriesList.js

@@ -17,12 +17,16 @@ import { navigate } from "./router.js";
 import { confirm } from "../ui/confirm.js";
 import { ErrorPane } from "./ErrorPane.js";
 import { rememberLocale, rememberedLocale } from "./locale-memory.js";
+import { usePresenceState } from "./presence-context.js";
+import { editorsOf } from "./presence.js";
+import { LockIcon } from "../ui/LockIcon.js";
 export function EntriesList({ ops, registry, collection }) {
     const adminHref = useAdminHref();
     const meta = registry.collections.find((c) => c.name === collection);
     const [records, setRecords] = useState(null);
     const [error, setError] = useState(null);
     const [locale, setLocale] = useState(() => rememberedLocale(registry.locales));
+    const { others } = usePresenceState();
     const multilingual = registry.locales.supported.length > 1;
     const pickLocale = (next) => {
         setLocale(next);
@@ -113,7 +117,7 @@ export function EntriesList({ ops, registry, collection }) {
                 key: row.id,
                 onClick: () => (row.present ? open(row.id) : void addLocale(row)),
                 cells: [
-                    _jsx("span", { className: "sm-cell sm-cell--title", style: dim, children: row.title }, "t"),
+                    _jsxs("span", { className: "sm-cell sm-cell--title", style: dim, children: [row.title, _jsx(LockIcon, { names: editorsOf(others, { kind: "entry", id: row.id, locale }) })] }, "t"),
                     row.present
                         ? _jsx("span", { className: "sm-cell sm-cell--muted", children: relativeTime(row.updatedAt) }, "u")
                         : _jsxs("span", { className: "sm-cell sm-cell--muted", children: ["not in ", locale, " \u2014 click to add"] }, "u"),

package/dist/admin/shell/EntryForm.js

@@ -37,6 +37,12 @@ import { localeFromUrl, writeLocaleToUrl } from "../editor/locale-url.js";
 import { navigate, useLeaveGuard } from "./router.js";
 import { LIVE_URL_CONFIRM, liveUrlChanges } from "./live-url.js";
 import { confirm, DISCARD_CONFIRM } from "../ui/confirm.js";
+import { draftToken } from "../../draft-token.js";
+import { isStale, staleInfoOf } from "./stale.js";
+import { StaleBanner } from "../ui/StaleBanner.js";
+import { usePresence, usePresenceState, useSavedElsewhere, useTrackPresence } from "./presence-context.js";
+import { editorsOf } from "./presence.js";
+import { PresenceLine } from "../ui/PresenceLine.js";
 /** A stable empty map for the hooks that run before the "no such collection" return. */
 const NO_FIELDS = {};
 export function EntryForm({ ops, registry, collection, id }) {
@@ -61,6 +67,7 @@ export function EntryForm({ ops, registry, collection, id }) {
     const [published, setPublished] = useState(false);
     const [history, setHistory] = useState(null);
     const [snapshot, setSnapshot] = useState(null);
+    const [stale, setStale] = useState(null);
     const formRef = useRef(null);
     const fieldsRef = useRef(fields);
     fieldsRef.current = fields;
@@ -69,7 +76,14 @@ export function EntryForm({ ops, registry, collection, id }) {
     /** The slug the editor already confirmed as a live-URL change, so the next autosave does not ask again. */
     const confirmedSlug = useRef(null);
     // The page editor's controller: debounced, retrying, flushable (spec 2026-09-14 §3).
-    const { saveState, mark, flush } = useDraftAutosave({
+    /** The token of the row on screen — what every guarded op sends (spec 2026-09-26 concurrency §1). */
+    const token = () => { const row = recordRef.current?.locales[locale]; return row ? draftToken(row) : null; };
+    // Presence (spec 2026-09-26 concurrency §5): this tab on this row, the others on it, every ack announced.
+    const target = { kind: "entry", id, locale };
+    useTrackPresence(target);
+    const { others } = usePresenceState();
+    const presence = usePresence();
+    const { saveState, mark, flush, reset } = useDraftAutosave({
         read: () => fieldsRef.current,
         persist: async (value) => {
             // A published entry's slug is a live URL: one confirm at the save, Cancel restores it (members management §5).
@@ -86,9 +100,13 @@ export function EntryForm({ ops, registry, collection, id }) {
                     setFields((f) => ({ ...(f ?? {}), slug: stored }));
                 }
             }
-            const r = await ops.entries.save(collection, id, locale, value);
-            if (r.ok)
+            const r = await ops.entries.save(collection, id, locale, value, token());
+            if (r.ok) {
                 setRecord(r.data);
+                presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
+            }
+            else if (isStale(r))
+                setStale(staleInfoOf(r));
             return r;
         },
         onSaved: () => setDirty(false),
@@ -113,6 +131,7 @@ export function EntryForm({ ops, registry, collection, id }) {
         setFields(null);
         setFieldErrors({});
         setDirty(false);
+        setStale(null);
         setTouched(false);
         ops.entries.get(collection, id, locale).then((r) => {
             if (cancelled)
@@ -151,6 +170,10 @@ export function EntryForm({ ops, registry, collection, id }) {
     }, [fields, hasFieldErrors, meta, elementDescs]);
     /** An op's failure onto the screen: amber with the fields for a validation result, red otherwise. */
     const fail = (r) => {
+        if (isStale(r)) {
+            setStale(staleInfoOf(r));
+            return;
+        }
         if (r.code === "validation" && r.fields && r.fields.length > 0) {
             setFieldErrors(Object.fromEntries(r.fields.map((f) => [f.field, f.message])));
             setNotice({ tone: "warn", text: r.message, fields: r.fields });
@@ -158,6 +181,17 @@ export function EntryForm({ ops, registry, collection, id }) {
         else
             setNotice({ tone: "error", text: r.message });
     };
+    /** Load their version (spec 2026-09-26 concurrency §4): drop the frozen state and re-get through the ops seam. */
+    const loadTheirs = () => { setStale(null); reset(); setReloadKey((k) => k + 1); };
+    // Someone else saved this row (§5): clean → their version silently; unsaved edits → the freeze at once.
+    useSavedElsewhere(target, (event) => {
+        if (stale)
+            return;
+        if (dirty || saveState !== "saved")
+            setStale({ by: event.email, at: Date.now() });
+        else
+            setReloadKey((k) => k + 1);
+    });
     /** Publish what is on screen: the pending edit is flushed first, and a failed flush cancels the publish. */
     const publish = async () => {
         setNotice(null);
@@ -169,7 +203,7 @@ export function EntryForm({ ops, registry, collection, id }) {
         }
         let r;
         try {
-            r = await ops.entries.setStatus(collection, id, locale, "published");
+            r = await ops.entries.setStatus(collection, id, locale, "published", token());
         }
         catch {
             r = { ok: false, code: "internal", message: "Couldn't reach the server." };
@@ -180,6 +214,7 @@ export function EntryForm({ ops, registry, collection, id }) {
             return;
         }
         setRecord(r.data);
+        presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
         setFieldErrors({});
         setPublished(true);
         setTimeout(() => setPublished(false), 1600);
@@ -213,7 +248,7 @@ export function EntryForm({ ops, registry, collection, id }) {
         }
         let r;
         try {
-            r = await ops.entries.discardDraft(collection, id, locale);
+            r = await ops.entries.discardDraft(collection, id, locale, token());
         }
         catch {
             r = { ok: false, code: "internal", message: "Couldn't reach the server." };
@@ -224,6 +259,7 @@ export function EntryForm({ ops, registry, collection, id }) {
             return;
         }
         setRecord(r.data);
+        presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
         setReloadKey((k) => k + 1);
         setNotice({ tone: "ok", text: "Changes discarded." });
     };
@@ -251,12 +287,13 @@ export function EntryForm({ ops, registry, collection, id }) {
             fail(r);
     };
     const restore = async (versionId) => {
-        const r = await ops.entries.restore(collection, id, locale, versionId);
+        const r = await ops.entries.restore(collection, id, locale, versionId, token());
         if (!r.ok) {
             fail(r);
             return false;
         }
         setRecord(r.data);
+        presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
         setReloadKey((k) => k + 1);
         setNotice({ tone: "ok", text: "Version restored." });
         return true;
@@ -374,6 +411,6 @@ export function EntryForm({ ops, registry, collection, id }) {
                                 trailing: multilingual && (_jsx(LocaleSwitcher, { registry: registry, present: present, parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => void doAddLocale(l) })),
                             },
                             { label: heading },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsxs("div", { className: "sm-editor", children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "entry" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
                                             revealField(formRef.current, path); } })] })), absent ? (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 12 }, children: [_jsxs("p", { children: ["This entry doesn't exist in ", locale, " yet. Adding it copies the ", entrySourceLocale(record, registry), " fields as the first ", locale, " draft."] }), _jsxs("div", { style: { display: "flex", gap: 8 }, children: [_jsxs(Button, { onClick: () => void doAddLocale(locale), disabled: adding || !parentLocales.includes(locale), title: parentLocales.includes(locale) ? undefined : `add ${locale} to the parent first`, children: ["Add ", locale] }), _jsxs(Button, { variant: "secondary", onClick: () => { void switchLocale(entrySourceLocale(record, registry)); }, children: ["Back to ", entrySourceLocale(record, registry)] })] })] })) : fields !== null ? (Object.entries(meta.fields).map(widget)) : !notice && _jsx("p", { style: { color: "var(--text-muted)" }, children: "Loading\u2026" })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", children: [record && row && (_jsxs("div", { className: "sm-card", children: [_jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Created", value: relativeTime(record.createdAt) }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), multilingual && _jsx(InfoRow, { label: "Languages", value: Object.keys(record.locales).join(", ") }), _jsx(InfoRow, { label: "ID", value: id, mono: true })] })), record && (_jsxs("div", { className: "sm-card", children: [multilingual && row && Object.keys(record.locales).length > 1 && (_jsxs(Button, { variant: "secondary", onClick: () => void doRemoveLocale(), children: ["Remove from ", locale] })), _jsx(Button, { variant: "danger", onClick: destroy, children: "Delete" })] }))] })] })] }));
 }