smoodly 0.0.26 → 0.0.28

package/README.md

@@ -477,6 +477,30 @@ Implemented:
   what (a lock in the lists, a line under the top bar) and announces
   saves so a clean view refreshes and a dirty one freezes early. Schema
   version 2 adds the draft-pointer foreign keys and the channel policies.
+- The security pass over the database boundary (spec 2026-09-26 security
+  pass): the presence channel admits a signed-in member of the topic's
+  space (`smoodly_presence_member()`, the socket carries the session
+  token through the client's `accessToken` callback, re-sent on refresh);
+  every function pins `search_path`; the three mutation RPCs are revoked
+  from `anon`/`public`. Schema version 3. The threat table, one test per
+  cell: content, `refs`/`members`, `spaces`/`smoodly_meta` and storage
+  columns — `test/isolation.supabase.test.ts` ("space isolation", "read
+  keys", "cloud state rows") and `test/rls.supabase.test.ts`; presence
+  and RPC columns — `isolation.supabase.test.ts` ("signed-in users and
+  the public keys"); admin ops — `test/admin-auth.test.ts`,
+  `test/admin-auth.supabase.test.ts`, `test/admin-ops.test.ts` ("members
+  ops").
+- Redirects (spec 2026-09-26 redirects): a `paths` row with `redirect`
+  set is an old address of its target (schema version 4). A published
+  rename or move keeps the old addresses as redirects unless the editor
+  unticks "Redirect the old address" on the live-URL confirm; the live
+  URL wins an address; nothing chains; `renderSmoodlyPath` answers a
+  redirect row with `permanentRedirect` through `href`. Settings ›
+  Redirects (every member) lists, adds by hand (validated old address,
+  target type-ahead) and removes. Tests: `test/path-index-contract.ts`
+  (the rule table, both adapters), the store contracts, `admin-ops`
+  ("redirects on rename and move", "redirects ops"),
+  `next-page-renderer` ("redirects"), `examples/site/e2e/redirects.spec.ts`.
 
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
@@ -504,6 +528,50 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-26, redirects spec)
+
+- Destinations outside Smoodly, extension and query-string addresses,
+  code-owned renames (a collection `path`, a fixed slug): the guide's
+  `next.config` recipe; a `redirects` table is OQ 34.
+- The content API's `getPage("/old")` returns null for a redirect row
+  (spec §7); a `follow` option is a one-line addition if a site asks.
+- A redirect row has no audit columns (who, when); add them with a
+  need. The Redirects page is not paged.
+- The browser suite covers rename, the unticked box, no chains, the
+  Settings tab's list and the manual add/remove; a parent's MOVE
+  redirecting a child's URL is proven at the store contract and ops
+  level only (no tree drag in the suite yet).
+- `remove` on the Supabase index deletes by target, one statement per
+  target (the RPC now spares redirect rows); fine at subtree sizes.
+- Pressing Enter in the page Settings tab's slug input commits once,
+  then the confirm's autofocus blurs the input and `commit` runs again,
+  so a second identical question queues behind the first and its Cancel
+  restores the input from a stale row closure (pre-existing, seen on the
+  redirects walk). A re-entrancy guard on `commit` fixes it.
+
+## Follow-ups (logged 2026-09-26, security pass)
+
+- The bridge posts with `"*"` on both sides. Safe today: the admin
+  accepts a message only when `e.source` is its own iframe's window, and
+  the canvas acts on two kinds, refresh and scroll. The target-origin
+  pass belongs to the content-surface sweep (spec §Out of scope).
+- The invite's `redirectTo` is a client-supplied string bounded by the
+  auth project's redirect allow-list; a same-origin check in the op is
+  one line when wanted.
+- Every op call with a junk token costs one `auth.getUser` against the
+  auth project; rate limiting is the session-model spec's (OQ 20).
+- The content-surface sweep: `f.link` values reach section components
+  unfiltered, uploads allow SVG and PDF on a public bucket (SVG served
+  with `?download=`), the custom CSS refusal list, richtext hrefs.
+- A refused private-channel join surfaces as `CHANNEL_ERROR` (about 80
+  ms on the local stack); the suite asserts "not SUBSCRIBED".
+- The isolation suite's `join` helper still uses a bare
+  `realtime.setAuth(key)`: its positive cases resolve on the first
+  SUBSCRIBED, before realtime-js re-asks the default `accessToken`
+  callback and the server closes the channel. Fine for proving the
+  policy; a client that must stay joined passes `accessToken` (what
+  `connectRealtime` does since 3ed8931).
+
 ## Follow-ups (logged 2026-09-26, concurrency spec)
 
 - A hard lock with takeover, if a real team asks: presence has the facts.
@@ -522,10 +590,6 @@ after both are on the registry. From the repo root:
   lock outlives a closed tab by that much.
 - The live suites wipe `members` and the content tables; a pane walk after
   them needs `npm run reseed` (or `scripts/demo-editor.ts`) first.
-- `e2e/helpers.ts`'s `expectSaved` passes at once when the indicator still
-  reads "Saved" from before the edit (the debounce is 800 ms), so a step that
-  needs the save landed can race it; `concurrency.spec.ts` waits for the
-  save's server response instead. Fold that into the helper for every spec.
 
 ## Follow-ups (logged 2026-09-26, browser suite)
 
@@ -1844,8 +1908,8 @@ the toolbar instead of pushing the content.
 - Once the policy-based published read exists, decide whether it becomes the canonical headless read path and the generated per-collection views turn optional (cloud has no views).
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
-- Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- **Verified and kept 2026-09-26 (security pass §3)** — Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
+- **Verified and kept 2026-09-26 (security pass §3)** — `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/client-ops.js

@@ -4,6 +4,7 @@ const GROUPS = {
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
     members: ["list", "me", "invite", "setRole", "remove"],
+    redirects: ["list", "targets", "add", "remove"],
     schema: ["status"],
     preview: ["enable", "disable"],
 };

package/dist/admin/editor/EditorView.js

@@ -83,6 +83,7 @@ export function EditorView({ ops, registry, id }) {
     const [folder, setFolder] = useState(false);
     const [reloadKey, setReloadKey] = useState(0);
     const [paths, setPaths] = useState({});
+    const [redirects, setRedirects] = useState({});
     const [urls, setUrls] = useState({});
     // The locales the parent exists in — "Add locale" offers only these.
     const [parentLocales, setParentLocales] = useState([]);
@@ -249,6 +250,7 @@ export function EditorView({ ops, registry, id }) {
             }
             setRecord(result.data.record);
             setPaths(result.data.paths);
+            setRedirects(result.data.redirects);
             setUrls(result.data.urls);
             setParentLocales(result.data.parentLocales);
             // Absent in this locale: the "Add <locale>" pane, derived from the record.
@@ -287,6 +289,7 @@ export function EditorView({ ops, registry, id }) {
             return;
         setRecord(result.data.record);
         setPaths(result.data.paths);
+        setRedirects(result.data.redirects);
         setUrls(result.data.urls);
         setParentLocales(result.data.parentLocales);
     }, [ops, id, locale]);
@@ -829,7 +832,7 @@ export function EditorView({ ops, registry, id }) {
                                 trailing: registry.locales.supported.length > 1 && (_jsx(LocaleSwitcher, { registry: registry, present: record ? registry.locales.supported.filter((l) => record.locales[l]) : [locale], parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => { void doAddLocale(l); } })),
                             },
                             { label },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
                                     setSelectedId(null); }, children: _jsxs("div", { className: "sm-page", style: { overflow: "hidden" }, children: [iframeSrc ? (_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: "Page canvas", style: { width: "100%", height: docH, border: 0, display: "block" } })) : (_jsx("div", { className: "sm-canvas__loading", children: "Loading canvas\u2026" })), _jsx(CanvasOverlay, { emptyZones: emptyZones, hoverRect: hoverRect, hoverGlobal: hoverGlobal, selection: selection, fieldHover: fieldHover, editing: editing, plusButtons: plusButtons, onPlus: (p, x, y) => setPicker({ zone: p.zone, index: p.index, x: x - 150, y: y + 12 }), onMove: doMove, onDuplicate: doDuplicate, onRemove: doRemove }), inline.richtext && (() => {
                                             const { session } = inline.richtext;
                                             const item = globalItemOf(session.node);
@@ -845,7 +848,7 @@ export function EditorView({ ops, registry, id }) {
                                                     else
                                                         mutate((t) => patchNodePath(t, session.node, session.path, doc));
                                                 }, onEscape: inline.end }));
-                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
+                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState, pending: globalDirty })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], redirects: redirects[locale] ?? [], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
                                             !isFixedNode(record, registry) &&
                                             !(record.parentId === null && record.locales[registry.locales.default]?.slug === registry.homePageSlug)
                                             ? () => { void doRemoveLocale(); }

package/dist/admin/editor/PageInspector.d.ts

@@ -3,7 +3,7 @@ import type { PageRecord } from "../../store.ts";
 import type { AdminPageTemplate, AdminRegistry } from "../serialize.ts";
 export type PageTab = "SEO & Social" | "Settings";
 export declare function pageTabsFor(template: AdminPageTemplate | undefined): PageTab[];
-export declare function PageInspector({ record, locale, registry, tree, path, fixed, onRename, onRemoveLocale, onPatch }: {
+export declare function PageInspector({ record, locale, registry, tree, path, fixed, redirects, onRename, onRemoveLocale, onPatch }: {
     record: PageRecord;
     locale: string;
     registry: AdminRegistry;
@@ -11,9 +11,12 @@ export declare function PageInspector({ record, locale, registry, tree, path, fi
     /** The page's path in this locale (the `paths` index). */
     path: string | undefined;
     fixed: boolean;
+    /** The active locale's old addresses that redirect here (spec 2026-09-26 redirects §6). */
+    redirects?: string[];
     onRename(patch: {
         title?: string;
         slug?: string;
+        redirect?: boolean;
     }): Promise<string | null>;
     /** Absent when the locale cannot be removed: a fixed node, the site root, or the page's last locale. */
     onRemoveLocale?: () => void;

package/dist/admin/editor/PageInspector.js

@@ -13,12 +13,12 @@ import { SeoSettings } from "./SeoSettings.js";
 export function pageTabsFor(template) {
     return template?.seo ? ["SEO & Social", "Settings"] : ["Settings"];
 }
-export function PageInspector({ record, locale, registry, tree, path, fixed, onRename, onRemoveLocale, onPatch }) {
+export function PageInspector({ record, locale, registry, tree, path, fixed, redirects, onRename, onRemoveLocale, onPatch }) {
     const template = registry.pages.find((p) => p.name === record.template);
     const tabs = pageTabsFor(template);
     const [tab, setTab] = useState(tabs[0]);
     useEffect(() => { setTab(pageTabsFor(template)[0]); }, [record.id]); // eslint-disable-line react-hooks/exhaustive-deps
     const active = tabs.includes(tab) ? tab : tabs[0];
     const title = record.locales[locale]?.title ?? "";
-    return (_jsxs(_Fragment, { children: [_jsx("div", { className: "sm-inspector__head", children: _jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-pageglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: title })] }) }), tabs.length > 1 && _jsx(Tabs, { tabs: tabs, value: active, onChange: setTab }), _jsx("div", { className: "sm-inspector__body", children: active === "SEO & Social" ? (_jsx(SeoSettings, { meta: tree?.meta ?? {}, onPatch: (key, value) => onPatch("meta", key, value) })) : (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsx(PageSettings, { record: record, locale: locale, registry: registry, path: path, fixed: fixed, onRename: onRename }), Object.entries(template?.fields ?? {}).map(([key, descriptor]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: descriptor, value: tree?.fields?.[key], onChange: (value) => onPatch("fields", key, value) }, key))), onRemoveLocale && _jsxs(Button, { variant: "secondary", onClick: onRemoveLocale, children: ["Remove from ", locale] })] })) })] }));
+    return (_jsxs(_Fragment, { children: [_jsx("div", { className: "sm-inspector__head", children: _jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-pageglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: title })] }) }), tabs.length > 1 && _jsx(Tabs, { tabs: tabs, value: active, onChange: setTab }), _jsx("div", { className: "sm-inspector__body", children: active === "SEO & Social" ? (_jsx(SeoSettings, { meta: tree?.meta ?? {}, onPatch: (key, value) => onPatch("meta", key, value) })) : (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsx(PageSettings, { record: record, locale: locale, registry: registry, path: path, fixed: fixed, redirects: redirects, onRename: onRename }), Object.entries(template?.fields ?? {}).map(([key, descriptor]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: descriptor, value: tree?.fields?.[key], onChange: (value) => onPatch("fields", key, value) }, key))), onRemoveLocale && _jsxs(Button, { variant: "secondary", onClick: onRemoveLocale, children: ["Remove from ", locale] })] })) })] }));
 }

package/dist/admin/editor/PageSettings.d.ts

@@ -1,6 +1,6 @@
 import type { PageRecord } from "../../store.ts";
 import type { AdminRegistry } from "../serialize.ts";
-export declare function PageSettings({ record, locale, registry, path, fixed, onRename }: {
+export declare function PageSettings({ record, locale, registry, path, fixed, redirects, onRename }: {
     record: PageRecord;
     locale: string;
     registry: AdminRegistry;
@@ -8,8 +8,11 @@ export declare function PageSettings({ record, locale, registry, path, fixed, on
     path: string | undefined;
     fixed: boolean;
     /** Resolves to an error message, or null when the rename landed. */
+    /** The active locale's old addresses that redirect here (spec 2026-09-26 redirects §6). */
+    redirects?: string[];
     onRename(patch: {
         title?: string;
         slug?: string;
+        redirect?: boolean;
     }): Promise<string | null>;
 }): import("react").JSX.Element | null;

package/dist/admin/editor/PageSettings.js

@@ -1,5 +1,5 @@
 "use client";
-import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 // Page settings (spec 2026-09-05 §7; per locale since spec 2026-09-06
 // §6): the ACTIVE locale's title and slug, saved through pages.rename,
 // and "Remove from this locale". The switcher in the canvas meta row
@@ -11,10 +11,13 @@ import { useEffect, useState } from "react";
 import { updatedLine } from "../ui/format.js";
 import { Field, InfoRow, SectionLabel } from "../ui/primitives.js";
 import { confirmLiveUrl } from "../shell/live-url.js";
-export function PageSettings({ record, locale, registry, path, fixed, onRename }) {
+import { RouteLink } from "../shell/RouteLink.js";
+import { useAdminHref } from "../shell/base.js";
+export function PageSettings({ record, locale, registry, path, fixed, redirects, onRename }) {
     const row = record.locales[locale];
     const [draft, setDraft] = useState({ title: row?.title ?? "", slug: row?.slug ?? "" });
     const [error, setError] = useState(null);
+    const adminHref = useAdminHref();
     const isHome = record.parentId === null && record.locales[registry.locales.default]?.slug === registry.homePageSlug;
     // The record changes identity on every rename; re-seed the inputs from it.
     useEffect(() => {
@@ -31,12 +34,17 @@ export function PageSettings({ record, locale, registry, path, fixed, onRename }
             setError(`A ${key} is required — nothing falls back to another locale.`);
             return;
         }
-        // A published slug is a live URL: one confirm, Cancel restores the input (members management §5).
-        if (key === "slug" && !(await confirmLiveUrl({ status: row.status, from: row.slug, to: next }, { name: row.title, path }))) {
-            setDraft((d) => ({ ...d, slug: row.slug }));
-            return;
+        // A published slug is a live URL: one confirm with the redirect box, Cancel restores the input (members management §5, redirects §6).
+        let redirect = true;
+        if (key === "slug") {
+            const live = await confirmLiveUrl({ status: row.status, from: row.slug, to: next }, { name: row.title, path });
+            if (!live.ok) {
+                setDraft((d) => ({ ...d, slug: row.slug }));
+                return;
+            }
+            redirect = live.redirect;
         }
-        setError(await onRename({ [key]: next }));
+        setError(await onRename(key === "slug" ? { slug: next, redirect } : { title: next }));
     };
     const onKey = (key) => (e) => {
         if (e.key === "Enter") {
@@ -44,5 +52,5 @@ export function PageSettings({ record, locale, registry, path, fixed, onRename }
             void commit(key);
         }
     };
-    return (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsxs(SectionLabel, { children: ["Page \u00B7 ", locale] }), fixed && _jsx("span", { className: "sm-hint", children: "Owned by code \u2014 change it in the registration." }), error && _jsx("span", { className: "sm-error", children: error }), _jsx(Field, { label: "Title", children: _jsx("input", { className: "sm-input", disabled: fixed, value: draft.title, onChange: (e) => setDraft((d) => ({ ...d, title: e.target.value })), onBlur: () => void commit("title"), onKeyDown: onKey("title") }) }), _jsx(Field, { label: "Slug", hint: path ?? "", children: _jsx("input", { className: "sm-input sm-input--mono", disabled: fixed || isHome, value: draft.slug, onChange: (e) => setDraft((d) => ({ ...d, slug: e.target.value })), onBlur: () => void commit("slug"), onKeyDown: onKey("slug") }) }), _jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), _jsx(InfoRow, { label: "ID", value: record.id, mono: true })] }));
+    return (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsxs(SectionLabel, { children: ["Page \u00B7 ", locale] }), fixed && _jsx("span", { className: "sm-hint", children: "Owned by code \u2014 change it in the registration." }), error && _jsx("span", { className: "sm-error", children: error }), _jsx(Field, { label: "Title", children: _jsx("input", { className: "sm-input", disabled: fixed, value: draft.title, onChange: (e) => setDraft((d) => ({ ...d, title: e.target.value })), onBlur: () => void commit("title"), onKeyDown: onKey("title") }) }), _jsx(Field, { label: "Slug", hint: path ?? "", children: _jsx("input", { className: "sm-input sm-input--mono", disabled: fixed || isHome, value: draft.slug, onChange: (e) => setDraft((d) => ({ ...d, slug: e.target.value })), onBlur: () => void commit("slug"), onKeyDown: onKey("slug") }) }), redirects && redirects.length > 0 && (_jsx(Field, { label: "Redirects from", asDiv: true, hint: _jsxs(_Fragment, { children: ["Old addresses that send visitors here. Manage them in ", _jsx(RouteLink, { href: adminHref("/settings/redirects"), children: "Settings \u203A Redirects" }), "."] }), children: _jsx("div", { className: "sm-redirects-from", children: redirects.map((p) => _jsx("code", { children: p }, p)) }) })), _jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), _jsx(InfoRow, { label: "ID", value: record.id, mono: true })] }));
 }

package/dist/admin/ops-impl.js

@@ -11,6 +11,7 @@ import { CUSTOM_NODE_TYPE, customSchema } from "../custom/index.js";
 import { SETTINGS_KEY, CSS_KEY } from "../global.js";
 import { withDefaults } from "../field-defaults.js";
 import { elementSchemas } from "../richtext-walk.js";
+import { REDIRECT_PATH_MESSAGE, redirectPathProblem } from "./redirect-path.js";
 import { SCHEMA_VERSION } from "../schema-version.js";
 import { draftToken, isDraftToken, StaleDraftError } from "../draft-token.js";
 const ok = (data) => ({ ok: true, data });
@@ -65,6 +66,8 @@ const classify = (e) => {
         return err("not_found", message);
     if (message.includes("cannot take a slug"))
         return err("validation", message);
+    if (message.includes("is a live address"))
+        return err("validation", message);
     // Ahead of the generic "already exists" check below: the singleton
     // refusal's message ("...already exists — it is a singleton.") contains
     // "already exists" as a substring, so it must classify here first or it
@@ -208,6 +211,22 @@ export function createAdminOps(deps) {
     const def = config.locales.default;
     /** The name messages use for a node: its default-locale slug, else any locale's, else the id. */
     const nameOf = (r) => r.locales[def]?.slug ?? Object.values(r.locales)[0]?.slug ?? r.id;
+    /** "kind:id" → title in the locale (+ collection for an entry): every page with a template, every entry of a routed collection. */
+    const targetTitles = async (locale) => {
+        const out = new Map();
+        for (const p of await pages.listPages()) {
+            if (p.template === null)
+                continue;
+            out.set(`page:${p.id}`, { title: p.locales[locale]?.title ?? nameOf(p), collection: null });
+        }
+        for (const c of config.registry.collections ?? []) {
+            if (!c.path)
+                continue;
+            for (const e of await entries.list(c.name))
+                out.set(`entry:${e.id}`, { title: entryTitleIn(e, locale, c), collection: c.name });
+        }
+        return out;
+    };
     const assets = deps.assets;
     const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
     const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
@@ -292,12 +311,13 @@ export function createAdminOps(deps) {
                 const draft = record.template === null || !record.locales[locale] ? null : await pages.getDraftTree(id, locale);
                 const paths = await pages.pathsOf(id);
                 const urls = Object.fromEntries(Object.entries(paths).map(([l, path]) => [l, href(path, l)]));
+                const redirects = await pages.redirectsOf(id);
                 // A locale can only be added where the parent already has it; a
                 // root has no parent, so every supported locale is open.
                 const parentLocales = record.parentId === null
                     ? config.locales.supported
                     : Object.keys((await pages.getPage(record.parentId))?.locales ?? {});
-                return ok({ record, locale, draft, paths, urls, parentLocales });
+                return ok({ record, locale, draft, paths, urls, redirects, parentLocales });
             }),
             create: (input) => guard(async () => {
                 const unsupported = supportedLocale(input.locale);
@@ -494,7 +514,8 @@ export function createAdminOps(deps) {
                     return unsupported;
                 if (record.parentId === null && patch.slug !== undefined && adminSlug(patch.slug))
                     return slugTaken();
-                const renamed = await pages.rename(id, patch, by);
+                const { redirect, ...rest } = patch;
+                const renamed = await pages.rename(id, rest, by, { redirect: redirect ?? true });
                 // Every descendant's path changed with this segment; the parent
                 // lists this node's title and path.
                 expirePages([...(await subtreeIds(id)), record.parentId]);
@@ -521,7 +542,8 @@ export function createAdminOps(deps) {
                     if (blocked)
                         return blocked;
                 }
-                const moved = await pages.move(id, to);
+                const { redirect, ...dest } = to;
+                const moved = await pages.move(id, dest, { redirect: redirect ?? true });
                 expirePages([...(await subtreeIds(id)), record.parentId, moved.parentId]);
                 expireTree();
                 return ok(moved);
@@ -607,7 +629,8 @@ export function createAdminOps(deps) {
                     : Object.keys((await entries.get(collection, record.parentId))?.locales ?? {});
                 const paths = await entries.pathsOf(collection, id);
                 const urls = Object.fromEntries(Object.entries(paths).map(([l, p]) => [l, href(p, l)]));
-                return ok({ record, locale, fields, parentLocales, urls });
+                const redirects = await entries.redirectsOf(collection, id);
+                return ok({ record, locale, fields, parentLocales, urls, redirects });
             }),
             create: (collection, input) => guard(async () => {
                 const unsupported = supportedLocale(input.locale);
@@ -620,7 +643,7 @@ export function createAdminOps(deps) {
                 expireCollection(collection);
                 return ok(created);
             }),
-            save: (collection, id, locale, fields, expected) => guard(async () => {
+            save: (collection, id, locale, fields, expected, options) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
@@ -630,7 +653,7 @@ export function createAdminOps(deps) {
                 const descriptors = collectionFields(collection);
                 if (!descriptors)
                     return err("not_found", `smoodly: no collection named "${collection}".`);
-                const entry = await entries.update(collection, id, locale, fields, by, token);
+                const entry = await entries.update(collection, id, locale, fields, by, token, { redirect: options?.redirect ?? true });
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
@@ -707,7 +730,8 @@ export function createAdminOps(deps) {
             // The tag expires only after the delete succeeded; a blocked delete expires nothing.
             delete: (collection, id) => guard(async () => (await entries.delete(collection, id), await fanOut(id), expireCollection(collection), ok(null))),
             move: (collection, id, to) => guard(async () => {
-                const moved = await entries.move(collection, id, to);
+                const { redirect, ...dest } = to;
+                const moved = await entries.move(collection, id, dest, { redirect: redirect ?? true });
                 if (effects?.revalidate) {
                     for (const entryId of await entrySubtreeIds(collection, id))
                         effects.revalidate(entryTag(entryId));
@@ -973,6 +997,61 @@ export function createAdminOps(deps) {
                 return ok(null);
             }),
         },
+        redirects: {
+            list: (locale) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const rows = await pages.listRedirects(locale);
+                const titles = await targetTitles(locale);
+                const items = [];
+                for (const r of rows) {
+                    const t = titles.get(`${r.kind}:${r.id}`);
+                    const currentPath = (await pages.targetPaths({ kind: r.kind, id: r.id }))[locale] ?? null;
+                    items.push({ locale, path: r.path, target: { kind: r.kind, id: r.id }, collection: t?.collection ?? null, title: t?.title ?? r.id, currentPath, url: currentPath ? href(currentPath, locale) : null });
+                }
+                return ok(items.sort((a, b) => a.path.localeCompare(b.path)));
+            }),
+            targets: (locale) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const titles = await targetTitles(locale);
+                const out = [];
+                for (const r of await pages.listLive(locale)) {
+                    const t = titles.get(`${r.kind}:${r.id}`);
+                    if (!t)
+                        continue; // a folder, or an entry outside a routed collection
+                    out.push({ target: { kind: r.kind, id: r.id }, collection: t.collection, title: t.title, path: r.path });
+                }
+                return ok(out.sort((a, b) => a.path.localeCompare(b.path)));
+            }),
+            add: (locale, path, target) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const problem = redirectPathProblem(path, { adminPath: config.admin.path, multilingual: config.locales.supported.length > 1 });
+                if (problem)
+                    return err("validation", REDIRECT_PATH_MESSAGE[problem]);
+                const titles = await targetTitles(locale);
+                if (!titles.has(`${target.kind}:${target.id}`))
+                    return err("not_found", `smoodly: no ${target.kind} "${target.id}" to redirect to.`);
+                const holder = await pages.resolvePath(locale, path);
+                if (holder && !holder.redirect) {
+                    const owner = titles.get(`${holder.kind}:${holder.id}`)?.title ?? holder.id;
+                    return err("validation", `smoodly: "${path}" is the address of "${owner}".`);
+                }
+                await pages.addRedirect({ kind: target.kind, id: target.id, locale, path });
+                return ok(null);
+            }),
+            remove: (locale, path) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                await pages.removeRedirect(locale, path);
+                return ok(null);
+            }),
+        },
         schema: {
             status: () => guard(async () => ok({ database: await pages.schemaVersion(), required: SCHEMA_VERSION })),
         },

package/dist/admin/ops.d.ts

@@ -7,6 +7,7 @@ import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 import type { DraftToken } from "../draft-token.ts";
+import type { PathTarget } from "../paths.ts";
 export type OpError = {
     ok: false;
     code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized";
@@ -44,6 +45,8 @@ export type PageGetResult = {
     paths: Record<string, string>;
     /** locale → site URL, `href` applied server-side (the canvas and "View live" use these). */
     urls: Record<string, string>;
+    /** locale → the page's old addresses that redirect to it (spec 2026-09-26 redirects §6). */
+    redirects: Record<string, string[]>;
     /** The locales the PARENT exists in — a locale can only be added here
      *  once the parent has it (DESIGN.md, Localization), so the editor
      *  disables the rest with a reason. Every supported locale for a root
@@ -65,6 +68,8 @@ export type EntryGetResult = {
     fields: Record<string, unknown> | null;
     /** locale → site URL (`href` applied server-side) for the locales the entry has a path in; empty for a collection without a path. */
     urls: Record<string, string>;
+    /** locale → the entry's old addresses that redirect to it (spec 2026-09-26 redirects §6). */
+    redirects: Record<string, string[]>;
     /** The locales the PARENT exists in (every supported locale for a root) — the form disables the rest with a reason. */
     parentLocales: string[];
 };
@@ -109,6 +114,23 @@ export type SchemaStatus = {
     database: number | null;
     required: number;
 };
+/** A redirect row with its target joined (spec 2026-09-26 redirects §6): `currentPath`/`url` null when the target has no live path in the locale. */
+export type RedirectItem = {
+    locale: string;
+    path: string;
+    target: PathTarget;
+    collection: string | null;
+    title: string;
+    currentPath: string | null;
+    url: string | null;
+};
+/** A page or entry live in the locale, for the Add dialog's type-ahead. */
+export type RedirectTargetItem = {
+    target: PathTarget;
+    collection: string | null;
+    title: string;
+    path: string;
+};
 export type AdminOps = {
     pages: {
         /** Lists every node, materializing fixed pages and collection mounts (in every supported locale) first. */
@@ -127,14 +149,17 @@ export type AdminOps = {
         /** The draft back to the published version (§4); `blocked` when nothing is published in the locale. */
         discardDraft(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         delete(id: string): Promise<OpResult<null>>;
+        /** `redirect` (default true) keeps a published row's old address as a redirect (spec 2026-09-26 redirects §1). */
         rename(id: string, patch: {
             locale: string;
             slug?: string;
             title?: string;
+            redirect?: boolean;
         }): Promise<OpResult<PageRecord>>;
         move(id: string, to: {
             parentId: string | null;
             index?: number;
+            redirect?: boolean;
         }): Promise<OpResult<PageRecord>>;
         /** "Add page here": a folder becomes a page. */
         setTemplate(id: string, template: string): Promise<OpResult<PageRecord>>;
@@ -159,7 +184,9 @@ export type AdminOps = {
         get(collection: string, id: string, locale: string): Promise<OpResult<EntryGetResult>>;
         create(collection: string, input: EntryCreateInput): Promise<OpResult<EntryRecord>>;
         /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
-        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null, options?: {
+            redirect?: boolean;
+        }): Promise<OpResult<EntryRecord>>;
         setStatus(collection: string, id: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The live row back to the published snapshot (§4); `blocked` when the locale has no published version. */
         discardDraft(collection: string, id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
@@ -167,6 +194,7 @@ export type AdminOps = {
         move(collection: string, id: string, to: {
             parentId: string | null;
             index?: number;
+            redirect?: boolean;
         }): Promise<OpResult<EntryRecord>>;
         /** Copies `from`'s localized fields and slug as the new locale's draft (spec 2026-09-06 §7). Expires nothing. */
         addLocale(collection: string, id: string, locale: string, options: {
@@ -225,6 +253,17 @@ export type AdminOps = {
         /** Admins only, self-host only; the same two guards. The Auth account stays. */
         remove(userId: string): Promise<OpResult<null>>;
     };
+    /** Redirects by hand (spec 2026-09-26 redirects §5): open to every member, as renaming is; nothing here expires a cache. */
+    redirects: {
+        /** The locale's redirect rows with their targets' titles and current URLs, sorted by old address. */
+        list(locale: string): Promise<OpResult<RedirectItem[]>>;
+        /** Every page with a template and every routed entry live in the locale, for the Add dialog's type-ahead. */
+        targets(locale: string): Promise<OpResult<RedirectTargetItem[]>>;
+        /** Validates the old address (redirect-path.ts), refuses a live address naming its owner, `not_found` for an unknown target. */
+        add(locale: string, path: string, target: PathTarget): Promise<OpResult<null>>;
+        /** Deletes a redirect row; a live row is never touched. */
+        remove(locale: string, path: string): Promise<OpResult<null>>;
+    };
     schema: {
         /** Every member. The shell calls it once on mount and blocks when behind. */
         status(): Promise<OpResult<SchemaStatus>>;

package/dist/admin/redirect-path.d.ts

@@ -0,0 +1,6 @@
+export type RedirectPathProblem = "empty" | "leading-slash" | "root" | "trailing-slash" | "double-slash" | "whitespace" | "query-or-hash" | "admin" | "extension";
+export declare const REDIRECT_PATH_MESSAGE: Record<RedirectPathProblem, string>;
+export declare function redirectPathProblem(path: string, opts: {
+    adminPath: string;
+    multilingual: boolean;
+}): RedirectPathProblem | null;

package/dist/admin/redirect-path.js

@@ -0,0 +1,33 @@
+export const REDIRECT_PATH_MESSAGE = {
+    empty: "Enter the old address.",
+    "leading-slash": "Start with a slash: /old-address.",
+    root: "The site root cannot redirect.",
+    "trailing-slash": "Leave out the trailing slash.",
+    "double-slash": "An address cannot have an empty part.",
+    whitespace: "An address cannot contain spaces.",
+    "query-or-hash": "Leave out the query string and the hash: they are not part of the address.",
+    admin: "That is the admin's address.",
+    extension: "An address with a file extension never reaches Smoodly on a multilingual site — redirect it in next.config instead.",
+};
+export function redirectPathProblem(path, opts) {
+    if (path === "")
+        return "empty";
+    if (/\s/.test(path))
+        return "whitespace";
+    if (/[?#]/.test(path))
+        return "query-or-hash";
+    if (!path.startsWith("/"))
+        return "leading-slash";
+    if (path === "/")
+        return "root";
+    if (path.endsWith("/"))
+        return "trailing-slash";
+    if (path.includes("//"))
+        return "double-slash";
+    if (path === opts.adminPath || path.startsWith(`${opts.adminPath}/`))
+        return "admin";
+    const last = path.slice(path.lastIndexOf("/") + 1);
+    if (opts.multilingual && /\.[A-Za-z0-9]+$/.test(last))
+        return "extension";
+    return null;
+}

package/dist/admin/shell/AddRedirectModal.d.ts

@@ -0,0 +1,11 @@
+import type { PathTarget } from "../../paths.ts";
+import type { RedirectTargetItem } from "../ops.ts";
+import type { AdminRegistry } from "../serialize.ts";
+export declare function AddRedirectModal({ locale, registry, targets, onClose, onAdd }: {
+    locale: string;
+    registry: AdminRegistry;
+    targets: RedirectTargetItem[];
+    onClose(): void;
+    /** Resolves to an error message, or null when the redirect landed (the caller closes). */
+    onAdd(path: string, target: PathTarget): Promise<string | null>;
+}): import("react").JSX.Element;