smoodly 0.0.28 → 0.0.30

package/README.md

@@ -252,7 +252,7 @@ Implemented:
   is stored as entries, spec 2026-09-07), not only through the generated
   views.
 
-- Admin login: `supabaseAdminAuth` + `gateAdminOp` around the ops seam;
+- Admin login: `supabaseAdminAuth` (from `smoodly/admin`) + `gateAdminOp` around the ops seam;
   `LoginView` + `useAdminSession` in the shell; `createSmoodlyAdmin({ auth })`.
   Env: `smoodlyEnv()` / `createSmoodlyClient()`.
 
@@ -477,6 +477,26 @@ Implemented:
   what (a lock in the lists, a line under the top bar) and announces
   saves so a clean view refreshes and a dirty one freezes early. Schema
   version 2 adds the draft-pointer foreign keys and the channel policies.
+  Only the editor's own edits freeze a view (2026-09-27): two editors
+  opening a fresh page at once both fill its locked hero, and the fill
+  that lands second used to freeze its view under "Your unsaved changes
+  here will be discarded" with nothing changed; now that view loads the
+  other's quietly, on the refusal or the `saved` broadcast. This was the
+  local-only timeout of "the guard alone" (CI's slower sign-in let the
+  first fill land first). Tests: `concurrency.spec.ts` ("two editors
+  opening a new page at once", with the channel cut and on; the fill
+  save is held so the race is deterministic).
+- ActionMenu near the screen's edge (2026-09-27): a row menu close to
+  the bottom opened below the viewport, where a fixed element cannot be
+  scrolled to, and the scroll event from bringing a row into view
+  arrived a frame after the click and closed the menu it had opened.
+  It now opens upward by the Combobox's `opensUp`, and closes only on a
+  scroll that moved its button. This was the Members test's flake (about
+  1 in 8 runs; the list was long because every concurrency run left
+  its second member behind — `concurrency.spec.ts` removes it in
+  `afterAll` since 2026-09-28, and `members.spec.ts` its invited Auth
+  user, which Remove member leaves in place). Tests: `admin-action-menu`, `members.spec.ts` (a
+  late scroll event, a real move, a row at the bottom of the screen).
 - The security pass over the database boundary (spec 2026-09-26 security
   pass): the presence channel admits a signed-in member of the topic's
   space (`smoodly_presence_member()`, the socket carries the session
@@ -501,6 +521,71 @@ Implemented:
   (the rule table, both adapters), the store contracts, `admin-ops`
   ("redirects on rename and move", "redirects ops"),
   `next-page-renderer` ("redirects"), `examples/site/e2e/redirects.spec.ts`.
+- Editor safety (spec 2026-09-27 editor safety): schema drift — stored
+  content the code no longer describes — is found by one pure walk
+  (`admin/drift.ts`) over the serialized registry. Broken findings
+  (an unknown section, element, page type or collection; a value that
+  doesn't fit its field; a zone rule broken) refuse publish for pages,
+  entries and global items; left-over ones (a removed field or zone, an
+  element outside its toolset, a localization change) never do. The
+  validator's one type check is `fits` (text and number checked for the
+  first time). Settings › Content health (every member) reports every
+  document, draft and live, grouped by the change; the editors mark the
+  open document (notice, Outline marks, a canvas placeholder, the
+  unknown-section inspector with Remove section, misfits as field
+  errors, a "No longer in the schema" group with Copy and Clear, Clear
+  zone). Turning `.localized()` on no longer deletes the other locales'
+  value (update, discard and restore keep a localized key's shared
+  value); the last `window.alert`s are `notify()`. No bulk writes
+  (OQ 35). Tests: `admin-drift`, `admin-drift-copy`, `admin-health`,
+  `admin-health-list`, `admin-health-page`, `admin-drift-markers`,
+  `admin-unknown-node`, the store contracts (`scanTrees`,
+  `scanEntries`, the pinning tests), `entry-store.supabase` (the
+  localized fix across two schemas), `examples/site/e2e/health.spec.ts`.
+- Shadowed-page detector (spec 2026-09-27 shadowed-page detector): a
+  canvas whose bridge never speaks within 4 s of the frame's load is
+  diagnosed — the editor fetches the canvas URL once and
+  `admin/editor/canvas-diagnosis.ts` names another route, a route file
+  that drops `searchParams`, a crash, a 404, a redirect, a refusal, a
+  framing header or a script error, as an editor sentence and a "For
+  your developer" line (`editor/CanvasWarning.tsx`, in place of
+  "Selection unavailable"). The renderer writes
+  `<meta name="smoodly-draft">` in draft mode only. No reserved-path
+  list (OQ 23 closed). Tests: `admin-canvas-diagnosis`,
+  `admin-canvas-warning`, `next-page-renderer` (the marker),
+  `admin-bridge`, `examples/site/e2e/editor.spec.ts`.
+- cacheComponents unsupported (spec 2026-09-27 cache components): under
+  Next's Cache Components the catch-all is served from a fallback shell
+  that commits 200, so 404s and 308s are lost; the renderer warns once
+  per renderer when `process.env.__NEXT_CACHE_COMPONENTS` is on, and the
+  Next.js guide says why. OQ 19 closed. Tests: `next-page-renderer`
+  ("cacheComponents").
+- Section guard (spec 2026-09-27 section guard): `Zone` calls a
+  plain-function section view inside try/catch (an async one through
+  `SectionGuard`, in place), so a throw in a section's own code leaves it
+  out and the page renders — nothing live, a placeholder in the canvas
+  and under `next dev`; the adapter's `rethrow` (Next: `unstable_rethrow`)
+  lets control flow through. In editor mode the Next adapter also wraps
+  each section in `<Suspense>` + the client `CanvasBoundary`, the bridge
+  reports crashed sections, the page editor lists them, and Publish asks
+  first. A healthy page's HTML is unchanged. Tests: `section-crash`,
+  `render` ("the section guard"), `next-canvas-boundary`,
+  `next-page-renderer`, `admin-crash-copy`, `admin-canvas-diagnosis`,
+  `examples/site/e2e/sections.spec.ts`.
+- No admin on the live site (2026-09-27): `supabaseAdminAuth` moved from
+  `smoodly/admin/next` to `smoodly/admin` (its `AuthConfig` type too).
+  `smoodly/server.ts`, which every site route imports, took it from the
+  `admin/next` barrel beside `createSmoodlyAdmin`, so the admin shell was
+  a client module of every site route. Confirmed by removing the import
+  and rebuilding; the starter's home page, production build, went from
+  1,616,602 to 628,849 bytes of JavaScript (8 chunks either way, the
+  1,050,601-byte chunk holding `AdminApp` gone). The rest of the page's
+  JavaScript is the site's own: of a 62,848-byte chunk, next-intl is
+  ~34 KB, `next/link` and `next/image` most of the rest, and the
+  editor-only modules ~3.4 KB (`EditorBridge` ~2.5 KB, the canvas net
+  ~0.9 KB) — too little to lazy-load. Tests: `site-entries` (every entry
+  but `smoodly/admin/next` reaches no client module except those two),
+  `examples/site/e2e/site-bundle.spec.ts` (CI only: production chunks).
 
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
@@ -528,6 +613,36 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-27, shadowed-page detector spec)
+
+- A section's crash on a live page after data changed outside the page
+  editor (an entry or a global item edited in its form): the guard
+  catches a throw in the section's own view, but one inside a component
+  it renders, in a richtext element's view or in a `'use client'`
+  section still fails the page, and no canvas previews those forms.
+  Catching it live needs `<Suspense>` (spec 2026-09-27 section guard,
+  measured). Revisit if a real site hits it.
+
+## Follow-ups (logged 2026-09-27, editor safety spec)
+
+- Scan paging: `health.scan` makes one bulk read per table (versions by
+  id in chunks of 100), and PostgREST's max-rows would cap a very large
+  space. Page it, and add a rail badge, when a real site's size asks.
+- Refs inside unknown nodes are not indexed: without a schema nothing
+  says which values are refs, so safe-delete cannot see them. Publish
+  refuses such nodes and a live one renders nothing.
+- Leftover shared values after `.localized()` is turned on stay on the
+  entry as every locale's fallback; removing them for good waits on
+  the fix tooling (OQ 35). `localization-on` is reported only where a
+  locale has no value of its own, so a fully translated entry no
+  longer lists it.
+- A visual global item's settings misfits (`settings.x`) don't reach
+  their widgets in the Globals form: `GlobalFields` keys errors by the
+  bare field key, the same gap the validator's refusal keys had before.
+  The notice and the refusal list still name them.
+- A CLI drift report was left out (the admin already has the config and
+  the database; a CLI needs the service key and a TS config loader).
+
 ## Follow-ups (logged 2026-09-26, redirects spec)
 
 - Destinations outside Smoodly, extension and query-string addresses,
@@ -543,11 +658,6 @@ after both are on the registry. From the repo root:
   level only (no tree drag in the suite yet).
 - `remove` on the Supabase index deletes by target, one statement per
   target (the RPC now spares redirect rows); fine at subtree sizes.
-- Pressing Enter in the page Settings tab's slug input commits once,
-  then the confirm's autofocus blurs the input and `commit` runs again,
-  so a second identical question queues behind the first and its Cancel
-  restores the input from a stale row closure (pre-existing, seen on the
-  redirects walk). A re-entrancy guard on `commit` fixes it.
 
 ## Follow-ups (logged 2026-09-26, security pass)
 
@@ -681,9 +791,13 @@ after both are on the registry. From the repo root:
   section, a global or a page is a plain chip input.
 - The picker's "open" link goes to `/admin/<collection>/<id>` without
   the edited locale; the form opens in the URL's or the default locale.
-- The Combobox list flips upwards when it does not fit under the input
-  (`opensUp`, measured against the nearest clipping ancestor); it does
-  not yet shrink when neither side has room for it.
+- The Combobox list is portaled into the admin wrapper and fixed to the
+  viewport (2026-09-27), so a modal body or scrolling form no longer
+  clips it; it flips upwards when the viewport has no room under the
+  input (`listPlacement`) and follows the input on scroll. It does not
+  yet shrink when neither side has room for it. A single select (a
+  single `f.ref`, the redirect target) shows its pick inside the input;
+  a single ref's status, open link and remove sit in the input too.
 - `RefOption.status` is the three-way `LocaleStatus` now; the old
   "(draft)" suffix in option titles is gone with the native select.
 - A `refList` on a global item's `settings` still loads no options in
@@ -1289,14 +1403,6 @@ the toolbar instead of pushing the content.
   the vocabulary once instead of per field, dedupe there.
 - The entry form's column is narrower than the inspector, so the default
   toolbar wraps to two rows there; the inspector shows it on one.
-- The example site's production bundle loads one shared chunk (~750 KB)
-  on every site page holding the package's admin client modules — the
-  shell, the Supabase client and now the TipTap widget — because
-  `next/page-renderer.tsx` imports the editor bridge from
-  `admin/next/bridge.tsx` and Turbopack bundles the package's client
-  modules together. Measured on the 2026-09-08 build; whether the shell
-  was already there before the widget is unverified. The fix is to give
-  the bridge its own entry outside the admin tree and re-measure.
 
 ## Follow-ups (logged 2026-09-07, starter)
 

package/dist/admin/client-ops.js

@@ -5,6 +5,7 @@ const GROUPS = {
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
     members: ["list", "me", "invite", "setRole", "remove"],
     redirects: ["list", "targets", "add", "remove"],
+    health: ["scan"],
     schema: ["status"],
     preview: ["enable", "disable"],
 };

package/dist/admin/drift-copy.d.ts

@@ -0,0 +1,19 @@
+import type { FieldError } from "./validate.ts";
+import { type Finding } from "./drift.ts";
+import type { AdminRegistry } from "./serialize.ts";
+/** A stored value as its JSON, cut at 60 characters. */
+export declare function valuePreview(value: unknown): string;
+/** One line: what a publish refusal lists and what a marker says. */
+export declare function driftMessage(f: Finding): string;
+/** The refusal's list (§6): the validator's errors, then each broken finding once per key. */
+export declare function publishErrors(validator: FieldError[], findings: Finding[]): FieldError[];
+/** The report's group line (§4): what the developer changed. */
+export declare function driftHeadline(f: Finding, _registry: AdminRegistry): string;
+/** The document notice under the top bar (§5): the counts, the live-only line, and what a localization change does on save. */
+export declare function driftNotice(draft: Finding[], live: Finding[]): {
+    summary: string | null;
+    liveOnly: string | null;
+    sentences: string[];
+};
+/** The markers' field-error map (§5): each misfit's message at its path, `strip.` removed. */
+export declare function misfitErrors(findings: Finding[], strip?: string): Record<string, string>;

package/dist/admin/drift-copy.js

@@ -0,0 +1,89 @@
+import { isBroken } from "./drift.js";
+/** A stored value as its JSON, cut at 60 characters. */
+export function valuePreview(value) {
+    let text;
+    try {
+        text = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        text = String(value);
+    }
+    return text.length > 60 ? `${text.slice(0, 60)}…` : text;
+}
+/** One line: what a publish refusal lists and what a marker says. */
+export function driftMessage(f) {
+    switch (f.kind) {
+        case "unknown-section": return f.subject.scope === "global" ? "The code no longer registers this global item." : "The code no longer registers this section.";
+        case "unknown-element": return "The code no longer registers this element.";
+        case "unknown-shape": return "The code no longer registers this page type.";
+        case "unknown-collection": return "The code no longer registers this collection.";
+        case "misfit": return `The stored value doesn't fit this field: ${valuePreview(f.value)}`;
+        case "zone-disallowed": return `Zone \`${f.subject.name}\` no longer allows \`${f.subject.field}\`. Remove or move it to publish.`;
+        case "zone-over-max": return `Zone \`${f.subject.name}\` allows ${f.detail?.max} sections and has ${f.detail?.count}.`;
+        case "orphan-field": return "No longer in the schema.";
+        case "orphan-zone": return `Removed zone \`${f.subject.name}\` · ${f.detail?.count} ${f.detail?.count === 1 ? "section" : "sections"}`;
+        case "element-outside-toolset": return "Not in this field's toolset";
+        case "localization-on": return `\`${f.subject.field}\` is now translated per language. Its shared value shows in every language until it's saved there.`;
+        case "localization-off": return `\`${f.subject.field}\` is now shared. Saving here makes this language's value the one every language shows.`;
+    }
+}
+/** The refusal's list (§6): the validator's errors, then each broken finding once per key. */
+export function publishErrors(validator, findings) {
+    const out = [...validator];
+    const seen = new Set(out.map((e) => e.field));
+    for (const f of findings) {
+        if (!isBroken(f) || seen.has(f.path))
+            continue;
+        seen.add(f.path);
+        out.push({ field: f.path, message: driftMessage(f) });
+    }
+    return out;
+}
+const SCOPE_WORD = { section: "section", element: "element", collection: "collection", global: "global item", page: "page type", zone: "zone" };
+/** The report's group line (§4): what the developer changed. */
+export function driftHeadline(f, _registry) {
+    const s = f.subject;
+    const owner = `${SCOPE_WORD[s.scope]} \`${s.name}\``;
+    switch (f.kind) {
+        case "unknown-section": return s.scope === "global" ? `Unknown global item \`${s.name}\`` : `Unknown section \`${s.name}\``;
+        case "unknown-element": return `Unknown element \`${s.name}\``;
+        case "unknown-shape": return `Unknown page type \`${s.name}\``;
+        case "unknown-collection": return `Collection \`${s.name}\` no longer registered`;
+        case "misfit": return `\`${s.field}\` in ${owner} doesn't fit f.${f.detail?.type}()`;
+        case "zone-disallowed": return `Zone \`${s.name}\` of \`${s.within}\` no longer allows \`${s.field}\``;
+        case "zone-over-max": return `Zone \`${s.name}\` of \`${s.within}\` holds more than its max`;
+        case "orphan-field": return `Field \`${s.field}\` no longer in ${owner}`;
+        case "orphan-zone": return `Zone \`${s.name}\` no longer on page type \`${s.within}\``;
+        case "element-outside-toolset": return `Element \`${s.name}\` not in the toolset of \`${s.field}\``;
+        case "localization-on": return `\`${s.field}\` in ${owner} is now translated — a shared value is left`;
+        case "localization-off": return `\`${s.field}\` in ${owner} is now shared — languages still hold their own`;
+    }
+}
+const n = (count, one, many) => `${count} ${count === 1 ? one : many}`;
+/** The document notice under the top bar (§5): the counts, the live-only line, and what a localization change does on save. */
+export function driftNotice(draft, live) {
+    const broken = draft.filter(isBroken).length;
+    const orphans = draft.length - broken;
+    const parts = [
+        broken > 0 ? `${n(broken, "problem blocks", "problems block")} publishing` : null,
+        orphans > 0 ? `${orphans} left over from an older schema` : null,
+    ].filter(Boolean);
+    const inDraft = new Set(draft.map((f) => `${f.kind}|${f.path}`));
+    const liveOnly = live.filter((f) => !inDraft.has(`${f.kind}|${f.path}`)).length;
+    return {
+        summary: parts.length > 0 ? parts.join(" · ") : null,
+        liveOnly: liveOnly > 0 ? `The live version has ${n(liveOnly, "problem", "problems")} the draft has already fixed — publish to clear it.` : null,
+        sentences: draft.filter((f) => f.kind === "localization-on" || f.kind === "localization-off").map(driftMessage),
+    };
+}
+/** The markers' field-error map (§5): each misfit's message at its path, `strip.` removed. */
+export function misfitErrors(findings, strip) {
+    const out = {};
+    for (const f of findings) {
+        if (f.kind !== "misfit")
+            continue;
+        const path = strip && f.path.startsWith(`${strip}.`) ? f.path.slice(strip.length + 1) : f.path;
+        out[path] = driftMessage(f);
+    }
+    return out;
+}

package/dist/admin/drift.d.ts

@@ -0,0 +1,76 @@
+import type { AdminField, AdminRegistry } from "./serialize.ts";
+import type { PageTree } from "../render.tsx";
+export type DriftKind = "unknown-section" | "unknown-element" | "unknown-shape" | "unknown-collection" | "misfit" | "zone-disallowed" | "zone-over-max" | "orphan-field" | "orphan-zone" | "element-outside-toolset" | "localization-on" | "localization-off";
+export type Severity = "broken" | "orphan";
+export declare const SEVERITY: Record<DriftKind, Severity>;
+/** Where the change the developer made lives — the report groups by it (§4). */
+export type DriftScope = "section" | "element" | "collection" | "global" | "page" | "zone";
+/** `field` is index-free (`points[].icon`); `within` names an outer owner (a zone's page type, an element's section). */
+export type DriftSubject = {
+    scope: DriftScope;
+    name: string;
+    field?: string;
+    within?: string;
+};
+/** `path` is the error key the publish refusal and the markers use (§6); indices stay in it. */
+export type Finding = {
+    kind: DriftKind;
+    path: string;
+    subject: DriftSubject;
+    /** A misfit's or an orphan's stored value — the marker's read-only copy. */
+    value?: unknown;
+    /** A misfit's field type; a zone's max and its node count. */
+    detail?: {
+        type?: string;
+        max?: number;
+        count?: number;
+    };
+};
+export declare const isBroken: (f: Finding) => boolean;
+/** The validator's empty: an empty value is `required`'s question, never drift's. */
+export declare const isEmptyValue: (v: unknown) => boolean;
+/** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind
+ *  this list does not know fits (the custom section's `spans`, whose structure is rowsProblems'). */
+export declare function fits(d: {
+    type: string;
+    options?: unknown;
+}, value: unknown): boolean;
+/** What the validator says when `fits` is false — its long-standing words, plus text and number. */
+export declare function misfitMessage(d: {
+    type: string;
+    options?: unknown;
+}, value: unknown): string;
+export type Holder = {
+    fields?: unknown;
+    settings?: unknown;
+    styles?: unknown;
+};
+export type HolderSchema = {
+    fields: Record<string, AdminField>;
+    settings?: Record<string, AdminField>;
+    styles?: Record<string, AdminField>;
+};
+/** A node-shaped value — a tree node, a visual global item — against a section-shaped schema:
+ *  fields at `prefix`, settings and styles under `prefix.settings` / `prefix.styles` (§1). */
+export declare function holderDrift(registry: AdminRegistry, subject: DriftSubject, prefix: string, holder: Holder, schema: HolderSchema): Finding[];
+/** A page's draft or live tree against its page type (§1): the type itself, each declared zone's
+ *  rules and nodes, stored zones the type no longer declares (orphans, never walked), page fields. */
+export declare function pageDrift(registry: AdminRegistry, template: string | null, tree: PageTree | null): Finding[];
+export type EntryInput = {
+    /** The merged view the editor sees (shared with the locale row on top). */
+    fields: Record<string, unknown>;
+    /** The node's shared fields and the locale row's own — both present to check localization. */
+    shared?: Record<string, unknown>;
+    own?: Record<string, unknown>;
+};
+/** An entry's or a global item's fields against its registration (§1). `name` is the stored
+ *  collection name: a collection, a global item, or neither — an unregistered collection. */
+export declare function entryDrift(registry: AdminRegistry, name: string, input: EntryInput): Finding[];
+/** The report's group (§4): what changed, not where — kind, scope, owner, name, index-free field. */
+export declare const groupKey: (f: Finding) => string;
+export type VersionedFinding = Finding & {
+    draft: boolean;
+    live: boolean;
+};
+/** One list per document and locale: a finding in both versions is listed once with both tags (§3). */
+export declare function mergeVersions(draft: Finding[], live: Finding[]): VersionedFinding[];

package/dist/admin/drift.js

@@ -0,0 +1,264 @@
+import { optionValues } from "../fields.js";
+import { isHidden } from "../conditions.js";
+import { allowedOf } from "../toolset.js";
+import { CUSTOM_NODE_TYPE } from "../custom/schema.js";
+import { CSS_KEY, GLOBAL_NODE_TYPE, SETTINGS_KEY, STYLES_KEY } from "../global.js";
+export const SEVERITY = {
+    "unknown-section": "broken", "unknown-element": "broken", "unknown-shape": "broken", "unknown-collection": "broken",
+    misfit: "broken", "zone-disallowed": "broken", "zone-over-max": "broken",
+    "orphan-field": "orphan", "orphan-zone": "orphan", "element-outside-toolset": "orphan",
+    "localization-on": "orphan", "localization-off": "orphan",
+};
+export const isBroken = (f) => SEVERITY[f.kind] === "broken";
+/** The validator's empty: an empty value is `required`'s question, never drift's. */
+export const isEmptyValue = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && v.length === 0);
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isStrings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+/** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind
+ *  this list does not know fits (the custom section's `spans`, whose structure is rowsProblems'). */
+export function fits(d, value) {
+    if (isEmptyValue(value))
+        return true;
+    switch (d.type) {
+        case "text":
+        case "link":
+        case "slug":
+        case "date":
+        case "datetime": return typeof value === "string";
+        case "tags": return isStrings(value);
+        case "number": return typeof value === "number" && Number.isFinite(value);
+        case "boolean": return typeof value === "boolean";
+        case "select":
+        case "radio": {
+            const allowed = optionValues(d.options);
+            return typeof value === "string" && (allowed.length === 0 || allowed.includes(value));
+        }
+        case "checkboxes": {
+            const allowed = optionValues(d.options);
+            return Array.isArray(value) && value.every((v) => typeof v === "string" && allowed.includes(v));
+        }
+        case "image":
+        case "video":
+        case "file": return isObject(value) && typeof value.asset === "string";
+        case "ref": return typeof value === "string";
+        case "refList": return Array.isArray(value) && value.every((v) => typeof v === "string" && v !== "");
+        case "object": return isObject(value);
+        case "list": return Array.isArray(value);
+        case "richtext": return isObject(value) && value.type === "doc";
+        default: return true;
+    }
+}
+/** What the validator says when `fits` is false — its long-standing words, plus text and number. */
+export function misfitMessage(d, value) {
+    const oneOf = () => `Must be one of: ${optionValues(d.options).join(", ")}.`;
+    switch (d.type) {
+        case "text":
+        case "link":
+        case "slug": return "Must be text.";
+        case "number": return "Must be a number.";
+        case "boolean": return "Must be on or off.";
+        case "date": return "Not a date (2026-09-02).";
+        case "datetime": return "Not a date and time.";
+        case "image":
+        case "video":
+        case "file": return "Must be an uploaded file.";
+        case "list": return "Must be a list.";
+        case "object": return "Must be an object.";
+        case "ref": return "Must be an entry.";
+        case "refList": return "Must be a list of entries.";
+        case "tags": return "Must be a list of tags.";
+        case "richtext": return "Must be rich text.";
+        case "select":
+        case "radio": return oneOf();
+        case "checkboxes": return Array.isArray(value) ? oneOf() : "Must be a list.";
+        default: return "Doesn't fit this field.";
+    }
+}
+const join = (a, b) => (a === "" ? b : `${a}.${b}`);
+/** One value map against its descriptors (§1): a stored key no descriptor names is an orphan;
+ *  a declared, visible value is checked. `path` is the error-key prefix, `schema` the index-free
+ *  path the report groups by. */
+function walkMap(path, schema, values, descs, w, scope) {
+    for (const [key, value] of Object.entries(values)) {
+        if (!(key in descs))
+            w.out.push({ kind: "orphan-field", path: join(path, key), subject: { ...w.subject, field: join(schema, key) }, value });
+    }
+    for (const [key, d] of Object.entries(descs)) {
+        if (isHidden(d, scope))
+            continue;
+        walkValue(join(path, key), join(schema, key), values[key], d, w, scope);
+    }
+}
+function walkValue(path, schema, value, d, w, scope) {
+    if (isEmptyValue(value))
+        return;
+    if (!fits(d, value)) {
+        w.out.push({ kind: "misfit", path, subject: { ...w.subject, field: schema }, value, detail: { type: d.type } });
+        return;
+    }
+    if (d.type === "object") {
+        walkMap(path, schema, value, d.fields ?? {}, w, { ...scope, self: value });
+    }
+    else if (d.type === "list") {
+        // As the validator: an item descriptor that is present and not hidden.
+        if (d.item && !isHidden(d.item, scope))
+            value.forEach((v, i) => walkValue(`${path}.${i}`, `${schema}[]`, v, d.item, w, scope));
+    }
+    else if (d.type === "richtext") {
+        walkDoc(path, schema, value, d, w);
+    }
+}
+/** Element nodes' attrs in document order at any depth — the validator's `elements.<i>`. Never mutates. */
+function elementAttrs(doc) {
+    const out = [];
+    const walk = (n) => {
+        if (!isObject(n))
+            return;
+        if (n.type === "element")
+            out.push(isObject(n.attrs) ? n.attrs : {});
+        if (Array.isArray(n.content))
+            n.content.forEach(walk);
+    };
+    walk(doc);
+    return out;
+}
+function walkDoc(path, schema, doc, d, w) {
+    const allowed = allowedOf(d.toolset).elements;
+    elementAttrs(doc).forEach((a, i) => {
+        const at = `${path}.elements.${i}`;
+        const name = typeof a.name === "string" ? a.name : "";
+        const el = w.registry.elements.find((e) => e.name === name);
+        if (!el) {
+            w.out.push({ kind: "unknown-element", path: at, subject: { scope: "element", name } });
+            return;
+        }
+        if (!allowed.includes(name) || !el.contexts.includes("richtext")) {
+            w.out.push({ kind: "element-outside-toolset", path: at, subject: { scope: "element", name, field: schema, within: `${w.subject.scope}:${w.subject.name}` } });
+        }
+        const fields = isObject(a.fields) ? a.fields : {};
+        const settings = isObject(a.settings) ? a.settings : {};
+        const inner = { ...w, subject: { scope: "element", name } };
+        walkMap(at, "", fields, el.fields, inner, { self: fields, fields, settings });
+        walkMap(`${at}.settings`, "settings", settings, el.settings, inner, { self: settings, fields, settings });
+    });
+}
+/** A node-shaped value — a tree node, a visual global item — against a section-shaped schema:
+ *  fields at `prefix`, settings and styles under `prefix.settings` / `prefix.styles` (§1). */
+export function holderDrift(registry, subject, prefix, holder, schema) {
+    const w = { registry, out: [], subject };
+    const fields = isObject(holder.fields) ? holder.fields : {};
+    const settings = isObject(holder.settings) ? holder.settings : {};
+    const styles = isObject(holder.styles) ? holder.styles : {};
+    walkMap(prefix, "", fields, schema.fields, w, { self: fields, fields, settings });
+    walkMap(join(prefix, "settings"), "settings", settings, schema.settings ?? {}, w, { self: settings, fields, settings });
+    walkMap(join(prefix, "styles"), "styles", styles, schema.styles ?? {}, w, { self: styles, fields, settings });
+    return w.out;
+}
+/** Whether a zone's policy still takes a node of this type (§1). Global placements are not checked here. */
+function zoneAllows(policy, type) {
+    if (policy.kind === "locked")
+        return type === policy.component;
+    if (policy.kind === "sections")
+        return policy.allow.includes(type);
+    if (type === CUSTOM_NODE_TYPE)
+        return policy.custom;
+    return policy.allow === "*" || policy.allow.includes(type);
+}
+function nodeDrift(registry, shape, zone, policy, node, out) {
+    if (node.type === GLOBAL_NODE_TYPE) {
+        const name = typeof node.fields?.item === "string" ? node.fields.item : "";
+        if (!registry.globals.some((g) => g.name === name))
+            out.push({ kind: "unknown-section", path: node.id, subject: { scope: "global", name } });
+        return;
+    }
+    const section = node.type === CUSTOM_NODE_TYPE ? registry.custom : registry.sections.find((s) => s.name === node.type);
+    if (!section) {
+        out.push({ kind: "unknown-section", path: node.id, subject: { scope: "section", name: node.type } });
+        return;
+    }
+    if (!zoneAllows(policy, node.type)) {
+        out.push({ kind: "zone-disallowed", path: node.id, subject: { scope: "zone", name: zone, field: node.type, within: shape } });
+    }
+    out.push(...holderDrift(registry, { scope: "section", name: section.name }, node.id, node, section));
+}
+/** A page's draft or live tree against its page type (§1): the type itself, each declared zone's
+ *  rules and nodes, stored zones the type no longer declares (orphans, never walked), page fields. */
+export function pageDrift(registry, template, tree) {
+    if (template === null)
+        return [];
+    const shape = registry.pages.find((p) => p.name === template);
+    if (!shape)
+        return [{ kind: "unknown-shape", path: "page", subject: { scope: "page", name: template } }];
+    if (!tree)
+        return [];
+    const out = [];
+    for (const [zone, stored] of Object.entries(tree.zones ?? {})) {
+        const nodes = Array.isArray(stored) ? stored : [];
+        const policy = shape.zones[zone];
+        if (!policy) {
+            if (nodes.length > 0)
+                out.push({ kind: "orphan-zone", path: `zone:${zone}`, subject: { scope: "zone", name: zone, within: shape.name }, detail: { count: nodes.length } });
+            continue;
+        }
+        if (policy.kind === "sections" && typeof policy.max === "number" && nodes.length > policy.max) {
+            out.push({ kind: "zone-over-max", path: `zone:${zone}`, subject: { scope: "zone", name: zone, within: shape.name }, detail: { max: policy.max, count: nodes.length } });
+        }
+        for (const node of nodes)
+            nodeDrift(registry, shape.name, zone, policy, node, out);
+    }
+    out.push(...holderDrift(registry, { scope: "page", name: shape.name }, "page.fields", { fields: tree.fields ?? {} }, { fields: shape.fields }));
+    return out;
+}
+const RESERVED = new Set(["slug", SETTINGS_KEY, STYLES_KEY, CSS_KEY]);
+function localization(subject, descs, input, out) {
+    if (!input.shared || !input.own)
+        return;
+    for (const [key, d] of Object.entries(descs)) {
+        if (RESERVED.has(key))
+            continue;
+        // On only where this locale still shows the shared value: once the row has its own, the
+        // leftover shared value is only a fallback (the leftover itself waits on OQ 35).
+        if (d.localized === true && key in input.shared && !(key in input.own))
+            out.push({ kind: "localization-on", path: key, subject: { ...subject, field: key }, value: input.shared[key] });
+        if (d.localized !== true && key in input.own)
+            out.push({ kind: "localization-off", path: key, subject: { ...subject, field: key }, value: input.own[key] });
+    }
+}
+/** An entry's or a global item's fields against its registration (§1). `name` is the stored
+ *  collection name: a collection, a global item, or neither — an unregistered collection. */
+export function entryDrift(registry, name, input) {
+    const out = [];
+    const collection = registry.collections.find((c) => c.name === name);
+    if (collection) {
+        const subject = { scope: "collection", name };
+        const { slug: _slug, ...fields } = input.fields;
+        out.push(...holderDrift(registry, subject, "", { fields }, { fields: collection.fields }));
+        localization(subject, collection.fields, input, out);
+        return out;
+    }
+    const item = registry.globals.find((g) => g.name === name);
+    if (item) {
+        const subject = { scope: "global", name };
+        const { [SETTINGS_KEY]: settings, [STYLES_KEY]: styles, [CSS_KEY]: _css, slug: _slug, ...fields } = input.fields;
+        out.push(...holderDrift(registry, subject, "", { fields, settings, styles }, item));
+        localization(subject, item.fields, input, out);
+        return out;
+    }
+    return [{ kind: "unknown-collection", path: "collection", subject: { scope: "collection", name } }];
+}
+/** The report's group (§4): what changed, not where — kind, scope, owner, name, index-free field. */
+export const groupKey = (f) => [f.kind, f.subject.scope, f.subject.within ?? "", f.subject.name, f.subject.field ?? ""].join("|");
+/** One list per document and locale: a finding in both versions is listed once with both tags (§3). */
+export function mergeVersions(draft, live) {
+    const out = new Map();
+    for (const f of draft)
+        out.set(`${f.kind}|${f.path}`, { ...f, draft: true, live: false });
+    for (const f of live) {
+        const hit = out.get(`${f.kind}|${f.path}`);
+        if (hit)
+            hit.live = true;
+        else
+            out.set(`${f.kind}|${f.path}`, { ...f, draft: false, live: true });
+    }
+    return [...out.values()];
+}

package/dist/admin/editor/CanvasWarning.d.ts

@@ -0,0 +1,5 @@
+import { type CanvasCause } from "./canvas-diagnosis.ts";
+export declare function CanvasWarning({ cause, path }: {
+    cause: CanvasCause;
+    path: string;
+}): import("react").JSX.Element;