smoodly 0.0.33 → 0.0.35

package/dist/env.d.ts

@@ -1,3 +1,4 @@
+import { readCurrentSpace } from "./current-space.ts";
 export type SmoodlyEnv = {
     /** The content project. */
     url: string;
@@ -20,6 +21,6 @@ export type ContentConfig = {
     key: string;
     spaceId: string;
 };
-/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
-export declare function spaceIdOfKey(key: string): string;
-export declare function publicContentConfig(env: SmoodlyEnv): ContentConfig;
+/** The public config, with the space the database says the secret key acts in —
+ *  asked, never read out of the key, so it cannot disagree with where rows land. */
+export declare function publicContentConfig(env: SmoodlyEnv, db?: Parameters<typeof readCurrentSpace>[0]): Promise<ContentConfig>;

package/dist/env.js

@@ -1,7 +1,8 @@
 // The one config shape (spec 2026-09-04 §4/§6). Self-host sets three
 // names; the cloud sets five. The two defaults are what keep a single
 // code path: a default for an absent value is not a mode branch.
-import { DEFAULT_SPACE_ID } from "./sql-space.js";
+import { createSmoodlyClient } from "./client.js";
+import { readCurrentSpace } from "./current-space.js";
 const REQUIRED = ["SMOODLY_URL", "SMOODLY_SECRET_KEY", "SMOODLY_PUBLISHABLE_KEY"];
 export function resolveSmoodlyEnv(env) {
     const missing = REQUIRED.filter((name) => !env[name]);
@@ -21,21 +22,18 @@ export function resolveSmoodlyEnv(env) {
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export const smoodlyEnv = () => resolveSmoodlyEnv(process.env);
-/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
-export function spaceIdOfKey(key) {
-    const parts = key.split(".");
-    if (parts.length !== 3)
-        return DEFAULT_SPACE_ID;
-    try {
-        // base64url → base64, padded; atob exists in Node 22 and every browser, so no Buffer here.
-        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(parts[1].length / 4) * 4, "=");
-        const claims = JSON.parse(atob(b64));
-        return typeof claims.space_id === "string" && claims.space_id ? claims.space_id : DEFAULT_SPACE_ID;
+/** One lookup per process per content project and key: the space never
+ *  changes for a key. A failed lookup is not cached, so the next call retries. */
+const spaces = new Map();
+/** The public config, with the space the database says the secret key acts in —
+ *  asked, never read out of the key, so it cannot disagree with where rows land. */
+export function publicContentConfig(env, db) {
+    const cacheKey = `${env.url}\n${env.secretKey}`;
+    let space = spaces.get(cacheKey);
+    if (!space) {
+        space = readCurrentSpace(db ?? createSmoodlyClient(env));
+        spaces.set(cacheKey, space);
+        space.catch(() => spaces.delete(cacheKey));
     }
-    catch {
-        return DEFAULT_SPACE_ID;
-    }
-}
-export function publicContentConfig(env) {
-    return { url: env.url, key: env.publishableKey, spaceId: spaceIdOfKey(env.secretKey) };
+    return space.then((spaceId) => ({ url: env.url, key: env.publishableKey, spaceId }));
 }

package/dist/index.d.ts

@@ -60,6 +60,8 @@ export type { EntryFetcher, ResolveFieldsOptions, AssetFetcher } from "./resolve
 export { SEGMENT_RE, isSegment, assertSegment, slugify, joinPath, splitPath, segmentFor, isHomeNode, pagePathIn, chainOf, assertDepth, pagePath, pagePathRows, entryPathRows, collectionSegment, buildPageTree, perLocaleSegments, assertSupportedLocale, unsupportedLocale, pageAlternates, entryAlternates, } from "./paths.ts";
 export type { LocaleSet, PathTarget, PathRow, PageLike, EntryLike, PageTreeNode, PagePathOptions, LocaleAlternate, PageAlternate } from "./paths.ts";
 export { fixedPathFor } from "./localize.ts";
+export { addressMap, assertAddress, codeAddresses, collectionKey, lastPart, ownerCollection, pageKey, type Addresses, type CodeAddress } from "./addresses.ts";
+export { anchorUrl, anchorsFor, candidates, fullPath, pickHit, type AnchorKey, type Anchors } from "./anchors.ts";
 export type { PageStore, PageRecord, PageLocale, PageVersion, PageScan, PageStoreOptions, CreatePageInput, AddLocaleOptions } from "./store.ts";
 export { pathOptions, pageErrors, localeRow, pageRefEdges, DEFAULT_LOCALES } from "./store.ts";
 export type { SmoodlyConfig, ResolvedConfig } from "./config.ts";
@@ -155,7 +157,7 @@ export declare const smoodly: {
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
 export type { MarkNode, MarkPath, Marks, Scope } from "./marks.ts";
-export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.ts";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig } from "./env.ts";
 export type { SmoodlyEnv, ContentConfig } from "./env.ts";
 export { clientOptions, createSmoodlyClient } from "./client.ts";
 export { createSmoodlySite, pageContextOf } from "./site.ts";

package/dist/index.js

@@ -43,6 +43,8 @@ export { affectedTargets, pageTag, entryTag, globalTag, pagesTreeTag, collection
 export { resolveTree, resolveFields, resolveMedia } from "./resolve.js";
 export { SEGMENT_RE, isSegment, assertSegment, slugify, joinPath, splitPath, segmentFor, isHomeNode, pagePathIn, chainOf, assertDepth, pagePath, pagePathRows, entryPathRows, collectionSegment, buildPageTree, perLocaleSegments, assertSupportedLocale, unsupportedLocale, pageAlternates, entryAlternates, } from "./paths.js";
 export { fixedPathFor } from "./localize.js";
+export { addressMap, assertAddress, codeAddresses, collectionKey, lastPart, ownerCollection, pageKey } from "./addresses.js";
+export { anchorUrl, anchorsFor, candidates, fullPath, pickHit } from "./anchors.js";
 export { pathOptions, pageErrors, localeRow, pageRefEdges, DEFAULT_LOCALES } from "./store.js";
 export { DEFAULT_TOOLSET } from "./toolset.js";
 export { collectionOrder, collectionDepth, DEFAULT_ORDER } from "./collections.js";
@@ -64,6 +66,6 @@ export const smoodly = {
     marks,
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
-export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.js";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig } from "./env.js";
 export { clientOptions, createSmoodlyClient } from "./client.js";
 export { createSmoodlySite, pageContextOf } from "./site.js";

package/dist/next/canvas-slot.d.ts

@@ -0,0 +1,7 @@
+import type { ReactNode } from "react";
+export declare const CanvasBridgeSlot: import("react").ComponentType<{}>;
+export declare const CanvasNetSlot: import("react").ComponentType<{
+    id: string;
+    title: string;
+    children?: ReactNode;
+}>;

package/dist/next/canvas-slot.js

@@ -0,0 +1,9 @@
+"use client";
+// The one Smoodly client module a live page carries (spec 2026-09-29
+// pre-install fixes §1). Next ships every client module a route's server
+// graph imports, rendered or not; this stub is that module, and the bridge
+// and the canvas net load from it lazily — only when the renderer is in
+// editor mode, so a live page downloads neither.
+import dynamic from "next/dynamic";
+export const CanvasBridgeSlot = dynamic(() => import("../admin/next/bridge.js").then((m) => m.EditorBridge));
+export const CanvasNetSlot = dynamic(() => import("./canvas-boundary.js").then((m) => m.CanvasBoundary));

package/dist/next/index.d.ts

@@ -3,3 +3,5 @@ export type { PageRendererOptions, PathRenderOptions, PageRegistration } from ".
 export { metadataFrom } from "./meta.ts";
 export { createSmoodlyQueries } from "./queries.ts";
 export type { SmoodlyQueries, QueryOptions, EntriesQuery, TypedEntryItem, GlobalValue } from "./queries.ts";
+export { previewRoute } from "./preview-route.ts";
+export { previewPill } from "./preview-pill.tsx";

package/dist/next/index.js

@@ -1,3 +1,5 @@
 export { createPageRenderer } from "./page-renderer.js";
 export { metadataFrom } from "./meta.js";
 export { createSmoodlyQueries } from "./queries.js";
+export { previewRoute } from "./preview-route.js";
+export { previewPill } from "./preview-pill.js";

package/dist/next/page-renderer.d.ts

@@ -30,6 +30,8 @@ export type PageRendererOptions = {
     /** Locale-relative CMS path → site URL. Default: the path itself. With
      *  next-intl: `(path, locale) => getPathname({ locale, href: path })`. */
     href?: (path: string, locale: string) => string;
+    /** Where the preview pill's Exit goes (spec 2026-09-29 pre-install fixes §2): the route that exports `previewRoute`. Default `/api/preview`. */
+    previewRoute?: string;
 };
 export type PathRenderOptions = {
     locale?: string;

package/dist/next/page-renderer.js

@@ -1,29 +1,30 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // The site-route seam (spec 2026-09-05 §5): the two route files call
 // renderSmoodlyPath; everything else — request gating, draft mode, the
-// cache keyed by (locale, path) and tagged by id, 404s, the editor
-// bridge — lives here, over the framework-free site layer. Bound once by
-// the app, exactly like createAdminOpHandler.
+// cache keyed by (locale, path, target) and tagged by id, 404s, the editor
+// bridge (through the lazy canvas stub) — lives here, over the
+// framework-free site layer. Bound once by the app, exactly like
+// createAdminOpHandler.
 import { Suspense } from "react";
 import { unstable_cache } from "next/cache";
 import { draftMode } from "next/headers";
 import { notFound, permanentRedirect, unstable_rethrow } from "next/navigation";
 import { connection } from "next/server";
-import { EditorBridge } from "../admin/next/bridge.js";
-import { CanvasBoundary } from "./canvas-boundary.js";
+import { CanvasBridgeSlot, CanvasNetSlot } from "./canvas-slot.js";
 import { DRAFT_META_NAME } from "../admin/editor/canvas-diagnosis.js";
 import { fixedPathFor } from "../localize.js";
-import { joinPath } from "../paths.js";
+import { decodeSegment, joinPath } from "../paths.js";
 import { renderPage } from "../render.js";
 import { entryTag, pageTag, globalTag } from "../revalidate.js";
 import { pageContextOf } from "../site.js";
 import { metadataFrom } from "./meta.js";
+import { previewPill } from "./preview-pill.js";
 /** Logged once per renderer when Next's cacheComponents is on (spec 2026-09-27 cache components §2). */
 export const CACHE_COMPONENTS_WARNING = "smoodly: Next's cacheComponents is on, and Smoodly does not support it — a missing page answers 200 with noindex instead of 404, and a redirect answers 200 instead of 308. Turn cacheComponents off in next.config.ts; the Next.js guide's \"Cache Components\" section says why (https://smoodly.io/docs/frameworks/nextjs).";
 /** The canvas net (spec 2026-09-27 section guard §5): Server Components hand a section that failed to the
  *  browser, where CanvasBoundary catches it. Defined here, not in the client file: a function exported
  *  from a "use client" module is a reference on the server and cannot be called. */
-const canvasWrap = (child, section) => (_jsx(Suspense, { fallback: null, children: _jsx(CanvasBoundary, { id: section.id, title: section.title, children: child }) }));
+const canvasWrap = (child, section) => (_jsx(Suspense, { fallback: null, children: _jsx(CanvasNetSlot, { id: section.id, title: section.title, children: child }) }));
 export function createPageRenderer(options) {
     const { site } = options;
     const href = options.href ?? ((path) => path);
@@ -34,7 +35,10 @@ export function createPageRenderer(options) {
     async function load(target, locale, path, draft, version) {
         if (draft)
             return site.load(target, locale, path, { draft: true, ...(version !== undefined ? { version } : {}) });
-        return unstable_cache(() => site.load(target, locale, path), ["smoodly-site", locale, path], {
+        // Keyed by what the unit holds, not only where: an address that changes
+        // owner — a deploy handing it to a code record, which fires no tag —
+        // can never serve the previous occupant (spec 2026-09-29 pre-install fixes §5).
+        return unstable_cache(() => site.load(target, locale, path), ["smoodly-site", locale, path, target.kind, target.id], {
             tags: [target.kind === "page" ? pageTag(target.id) : entryTag(target.id)],
         })();
     }
@@ -115,7 +119,7 @@ export function createPageRenderer(options) {
         // The draft marker tells the page editor's canvas diagnosis that Smoodly
         // rendered this response (spec 2026-09-27 shadowed-page detector §3);
         // React hoists the meta into the head. Never outside draft mode.
-        return (_jsxs(_Fragment, { children: [draft ? _jsx("meta", { name: DRAFT_META_NAME }) : null, editor ? _jsx(EditorBridge, {}) : null, render(hit, editor, locale)] }));
+        return (_jsxs(_Fragment, { children: [draft ? _jsx("meta", { name: DRAFT_META_NAME }) : null, editor ? _jsx(CanvasBridgeSlot, {}) : null, draft && !editor && !version ? previewPill({ route: options.previewRoute }) : null, render(hit, editor, locale)] }));
     }
     async function metadata(pathFor, opts, accept) {
         // generateMetadata runs alongside the page render, so it gates too.
@@ -137,7 +141,7 @@ export function createPageRenderer(options) {
     /** Resolved AFTER connection(), inside page()/metadata(), so a wiring
      *  error surfaces as a rejected promise like every other failure. */
     const fixedPath = (Page) => (locale) => fixedPathFor(Page.schema, locale, site.locales, site.homePageSlug);
-    const literal = (segments) => () => joinPath(segments);
+    const literal = (segments) => () => joinPath(segments.map(decodeSegment));
     /** A global item for a layout: cached per (item, locale) under the
      *  global tag outside draft mode, the live draft inside it. */
     async function getSmoodlyGlobal(item, opts) {

package/dist/next/preview-pill.d.ts

@@ -0,0 +1,9 @@
+import { type ReactElement } from "react";
+/** The pill's whole client side. `closed` lives in the closure, so a hidden
+ *  pill stays hidden across client navigations and returns on a reload. */
+export declare const PREVIEW_PILL_SCRIPT: string;
+/** The pill for a route that does not go through the renderer: render it
+ *  when `(await draftMode()).isEnabled`, never in the editor's canvas. */
+export declare function previewPill(opts?: {
+    route?: string;
+}): ReactElement;

package/dist/next/preview-pill.js

@@ -0,0 +1,56 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// The preview pill (spec 2026-09-29 pre-install fixes §2): while draft mode
+// is on, outside the editor's canvas, a floating pill says the page shows
+// unpublished changes and offers Exit preview. It is an inline script
+// defining a custom element with its styles in a Shadow DOM — no React,
+// no client module, never in the site's bundles (the live-page rule, §1).
+// The renderer emits it only in draft mode, so a live page's HTML is
+// unchanged. A strict Content-Security-Policy blocks the inline script;
+// the Next.js guide says so. The script is a constant: the route rides on
+// the element, so nothing is interpolated into code.
+import { createElement } from "react";
+const CSS = ":host{all:initial}:host([hidden]){display:none}" +
+    ".pill{position:fixed;bottom:16px;z-index:2147483647;display:flex;align-items:center;gap:8px;padding:6px 6px 6px 14px;" +
+    "border-radius:999px;background:#151727;color:#fff;font:500 13px/1.2 system-ui,-apple-system,sans-serif;" +
+    "box-shadow:0 4px 16px rgba(0,0,0,.25);cursor:grab;user-select:none;touch-action:none}" +
+    ".pill[data-pos=left]{left:16px}.pill[data-pos=center]{left:50%;transform:translateX(-50%)}.pill[data-pos=right]{right:16px}" +
+    ".pill.dragging{cursor:grabbing}" +
+    "a{color:#151727;background:#fff;border-radius:999px;padding:5px 10px;text-decoration:none;font-weight:600}" +
+    "button{all:unset;cursor:pointer;width:24px;height:24px;border-radius:999px;display:grid;place-items:center;color:#fff;opacity:.7}" +
+    "button:hover,button:focus-visible{opacity:1;outline:2px solid #fff}";
+const HTML = '<div class="pill" role="region" aria-label="Smoodly preview">' +
+    "<span>Preview \\u00b7 unpublished changes</span>" +
+    '<a href="#">Exit preview</a>' +
+    '<button type="button" aria-label="Hide until reload">\\u00d7</button>' +
+    "</div>";
+/** The pill's whole client side. `closed` lives in the closure, so a hidden
+ *  pill stays hidden across client navigations and returns on a reload. */
+export const PREVIEW_PILL_SCRIPT = "(function(){" +
+    'if(customElements.get("smoodly-preview-pill"))return;' +
+    'var KEY="smoodly-pill-position",closed=false;' +
+    'function load(){try{var v=localStorage.getItem(KEY);return v==="left"||v==="right"?v:"center"}catch(e){return"center"}}' +
+    "function save(v){try{localStorage.setItem(KEY,v)}catch(e){}}" +
+    "class Pill extends HTMLElement{connectedCallback(){" +
+    "if(closed){this.hidden=true;return}" +
+    "if(this.shadowRoot)return;" +
+    'var root=this.attachShadow({mode:"open"}),self=this;' +
+    `root.innerHTML="<style>${CSS}</style>${HTML.replace(/"/g, '\\"')}";` +
+    'var pill=root.querySelector(".pill"),link=root.querySelector("a"),close=root.querySelector("button");' +
+    'pill.setAttribute("data-pos",load());' +
+    'link.addEventListener("click",function(e){e.preventDefault();var route=self.getAttribute("data-route")||"/api/preview";' +
+    'location.href=route+(route.indexOf("?")<0?"?":"&")+"disable&path="+encodeURIComponent(location.pathname+location.search)});' +
+    'close.addEventListener("click",function(){closed=true;self.hidden=true});' +
+    "var start=null;" +
+    'pill.addEventListener("pointerdown",function(e){if(e.target.closest("a,button"))return;start=e.clientX;pill.setPointerCapture(e.pointerId);pill.classList.add("dragging")});' +
+    'pill.addEventListener("pointermove",function(e){if(start!==null)pill.style.translate=(e.clientX-start)+"px 0"});' +
+    'pill.addEventListener("pointerup",function(e){if(start===null)return;start=null;pill.classList.remove("dragging");pill.style.translate="";' +
+    'var x=e.clientX/innerWidth,pos=x<1/3?"left":x>2/3?"right":"center";pill.setAttribute("data-pos",pos);save(pos)});' +
+    'pill.addEventListener("pointercancel",function(){if(start===null)return;start=null;pill.classList.remove("dragging");pill.style.translate=""});' +
+    "}}" +
+    'customElements.define("smoodly-preview-pill",Pill);' +
+    "})();";
+/** The pill for a route that does not go through the renderer: render it
+ *  when `(await draftMode()).isEnabled`, never in the editor's canvas. */
+export function previewPill(opts) {
+    return (_jsxs(_Fragment, { children: [_jsx("script", { dangerouslySetInnerHTML: { __html: PREVIEW_PILL_SCRIPT } }), createElement("smoodly-preview-pill", { "data-route": opts?.route ?? "/api/preview" })] }));
+}

package/dist/next/preview-route.d.ts

@@ -0,0 +1 @@
+export declare function previewRoute(request: Request): Promise<Response>;

package/dist/next/preview-route.js

@@ -0,0 +1,30 @@
+// The draft-mode switch every starter mounts at app/api/preview/route.ts
+// (spec 2026-09-29 pre-install fixes §2). Turning drafts OFF is harmless,
+// so `?disable` needs no secret — the preview pill's Exit links here.
+// Turning them ON needs SMOODLY_PREVIEW_SECRET and fails closed when it is
+// unset. Either way it returns to a same-origin path.
+import { draftMode } from "next/headers";
+import { redirect } from "next/navigation";
+export async function previewRoute(request) {
+    const url = new URL(request.url);
+    const draft = await draftMode();
+    if (url.searchParams.has("disable")) {
+        draft.disable();
+    }
+    else {
+        const secret = process.env.SMOODLY_PREVIEW_SECRET;
+        if (!secret || url.searchParams.get("secret") !== secret)
+            return new Response("Invalid secret", { status: 401 });
+        draft.enable();
+    }
+    redirect(sameOriginPath(url.searchParams.get("path") ?? "/", url));
+}
+/** The path as this origin resolves it, or "/" when it would leave the site. A browser's URL parser strips
+ *  tab, CR and LF before it resolves a Location, so "/\t/evil.test" is "//evil.test" to it: resolve the
+ *  way it does and compare origins, and refuse control characters and backslashes outright. */
+function sameOriginPath(raw, base) {
+    if (!raw.startsWith("/") || /[\u0000-\u001f\u007f\\]/.test(raw))
+        return "/";
+    const to = new URL(raw, base);
+    return to.origin === base.origin ? to.pathname + to.search + to.hash : "/";
+}

package/dist/path-index.d.ts

@@ -1,4 +1,5 @@
 import type { PathRow, PathTarget } from "./paths.ts";
+import { type Anchors } from "./anchors.ts";
 export type { PathRow, PathTarget } from "./paths.ts";
 /** A rewrite target; `redirectLocales` names the locales whose old live rows stay as redirects (none = drop them). */
 export type RewriteTarget = PathTarget & {
@@ -27,14 +28,24 @@ export interface PathIndex {
 export declare const pathTakenError: (locale: string, path: string) => Error;
 export declare const pathLiveError: (locale: string, path: string) => Error;
 export declare class MemoryPathIndex implements PathIndex {
+    private anchors;
     private rows;
+    /** Held by reference: the config's addresses, read on every call (spec 2026-09-29 anchored paths §2). */
+    constructor(anchors?: Anchors);
+    /** A stored row as callers see it: the full URL, or nothing when its anchor has no address. */
+    private shown;
+    private shownAll;
     rewrite(targets: RewriteTarget[], rows: PathRow[]): Promise<void>;
     remove(targets: PathTarget[]): Promise<void>;
+    private hit;
     resolve(locale: string, path: string): Promise<PathHit | null>;
     pathsOf(target: PathTarget): Promise<Record<string, string>>;
     redirectsOf(target: PathTarget): Promise<PathRow[]>;
+    /** Every live URL in the locale; an editor's row under a code address is left out, since visitors never reach it (spec §4). */
     listLive(locale: string): Promise<PathRow[]>;
     listRedirects(locale: string): Promise<PathRow[]>;
+    /** A redirect by hand stays absolute (anchor ''): refused where the URL resolves live; a redirect there is replaced. */
     addRedirect(row: PathRow): Promise<void>;
+    /** Deletes the redirect rows a URL reaches, under any candidate anchor; a live row there is left alone. */
     removeRedirect(locale: string, path: string): Promise<void>;
 }

package/dist/path-index.js

@@ -1,66 +1,93 @@
+import { candidates, fullPath, pickHit, sameUrlKeys } from "./anchors.js";
 const sameTarget = (a, b) => a.kind === b.kind && a.id === b.id;
-const key = (locale, path) => `${locale} ${path}`;
 export const pathTakenError = (locale, path) => new Error(`smoodly: the path "${path}" (${locale}) is already taken.`);
 export const pathLiveError = (locale, path) => new Error(`smoodly: "${path}" (${locale}) is a live address.`);
-const strip = ({ redirect: _redirect, ...row }) => row;
+const key = (locale, anchor, path) => `${locale} ${anchor} ${path}`;
+const stored = (r) => ({ kind: r.kind, id: r.id, locale: r.locale, anchor: r.anchor ?? "", path: r.path, redirect: false });
 export class MemoryPathIndex {
-    constructor() {
+    /** Held by reference: the config's addresses, read on every call (spec 2026-09-29 anchored paths §2). */
+    constructor(anchors = { addresses: {}, homePageSlug: "home", defaultLocale: "en" }) {
+        this.anchors = anchors;
         this.rows = [];
     }
+    /** A stored row as callers see it: the full URL, or nothing when its anchor has no address. */
+    shown(r) {
+        const path = fullPath(this.anchors, r.anchor, r.path, r.locale);
+        return path === null ? null : { kind: r.kind, id: r.id, locale: r.locale, path };
+    }
+    shownAll(rows) {
+        return rows.map((r) => this.shown(r)).filter((r) => r !== null);
+    }
     async rewrite(targets, rows) {
+        const incoming = rows.map(stored);
         const ofTarget = (r) => targets.find((t) => sameTarget(t, r));
-        const newKeys = new Set(rows.map((r) => key(r.locale, r.path)));
+        // Every key a new row's full URL answers to: live wins a redirect there under any anchor (a redirect by
+        // hand has none), and an old row at the same full URL is the same address, not an old one.
+        const newKeys = new Set(incoming.flatMap((r) => sameUrlKeys(this.anchors, r.locale, r.anchor, r.path).map((k) => key(r.locale, k.anchor, k.path))));
         // 1. redirect rows at the new live addresses go, whoever they point at (live wins, rename-back reclaims)
-        let kept = this.rows.filter((r) => !(r.redirect && newKeys.has(key(r.locale, r.path))));
+        let kept = this.rows.filter((r) => !(r.redirect && newKeys.has(key(r.locale, r.anchor, r.path))));
         // 2. the targets' old live rows: flipped to redirects in the named locales unless the address stays live
         kept = kept.map((r) => {
             const t = !r.redirect ? ofTarget(r) : undefined;
-            return t && t.redirectLocales?.includes(r.locale) && !newKeys.has(key(r.locale, r.path)) ? { ...r, redirect: true } : r;
+            return t && t.redirectLocales?.includes(r.locale) && !newKeys.has(key(r.locale, r.anchor, r.path)) ? { ...r, redirect: true } : r;
         });
-        // 3. the targets' remaining live rows go — and so do their redirect rows in a locale the
-        //    target has no new live row in (a removed translation: nothing could resolve them)
-        const liveLocales = new Set(rows.map((r) => `${r.kind} ${r.id} ${r.locale}`));
+        // 3. the targets' remaining live rows go — and so do their redirect rows in a locale the target has no new live row in
+        const liveLocales = new Set(incoming.map((r) => `${r.kind} ${r.id} ${r.locale}`));
         kept = kept.filter((r) => !ofTarget(r) || (r.redirect && liveLocales.has(`${r.kind} ${r.id} ${r.locale}`)));
-        // 4. the new live rows: a collision now is with another target's live row
-        const taken = new Set(kept.map((r) => key(r.locale, r.path)));
-        for (const row of rows) {
-            const k = key(row.locale, row.path);
+        // 4. the new live rows: a collision now is with another target's live row under the same anchor
+        const taken = new Set(kept.map((r) => key(r.locale, r.anchor, r.path)));
+        for (const r of incoming) {
+            const k = key(r.locale, r.anchor, r.path);
             if (taken.has(k))
-                throw pathTakenError(row.locale, row.path);
+                throw pathTakenError(r.locale, fullPath(this.anchors, r.anchor, r.path, r.locale) ?? r.path);
             taken.add(k);
         }
-        this.rows = [...kept, ...rows.map((r) => ({ ...r, redirect: false }))];
+        this.rows = [...kept, ...incoming];
     }
     async remove(targets) {
         this.rows = this.rows.filter((r) => !targets.some((t) => sameTarget(t, r)));
     }
+    hit(locale, url) {
+        const { keys, coded } = candidates(this.anchors, locale, url);
+        return pickHit(this.rows.filter((r) => r.locale === locale), keys, coded);
+    }
     async resolve(locale, path) {
-        const row = this.rows.find((r) => r.locale === locale && r.path === path);
+        const row = this.hit(locale, path);
         return row ? { kind: row.kind, id: row.id, redirect: row.redirect } : null;
     }
     async pathsOf(target) {
         const out = {};
-        for (const r of this.rows)
-            if (!r.redirect && sameTarget(r, target))
-                out[r.locale] = r.path;
+        for (const r of this.shownAll(this.rows.filter((r) => !r.redirect && sameTarget(r, target))))
+            out[r.locale] = r.path;
         return out;
     }
     async redirectsOf(target) {
-        return this.rows.filter((r) => r.redirect && sameTarget(r, target)).map(strip);
+        return this.shownAll(this.rows.filter((r) => r.redirect && sameTarget(r, target)));
     }
+    /** Every live URL in the locale; an editor's row under a code address is left out, since visitors never reach it (spec §4). */
     async listLive(locale) {
-        return this.rows.filter((r) => !r.redirect && r.locale === locale).map(strip);
+        const served = (r) => !(r.anchor === "" && candidates(this.anchors, locale, r.path).coded);
+        return this.shownAll(this.rows.filter((r) => !r.redirect && r.locale === locale && served(r))).sort((a, b) => a.path.localeCompare(b.path));
     }
     async listRedirects(locale) {
-        return this.rows.filter((r) => r.redirect && r.locale === locale).map(strip);
+        return this.shownAll(this.rows.filter((r) => r.redirect && r.locale === locale)).sort((a, b) => a.path.localeCompare(b.path));
     }
+    /** A redirect by hand stays absolute (anchor ''): refused where the URL resolves live; a redirect there is replaced. */
     async addRedirect(row) {
-        const existing = this.rows.find((r) => r.locale === row.locale && r.path === row.path);
+        const existing = this.hit(row.locale, row.path);
         if (existing && !existing.redirect)
             throw pathLiveError(row.locale, row.path);
-        this.rows = [...this.rows.filter((r) => r !== existing), { ...row, redirect: true }];
+        // An editor's page hidden under a code address still holds its row: a redirect never stacks on it.
+        if (this.rows.some((r) => !r.redirect && r.locale === row.locale && r.anchor === "" && r.path === row.path))
+            throw pathLiveError(row.locale, row.path);
+        // Every redirect the URL reaches goes, under any anchor: the new one replaces them all.
+        const { keys } = candidates(this.anchors, row.locale, row.path);
+        const replaced = (r) => r.redirect && r.locale === row.locale && keys.some((k) => k.anchor === r.anchor && k.path === r.path);
+        this.rows = [...this.rows.filter((r) => !replaced(r)), { ...stored({ ...row, anchor: "" }), redirect: true }];
     }
+    /** Deletes the redirect rows a URL reaches, under any candidate anchor; a live row there is left alone. */
     async removeRedirect(locale, path) {
-        this.rows = this.rows.filter((r) => !(r.redirect && r.locale === locale && r.path === path));
+        const { keys } = candidates(this.anchors, locale, path);
+        this.rows = this.rows.filter((r) => !(r.redirect && r.locale === locale && keys.some((k) => k.anchor === r.anchor && k.path === r.path)));
     }
 }

package/dist/paths.d.ts

@@ -1,3 +1,4 @@
+import type { Addresses } from "./addresses.ts";
 export declare const SEGMENT_RE: RegExp;
 export declare const isSegment: (s: string) => boolean;
 export declare function assertSegment(s: string, what: string): void;
@@ -24,18 +25,28 @@ export declare function perLocaleSegments(value: string | Record<string, string>
  *  (spec 2026-09-06 §3). The boot collision check (config.ts), the
  *  materializer (admin/fixed-nodes.ts) and the fixed path derivation
  *  (localize.ts) all fill through here, or a collision passes boot and
- *  only surfaces at materialization. Collection mounts are NOT filled:
- *  a per-locale path claims exactly the locales it names. */
+ *  only surfaces at materialization. Collection paths fill the same way
+ *  (addresses.ts): their entries take the default path in a locale the
+ *  path omits (collectionSegment), so the address is claimed there too. */
 export declare function fixedPageSegments(slug: string | Record<string, string>, locales: LocaleSet): Record<string, string>;
 export type PathTarget = {
     kind: "page" | "entry";
     id: string;
 };
+/** A URL row: `anchor` names the code address it hangs under (spec 2026-09-29 anchored paths §1), absent = the editors' tree;
+ *  `path` is the part editors made. Read back from the index, `path` is the full URL and `anchor` is absent. */
 export type PathRow = PathTarget & {
     locale: string;
     path: string;
+    anchor?: string;
 };
 export declare const joinPath: (segments: string[]) => string;
+/** A request's segment or a typed address's, as stored: percent-decoded and NFC-composed, so
+ *  a pasted `%C3%A4`, a typed `ä` and a decomposed `a\u0308` are one address. Next hands the
+ *  catch-all its segments still encoded. A stray `%` that is no escape stays as it is, and so
+ *  does a segment holding an encoded slash: decoded, it would become two segments and make
+ *  `/a%2Fb` an alias of `/a/b`. Slugs are ASCII, so this changes nothing a slug path holds. */
+export declare function decodeSegment(segment: string): string;
 export declare const splitPath: (path: string) => string[];
 /** The node's segment in one locale. An absent locale is an error, never
  *  a fallback: the stores' parent rule guarantees a present node has a
@@ -49,6 +60,8 @@ export declare function assertDepth(depth: number, max: number, what: string): v
 export type PageLike = {
     id: string;
     parentId: string | null;
+    /** The owner key when code owns the record (spec 2026-09-29 nested paths §3); absent or null = an editor's page. */
+    fixed?: string | null;
     /** The locales the node exists in, each with the node's OWN segment there. Presence IS the key (spec 2026-09-06 §3). */
     locales: Record<string, {
         slug: string;
@@ -57,18 +70,22 @@ export type PageLike = {
 export type PagePathOptions = {
     locales: LocaleSet;
     homePageSlug: string;
+    addresses?: Addresses;
 };
 /** Home is judged by identity: the root node whose DEFAULT-locale slug is
  *  homePageSlug serves "/" in every locale it exists in. */
 export declare const isHomeNode: (node: PageLike, opts: PagePathOptions) => boolean;
 /** The node's path in one locale: `/` for the home node, else the
- *  locale's ancestor chain joined. THE derivation — pagePathRows,
+ *  locale's ancestor chain joined. A code-owned root's path is its
+ *  address (spec 2026-09-29). THE derivation — pagePathRows,
  *  buildPageTree and the site layer all call this. */
 export declare function pagePath(node: PageLike, byId: (id: string) => PageLike | undefined, locale: string, opts: PagePathOptions): string;
 /** The same path, or null when the node or an ancestor is absent from the
- *  locale — what the Pages list shows as a dimmed "not in fi" row. */
+ *  locale — what the Pages list shows as a dimmed "not in fi" row — or
+ *  when its code-owned root has no address there. */
 export declare function pagePathIn(node: PageLike, byId: (id: string) => PageLike | undefined, locale: string, opts: PagePathOptions): string | null;
-/** One row per locale the target EXISTS in. */
+/** One row per locale the target EXISTS in (spec 2026-09-29 anchored paths §3): under a code-owned root, the root's
+ *  owner key and the chain below it (`''` for the root itself); in the editors' tree, no anchor and the full path. */
 export declare function pagePathRows(targets: PageLike[], byId: (id: string) => PageLike | undefined, opts: PagePathOptions): PathRow[];
 export type EntryLike = {
     id: string;
@@ -91,13 +108,9 @@ export declare const slugOf: (fields: Record<string, unknown>) => string | null;
 /** The entry's segment in one locale: its row's slug. An absent locale
  *  or a slug-less row is null — no URL there, never a fallback. */
 export declare function entrySegment(entry: EntryLike, locale: string): string | null;
-/** One row per locale the target EXISTS in, where the whole chain has a
- *  segment in that locale. The stores' parent rule guarantees an ancestor
- *  is present wherever a descendant is; an ancestor without a slug there
- *  simply yields no URL for the subtree in that locale. */
-export declare function entryPathRows(targets: EntryLike[], byId: (id: string) => EntryLike | undefined, collection: {
-    path?: string | Record<string, string>;
-}, set: LocaleSet): PathRow[];
+/** One row per locale the target EXISTS in, where the whole chain has a slug there, under the collection's anchor
+ *  (spec 2026-09-29 anchored paths §1): written whether or not the collection has a `path`, which the index reads. */
+export declare function entryPathRows(targets: EntryLike[], byId: (id: string) => EntryLike | undefined, collection: string): PathRow[];
 /** The locales a node is published in — the ones whose old addresses may
  *  stay as redirects (spec 2026-09-26 redirects §2: only published rows). */
 export declare function publishedLocales(node: {