smoodly 0.0.34 → 0.0.35

package/dist/admin/editor/EditorView.js

@@ -64,6 +64,7 @@ import { PublishControl } from "../ui/PublishControl.js";
 import { confirm, DISCARD_CONFIRM } from "../ui/confirm.js";
 import { HistoryModal, historyRows } from "../ui/HistoryModal.js";
 import { draftToken } from "../../draft-token.js";
+import { useUnloadGuard } from "../shell/router.js";
 import { isStale, staleInfoOf } from "../shell/stale.js";
 import { StaleBanner } from "../ui/StaleBanner.js";
 import { DriftNotice } from "../ui/DriftNotice.js";
@@ -150,9 +151,14 @@ export function EditorView({ ops, registry, id }) {
             const r = await ops.pages.saveDraft(id, target, t, token());
             if (r.ok) {
                 // The badge and Publish follow each save without a re-get: saveDraft answers with the version id and the new token.
-                setRecord((rec) => rec?.locales[target]
-                    ? { ...rec, locales: { ...rec.locales, [target]: { ...rec.locales[target], draftVersionId: r.data.versionId, draftSavedAt: r.data.draft?.savedAt ?? null } } }
-                    : rec);
+                // The ref moves with the ack, not with the next render: a save that follows an unmounted view's
+                // (close()) must carry this token, and no render will ever run to refresh it (review I3).
+                const rec = recordRef.current;
+                if (rec?.locales[target]) {
+                    const next = { ...rec, locales: { ...rec.locales, [target]: { ...rec.locales[target], draftVersionId: r.data.versionId, draftSavedAt: r.data.draft?.savedAt ?? null } } };
+                    recordRef.current = next;
+                    setRecord(next);
+                }
                 setDirty(false);
                 presence?.announce(pageTarget(target), r.data.draft?.savedAt ?? null);
             }
@@ -166,6 +172,7 @@ export function EditorView({ ops, registry, id }) {
     // autosave (spec 2026-09-13 §4); the save ack refreshes the canvas
     // through the same inline-session deferral as the page's.
     const globalEdit = useGlobalEdit({ ops, onSaved: (name) => { setGlobalDirty(false); inlineRef.current?.onSaved(); presence?.announce({ kind: "global", id: name, locale }, null); } });
+    useUnloadGuard(dirty || saveState !== "saved" || globalDirty || globalEdit.saveState !== "saved");
     const patchGlobal = (name, path, value) => {
         globalEdit.patch(name, path, value);
         setGlobalDirty(true);

package/dist/admin/editor/autosave.d.ts

@@ -12,6 +12,11 @@ export type DraftAutosave = {
     subscribe(listener: () => void): () => void;
     /** Cancel pending timers; call on unmount. */
     dispose(): void;
+    /** Unmount: save a pending edit now, cancel the timers, and retry nothing
+     *  afterwards (spec 2026-09-29 pre-install fixes §4). */
+    close(): Promise<boolean>;
+    /** Undo `close()` when the hook's effect runs again (React StrictMode mounts, cleans up, mounts). */
+    reopen(): void;
     /** Leave `stale` after the record was reloaded: timers cleared, the reloaded value counts as saved. */
     reset(): void;
 };
@@ -26,7 +31,7 @@ export declare function createDraftAutosave<T>(opts: {
 export type DraftAutosaveOptions<T> = Parameters<typeof createDraftAutosave<T>>[0];
 /** React glue: one controller per mount, always calling the latest
  *  `read`/`persist`/`onSaved` (their identities change on every render —
- *  `ops` and `slug` are props), timers cleared on unmount. */
+ *  `ops` and `slug` are props), a pending edit saved on unmount. */
 export declare function useDraftAutosave<T>(opts: DraftAutosaveOptions<T>): {
     saveState: SaveState;
     mark: () => void;

package/dist/admin/editor/autosave.js

@@ -12,13 +12,24 @@ export function createDraftAutosave(opts) {
     let revision = 0;
     let savedRevision = 0;
     let state = "saved";
+    let closed = false;
+    /** The save on the wire, if any: close() waits for it instead of racing it with a second save. */
+    let inflight = null;
     const listeners = new Set();
     const setState = (next) => {
         state = next;
         for (const l of listeners)
             l();
     };
-    const save = async () => {
+    const save = () => {
+        const run = send();
+        inflight = run;
+        const clear = () => { if (inflight === run)
+            inflight = null; };
+        run.then(clear, clear);
+        return run;
+    };
+    const send = async () => {
         const current = opts.read();
         if (current === null)
             return true;
@@ -60,6 +71,10 @@ export function createDraftAutosave(opts) {
         }
         else {
             // Keep local state; retry with a doubling, capped delay.
+            if (closed) {
+                setState("error");
+                return false;
+            }
             setState("error");
             const delay = retryDelay;
             retryDelay = Math.min(delay * 2, retryCapMs);
@@ -102,6 +117,28 @@ export function createDraftAutosave(opts) {
                 retryTimer = null;
             }
         },
+        close() {
+            closed = true;
+            if (debounceTimer) {
+                clearTimeout(debounceTimer);
+                debounceTimer = null;
+            }
+            if (retryTimer) {
+                clearTimeout(retryTimer);
+                retryTimer = null;
+            }
+            // A save in flight holds the token the next one must carry, and only its ack moves it (review I3):
+            // wait, then send whatever the ack did not cover.
+            const remainder = () => {
+                if (state === "stale")
+                    return Promise.resolve(false);
+                if (revision === savedRevision)
+                    return Promise.resolve(true);
+                return save();
+            };
+            return inflight ? inflight.then(remainder) : remainder();
+        },
+        reopen() { closed = false; },
         reset() {
             if (debounceTimer) {
                 clearTimeout(debounceTimer);
@@ -119,7 +156,7 @@ export function createDraftAutosave(opts) {
 }
 /** React glue: one controller per mount, always calling the latest
  *  `read`/`persist`/`onSaved` (their identities change on every render —
- *  `ops` and `slug` are props), timers cleared on unmount. */
+ *  `ops` and `slug` are props), a pending edit saved on unmount. */
 export function useDraftAutosave(opts) {
     const latest = useRef(opts);
     latest.current = opts;
@@ -131,7 +168,10 @@ export function useDraftAutosave(opts) {
         retryBaseMs: opts.retryBaseMs,
         retryCapMs: opts.retryCapMs,
     }));
-    useEffect(() => () => controller.dispose(), [controller]);
+    useEffect(() => {
+        controller.reopen();
+        return () => { void controller.close(); };
+    }, [controller]);
     const saveState = useSyncExternalStore(controller.subscribe, controller.getState, controller.getState);
     return { saveState, mark: controller.mark, flush: controller.flush, reset: controller.reset };
 }

package/dist/admin/forms/list.js

@@ -1,3 +1,6 @@
+// The list widget's logic as pure functions over plain arrays and objects,
+// so it is tested without a DOM. FieldWidget renders; this file decides.
+import { optionsOf } from "../../fields.js";
 /** An empty item: an object of its subfields' defaults, else the default. */
 export function emptyValue(d) {
     if (d.type === "object") {
@@ -9,7 +12,13 @@ export function emptyValue(d) {
         }
         return out;
     }
-    return d.default;
+    if (d.default !== undefined)
+        return d.default;
+    // A required choice shows its first option (FieldWidget renders no blank
+    // one), so it stores it too — a new item never looks set while it is empty.
+    if ((d.type === "select" || d.type === "radio") && d.optional !== true)
+        return optionsOf(d.options)[0]?.value;
+    return undefined;
 }
 export function addItem(items, list) {
     if (typeof list.max === "number" && items.length >= list.max)

package/dist/admin/shell/EntryForm.js

@@ -34,7 +34,7 @@ import { ResizeHandle } from "../ui/ResizeHandle.js";
 import { entrySourceLocale, entryTitle, localizedFieldKeys } from "./entries-list.js";
 import { useAdminHref } from "./base.js";
 import { localeFromUrl, writeLocaleToUrl } from "../editor/locale-url.js";
-import { navigate, useLeaveGuard } from "./router.js";
+import { navigate, useUnloadGuard } from "./router.js";
 import { LIVE_URL_CONFIRM, LIVE_URL_OPTION, liveUrlChanges } from "./live-url.js";
 import { confirm, confirmWithOption, DISCARD_CONFIRM } from "../ui/confirm.js";
 import { draftToken } from "../../draft-token.js";
@@ -139,6 +139,7 @@ export function EntryForm({ ops, registry, collection, id }) {
             const r = await ops.entries.save(collection, id, locale, value, token(), { redirect: redirectRef.current });
             if (r.ok) {
                 redirectRef.current = true;
+                recordRef.current = r.data;
                 setRecord(r.data);
                 setSaveErrors({});
                 presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
@@ -155,7 +156,7 @@ export function EntryForm({ ops, registry, collection, id }) {
             setDirty(false); },
     });
     // Reload and close ask only while a save is pending or in flight.
-    useLeaveGuard(dirty || saveState !== "saved");
+    useUnloadGuard(dirty || saveState !== "saved");
     const refTargets = useMemo(() => {
         const out = {};
         for (const [key, d] of Object.entries(meta?.fields ?? {})) {

package/dist/admin/shell/GlobalForm.js

@@ -29,7 +29,7 @@ import { ResizeHandle } from "../ui/ResizeHandle.js";
 import { useAdminHref } from "./base.js";
 import { GlobalFields } from "./GlobalFields.js";
 import { localeFromUrl, writeLocaleToUrl } from "../editor/locale-url.js";
-import { useLeaveGuard } from "./router.js";
+import { useUnloadGuard } from "./router.js";
 import { confirm, DISCARD_CONFIRM } from "../ui/confirm.js";
 import { draftToken } from "../../draft-token.js";
 import { isStale, staleInfoOf } from "./stale.js";
@@ -78,6 +78,7 @@ export function GlobalForm({ ops, registry, name }) {
         persist: async (value) => {
             const r = await ops.globals.save(name, locale, value, token());
             if (r.ok) {
+                recordRef.current = r.data;
                 setRecord(r.data);
                 presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
             }
@@ -87,7 +88,7 @@ export function GlobalForm({ ops, registry, name }) {
         },
         onSaved: () => setDirty(false),
     });
-    useLeaveGuard(dirty || saveState !== "saved");
+    useUnloadGuard(dirty || saveState !== "saved");
     const refTargets = useMemo(() => {
         const out = {};
         for (const [key, d] of Object.entries(item?.fields ?? {})) {

package/dist/admin/shell/router.d.ts

@@ -39,3 +39,8 @@ export declare function useRoute(base: string): Route;
 /** Register the calling view as dirty: navigate() asks before leaving,
  *  and beforeunload covers reload, closing the tab and a real link out. */
 export declare function useLeaveGuard(dirty: boolean): void;
+/** The tab-close half of useLeaveGuard alone, for a view that saves on
+ *  unmount (the page editor, spec 2026-09-29 pre-install fixes §4): an
+ *  in-app navigation loses nothing, so only reload, closing the tab and a
+ *  real link out ask, while a change or a save is pending. */
+export declare function useUnloadGuard(pending: boolean): void;

package/dist/admin/shell/router.js

@@ -94,3 +94,16 @@ export function useLeaveGuard(dirty) {
         return () => { guards.delete(guard); window.removeEventListener("beforeunload", onBeforeUnload); };
     }, [dirty]);
 }
+/** The tab-close half of useLeaveGuard alone, for a view that saves on
+ *  unmount (the page editor, spec 2026-09-29 pre-install fixes §4): an
+ *  in-app navigation loses nothing, so only reload, closing the tab and a
+ *  real link out ask, while a change or a save is pending. */
+export function useUnloadGuard(pending) {
+    useEffect(() => {
+        if (!pending)
+            return;
+        const onBeforeUnload = (e) => { e.preventDefault(); e.returnValue = ""; };
+        window.addEventListener("beforeunload", onBeforeUnload);
+        return () => window.removeEventListener("beforeunload", onBeforeUnload);
+    }, [pending]);
+}

package/dist/next/canvas-slot.d.ts

@@ -0,0 +1,7 @@
+import type { ReactNode } from "react";
+export declare const CanvasBridgeSlot: import("react").ComponentType<{}>;
+export declare const CanvasNetSlot: import("react").ComponentType<{
+    id: string;
+    title: string;
+    children?: ReactNode;
+}>;

package/dist/next/canvas-slot.js

@@ -0,0 +1,9 @@
+"use client";
+// The one Smoodly client module a live page carries (spec 2026-09-29
+// pre-install fixes §1). Next ships every client module a route's server
+// graph imports, rendered or not; this stub is that module, and the bridge
+// and the canvas net load from it lazily — only when the renderer is in
+// editor mode, so a live page downloads neither.
+import dynamic from "next/dynamic";
+export const CanvasBridgeSlot = dynamic(() => import("../admin/next/bridge.js").then((m) => m.EditorBridge));
+export const CanvasNetSlot = dynamic(() => import("./canvas-boundary.js").then((m) => m.CanvasBoundary));

package/dist/next/index.d.ts

@@ -3,3 +3,5 @@ export type { PageRendererOptions, PathRenderOptions, PageRegistration } from ".
 export { metadataFrom } from "./meta.ts";
 export { createSmoodlyQueries } from "./queries.ts";
 export type { SmoodlyQueries, QueryOptions, EntriesQuery, TypedEntryItem, GlobalValue } from "./queries.ts";
+export { previewRoute } from "./preview-route.ts";
+export { previewPill } from "./preview-pill.tsx";

package/dist/next/index.js

@@ -1,3 +1,5 @@
 export { createPageRenderer } from "./page-renderer.js";
 export { metadataFrom } from "./meta.js";
 export { createSmoodlyQueries } from "./queries.js";
+export { previewRoute } from "./preview-route.js";
+export { previewPill } from "./preview-pill.js";

package/dist/next/page-renderer.d.ts

@@ -30,6 +30,8 @@ export type PageRendererOptions = {
     /** Locale-relative CMS path → site URL. Default: the path itself. With
      *  next-intl: `(path, locale) => getPathname({ locale, href: path })`. */
     href?: (path: string, locale: string) => string;
+    /** Where the preview pill's Exit goes (spec 2026-09-29 pre-install fixes §2): the route that exports `previewRoute`. Default `/api/preview`. */
+    previewRoute?: string;
 };
 export type PathRenderOptions = {
     locale?: string;

package/dist/next/page-renderer.js

@@ -1,16 +1,16 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // The site-route seam (spec 2026-09-05 §5): the two route files call
 // renderSmoodlyPath; everything else — request gating, draft mode, the
-// cache keyed by (locale, path) and tagged by id, 404s, the editor
-// bridge — lives here, over the framework-free site layer. Bound once by
-// the app, exactly like createAdminOpHandler.
+// cache keyed by (locale, path, target) and tagged by id, 404s, the editor
+// bridge (through the lazy canvas stub) — lives here, over the
+// framework-free site layer. Bound once by the app, exactly like
+// createAdminOpHandler.
 import { Suspense } from "react";
 import { unstable_cache } from "next/cache";
 import { draftMode } from "next/headers";
 import { notFound, permanentRedirect, unstable_rethrow } from "next/navigation";
 import { connection } from "next/server";
-import { EditorBridge } from "../admin/next/bridge.js";
-import { CanvasBoundary } from "./canvas-boundary.js";
+import { CanvasBridgeSlot, CanvasNetSlot } from "./canvas-slot.js";
 import { DRAFT_META_NAME } from "../admin/editor/canvas-diagnosis.js";
 import { fixedPathFor } from "../localize.js";
 import { decodeSegment, joinPath } from "../paths.js";
@@ -18,12 +18,13 @@ import { renderPage } from "../render.js";
 import { entryTag, pageTag, globalTag } from "../revalidate.js";
 import { pageContextOf } from "../site.js";
 import { metadataFrom } from "./meta.js";
+import { previewPill } from "./preview-pill.js";
 /** Logged once per renderer when Next's cacheComponents is on (spec 2026-09-27 cache components §2). */
 export const CACHE_COMPONENTS_WARNING = "smoodly: Next's cacheComponents is on, and Smoodly does not support it — a missing page answers 200 with noindex instead of 404, and a redirect answers 200 instead of 308. Turn cacheComponents off in next.config.ts; the Next.js guide's \"Cache Components\" section says why (https://smoodly.io/docs/frameworks/nextjs).";
 /** The canvas net (spec 2026-09-27 section guard §5): Server Components hand a section that failed to the
  *  browser, where CanvasBoundary catches it. Defined here, not in the client file: a function exported
  *  from a "use client" module is a reference on the server and cannot be called. */
-const canvasWrap = (child, section) => (_jsx(Suspense, { fallback: null, children: _jsx(CanvasBoundary, { id: section.id, title: section.title, children: child }) }));
+const canvasWrap = (child, section) => (_jsx(Suspense, { fallback: null, children: _jsx(CanvasNetSlot, { id: section.id, title: section.title, children: child }) }));
 export function createPageRenderer(options) {
     const { site } = options;
     const href = options.href ?? ((path) => path);
@@ -34,7 +35,10 @@ export function createPageRenderer(options) {
     async function load(target, locale, path, draft, version) {
         if (draft)
             return site.load(target, locale, path, { draft: true, ...(version !== undefined ? { version } : {}) });
-        return unstable_cache(() => site.load(target, locale, path), ["smoodly-site", locale, path], {
+        // Keyed by what the unit holds, not only where: an address that changes
+        // owner — a deploy handing it to a code record, which fires no tag —
+        // can never serve the previous occupant (spec 2026-09-29 pre-install fixes §5).
+        return unstable_cache(() => site.load(target, locale, path), ["smoodly-site", locale, path, target.kind, target.id], {
             tags: [target.kind === "page" ? pageTag(target.id) : entryTag(target.id)],
         })();
     }
@@ -115,7 +119,7 @@ export function createPageRenderer(options) {
         // The draft marker tells the page editor's canvas diagnosis that Smoodly
         // rendered this response (spec 2026-09-27 shadowed-page detector §3);
         // React hoists the meta into the head. Never outside draft mode.
-        return (_jsxs(_Fragment, { children: [draft ? _jsx("meta", { name: DRAFT_META_NAME }) : null, editor ? _jsx(EditorBridge, {}) : null, render(hit, editor, locale)] }));
+        return (_jsxs(_Fragment, { children: [draft ? _jsx("meta", { name: DRAFT_META_NAME }) : null, editor ? _jsx(CanvasBridgeSlot, {}) : null, draft && !editor && !version ? previewPill({ route: options.previewRoute }) : null, render(hit, editor, locale)] }));
     }
     async function metadata(pathFor, opts, accept) {
         // generateMetadata runs alongside the page render, so it gates too.

package/dist/next/preview-pill.d.ts

@@ -0,0 +1,9 @@
+import { type ReactElement } from "react";
+/** The pill's whole client side. `closed` lives in the closure, so a hidden
+ *  pill stays hidden across client navigations and returns on a reload. */
+export declare const PREVIEW_PILL_SCRIPT: string;
+/** The pill for a route that does not go through the renderer: render it
+ *  when `(await draftMode()).isEnabled`, never in the editor's canvas. */
+export declare function previewPill(opts?: {
+    route?: string;
+}): ReactElement;

package/dist/next/preview-pill.js

@@ -0,0 +1,56 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// The preview pill (spec 2026-09-29 pre-install fixes §2): while draft mode
+// is on, outside the editor's canvas, a floating pill says the page shows
+// unpublished changes and offers Exit preview. It is an inline script
+// defining a custom element with its styles in a Shadow DOM — no React,
+// no client module, never in the site's bundles (the live-page rule, §1).
+// The renderer emits it only in draft mode, so a live page's HTML is
+// unchanged. A strict Content-Security-Policy blocks the inline script;
+// the Next.js guide says so. The script is a constant: the route rides on
+// the element, so nothing is interpolated into code.
+import { createElement } from "react";
+const CSS = ":host{all:initial}:host([hidden]){display:none}" +
+    ".pill{position:fixed;bottom:16px;z-index:2147483647;display:flex;align-items:center;gap:8px;padding:6px 6px 6px 14px;" +
+    "border-radius:999px;background:#151727;color:#fff;font:500 13px/1.2 system-ui,-apple-system,sans-serif;" +
+    "box-shadow:0 4px 16px rgba(0,0,0,.25);cursor:grab;user-select:none;touch-action:none}" +
+    ".pill[data-pos=left]{left:16px}.pill[data-pos=center]{left:50%;transform:translateX(-50%)}.pill[data-pos=right]{right:16px}" +
+    ".pill.dragging{cursor:grabbing}" +
+    "a{color:#151727;background:#fff;border-radius:999px;padding:5px 10px;text-decoration:none;font-weight:600}" +
+    "button{all:unset;cursor:pointer;width:24px;height:24px;border-radius:999px;display:grid;place-items:center;color:#fff;opacity:.7}" +
+    "button:hover,button:focus-visible{opacity:1;outline:2px solid #fff}";
+const HTML = '<div class="pill" role="region" aria-label="Smoodly preview">' +
+    "<span>Preview \\u00b7 unpublished changes</span>" +
+    '<a href="#">Exit preview</a>' +
+    '<button type="button" aria-label="Hide until reload">\\u00d7</button>' +
+    "</div>";
+/** The pill's whole client side. `closed` lives in the closure, so a hidden
+ *  pill stays hidden across client navigations and returns on a reload. */
+export const PREVIEW_PILL_SCRIPT = "(function(){" +
+    'if(customElements.get("smoodly-preview-pill"))return;' +
+    'var KEY="smoodly-pill-position",closed=false;' +
+    'function load(){try{var v=localStorage.getItem(KEY);return v==="left"||v==="right"?v:"center"}catch(e){return"center"}}' +
+    "function save(v){try{localStorage.setItem(KEY,v)}catch(e){}}" +
+    "class Pill extends HTMLElement{connectedCallback(){" +
+    "if(closed){this.hidden=true;return}" +
+    "if(this.shadowRoot)return;" +
+    'var root=this.attachShadow({mode:"open"}),self=this;' +
+    `root.innerHTML="<style>${CSS}</style>${HTML.replace(/"/g, '\\"')}";` +
+    'var pill=root.querySelector(".pill"),link=root.querySelector("a"),close=root.querySelector("button");' +
+    'pill.setAttribute("data-pos",load());' +
+    'link.addEventListener("click",function(e){e.preventDefault();var route=self.getAttribute("data-route")||"/api/preview";' +
+    'location.href=route+(route.indexOf("?")<0?"?":"&")+"disable&path="+encodeURIComponent(location.pathname+location.search)});' +
+    'close.addEventListener("click",function(){closed=true;self.hidden=true});' +
+    "var start=null;" +
+    'pill.addEventListener("pointerdown",function(e){if(e.target.closest("a,button"))return;start=e.clientX;pill.setPointerCapture(e.pointerId);pill.classList.add("dragging")});' +
+    'pill.addEventListener("pointermove",function(e){if(start!==null)pill.style.translate=(e.clientX-start)+"px 0"});' +
+    'pill.addEventListener("pointerup",function(e){if(start===null)return;start=null;pill.classList.remove("dragging");pill.style.translate="";' +
+    'var x=e.clientX/innerWidth,pos=x<1/3?"left":x>2/3?"right":"center";pill.setAttribute("data-pos",pos);save(pos)});' +
+    'pill.addEventListener("pointercancel",function(){if(start===null)return;start=null;pill.classList.remove("dragging");pill.style.translate=""});' +
+    "}}" +
+    'customElements.define("smoodly-preview-pill",Pill);' +
+    "})();";
+/** The pill for a route that does not go through the renderer: render it
+ *  when `(await draftMode()).isEnabled`, never in the editor's canvas. */
+export function previewPill(opts) {
+    return (_jsxs(_Fragment, { children: [_jsx("script", { dangerouslySetInnerHTML: { __html: PREVIEW_PILL_SCRIPT } }), createElement("smoodly-preview-pill", { "data-route": opts?.route ?? "/api/preview" })] }));
+}

package/dist/next/preview-route.d.ts

@@ -0,0 +1 @@
+export declare function previewRoute(request: Request): Promise<Response>;

package/dist/next/preview-route.js

@@ -0,0 +1,30 @@
+// The draft-mode switch every starter mounts at app/api/preview/route.ts
+// (spec 2026-09-29 pre-install fixes §2). Turning drafts OFF is harmless,
+// so `?disable` needs no secret — the preview pill's Exit links here.
+// Turning them ON needs SMOODLY_PREVIEW_SECRET and fails closed when it is
+// unset. Either way it returns to a same-origin path.
+import { draftMode } from "next/headers";
+import { redirect } from "next/navigation";
+export async function previewRoute(request) {
+    const url = new URL(request.url);
+    const draft = await draftMode();
+    if (url.searchParams.has("disable")) {
+        draft.disable();
+    }
+    else {
+        const secret = process.env.SMOODLY_PREVIEW_SECRET;
+        if (!secret || url.searchParams.get("secret") !== secret)
+            return new Response("Invalid secret", { status: 401 });
+        draft.enable();
+    }
+    redirect(sameOriginPath(url.searchParams.get("path") ?? "/", url));
+}
+/** The path as this origin resolves it, or "/" when it would leave the site. A browser's URL parser strips
+ *  tab, CR and LF before it resolves a Location, so "/\t/evil.test" is "//evil.test" to it: resolve the
+ *  way it does and compare origins, and refuse control characters and backslashes outright. */
+function sameOriginPath(raw, base) {
+    if (!raw.startsWith("/") || /[\u0000-\u001f\u007f\\]/.test(raw))
+        return "/";
+    const to = new URL(raw, base);
+    return to.origin === base.origin ? to.pathname + to.search + to.hash : "/";
+}

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 5;
+export declare const SCHEMA_VERSION = 6;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 5;
+export const SCHEMA_VERSION = 6;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/sql-space.d.ts

@@ -7,6 +7,17 @@ export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0
 export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths", "assets"];
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 export declare function currentSpaceSQL(): string;
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export declare function writePoliciesSQL(table: string, write: string, prefix: string): string;
+/** The content tables' and members' policies. A table with a public read
+ *  has ONE select policy — its own space, not revoked, and a write key or
+ *  the published condition — and split write policies. A table without
+ *  one (refs, members) keeps its `for all` write policy, which is also its
+ *  only select. */
+export declare function contentPoliciesSQL(): string;
 export declare function spaceLayerSQL(): string;
 /** The media bucket and its object policies (spec 2026-09-08 media §3,
  *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
@@ -15,6 +26,9 @@ export declare function spaceLayerSQL(): string;
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export declare function storageSQL(): string;
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export declare function mediaPoliciesSQL(): string;
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
  *  `authenticated` (the role a cloud write key carries), not by anon or

package/dist/sql-space.js

@@ -49,6 +49,43 @@ const PUBLISHED_READ = {
 const NEEDS_SPACE_INDEX = [
     "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
 ];
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export function writePoliciesSQL(table, write, prefix) {
+    return [
+        `drop policy if exists "${prefix}_write" on ${table};`,
+        `drop policy if exists "${prefix}_insert" on ${table};\ncreate policy "${prefix}_insert" on ${table} for insert\n  with check (${write});`,
+        `drop policy if exists "${prefix}_update" on ${table};\ncreate policy "${prefix}_update" on ${table} for update\n  using (${write})\n  with check (${write});`,
+        `drop policy if exists "${prefix}_delete" on ${table};\ncreate policy "${prefix}_delete" on ${table} for delete\n  using (${write});`,
+    ].join("\n\n");
+}
+const OWN = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
+const WRITE = `${OWN} and (select "smoodly_key_kind"()) = 'write'`;
+/** The content tables' and members' policies. A table with a public read
+ *  has ONE select policy — its own space, not revoked, and a write key or
+ *  the published condition — and split write policies. A table without
+ *  one (refs, members) keeps its `for all` write policy, which is also its
+ *  only select. */
+export function contentPoliciesSQL() {
+    const statements = [];
+    for (const table of [...CONTENT_TABLES, "members"]) {
+        const published = PUBLISHED_READ[table];
+        if (published === null) {
+            statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
+                `create policy "smoodly_write" on "${table}" for all\n` +
+                `  using (${WRITE})\n` +
+                `  with check (${WRITE});`);
+            continue;
+        }
+        statements.push(writePoliciesSQL(`"${table}"`, WRITE, "smoodly"));
+        statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
+            `create policy "smoodly_read" on "${table}" for select\n` +
+            `  using (${OWN} and ((select "smoodly_key_kind"()) = 'write' or ${published}));`);
+    }
+    return statements.join("\n\n");
+}
 export function spaceLayerSQL() {
     const statements = [];
     statements.push(`
@@ -185,21 +222,9 @@ $$;`.trim());
     // an InitPlan, evaluated once per statement rather than once per row
     // — needed for smoodly_space_key_revoked, a security definer function
     // Postgres never inlines; applied to all three calls for the same win.
-    const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
-    const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
-    for (const table of [...CONTENT_TABLES, "members"]) {
-        statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
-            `create policy "smoodly_write" on "${table}" for all\n` +
-            `  using (${write})\n` +
-            `  with check (${write});`);
-        const published = PUBLISHED_READ[table];
-        if (published !== null) {
-            const predicate = `${own}${published ? ` and ${published}` : ""}`;
-            statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
-                `create policy "smoodly_read" on "${table}" for select\n` +
-                `  using (${predicate});`);
-        }
-    }
+    const own = OWN;
+    const write = WRITE;
+    statements.push(contentPoliciesSQL());
     // A write key reads its own space's row — the console URL the Members
     // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
     // space_keys but the two definer functions and the service role.
@@ -235,10 +260,6 @@ $$;`.trim());
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export function storageSQL() {
-    const write = `"bucket_id" = 'media'` +
-        ` and (select public."smoodly_key_kind"()) = 'write'` +
-        ` and not (select public."smoodly_space_key_revoked"())` +
-        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
     return `
 insert into storage.buckets ("id", "name", "public", "file_size_limit")
   values ('media', 'media', true, 104857600)
@@ -248,10 +269,16 @@ drop policy if exists "smoodly_media_read" on storage.objects;
 create policy "smoodly_media_read" on storage.objects for select
   using ("bucket_id" = 'media');
 
-drop policy if exists "smoodly_media_write" on storage.objects;
-create policy "smoodly_media_write" on storage.objects for all
-  using (${write})
-  with check (${write});`.trim();
+${mediaPoliciesSQL()}`.trim();
+}
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export function mediaPoliciesSQL() {
+    const write = `"bucket_id" = 'media'` +
+        ` and (select public."smoodly_key_kind"()) = 'write'` +
+        ` and not (select public."smoodly_space_key_revoked"())` +
+        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
+    return writePoliciesSQL("storage.objects", write, "smoodly_media");
 }
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
@@ -263,5 +290,6 @@ export function grantsSQL() {
         `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
+        `revoke execute on function "smoodly_space_row_cap"() from public, anon;`,
     ].join("\n");
 }

package/dist/sql.d.ts

@@ -1,3 +1,8 @@
 import { type CollectionSchema } from "./collections.ts";
 export declare function collectionSQL(collection: CollectionSchema<any>): string;
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export declare function foreignKeyIndexesSQL(): string;
 export declare function coreTablesSQL(): string;