smoodly 0.0.39 → 0.0.41

package/dist/admin/next/create-admin.js

@@ -28,6 +28,9 @@ export function createSmoodlyAdmin(input) {
         // Presence is the one thing that needs it: a failed lookup (an unmigrated project, an
         // unreachable database) is logged and turns presence off, so the shell still reaches
         // sign-in, the schema notice or the admin-path ErrorPane.
+        // Auth first: an admin that cannot start (a missing publishable key) fails on its own
+        // error, not after a presence line that suggests it runs without presence.
+        const auth = input.auth();
         let presenceConfig;
         try {
             presenceConfig = await input.presence?.();
@@ -35,7 +38,7 @@ export function createSmoodlyAdmin(input) {
         catch (e) {
             console.error("smoodly: editing presence is off —", e instanceof Error ? e.message : e);
         }
-        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth(), presenceConfig: presenceConfig }), children] }));
+        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: auth, presenceConfig: presenceConfig }), children] }));
     }
     return { AdminPage, AdminLayout };
 }

package/dist/admin/supabase-auth.js

@@ -11,7 +11,7 @@ export function supabaseAdminAuth(input) {
     let client = null;
     const auth = () => {
         if (!input.authKey) {
-            throw new Error("smoodly: set SMOODLY_PUBLISHABLE_KEY in .env.local — the admin signs in with it (Deploying: https://smoodly.io/docs/getting-started/deploying).");
+            throw new Error("smoodly: set SMOODLY_PUBLISHABLE_KEY in .env.local, or in your host's environment variables — the admin signs in with it (Deploying: https://smoodly.io/docs/getting-started/deploying).");
         }
         return (client ?? (client = createClient(input.authUrl, input.authKey, { auth: { persistSession: false, autoRefreshToken: false } })));
     };

package/dist/cli/space-io.d.ts

@@ -7,10 +7,11 @@ export type SpaceConnection = {
 export declare const MEDIA_BUCKET = "media";
 /** Rows per request. A host may cap below it, so a read stops at the first empty page, not the first short one. */
 export declare const PAGE_ROWS = 1000;
-/** `.env.local`, then `.env`, as Next reads them; a variable already set wins (spec §5). */
-export declare function loadAppEnv(cwd: string, env?: Record<string, string | undefined>): void;
-/** The app's content client, from its env. */
-export declare function connectFromEnv(cwd: string): SpaceConnection;
+/** `.env.local`, then `.env`, as Next reads them; a variable already set wins (spec §5). Returns the files it read. */
+export declare function loadAppEnv(cwd: string, env?: Record<string, string | undefined>): string[];
+/** The app's content client, from its env. Run outside the app, the missing keys are a missing
+ *  folder, so the error names the folder it looked in. */
+export declare function connectFromEnv(cwd: string, env?: Record<string, string | undefined>): SpaceConnection;
 export { readSchemaVersion } from "../schema-read.ts";
 export declare function schemaRefusal(missing: "key" | "schema", command: "Export" | "Import"): string;
 /** Every row of one table in one space, paged in primary-key order. The space filter is explicit: a service-role key sees every space. */

package/dist/cli/space-io.js

@@ -13,22 +13,29 @@ import { ROW_KEY } from "../space-transfer.js";
 export const MEDIA_BUCKET = "media";
 /** Rows per request. A host may cap below it, so a read stops at the first empty page, not the first short one. */
 export const PAGE_ROWS = 1000;
-/** `.env.local`, then `.env`, as Next reads them; a variable already set wins (spec §5). */
+/** `.env.local`, then `.env`, as Next reads them; a variable already set wins (spec §5). Returns the files it read. */
 export function loadAppEnv(cwd, env = process.env) {
+    const read = [];
     for (const name of [".env.local", ".env"]) {
         const file = join(cwd, name);
         if (!existsSync(file))
             continue;
+        read.push(name);
         for (const [key, value] of Object.entries(parseEnv(readFileSync(file, "utf8")))) {
             if (env[key] === undefined)
                 env[key] = value;
         }
     }
+    return read;
 }
-/** The app's content client, from its env. */
-export function connectFromEnv(cwd) {
-    loadAppEnv(cwd);
-    return { db: createSmoodlyClient(resolveSmoodlyEnv(process.env)) };
+/** The app's content client, from its env. Run outside the app, the missing keys are a missing
+ *  folder, so the error names the folder it looked in. */
+export function connectFromEnv(cwd, env = process.env) {
+    const read = loadAppEnv(cwd, env);
+    if (read.length === 0 && (!env.SMOODLY_URL || !env.SMOODLY_SECRET_KEY)) {
+        throw new Error(`smoodly: no .env.local or .env in ${cwd} — run this in your app's folder.`);
+    }
+    return { db: createSmoodlyClient(resolveSmoodlyEnv(env)) };
 }
 export { readSchemaVersion } from "../schema-read.js";
 export function schemaRefusal(missing, command) {

package/dist/client.js

@@ -11,11 +11,39 @@ export function clientOptions(env) {
     // without one (spec 2026-09-30 tester findings §4): a self-host service role is a valid apikey.
     return { url: env.url, key: env.publishableKey || env.secretKey, headers: { Authorization: `Bearer ${env.secretKey}` } };
 }
+/** fetch that names the variable behind two failures supabase-js reports bare: the network
+ *  ("TypeError: fetch failed") and PostgREST refusing the key. */
+function namedFetch(url) {
+    return async (input, init) => {
+        let res;
+        try {
+            res = await fetch(input, init);
+        }
+        catch (e) {
+            if (e instanceof Error && e.name === "AbortError")
+                throw e;
+            throw new TypeError(`can't reach SMOODLY_URL (${url}): ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (res.status !== 401)
+            return res;
+        // PostgREST's key errors are PGRST300–303; their message varies by version ("JWT cryptographic
+        // operation failed", "No suitable key or wrong key type").
+        const body = (await res.clone().json().catch(() => null));
+        if (typeof body?.message !== "string")
+            return res;
+        if (!(typeof body.code === "string" && /^PGRST30\d$/.test(body.code)) && !/JWT/i.test(body.message))
+            return res;
+        const headers = new Headers(res.headers);
+        headers.delete("content-length");
+        const message = `SMOODLY_SECRET_KEY is not a valid key for SMOODLY_URL (${url}): ${body.message}`;
+        return new Response(JSON.stringify({ ...body, message }), { status: 401, statusText: res.statusText, headers });
+    };
+}
 /** The server-side client the stores are built on. */
 export function createSmoodlyClient(env) {
     const options = clientOptions(env);
     return createClient(options.url, options.key, {
-        global: { headers: options.headers },
+        global: { headers: options.headers, fetch: namedFetch(options.url) },
         auth: { persistSession: false, autoRefreshToken: false },
     });
 }

package/dist/content/content-api.d.ts

@@ -43,6 +43,12 @@ export declare function createSmoodlyContent(deps: ContentDeps): {
             title?: string;
         }): Promise<PageRecord>;
         publish: (id: string, locale: string) => Promise<PageRecord>;
+        /** Every page present in `locale` (the default language unless given), code-owned ones included and
+         *  folders left out, optionally only one page type: what a script walks to change many pages. */
+        list(options?: {
+            locale?: string;
+            template?: string;
+        }): Promise<PageRecord[]>;
         /** A code-owned address with no record gets it created the way the admin's Pages list does (spec §2). */
         find(locale: string, path: string): Promise<PageRecord | null>;
     };

package/dist/content/content-api.js

@@ -107,6 +107,12 @@ export function createSmoodlyContent(deps) {
                 }));
             },
             publish: (id, locale) => must(ops.pages.publish(id, locale)),
+            /** Every page present in `locale` (the default language unless given), code-owned ones included and
+             *  folders left out, optionally only one page type: what a script walks to change many pages. */
+            async list(options = {}) {
+                const locale = options.locale ?? def;
+                return (await must(ops.pages.list())).filter((p) => p.template !== null && p.locales[locale] !== undefined && (options.template === undefined || p.template === options.template));
+            },
             /** A code-owned address with no record gets it created the way the admin's Pages list does (spec §2). */
             async find(locale, path) {
                 const found = await findPage(locale, path);

package/dist/env.d.ts

@@ -15,6 +15,11 @@ export type SmoodlyEnv = {
  *  publishable key, so their callers pass "admin" (spec 2026-09-30 tester findings §4). A key
  *  in the wrong variable or of no known form is named here, not by a failed read later. */
 export declare function resolveSmoodlyEnv(env: Record<string, string | undefined>, need?: "site" | "admin"): SmoodlyEnv;
+/** The site's own address for the root layout's `metadataBase`, so canonical, hreflang and social
+ *  image links are absolute. A value without a scheme is named here, not by a bare "Invalid URL" on
+ *  every page; an unset one falls back to localhost and warns once in production, where it would
+ *  put localhost into every page's head. */
+export declare function siteUrl(env?: Record<string, string | undefined>): URL;
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export declare const smoodlyEnv: (need?: "site" | "admin") => SmoodlyEnv;

package/dist/env.js

@@ -25,7 +25,7 @@ function jwtRole(v) {
 export function resolveSmoodlyEnv(env, need = "site") {
     const missing = (need === "admin" ? ADMIN_NEEDS : SITE_NEEDS).filter((name) => !env[name]);
     if (missing.length > 0)
-        throw new Error(`smoodly: set ${missing.join(", ")} in .env.local (Deploying: ${DEPLOYING}).`);
+        throw new Error(`smoodly: set ${missing.join(", ")} in .env.local, or in your host's environment variables (Deploying: ${DEPLOYING}).`);
     const secretKey = env.SMOODLY_SECRET_KEY;
     const publishableKey = env.SMOODLY_PUBLISHABLE_KEY ?? "";
     if (secretKey.startsWith("sb_publishable_") || jwtRole(secretKey) === "anon") {
@@ -41,8 +41,30 @@ export function resolveSmoodlyEnv(env, need = "site") {
         throw new Error("smoodly: SMOODLY_PUBLISHABLE_KEY is neither an sb_publishable_ key nor a JWT — copy the publishable (anon) key from your Supabase project.");
     }
     const url = env.SMOODLY_URL;
+    if (!/^https?:\/\/[^/\s]+/.test(url)) {
+        throw new Error(`smoodly: SMOODLY_URL "${url}" is not an http(s) address — copy the project URL from your Supabase project.`);
+    }
     return { url, secretKey, publishableKey, authUrl: env.SMOODLY_AUTH_URL || url, authKey: env.SMOODLY_AUTH_KEY || publishableKey };
 }
+let siteUrlWarned = false;
+/** The site's own address for the root layout's `metadataBase`, so canonical, hreflang and social
+ *  image links are absolute. A value without a scheme is named here, not by a bare "Invalid URL" on
+ *  every page; an unset one falls back to localhost and warns once in production, where it would
+ *  put localhost into every page's head. */
+export function siteUrl(env = process.env) {
+    const value = env.SITE_URL;
+    if (!value) {
+        if (env.NODE_ENV === "production" && !siteUrlWarned) {
+            siteUrlWarned = true;
+            console.warn(`smoodly: SITE_URL is not set — the page head's links point at http://localhost:3000 (Deploying: ${DEPLOYING}).`);
+        }
+        return new URL("http://localhost:3000");
+    }
+    if (!/^https?:\/\/[^/\s]+/.test(value)) {
+        throw new Error(`smoodly: SITE_URL "${value}" is not an http(s) address — set it like https://www.example.com.`);
+    }
+    return new URL(value);
+}
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export const smoodlyEnv = (need = "site") => resolveSmoodlyEnv(process.env, need);

package/dist/index.d.ts

@@ -129,7 +129,7 @@ export declare const smoodly: {
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
 export type { MarkNode, MarkPath, Marks, Scope } from "./marks.ts";
-export { resolveSmoodlyEnv, smoodlyEnv, presenceConfig } from "./env.ts";
+export { resolveSmoodlyEnv, smoodlyEnv, presenceConfig, siteUrl } from "./env.ts";
 export type { SmoodlyEnv, PresenceConfig } from "./env.ts";
 export { clientOptions, createSmoodlyClient } from "./client.ts";
 export { createSmoodlySite, pageContextOf } from "./site.ts";

package/dist/index.js

@@ -67,6 +67,6 @@ export const smoodly = {
     marks,
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
-export { resolveSmoodlyEnv, smoodlyEnv, presenceConfig } from "./env.js";
+export { resolveSmoodlyEnv, smoodlyEnv, presenceConfig, siteUrl } from "./env.js";
 export { clientOptions, createSmoodlyClient } from "./client.js";
 export { createSmoodlySite, pageContextOf } from "./site.js";

package/dist/next/page-renderer.js

@@ -76,15 +76,19 @@ export function createPageRenderer(options) {
         }
         return _jsx(View, { entry: toEntryItem(hit.entry, hit.entry.fields, hit) });
     }
-    /** hreflang from the SAME map a language switch reads (spec 2026-09-15 §3): the locales with a URL, through href. */
-    function alternates(hit) {
+    /** The page's own address as its canonical, and hreflang from the SAME map a language switch reads
+     *  (spec 2026-09-15 §3): the locales with a URL, through href. Next makes both absolute from the
+     *  layout's `metadataBase` (tester run on 0.0.39, mission 6). */
+    function addresses(hit, locale) {
+        const own = hit.locales[locale]?.path;
+        const out = own ? { canonical: href(own, locale) } : {};
         if (site.locales.supported.length < 2)
-            return {};
+            return out;
         const languages = {};
-        for (const [locale, alt] of Object.entries(hit.locales))
+        for (const [l, alt] of Object.entries(hit.locales))
             if (alt?.path)
-                languages[locale] = href(alt.path, locale);
-        return { alternates: { languages } };
+                languages[l] = href(alt.path, l);
+        return { ...out, languages };
     }
     // Next's cacheComponents serves the catch-all from a fallback shell that
     // commits 200 before the page renders, so 404s and 308s are lost (spec
@@ -137,7 +141,13 @@ export function createPageRenderer(options) {
             return {};
         // A page type without seo: true still gets its page title as <title>; seo: true adds the panel's values on top.
         const seo = hit.seo ?? (hit.kind === "page" ? { title: hit.title } : undefined);
-        return { ...metadataFromSeo(seo), ...alternates(hit) };
+        const meta = metadataFromSeo(seo);
+        const { canonical, languages } = addresses(hit, locale);
+        // og:url only beside Open Graph values the page already sets: an openGraph of its own would
+        // replace the layout's defaults (Next merges metadata one key deep).
+        if (canonical && meta.openGraph)
+            meta.openGraph = { ...meta.openGraph, url: canonical };
+        return canonical || languages ? { ...meta, alternates: { ...(canonical ? { canonical } : {}), ...(languages ? { languages } : {}) } } : meta;
     }
     const any = () => true;
     /** The escape hatch may only render ITS OWN registration's record. */

package/dist/next/preview-route.js

@@ -13,7 +13,9 @@ export async function previewRoute(request) {
     }
     else {
         const secret = process.env.SMOODLY_PREVIEW_SECRET;
-        if (!secret || url.searchParams.get("secret") !== secret)
+        if (!secret)
+            return new Response("Draft links are off: SMOODLY_PREVIEW_SECRET is not set.", { status: 401 });
+        if (url.searchParams.get("secret") !== secret)
             return new Response("Invalid secret", { status: 401 });
         draft.enable();
     }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SMOODLY_VERSION = "0.0.39";
+export declare const SMOODLY_VERSION = "0.0.41";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/write-version.mjs from package.json — do not edit.
-export const SMOODLY_VERSION = "0.0.39";
+export const SMOODLY_VERSION = "0.0.41";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {