smoodly 0.0.40 → 0.0.42

package/dist/admin/next/create-admin.js

@@ -28,6 +28,9 @@ export function createSmoodlyAdmin(input) {
         // Presence is the one thing that needs it: a failed lookup (an unmigrated project, an
         // unreachable database) is logged and turns presence off, so the shell still reaches
         // sign-in, the schema notice or the admin-path ErrorPane.
+        // Auth first: an admin that cannot start (a missing publishable key) fails on its own
+        // error, not after a presence line that suggests it runs without presence.
+        const auth = input.auth();
         let presenceConfig;
         try {
             presenceConfig = await input.presence?.();
@@ -35,7 +38,7 @@ export function createSmoodlyAdmin(input) {
         catch (e) {
             console.error("smoodly: editing presence is off —", e instanceof Error ? e.message : e);
         }
-        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: input.auth(), presenceConfig: presenceConfig }), children] }));
+        return (_jsxs("div", { className: "sm-admin", suppressHydrationWarning: true, children: [_jsx(AdminStyles, {}), _jsx(AdminApp, { registry: registry, op: input.op, auth: auth, presenceConfig: presenceConfig }), children] }));
     }
     return { AdminPage, AdminLayout };
 }

package/dist/admin/supabase-auth.js

@@ -11,7 +11,7 @@ export function supabaseAdminAuth(input) {
     let client = null;
     const auth = () => {
         if (!input.authKey) {
-            throw new Error("smoodly: set SMOODLY_PUBLISHABLE_KEY in .env.local — the admin signs in with it (Deploying: https://smoodly.io/docs/getting-started/deploying).");
+            throw new Error("smoodly: set SMOODLY_PUBLISHABLE_KEY in .env.local, or in your host's environment variables — the admin signs in with it (Deploying: https://smoodly.io/docs/getting-started/deploying).");
         }
         return (client ?? (client = createClient(input.authUrl, input.authKey, { auth: { persistSession: false, autoRefreshToken: false } })));
     };

package/dist/cli/main.js

@@ -35,7 +35,7 @@ export const USAGE = `usage: smoodly <command>
     whose link lands on --admin-url (default: SITE_URL + /admin).`;
 export function parseArgs(argv) {
     const [command, ...rest] = argv;
-    if (!command || command === "--help" || command === "-h" || command === "help")
+    if (!command || command === "help" || argv.some((a) => a === "--help" || a === "-h"))
         return { command: "help" };
     if (command === "export") {
         const args = { out: null };

package/dist/client.js

@@ -11,18 +11,32 @@ export function clientOptions(env) {
     // without one (spec 2026-09-30 tester findings §4): a self-host service role is a valid apikey.
     return { url: env.url, key: env.publishableKey || env.secretKey, headers: { Authorization: `Bearer ${env.secretKey}` } };
 }
-/** fetch that names the address when the network fails: supabase-js reports only
- *  "TypeError: fetch failed", which names neither the variable nor the URL. */
+/** fetch that names the variable behind two failures supabase-js reports bare: the network
+ *  ("TypeError: fetch failed") and PostgREST refusing the key. */
 function namedFetch(url) {
     return async (input, init) => {
+        let res;
         try {
-            return await fetch(input, init);
+            res = await fetch(input, init);
         }
         catch (e) {
             if (e instanceof Error && e.name === "AbortError")
                 throw e;
             throw new TypeError(`can't reach SMOODLY_URL (${url}): ${e instanceof Error ? e.message : String(e)}`);
         }
+        if (res.status !== 401)
+            return res;
+        // PostgREST's key errors are PGRST300–303; their message varies by version ("JWT cryptographic
+        // operation failed", "No suitable key or wrong key type").
+        const body = (await res.clone().json().catch(() => null));
+        if (typeof body?.message !== "string")
+            return res;
+        if (!(typeof body.code === "string" && /^PGRST30\d$/.test(body.code)) && !/JWT/i.test(body.message))
+            return res;
+        const headers = new Headers(res.headers);
+        headers.delete("content-length");
+        const message = `SMOODLY_SECRET_KEY is not a valid key for SMOODLY_URL (${url}): ${body.message}`;
+        return new Response(JSON.stringify({ ...body, message }), { status: 401, statusText: res.statusText, headers });
     };
 }
 /** The server-side client the stores are built on. */

package/dist/env.js

@@ -25,7 +25,7 @@ function jwtRole(v) {
 export function resolveSmoodlyEnv(env, need = "site") {
     const missing = (need === "admin" ? ADMIN_NEEDS : SITE_NEEDS).filter((name) => !env[name]);
     if (missing.length > 0)
-        throw new Error(`smoodly: set ${missing.join(", ")} in .env.local (Deploying: ${DEPLOYING}).`);
+        throw new Error(`smoodly: set ${missing.join(", ")} in .env.local, or in your host's environment variables (Deploying: ${DEPLOYING}).`);
     const secretKey = env.SMOODLY_SECRET_KEY;
     const publishableKey = env.SMOODLY_PUBLISHABLE_KEY ?? "";
     if (secretKey.startsWith("sb_publishable_") || jwtRole(secretKey) === "anon") {

package/dist/next/preview-route.js

@@ -13,7 +13,9 @@ export async function previewRoute(request) {
     }
     else {
         const secret = process.env.SMOODLY_PREVIEW_SECRET;
-        if (!secret || url.searchParams.get("secret") !== secret)
+        if (!secret)
+            return new Response("Draft links are off: SMOODLY_PREVIEW_SECRET is not set.", { status: 401 });
+        if (url.searchParams.get("secret") !== secret)
             return new Response("Invalid secret", { status: 401 });
         draft.enable();
     }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SMOODLY_VERSION = "0.0.40";
+export declare const SMOODLY_VERSION = "0.0.42";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/write-version.mjs from package.json — do not edit.
-export const SMOODLY_VERSION = "0.0.40";
+export const SMOODLY_VERSION = "0.0.42";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.40",
+  "version": "0.0.42",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {