smoodly 0.0.42 → 0.0.43

package/dist/admin/auth.js

@@ -15,8 +15,9 @@ export async function gateAdminOp(auth, call, run) {
     let stored;
     try {
         user = await auth.verify(token);
+        // Marked, so the browser signs itself out instead of showing this on every screen (2026-10-02).
         if (!user)
-            return unauthorized("smoodly: your session has expired — sign in again.");
+            return { ok: false, code: "unauthorized", message: "smoodly: your session has expired — sign in again.", expired: true };
         stored = await auth.memberOf(user.userId);
     }
     catch (e) {

package/dist/admin/client-ops.d.ts

@@ -1,2 +1,5 @@
 import type { AdminOpAction, AdminOps } from "./ops.ts";
-export declare function makeClientOps(action: AdminOpAction, token?: () => string | null): AdminOps;
+/** `onExpired` runs when the server refuses the token outright (gateAdminOp's `expired`): the browser
+ *  still holds a session the auth project no longer knows — after a database reset, a deleted user —
+ *  and only a local sign-out brings the sign-in form back (2026-10-02). */
+export declare function makeClientOps(action: AdminOpAction, token?: () => string | null, onExpired?: () => void): AdminOps;

package/dist/admin/client-ops.js

@@ -9,14 +9,21 @@ const GROUPS = {
     schema: ["status"],
     preview: ["enable", "disable"],
 };
-export function makeClientOps(action, token) {
+/** `onExpired` runs when the server refuses the token outright (gateAdminOp's `expired`): the browser
+ *  still holds a session the auth project no longer knows — after a database reset, a deleted user —
+ *  and only a local sign-out brings the sign-in form back (2026-10-02). */
+export function makeClientOps(action, token, onExpired) {
     const out = {};
     for (const [group, methods] of Object.entries(GROUPS)) {
         out[group] = {};
         for (const method of methods) {
             out[group][method] = (...args) => {
                 const t = token?.() ?? null;
-                return action({ path: `${group}.${method}`, args, ...(t ? { token: t } : {}) });
+                return action({ path: `${group}.${method}`, args, ...(t ? { token: t } : {}) }).then((r) => {
+                    if (!r.ok && r.expired)
+                        onExpired?.();
+                    return r;
+                });
             };
         }
     }

package/dist/admin/forms/useRefOptions.d.ts

@@ -3,5 +3,10 @@ import type { AdminOps } from "../ops.ts";
 import type { AdminCollection, AdminRegistry } from "../serialize.ts";
 import type { RefOption } from "./ref-picker.ts";
 export declare function refOptionsOf(records: EntryRecord[], meta: AdminCollection | undefined, registry: AdminRegistry, locale: string): RefOption[];
+/** What the options are read from, by content: the registry crosses the server → client boundary
+ *  and is re-serialized on every autosave (a Server Action re-renders the route), so a key on its
+ *  identity emptied the picker to "Loading…" and refetched every target on each save (2026-10-02;
+ *  the richtext editor's toolset and elements are keyed the same way, 2026-09-26). */
+export declare function refOptionsKey(registry: AdminRegistry, locale: string, targets: readonly string[]): string;
 /** Options by target collection; a target is `undefined` until its list arrives. */
 export declare function useRefOptions(ops: AdminOps, registry: AdminRegistry, locale: string, targets: readonly string[]): Record<string, RefOption[] | undefined>;

package/dist/admin/forms/useRefOptions.js

@@ -3,7 +3,7 @@
 // collection, loaded once per locale and filtered in the browser. One hook
 // for the entry form, the Globals form and the page editor — the picker
 // takes options as a prop, so a move to server search changes this file only.
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { entryTitle } from "../shell/entries-list.js";
 import { localeStatusOf } from "../shell/pages-tree.js";
 export function refOptionsOf(records, meta, registry, locale) {
@@ -13,14 +13,27 @@ export function refOptionsOf(records, meta, registry, locale) {
         return row ? { id: e.id, title, status: localeStatusOf(row) } : { id: e.id, title, status: "", absent: true };
     });
 }
+/** What the options are read from, by content: the registry crosses the server → client boundary
+ *  and is re-serialized on every autosave (a Server Action re-renders the route), so a key on its
+ *  identity emptied the picker to "Loading…" and refetched every target on each save (2026-10-02;
+ *  the richtext editor's toolset and elements are keyed the same way, 2026-09-26). */
+export function refOptionsKey(registry, locale, targets) {
+    const names = [...new Set(targets)].sort();
+    const metas = names.map((n) => registry.collections.find((c) => c.name === n) ?? null);
+    return JSON.stringify([locale, registry.locales.default, names, metas]);
+}
 /** Options by target collection; a target is `undefined` until its list arrives. */
 export function useRefOptions(ops, registry, locale, targets) {
     const [loaded, setLoaded] = useState({});
-    const key = [...new Set(targets)].sort().join("\n");
+    const key = refOptionsKey(registry, locale, targets);
+    // The effect reads the render's registry, but reloads only when the key says its content changed.
+    const latest = useRef({ registry, locale, targets });
+    latest.current = { registry, locale, targets };
     useEffect(() => {
+        const { registry, locale, targets } = latest.current;
         let cancelled = false;
         setLoaded({}); // the previous locale's options must not show under this one
-        for (const target of key === "" ? [] : key.split("\n")) {
+        for (const target of new Set(targets)) {
             const meta = registry.collections.find((c) => c.name === target);
             ops.entries.list(target).then((r) => {
                 if (cancelled)
@@ -31,6 +44,6 @@ export function useRefOptions(ops, registry, locale, targets) {
                 setLoaded((prev) => ({ ...prev, [target]: [] })); });
         }
         return () => { cancelled = true; };
-    }, [ops, registry, locale, key]);
+    }, [ops, key]);
     return loaded;
 }

package/dist/admin/ops.d.ts

@@ -20,6 +20,8 @@ export type OpError = {
     /** Who wrote it last and when — the freeze notice's two facts. */
     by?: string | null;
     at?: number;
+    /** An `unauthorized` for a token the auth project rejects: the browser signs itself out (2026-10-02). */
+    expired?: true;
 };
 export type OpResult<T> = {
     ok: true;

package/dist/admin/shell/AdminApp.js

@@ -41,7 +41,8 @@ import { connectRealtime } from "./presence-realtime.js";
 import { PresenceProvider } from "./presence-context.js";
 export function AdminApp({ registry, op, auth, presenceConfig }) {
     const session = useAdminSession(auth);
-    const [ops] = useState(() => makeClientOps(op, session.token));
+    // An expired session signs out here, locally: the user it names may no longer exist to log out.
+    const [ops] = useState(() => makeClientOps(op, session.token, () => { void session.client.auth.signOut({ scope: "local" }); }));
     const route = useRoute(registry.adminPath);
     const [head = "pages", tail] = route.segments.length ? route.segments : ["pages"];
     const isCollection = registry.collections.some((c) => c.name === head);

package/dist/admin/shell/EntryForm.js

@@ -102,6 +102,17 @@ export function EntryForm({ ops, registry, collection, id }) {
     useTrackPresence(target);
     const { others } = usePresenceState();
     const presence = usePresence();
+    /** After a publish, an unpublish or a slug change only the address indexes are stale: re-read the URLs
+     *  ("View live"), the redirects and the live findings — never the fields, which may be ahead of the store
+     *  (as the page editor's reload after a rename, 2026-10-02). */
+    const reloadIndexes = async () => {
+        const r = await ops.entries.get(collection, id, locale).catch(() => null);
+        if (!r?.ok)
+            return;
+        setUrls(r.data.urls);
+        setRedirects(r.data.redirects);
+        setLiveFindings(r.data.liveFindings);
+    };
     const { saveState, mark, flush, reset } = useDraftAutosave({
         read: () => fieldsRef.current,
         persist: async (value) => {
@@ -140,11 +151,14 @@ export function EntryForm({ ops, registry, collection, id }) {
             }
             const r = await ops.entries.save(collection, id, locale, value, token(), { redirect: redirectRef.current });
             if (r.ok) {
+                const slugBefore = recordRef.current?.locales[locale]?.slug;
                 redirectRef.current = true;
                 recordRef.current = r.data;
                 setRecord(r.data);
                 setSaveErrors({});
                 presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
+                if (r.data.locales[locale]?.slug !== slugBefore)
+                    void reloadIndexes();
             }
             else if (isStale(r))
                 setStale(staleInfoOf(r));
@@ -271,6 +285,7 @@ export function EntryForm({ ops, registry, collection, id }) {
         setRecord(r.data);
         presence?.announce(target, r.data.locales[locale]?.draftSavedAt ?? null);
         setFieldErrors({});
+        void reloadIndexes();
         setPublished(true);
         setTimeout(() => setPublished(false), 1600);
     };
@@ -285,8 +300,10 @@ export function EntryForm({ ops, registry, collection, id }) {
             r = { ok: false, code: "internal", message: "Couldn't reach the server." };
         }
         setBusy(null);
-        if (r.ok)
+        if (r.ok) {
             setRecord(r.data);
+            void reloadIndexes();
+        }
         else
             fail(r);
     };
@@ -474,7 +491,7 @@ export function EntryForm({ ops, registry, collection, id }) {
                                 trailing: multilingual && (_jsx(LocaleSwitcher, { registry: registry, present: present, parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => void doAddLocale(l) })),
                             },
                             { label: heading },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "entry" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "entry" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), revealKey: `${notice.tone}:${notice.text}`, children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
                                             revealField(formRef.current, path); } })] })), absent ? (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 12 }, children: [_jsxs("p", { children: ["This entry doesn't exist in ", locale, " yet. Adding it copies the ", entrySourceLocale(record, registry), " fields as the first ", locale, " draft."] }), _jsxs("div", { style: { display: "flex", gap: 8 }, children: [_jsxs(Button, { onClick: () => void doAddLocale(locale), disabled: adding || !parentLocales.includes(locale), title: parentLocales.includes(locale) ? undefined : `add ${locale} to the parent first`, children: ["Add ", locale] }), _jsxs(Button, { variant: "secondary", onClick: () => { void switchLocale(entrySourceLocale(record, registry)); }, children: ["Back to ", entrySourceLocale(record, registry)] })] })] })) : fields !== null ? (_jsxs(_Fragment, { children: [Object.entries(meta.fields).map(widget), _jsx(OrphanFields, { orphans: findings, onClear: (path) => {
                                             setFields((f) => unsetAtPath(f ?? {}, path));
                                             setDirty(true);

package/dist/admin/shell/GlobalForm.js

@@ -319,6 +319,6 @@ export function GlobalForm({ ops, registry, name }) {
                                 trailing: multilingual && (_jsx(LocaleSwitcher, { registry: registry, present: registry.locales.supported, parentLocales: [], value: locale, adding: false, onSwitch: (l) => { void switchLocale(l); }, onAdd: () => undefined })),
                             },
                             { label: item.title },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsxs("fieldset", { disabled: true, className: "sm-history__form", children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } })] }))] })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "item" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsxs("fieldset", { disabled: true, className: "sm-history__form", children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } })] }))] })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "item" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), revealKey: `${notice.tone}:${notice.text}`, children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
                                             revealField(formRef.current, path); } })] })), record && (_jsxs("p", { className: "sm-hint", children: [pages.size === 0 ? "Not placed on any page yet." : `Used on ${pages.size} page${pages.size === 1 ? "" : "s"}: `, [...pages].map((id, i) => (_jsxs("span", { children: [i > 0 && ", ", _jsx("a", { href: adminHref(`/pages/${encodeURIComponent(id)}?locale=${encodeURIComponent(locale)}`), children: id })] }, id)))] })), fields !== null ? (_jsxs(_Fragment, { children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: fields, errors: markerErrors, refOptions: refOptions, multilingual: multilingual, onChange: onChange }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: fields, errors: markerErrors, refOptions: refOptions, multilingual: multilingual, onChange: onChange })] })), _jsx(OrphanFields, { orphans: findings, onClear: clearOrphan })] })) : !notice && _jsx("p", { style: { color: "var(--text-muted)" }, children: "Loading\u2026" })] }), _jsx(ResizeHandle, {}), _jsx("aside", { className: "sm-inspector", children: record && row && (_jsxs("div", { className: "sm-card", children: [_jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Kind", value: item.section !== undefined ? `Visual · ${item.section}` : "Fields" }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), _jsx(InfoRow, { label: "ID", value: record.id, mono: true })] })) })] })] }));
 }

package/dist/admin/ui/primitives.d.ts

@@ -142,10 +142,14 @@ export declare function FieldErrorList({ fields, onReveal }: {
     fields: FieldError[];
     onReveal?(path: string): void;
 }): import("react").JSX.Element | null;
-export declare function Banner({ tone, children, onDismiss }: {
+export declare function Banner({ tone, children, onDismiss, revealKey }: {
     tone: "ok" | "error" | "warn";
     children: ReactNode;
     onDismiss?: () => void;
+    /** Scrolls the banner into view when it appears and whenever this changes: a refused publish
+     *  clicked at the foot of a long form shows its list of fields (2026-10-02). Unchanged while the
+     *  list shrinks as fields are fixed, so typing never scrolls. */
+    revealKey?: string;
 }): import("react").JSX.Element;
 export declare function cx(...parts: (string | false | null | undefined)[]): string;
 /** One line of a form's info block: a muted label, the value right-aligned and clipped. */

package/dist/admin/ui/primitives.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // components/ set (design_handoff_smoodly_cms). Structure and dynamic
 // values live here; every static rule, and all hover/focus state, lives in
 // theme.tsx's stylesheet.
-import { Fragment } from "react";
+import { Fragment, useEffect, useRef } from "react";
 import { GlobeOff, GripVertical, Moon, Sun } from "lucide-react";
 import { THEME_KEY } from "./theme.js";
 import { RouteLink } from "../shell/RouteLink.js";
@@ -153,8 +153,13 @@ export function FieldErrorList({ fields, onReveal }) {
                     ? _jsx("button", { type: "button", className: "sm-fielderr__field", onClick: () => onReveal(f.field), children: f.field })
                     : f.field, ": ", f.message] }, f.field))) }));
 }
-export function Banner({ tone, children, onDismiss }) {
-    return (_jsxs("div", { className: `sm-banner sm-banner--${tone}`, role: tone === "error" ? "alert" : undefined, children: [_jsx("div", { style: { flex: 1, minWidth: 0 }, children: children }), onDismiss && (_jsx("button", { type: "button", onClick: onDismiss, "aria-label": "Dismiss", style: { background: "transparent", border: 0, color: "inherit", cursor: "pointer", font: "inherit", padding: 0 }, children: "\u00D7" }))] }));
+export function Banner({ tone, children, onDismiss, revealKey }) {
+    const ref = useRef(null);
+    useEffect(() => {
+        if (revealKey !== undefined)
+            ref.current?.scrollIntoView({ block: "nearest", behavior: "smooth" });
+    }, [revealKey]);
+    return (_jsxs("div", { ref: ref, className: `sm-banner sm-banner--${tone}`, role: tone === "error" ? "alert" : undefined, children: [_jsx("div", { style: { flex: 1, minWidth: 0 }, children: children }), onDismiss && (_jsx("button", { type: "button", onClick: onDismiss, "aria-label": "Dismiss", style: { background: "transparent", border: 0, color: "inherit", cursor: "pointer", font: "inherit", padding: 0 }, children: "\u00D7" }))] }));
 }
 export function cx(...parts) {
     return parts.filter(Boolean).join(" ");

package/dist/cli/main.d.ts

@@ -2,7 +2,7 @@ import { type MigrateArgs } from "./migrate.ts";
 import { type ExportArgs } from "./export.ts";
 import { type ImportArgs } from "./import.ts";
 import { type AddAdminArgs } from "./add-admin.ts";
-export declare const USAGE = "usage: smoodly <command>\n\n  migrate [--check] [--collections <file>] [--migrations <dir>]\n    Copies the core schema files this package ships that supabase/migrations/\n    lacks, and writes one views file for the collections whose view is new or\n    changed. Prints the push or reset command; never runs it.\n\n    --check              write nothing; exit 1 when anything is pending\n    --collections <file> the module exporting `collections` (default smoodly/collections.ts)\n    --migrations <dir>   the app's migration folder (default supabase/migrations)\n\n  export [--out <dir>]\n    Writes the space SMOODLY_SECRET_KEY names \u2014 every content row, history\n    included, and the media files \u2014 into a folder (default\n    smoodly-export-<date>). Reads only.\n\n  import <dir>\n    Writes an export folder into the key's space, which must be empty or hold\n    only this export's rows (an earlier run to continue). Never deletes.\n\n  add-admin <email> [--admin-url <url>]\n    Makes <email> an admin of the key's space: with SMOODLY_ADMIN_PASSWORD\n    set, creates the account with that password; without, mails an invite\n    whose link lands on --admin-url (default: SITE_URL + /admin).";
+export declare const USAGE = "usage: smoodly <command>\n\n  migrate [--check] [--collections <file>] [--migrations <dir>]\n    Copies the core schema files this package ships that supabase/migrations/\n    lacks, and writes one views file for the collections whose view is new or\n    changed. Prints the push or reset command; never runs it.\n\n    --check              write nothing; exit 1 when anything is pending, or when\n                         SMOODLY_SECRET_KEY (if set) cannot read the database\n    --collections <file> the module exporting `collections` (default smoodly/collections.ts)\n    --migrations <dir>   the app's migration folder (default supabase/migrations)\n\n  export [--out <dir>]\n    Writes the space SMOODLY_SECRET_KEY names \u2014 every content row, history\n    included, and the media files \u2014 into a folder (default\n    smoodly-export-<date>). Reads only.\n\n  import <dir>\n    Writes an export folder into the key's space, which must be empty or hold\n    only this export's rows (an earlier run to continue). Never deletes.\n\n  add-admin <email> [--admin-url <url>]\n    Makes <email> an admin of the key's space: with SMOODLY_ADMIN_PASSWORD\n    set, creates the account with that password; without, mails an invite\n    whose link lands on --admin-url (default: SITE_URL + /admin).";
 export type Parsed = {
     command: "migrate";
     args: MigrateArgs;

package/dist/cli/main.js

@@ -16,7 +16,8 @@ export const USAGE = `usage: smoodly <command>
     lacks, and writes one views file for the collections whose view is new or
     changed. Prints the push or reset command; never runs it.
 
-    --check              write nothing; exit 1 when anything is pending
+    --check              write nothing; exit 1 when anything is pending, or when
+                         SMOODLY_SECRET_KEY (if set) cannot read the database
     --collections <file> the module exporting \`collections\` (default smoodly/collections.ts)
     --migrations <dir>   the app's migration folder (default supabase/migrations)
 

package/dist/cli/migrate.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionSchema } from "../collections.ts";
+import { type SchemaRead } from "../schema-read.ts";
 import { type MigrationFile, type MigratePlan } from "../migrations.ts";
 export type MigrateArgs = {
     check: boolean;
@@ -10,6 +11,8 @@ export declare const PACKAGE_MIGRATIONS_DIR: string;
 export declare const NO_FOLDER = "No supabase/migrations folder here \u2014 nothing to do. (Smoodly Cloud keeps the schema current; a self-host app gets the folder from `supabase init`.)";
 export declare const NEXT_STEP = "Next: apply it \u2014 `supabase db push` (hosted) or `supabase migration up` (local).";
 export declare const upToDate: (version: number, n: number) => string;
+export declare const KEY_NOT_CHECKED = "Key not checked: SMOODLY_URL and SMOODLY_SECRET_KEY are not both set here.";
+export declare const keyChecked: (version: number) => string;
 export declare const modifiedMessage: (name: string) => string;
 export declare function readSqlFiles(dir: string): Promise<MigrationFile[]>;
 /** One line per thing the plan does; "Pending" wording under --check. */
@@ -19,5 +22,9 @@ export type MigrateDeps = {
     /** Test seam: replaces the tsx loader. */
     load?: (file: string, cwd: string) => Promise<CollectionSchema<any>[]>;
     now?: () => Date;
+    /** The env the key check reads; `.env.local` and `.env` fill what it lacks, as Next does. */
+    env?: Record<string, string | undefined>;
+    /** Test seam: replaces the database read behind the key check. */
+    readKey?: (env: Record<string, string | undefined>) => Promise<SchemaRead>;
 };
 export declare function runMigrate(args: MigrateArgs, out: (line: string) => void, deps?: MigrateDeps): Promise<number>;

package/dist/cli/migrate.js

@@ -8,7 +8,11 @@ import { readdir, readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { collectionSQL } from "../sql.js";
-import { coreFileVersion, SCHEMA_VERSION } from "../schema-version.js";
+import { coreFileVersion, SCHEMA_VERSION, secretKeyRefusedMessage } from "../schema-version.js";
+import { readSchemaVersion } from "../schema-read.js";
+import { createSmoodlyClient } from "../client.js";
+import { resolveSmoodlyEnv } from "../env.js";
+import { loadAppEnv } from "./space-io.js";
 import { planIsEmpty, planMigrate } from "../migrations.js";
 import { loadCollections } from "./load-collections.js";
 /** The folder shipped in the package: `../../migrations/` from dist/cli/ and from src/cli/ alike. */
@@ -16,6 +20,8 @@ export const PACKAGE_MIGRATIONS_DIR = fileURLToPath(new URL("../../migrations/",
 export const NO_FOLDER = "No supabase/migrations folder here — nothing to do. (Smoodly Cloud keeps the schema current; a self-host app gets the folder from `supabase init`.)";
 export const NEXT_STEP = "Next: apply it — `supabase db push` (hosted) or `supabase migration up` (local).";
 export const upToDate = (version, n) => `Up to date: core schema v${version}, every collection's view is current (${n} ${n === 1 ? "collection" : "collections"}).`;
+export const KEY_NOT_CHECKED = "Key not checked: SMOODLY_URL and SMOODLY_SECRET_KEY are not both set here.";
+export const keyChecked = (version) => `SMOODLY_SECRET_KEY reads the database (schema v${version}).`;
 export const modifiedMessage = (name) => `Refusing: ${name} differs from the package's copy. A published migration is never edited — restore it from the package, or move your change to a new file.`;
 export async function readSqlFiles(dir) {
     const names = (await readdir(dir)).filter((n) => n.endsWith(".sql")).sort();
@@ -34,6 +40,41 @@ export function describePlan(plan, check) {
     }
     return lines;
 }
+/** Errors that are a verdict on the env itself, not on the network: they fail the build. */
+const ENV_VERDICT = /SMOODLY_(SECRET|PUBLISHABLE)_KEY|SMOODLY_URL "/;
+/** The build's key check (decided 2026-10-02): a key the site would be refused with fails the
+ *  deploy, so the running deployment keeps serving. No key here, or no route to the database
+ *  (a CI build), passes without a verdict. */
+async function checkKey(out, cwd, deps) {
+    const env = deps.env ?? process.env;
+    loadAppEnv(cwd, env);
+    if (!env.SMOODLY_URL || !env.SMOODLY_SECRET_KEY) {
+        out(KEY_NOT_CHECKED);
+        return 0;
+    }
+    let read;
+    try {
+        read = await (deps.readKey ?? ((e) => readSchemaVersion(createSmoodlyClient(resolveSmoodlyEnv(e)))))(env);
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        if (ENV_VERDICT.test(message)) {
+            out(message);
+            return 1;
+        }
+        out(`Key not checked: ${message}`);
+        return 0;
+    }
+    if ("version" in read)
+        out(keyChecked(read.version));
+    else if (read.missing === "key") {
+        out(secretKeyRefusedMessage);
+        return 1;
+    }
+    else
+        out("Key not checked: the database has no Smoodly schema yet — apply the migrations before the site goes live.");
+    return 0;
+}
 export async function runMigrate(args, out, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const appDir = resolve(cwd, args.migrations);
@@ -58,7 +99,7 @@ export async function runMigrate(args, out, deps = {}) {
         return 1;
     if (planIsEmpty(plan)) {
         out(upToDate(SCHEMA_VERSION, collections.length));
-        return 0;
+        return args.check ? checkKey(out, cwd, deps) : 0;
     }
     if (args.check)
         return 1;

package/dist/schema-read.d.ts

@@ -1,7 +1,23 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-/** The policies show `smoodly_meta` to a write key only, so no visible row means the key is not a secret key (spec §5). */
-export declare function readSchemaVersion(db: SupabaseClient): Promise<{
+export type SchemaRead = {
     version: number;
 } | {
     missing: "key" | "schema";
-}>;
+};
+/** The policies show `smoodly_meta` to a write key only, so no visible row means the key is not a secret key (spec §5). */
+export declare function readSchemaVersion(db: SupabaseClient): Promise<SchemaRead>;
+/** How long a refused key is believed before it is read again. */
+export declare const KEY_RECHECK_MS = 30000;
+/** The site's schema check, once per process (spec 2026-09-26 §5). An old or missing schema warns
+ *  and never blocks. A key that cannot see the version row reads every table as empty rather than
+ *  refused, so lookups fail instead of serving empty pages and 404s (decided 2026-10-02) — but only
+ *  for {@link KEY_RECHECK_MS}: a fixed key or a briefly missing row recovers without a restart. A
+ *  failed read refuses nothing and is tried again; the lookup itself names that error. */
+export declare class SecretKeyCheck {
+    private readonly read;
+    private readonly now;
+    private pending;
+    private refusedAt;
+    constructor(read: () => Promise<SchemaRead>, now?: () => number);
+    refused(): Promise<boolean>;
+}

package/dist/schema-read.js

@@ -1,4 +1,4 @@
-import { SCHEMA_VERSION_KEY } from "./schema-version.js";
+import { SCHEMA_VERSION_KEY, schemaBehind, schemaBehindMessage } from "./schema-version.js";
 /** The policies show `smoodly_meta` to a write key only, so no visible row means the key is not a secret key (spec §5). */
 export async function readSchemaVersion(db) {
     const res = await db.from("smoodly_meta").select("value").eq("key", SCHEMA_VERSION_KEY).maybeSingle();
@@ -13,3 +13,38 @@ export async function readSchemaVersion(db) {
     const n = Number(res.data?.value);
     return res.data && Number.isInteger(n) ? { version: n } : { missing: "key" };
 }
+/** How long a refused key is believed before it is read again. */
+export const KEY_RECHECK_MS = 30000;
+/** The site's schema check, once per process (spec 2026-09-26 §5). An old or missing schema warns
+ *  and never blocks. A key that cannot see the version row reads every table as empty rather than
+ *  refused, so lookups fail instead of serving empty pages and 404s (decided 2026-10-02) — but only
+ *  for {@link KEY_RECHECK_MS}: a fixed key or a briefly missing row recovers without a restart. A
+ *  failed read refuses nothing and is tried again; the lookup itself names that error. */
+export class SecretKeyCheck {
+    constructor(read, now = Date.now) {
+        this.read = read;
+        this.now = now;
+        this.pending = null;
+        this.refusedAt = null;
+    }
+    refused() {
+        if (this.refusedAt !== null && this.now() - this.refusedAt >= KEY_RECHECK_MS)
+            this.pending = null;
+        this.pending ?? (this.pending = this.read().then((read) => {
+            if ("missing" in read && read.missing === "key") {
+                this.refusedAt = this.now();
+                return true;
+            }
+            this.refusedAt = null;
+            if ("missing" in read)
+                console.warn(schemaBehindMessage(null));
+            else if (schemaBehind(read.version))
+                console.warn(schemaBehindMessage(read.version));
+            return false;
+        }, () => {
+            this.pending = null;
+            return false;
+        }));
+        return this.pending;
+    }
+}

package/dist/supabase-store.d.ts

@@ -62,8 +62,8 @@ export declare class SupabasePageStore implements PageStore {
     getPage(id: string): Promise<PageRecord | null>;
     scanTrees(): Promise<PageScan[]>;
     listPages(): Promise<PageRecord[]>;
-    /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
-    private schemaChecked;
+    /** Once per store; a refused key fails lookups for 30 s at a time (schema-read.ts). */
+    private readonly keyCheck;
     resolvePath(locale: string, path: string): Promise<import("./path-index.ts").PathHit | null>;
     schemaVersion(): Promise<number | null>;
     pathsOf(id: string): Promise<{}>;

package/dist/supabase-store.js

@@ -8,8 +8,8 @@
 // rewritten through ONE RPC per write, so a collision rolls back.
 import { assertPublishable, assertSupportedLocale, localeRow, pageErrors, pageRefEdges, pathOptions, refSections, storeAnchors, } from "./store.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
-import { schemaBehind, schemaBehindMessage, secretKeyRefusedMessage } from "./schema-version.js";
-import { readSchemaVersion } from "./schema-read.js";
+import { secretKeyRefusedMessage } from "./schema-version.js";
+import { readSchemaVersion, SecretKeyCheck } from "./schema-read.js";
 import { groupRedirects } from "./store.js";
 import { assertFresh, draftToken, StaleDraftError } from "./draft-token.js";
 import { assertDepth, assertSegment, isHomeNode, pagePathRows, rewriteTargets } from "./paths.js";
@@ -46,8 +46,8 @@ export class SupabasePageStore {
     constructor(db, options = {}) {
         this.db = db;
         this.options = options;
-        /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
-        this.schemaChecked = false;
+        /** Once per store; a refused key fails lookups for 30 s at a time (schema-read.ts). */
+        this.keyCheck = new SecretKeyCheck(() => readSchemaVersion(this.db));
         this.options = { ...options, sections: refSections(options) };
         this.opts = pathOptions(options);
         // Alone, the store's own index reads the addresses it was given (spec 2026-09-29 anchored paths §2).
@@ -379,20 +379,12 @@ export class SupabasePageStore {
             this.fail(res.error.message);
         return res.data.map(toRecord);
     }
-    resolvePath(locale, path) {
-        if (!this.schemaChecked) {
-            this.schemaChecked = true;
-            // Once per store: a wrong key is named as a wrong key, not as an old schema (spec 2026-09-30 tester findings §4).
-            void readSchemaVersion(this.db)
-                .then((read) => {
-                if ("missing" in read)
-                    console.warn(read.missing === "key" ? secretKeyRefusedMessage : schemaBehindMessage(null));
-                else if (schemaBehind(read.version))
-                    console.warn(schemaBehindMessage(read.version));
-            })
-                .catch(() => { });
-        }
-        return this.paths.resolve(locale, path);
+    async resolvePath(locale, path) {
+        // In parallel: the check costs the first request no extra round trip.
+        const [refused, hit] = await Promise.all([this.keyCheck.refused(), this.paths.resolve(locale, path)]);
+        if (refused)
+            throw new Error(secretKeyRefusedMessage);
+        return hit;
     }
     async schemaVersion() {
         const read = await readSchemaVersion(this.db);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SMOODLY_VERSION = "0.0.42";
+export declare const SMOODLY_VERSION = "0.0.43";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/write-version.mjs from package.json — do not edit.
-export const SMOODLY_VERSION = "0.0.42";
+export const SMOODLY_VERSION = "0.0.43";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.42",
+  "version": "0.0.43",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {