smoodly 0.0.45 → 0.0.46

package/README.md

@@ -1,15 +1,15 @@
 # smoodly
 
-A code-first CMS for Next.js. Define a component once in code and it
+A code-first CMS for Astro and Next.js. Define a component once in code and it
 becomes a typed, editable building block your editors compose, within
 the rails you set. Content lives in Supabase; the admin mounts into
-your own app at `/admin`.
+your own site at `/admin`.
 
 ## Install
 
     npx create-smoodly-app my-site
 
-This creates a Next.js site with the admin mounted, the database schema
+This creates an Astro or Next.js site with the admin mounted, the database schema
 in place and a first editor who can sign in.
 
 ## Environment

package/dist/addresses.d.ts

@@ -1,4 +1,5 @@
 import { type LocaleSet } from "./paths.ts";
+import { type SchemaOr } from "./registration.ts";
 /** owner key → locale → address, without slashes at either end (`company/news`). */
 export type Addresses = Record<string, Record<string, string>>;
 export declare const collectionKey: (name: string) => string;
@@ -21,12 +22,10 @@ export type CodeAddress = {
     collection: string | null;
 };
 type PageLike = {
-    schema: {
-        kind: string;
-        name: string;
-        title?: string;
-        slug?: string | Record<string, string>;
-    };
+    kind: string;
+    name: string;
+    title?: string;
+    slug?: string | Record<string, string>;
 };
 type CollectionLike = {
     name: string;
@@ -35,7 +34,7 @@ type CollectionLike = {
 };
 export declare function codeAddresses(input: {
     locales: LocaleSet;
-    pages: ReadonlyArray<PageLike>;
+    pages: ReadonlyArray<SchemaOr<PageLike>>;
     collections: ReadonlyArray<CollectionLike>;
 }): CodeAddress[];
 export declare const addressMap: (list: CodeAddress[]) => Addresses;

package/dist/addresses.js

@@ -5,6 +5,7 @@
 // rule, so SEGMENT_RE stays the only gate. Pure: defineConfig, the
 // materializer, the stores, the site and the admin tree all read it here.
 import { assertSegment, fixedPageSegments } from "./paths.js";
+import { schemaOf } from "./registration.js";
 export const collectionKey = (name) => `collection:${name}`;
 export const pageKey = (name) => `page:${name}`;
 /** The collection an owner key names, or null for a fixed page. */
@@ -23,11 +24,12 @@ export function codeAddresses(input) {
     const def = input.locales.default;
     const byDefault = new Map();
     const out = [];
-    for (const p of input.pages) {
-        if (p.schema.kind !== "page" || p.schema.slug === undefined)
+    for (const carrier of input.pages) {
+        const p = schemaOf(carrier);
+        if (p.kind !== "page" || p.slug === undefined)
             continue;
-        const segments = fixedPageSegments(p.schema.slug, input.locales);
-        const spec = { key: pageKey(p.schema.name), segments, title: p.schema.title ?? p.schema.name, template: p.schema.name, collection: null };
+        const segments = fixedPageSegments(p.slug, input.locales);
+        const spec = { key: pageKey(p.name), segments, title: p.title ?? p.name, template: p.name, collection: null };
         byDefault.set(segments[def], spec);
         out.push(spec);
     }

package/dist/admin/PublicSans-LICENSE.txt

@@ -0,0 +1,93 @@
+Copyright 2015 The Public Sans Project Authors (https://github.com/uswds/public-sans) PublicSans-Italic[wght].ttf: Copyright 2015 The Public Sans Project Authors (https://github.com/uswds/public-sans)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/dist/admin/auth-config.d.ts

@@ -0,0 +1,6 @@
+/** What the browser needs to sign in — public values only (admin/shell/session.ts reads it; the handler and the page data carry it). */
+export type AuthConfig = {
+    url: string;
+    key: string;
+    providers?: ("google" | "github")[];
+};

package/dist/admin/auth-config.js

@@ -0,0 +1 @@
+export {};

package/dist/admin/browser/fetch-op.d.ts

@@ -0,0 +1,10 @@
+import type { AdminOpAction } from "../ops.ts";
+/** JSON has no `undefined`: in an array it becomes null, which several ops read as a value (`expected:
+ *  null` is "no draft", `undefined` is "skip the check"). Trailing ones are dropped; one between two
+ *  arguments cannot be sent and is named here. */
+export declare function wireArgs(args: unknown[]): unknown[];
+/** `fetcher` is the test seam. A network failure rejects; every answer resolves to a typed result.
+ *  One operation at a time, in call order: Next queued server actions per browser, and the admin's reads
+ *  and writes rely on it (a read sent after a save must see that save's token; a save typed during a
+ *  publish must follow the publish). A call that fails does not hold the ones behind it. */
+export declare function fetchOp(url: string, fetcher?: typeof fetch): AdminOpAction;

package/dist/admin/browser/fetch-op.js

@@ -0,0 +1,44 @@
+/** JSON has no `undefined`: in an array it becomes null, which several ops read as a value (`expected:
+ *  null` is "no draft", `undefined` is "skip the check"). Trailing ones are dropped; one between two
+ *  arguments cannot be sent and is named here. */
+export function wireArgs(args) {
+    let end = args.length;
+    while (end > 0 && args[end - 1] === undefined)
+        end--;
+    const out = args.slice(0, end);
+    if (out.some((a) => a === undefined)) {
+        throw new Error("smoodly: an operation argument is undefined between two others — pass null or a value; JSON cannot carry undefined.");
+    }
+    return out;
+}
+const noResult = (status) => ({ ok: false, code: "internal", message: `smoodly: the admin's endpoint answered ${status} without a result — see the server log.` });
+/** `fetcher` is the test seam. A network failure rejects; every answer resolves to a typed result.
+ *  One operation at a time, in call order: Next queued server actions per browser, and the admin's reads
+ *  and writes rely on it (a read sent after a save must see that save's token; a save typed during a
+ *  publish must follow the publish). A call that fails does not hold the ones behind it. */
+export function fetchOp(url, fetcher = fetch) {
+    const send = async (call) => {
+        const res = await fetcher(url, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { "content-type": "application/json", ...(call.token ? { authorization: `Bearer ${call.token}` } : {}) },
+            body: JSON.stringify({ path: call.path, args: wireArgs(call.args) }),
+        });
+        let body;
+        try {
+            body = await res.json();
+        }
+        catch {
+            return noResult(res.status);
+        }
+        if (typeof body === "object" && body !== null && typeof body.ok === "boolean")
+            return body;
+        return noResult(res.status);
+    };
+    let last = Promise.resolve();
+    return (call) => {
+        const run = last.then(() => send(call));
+        last = run.catch(() => { });
+        return run;
+    };
+}

package/dist/admin/browser/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/admin/browser/main.js

@@ -0,0 +1,21 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// packages/smoodly/src/admin/browser/main.tsx
+// The prebuilt admin's entry (spec 2026-10-02 astro cloud fit §4): reads the page's data, writes the
+// stylesheet into the document and mounts the shell. Bundled by scripts/build-admin.ts; no app compiles it.
+import { createRoot } from "react-dom/client";
+import { ADMIN_DATA_ID, ADMIN_ROOT_ID } from "../page-data.js";
+import { setPreviewBase } from "../editor/canvas-address.js";
+import { AdminApp } from "../shell/AdminApp.js";
+import { fontFaceCss } from "../ui/fonts.js";
+import { ADMIN_CSS } from "../ui/theme.js";
+import { fetchOp } from "./fetch-op.js";
+const data = JSON.parse(document.getElementById(ADMIN_DATA_ID).textContent ?? "");
+setPreviewBase(data.previewBase ?? "");
+// One <style>, fonts first: the canvas copies this element's text into the site's frame (editor/useInlineSession.ts).
+const style = document.createElement("style");
+style.setAttribute("data-smoodly-admin-styles", "");
+style.textContent = `${fontFaceCss(data.filesBase)}\n${ADMIN_CSS}`;
+document.head.appendChild(style);
+// The page's own background rules did their job (admin/page.ts): the stylesheet owns the look now.
+document.querySelector("style[data-smoodly-boot]")?.remove();
+createRoot(document.getElementById(ADMIN_ROOT_ID)).render(_jsx(AdminApp, { registry: data.registry, op: fetchOp(data.opUrl), auth: data.auth, presenceConfig: data.presence ?? undefined }));

package/dist/admin/custom-section.d.ts

@@ -1,5 +1,5 @@
 import type { AdminRegistry, AdminSection } from "./serialize.ts";
-import type { TreeNode } from "../render.tsx";
+import type { TreeNode } from "../page-context.ts";
 import type { ZonePolicy } from "../zones.ts";
 export declare const customSection: (registry: Pick<AdminRegistry, "custom">) => AdminSection;
 /** Only a freeform zone that says so takes a custom section (the developer's per-zone switch). */

package/dist/admin/drift.d.ts

@@ -1,5 +1,5 @@
 import type { AdminField, AdminRegistry } from "./serialize.ts";
-import type { PageTree } from "../render.tsx";
+import type { PageTree } from "../page-context.ts";
 export type DriftKind = "unknown-section" | "unknown-element" | "unknown-shape" | "unknown-collection" | "misfit" | "zone-disallowed" | "zone-over-max" | "orphan-field" | "orphan-zone" | "element-outside-toolset" | "localization-on" | "localization-off";
 export type Severity = "broken" | "orphan";
 export declare const SEVERITY: Record<DriftKind, Severity>;

package/dist/admin/editor/EditorView.js

@@ -38,6 +38,7 @@ import { tabOf, tabsFor } from "../forms/tabs.js";
 import { InspectorFields, valueOf } from "./InspectorFields.js";
 import { allowedSections, canInsert, fillLockedZones, findNode, insertNode, moveNode, moveNodeTo, newNodeId, nodeFromSample, patchNode, patchNodeCss, patchNodePath, patchPage, placementNode, removeNode, zoneOf, clearZone, unsetNodePath, } from "../tree-ops.js";
 import { useDraftAutosave } from "./autosave.js";
+import { draftAddress } from "./canvas-address.js";
 import { CanvasOverlay } from "./CanvasOverlay.js";
 import { InlineRichtext } from "./InlineRichtext.js";
 import { InsertPicker } from "./InsertPicker.js";
@@ -198,7 +199,7 @@ export function EditorView({ ops, registry, id }) {
     const path = paths[locale] ?? "/";
     const label = path;
     const siteUrl = urls[locale] ?? path;
-    const iframeSrc = ready ? withEditorParam(siteUrl) : null;
+    const iframeSrc = ready ? withEditorParam(draftAddress(siteUrl)) : null;
     // Canvas-originated selection: the node is under the cursor already, so
     // this path deliberately skips the scroll every other selection does.
     // (`onCanvasSelect` is declared further down; the handler runs at event time.)
@@ -238,7 +239,7 @@ export function EditorView({ ops, registry, id }) {
             setTouched(false);
             setGlobalDirty(false);
             setGlobalTouched(false);
-            // ops is a server action — it can reject outright (offline, 500,
+            // ops is a fetch to the admin's endpoint — it can reject outright (offline,
             // aborted), not just resolve to a typed error. Either failure mode
             // must land on the same full-pane error, never a hung load.
             let previewResult;
@@ -287,10 +288,8 @@ export function EditorView({ ops, registry, id }) {
             // Locked zones can't be filled by any gesture, so fill the empty
             // ones here; a change marks the draft dirty so the debounced save
             // persists it and the canvas shows the same tree as the outline.
-            // Read through the ref: `registry` is a server-component prop, so
-            // its identity changes on every RSC refresh — and preview.enable's
-            // cookie write triggers one. As a dependency it would loop this
-            // effect forever (same reason AdminApp pins `ops` with useState).
+            // Read through the ref, so the registry is not a dependency of this
+            // effect: a load runs for a new page, locale or reload, nothing else.
             const reg = registryRef.current;
             const template = reg.pages.find((p) => p.name === result.data.record.template);
             const draft = fillLockedZones(result.data.draft, template?.zones ?? {}, reg.sections);
@@ -435,14 +434,15 @@ export function EditorView({ ops, registry, id }) {
     useSavedElsewhere(target, (event) => {
         if (stale)
             return;
-        if (!(dirty || globalDirty || saveState !== "saved" || globalEdit.saveState !== "saved")) {
-            keepSelectionRef.current = true;
-            setReloadKey((k) => k + 1);
-        }
-        else if (editedRef.current)
+        const pending = dirty || globalDirty || saveState !== "saved" || globalEdit.saveState !== "saved";
+        if (pending && editedRef.current)
             setStale({ by: event.email, at: Date.now() });
+        // Clean, or only the fill is pending. The fill waits in the autosave's debounce, which no flag here shows
+        // (it marks without setDirty): always reset, or it would save their reloaded tree and move the token
+        // under the editor who just saved (found 2026-10-03, on a production build fast enough to open the page
+        // before the first fill landed).
         else
-            loadTheirsQuietly(); // only the fill is pending: drop it
+            loadTheirsQuietly();
     });
     // Selecting from the outline must reveal the block. The canvas column is
     // the scroller now (the iframe has no scrollbar of its own — it is sized to
@@ -661,7 +661,7 @@ export function EditorView({ ops, registry, id }) {
         }
         catch (e) {
             console.error(e);
-            // Same transport concern as the autosave persist: the server action can reject
+            // Same transport concern as the autosave persist: the fetch can reject
             // outright instead of resolving to a typed error.
             result = { ok: false, code: "internal", message: "Publish failed — check your connection and try again." };
         }
@@ -898,7 +898,7 @@ export function EditorView({ ops, registry, id }) {
                                 trailing: registry.locales.supported.length > 1 && (_jsx(LocaleSwitcher, { registry: registry, present: record ? registry.locales.supported.filter((l) => record.locales[l]) : [locale], parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => { void doAddLocale(l); } })),
                             },
                             { label },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || diagnosis || crashedLines.length > 0) && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), diagnosis && _jsx(CanvasWarning, { cause: diagnosis.cause, path: diagnosis.path }), crashedLines.length > 0 && (_jsx(BannerBox, { tone: "warn", children: crashedLines.map((line, i) => _jsx("p", { children: line }, i)) }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(draftAddress(siteUrl), versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || diagnosis || crashedLines.length > 0) && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), diagnosis && _jsx(CanvasWarning, { cause: diagnosis.cause, path: diagnosis.path }), crashedLines.length > 0 && (_jsx(BannerBox, { tone: "warn", children: crashedLines.map((line, i) => _jsx("p", { children: line }, i)) }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
                                     setSelectedId(null); }, children: _jsxs("div", { className: "sm-page", style: { overflow: "hidden" }, children: [iframeSrc ? (_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: "Page canvas", onLoad: onFrameLoad, style: { width: "100%", height: docH, border: 0, display: "block" } })) : (_jsx("div", { className: "sm-canvas__loading", children: "Loading canvas\u2026" })), _jsx(CanvasOverlay, { emptyZones: emptyZones, hoverRect: hoverRect, hoverGlobal: hoverGlobal, selection: selection, fieldHover: fieldHover, editing: editing, plusButtons: plusButtons, onPlus: (p, x, y) => setPicker({ zone: p.zone, index: p.index, x: x - 150, y: y + 12 }), onMove: doMove, onDuplicate: doDuplicate, onRemove: doRemove }), inline.richtext && (() => {
                                             const { session } = inline.richtext;
                                             const item = globalItemOf(session.node);

package/dist/admin/editor/autosave.js

@@ -45,7 +45,7 @@ export function createDraftAutosave(opts) {
         }
         catch (e) {
             console.error(e);
-            // persist is a server action — it can reject outright (offline, 500,
+            // persist is a fetch to the admin's endpoint — it can reject outright (offline,
             // aborted), not just resolve to a typed error. Fold that into the
             // same failure path so it isn't a stuck "saving" state.
             result = { ok: false, code: "internal", message: "" };

package/dist/admin/editor/canvas-address.d.ts

@@ -0,0 +1,2 @@
+export declare function setPreviewBase(value: string): void;
+export declare const draftAddress: (siteUrl: string) => string;

package/dist/admin/editor/canvas-address.js

@@ -0,0 +1,8 @@
+// Where a page's draft is loaded (DESIGN.md Vision, preview per framework): the server names a base once,
+// in the page's data, and the canvas and the History frame put it before the page's address. Module
+// state, set by the browser entry before the shell mounts: the admin is one script on one page.
+let base = "";
+export function setPreviewBase(value) {
+    base = value;
+}
+export const draftAddress = (siteUrl) => base + siteUrl;

package/dist/admin/editor/overlay-geometry.d.ts

@@ -1,4 +1,4 @@
-import type { TreeNode } from "../../render.tsx";
+import type { TreeNode } from "../../page-context.ts";
 import type { BridgeRect, ZoneRect } from "./protocol.ts";
 export type PlusButton = {
     zone: string;

package/dist/admin/editor/protocol.d.ts

@@ -50,11 +50,25 @@ export type FromBridge = {
     source: "smoodly";
     kind: "rendered";
 };
+/** The editor asks one thing of the canvas: render again. */
 export type ToBridge = {
     source: "smoodly";
     kind: "refresh";
-} | {
-    source: "smoodly";
-    kind: "scroll";
-    id: string;
 };
+/** What both guards read of a MessageEvent. */
+type Incoming = {
+    data: unknown;
+    origin: string;
+    source: unknown;
+};
+/** The bridge's guard: a message counts only when the window framing this one sent it, from this
+ *  origin, in Smoodly's envelope. The canvas is same-origin with the admin by design (DESIGN.md §2). */
+export declare function toBridgeMessage(e: Incoming, win: {
+    parent: unknown;
+    location: {
+        origin: string;
+    };
+}): ToBridge | null;
+/** The editor's guard: a message counts only when the canvas frame sent it, from the admin's own origin. */
+export declare function fromBridgeMessage(e: Incoming, frame: unknown, origin: string): FromBridge | null;
+export {};

package/dist/admin/editor/protocol.js

@@ -1 +1,15 @@
-export {};
+/** The bridge's guard: a message counts only when the window framing this one sent it, from this
+ *  origin, in Smoodly's envelope. The canvas is same-origin with the admin by design (DESIGN.md §2). */
+export function toBridgeMessage(e, win) {
+    if (e.source !== win.parent || e.origin !== win.location.origin)
+        return null;
+    const m = e.data;
+    return typeof m === "object" && m?.source === "smoodly" && m.kind === "refresh" ? { source: "smoodly", kind: "refresh" } : null;
+}
+/** The editor's guard: a message counts only when the canvas frame sent it, from the admin's own origin. */
+export function fromBridgeMessage(e, frame, origin) {
+    if (!frame || e.source !== frame || e.origin !== origin)
+        return null;
+    const m = e.data;
+    return typeof m === "object" && m?.source === "smoodly" ? m : null;
+}

package/dist/admin/editor/useCanvasBridge.d.ts

@@ -1,5 +1,5 @@
 import { type RefObject } from "react";
-import type { BridgeRect, FieldRect, ToBridge, ZoneRect } from "./protocol.ts";
+import { type BridgeRect, type FieldRect, type ToBridge, type ZoneRect } from "./protocol.ts";
 import type { CrashedSection } from "../../marks.ts";
 export type Geometry = "waiting" | "ok" | "missing";
 export declare function useCanvasBridge({ iframeRef, iframeSrc, onSelect, onHover, onRendered }: {

package/dist/admin/editor/useCanvasBridge.js

@@ -1,11 +1,12 @@
 // The admin side of the editor⇄canvas protocol: the geometry the bridge
 // reports (node rects, empty zones, document height), select/hover
-// forwarded from the iframe, and `postToCanvas` for refresh/scroll.
+// forwarded from the iframe, and `postToCanvas` for refresh.
 // Silence is survivable — GEOMETRY_TIMEOUT_MS after the frame's load
 // with no bridge message, `geometry` turns "missing" and the page editor
 // diagnoses why (spec 2026-09-27 shadowed-page detector §2); the iframe
 // and the outline keep working.
 import { useCallback, useEffect, useRef, useState } from "react";
+import { fromBridgeMessage } from "./protocol.js";
 const GEOMETRY_TIMEOUT_MS = 4000;
 export function useCanvasBridge({ iframeRef, iframeSrc, onSelect, onHover, onRendered }) {
     const [rects, setRects] = useState([]);
@@ -40,14 +41,12 @@ export function useCanvasBridge({ iframeRef, iframeSrc, onSelect, onHover, onRen
     const postToCanvas = useCallback((m) => {
         if (m.kind === "refresh" && !heard.current)
             missedRefresh.current = true;
-        iframeRef.current?.contentWindow?.postMessage(m, "*");
+        iframeRef.current?.contentWindow?.postMessage(m, window.location.origin);
     }, [iframeRef]);
     useEffect(() => {
         const onMessage = (e) => {
-            const m = e.data;
-            if (m?.source !== "smoodly")
-                return;
-            if (e.source !== iframeRef.current?.contentWindow)
+            const m = fromBridgeMessage(e, iframeRef.current?.contentWindow, window.location.origin);
+            if (!m)
                 return;
             setGeometry("ok"); // any bridge message: Smoodly rendered the canvas with its bridge
             if (!heard.current) {

package/dist/admin/editor/useInlineSession.js

@@ -216,13 +216,15 @@ export function useInlineSession({ iframeRef, postToCanvas, patch }) {
         clearTimeout(closeTimer.current); }, []);
     return { session: state.session, richtext, start, end, writeText, markChanged, onSaved, onRendered, onSelection, onCanvasChange };
 }
-/** The admin stylesheet inside the iframe, once: the cards inside the canvas editor are admin UI. */
+/** The admin stylesheet inside the iframe, once: the cards inside the canvas editor are admin UI. The text is
+ *  the admin document's own, fonts included (the entry writes it with the files' absolute addresses,
+ *  browser/main.tsx); the bare rules when no page mounted one (a test). */
 function ensureStyles(d) {
     if (d.querySelector("style[data-smoodly-admin-styles]"))
         return;
     const style = d.createElement("style");
     style.setAttribute("data-smoodly-admin-styles", "");
-    style.textContent = ADMIN_CSS;
+    style.textContent = document.querySelector("style[data-smoodly-admin-styles]")?.textContent ?? ADMIN_CSS;
     d.head.appendChild(style);
 }
 /** The caret at a point, for the text session (spec §4). */

package/dist/admin/files.d.ts

@@ -0,0 +1,11 @@
+export type AdminFile = {
+    type: string;
+    body: string;
+    encoding?: "base64";
+};
+/** `hash` names the build: the files are served under it and cached for good. */
+export type AdminFiles = {
+    hash: string;
+    files: Record<string, AdminFile>;
+};
+export declare function loadAdminFiles(): Promise<AdminFiles>;