smoodly 0.0.45 → 0.0.47

package/dist/admin/files.js

@@ -0,0 +1,8 @@
+let loaded = null;
+export function loadAdminFiles() {
+    loaded ?? (loaded = import("./files.generated.js").then((m) => m.adminFiles, () => {
+        loaded = null;
+        throw new Error("smoodly: the admin's files are not built. In the Smoodly repo run `npm run build:admin -w smoodly`; an installed package ships them.");
+    }));
+    return loaded;
+}

package/dist/admin/forms/useRefOptions.d.ts

@@ -3,8 +3,8 @@ import type { AdminOps } from "../ops.ts";
 import type { AdminCollection, AdminRegistry } from "../serialize.ts";
 import type { RefOption } from "./ref-picker.ts";
 export declare function refOptionsOf(records: EntryRecord[], meta: AdminCollection | undefined, registry: AdminRegistry, locale: string): RefOption[];
-/** What the options are read from, by content: the registry crosses the server → client boundary
- *  and is re-serialized on every autosave (a Server Action re-renders the route), so a key on its
+/** What the options are read from, by content, not identity: while Next compiled the admin the registry
+ *  was re-serialized on every autosave (a server action re-rendered the route), and a key on its
  *  identity emptied the picker to "Loading…" and refetched every target on each save (2026-10-02;
  *  the richtext editor's toolset and elements are keyed the same way, 2026-09-26). */
 export declare function refOptionsKey(registry: AdminRegistry, locale: string, targets: readonly string[]): string;

package/dist/admin/forms/useRefOptions.js

@@ -13,8 +13,8 @@ export function refOptionsOf(records, meta, registry, locale) {
         return row ? { id: e.id, title, status: localeStatusOf(row) } : { id: e.id, title, status: "", absent: true };
     });
 }
-/** What the options are read from, by content: the registry crosses the server → client boundary
- *  and is re-serialized on every autosave (a Server Action re-renders the route), so a key on its
+/** What the options are read from, by content, not identity: while Next compiled the admin the registry
+ *  was re-serialized on every autosave (a server action re-rendered the route), and a key on its
  *  identity emptied the picker to "Loading…" and refetched every target on each save (2026-10-02;
  *  the richtext editor's toolset and elements are keyed the same way, 2026-09-26). */
 export function refOptionsKey(registry, locale, targets) {

package/dist/admin/forms/useRichtextEditor.js

@@ -28,10 +28,10 @@ const EMPTY = { type: "doc", content: [{ type: "paragraph" }] };
 const LEVELS = [1, 2, 3, 4, 5, 6];
 const isDoc = (v) => !!v && typeof v === "object" && v.type === "doc";
 export function useRichtextEditor({ value, toolset, onChange, contentClass, onEscape }) {
-    // Keyed by content, not identity: the registry crosses the server → client
-    // boundary and is re-serialized whenever the route's server tree renders
-    // again — every autosave does that, since the op is a Server Action that
-    // expires the page's cache tag — so `toolset` arrives as a new object with
+    // Keyed by content, not identity: while Next compiled the admin, the
+    // registry was re-serialized whenever the route's server tree rendered
+    // again — every autosave did that, the op being a server action that
+    // expired the page's cache tag — so `toolset` arrived as a new object with
     // the same content. On identity TipTap rebuilt the editor after each save,
     // dropping its undo history and the focus (found 2026-09-26: cmd-Z did
     // nothing once the first autosave had landed). The elements list is made

package/dist/admin/handler.d.ts

@@ -0,0 +1,40 @@
+import type { AssetStore } from "../asset-store.ts";
+import type { ResolvedConfig } from "../config.ts";
+import type { EntryStore } from "../entry-store.ts";
+import type { PresenceConfig } from "../env.ts";
+import type { MemberStore } from "../member-store.ts";
+import type { PageStore } from "../store.ts";
+import type { Projector } from "../project.ts";
+import { type AdminAuth } from "./auth.ts";
+import { type AdminFiles } from "./files.ts";
+import { type AdminEffects } from "./ops-impl.ts";
+import type { AuthConfig } from "./auth-config.ts";
+export type AdminHandlerDeps = {
+    config: ResolvedConfig;
+    pages: PageStore;
+    entries: EntryStore;
+    /** The server gate: verifies a session token and reads the member's role. */
+    auth: AdminAuth;
+    /** What the browser needs to sign in: public values only. */
+    signIn: AuthConfig;
+    href?: (path: string, locale: string) => string;
+    /** The media library; without it the assets ops answer "no media store". */
+    assets?: AssetStore;
+    /** The admission table; without it members.list answers "no member store". */
+    members?: MemberStore;
+    /** The site's `site.projector`: a publish writes the delivery rows before it expires the cache. */
+    projector: Projector;
+    /** The content project's public config for editing presence; absent or failed, presence is off. */
+    presence?: () => PresenceConfig | Promise<PresenceConfig>;
+    effects?: AdminEffects;
+    /** Where drafts are served, when not at the page's own address (page-data.ts). */
+    previewBase?: string;
+    /** The prebuilt files; default: the ones the package's build wrote. Tests pass their own. */
+    files?: AdminFiles;
+};
+/** The request came from a page of this site: its Origin names the host the browser asked for. Behind a
+ *  proxy that host is X-Forwarded-Host (the first, when a chain appended more), as in Next's own check for
+ *  server actions. No Origin, no operation: every browser sends one with a POST. */
+export declare function sameOrigin(request: Request): boolean;
+/** `deps` is read on every request, so nothing is read at import and a build with no keys succeeds. */
+export declare function createAdminHandler(deps: () => AdminHandlerDeps): (request: Request) => Promise<Response>;

package/dist/admin/handler.js

@@ -0,0 +1,151 @@
+// packages/smoodly/src/admin/handler.ts
+// The admin's whole server face (spec 2026-10-02 astro cloud fit §4), framework-free: a web Request in, a
+// Response out. GET under the admin path is the HTML page, GET under the reserved segment is one of the
+// package's files, POST to `<admin path>/_smoodly/op` is an operation — gated by the origin check, then
+// by the session (auth.ts). Each framework's adapter supplies the effects (next/admin-route.ts).
+import { mountMismatch } from "../admin-path.js";
+import { gateAdminOp } from "./auth.js";
+import { loadAdminFiles } from "./files.js";
+import { createAdminOps, runAdminOp } from "./ops-impl.js";
+import { ADMIN_INTERNAL } from "./page-data.js";
+import { adminErrorHtml, adminPageHtml } from "./page.js";
+import { serializeAdminConfig } from "./serialize.js";
+const NO_STORE = "no-store";
+const json = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8", "cache-control": NO_STORE } });
+const html = (status, body) => new Response(body, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8", "cache-control": NO_STORE, "content-security-policy": "frame-ancestors 'none'" },
+});
+const refused = (code, message) => ({ ok: false, code, message });
+/** The request came from a page of this site: its Origin names the host the browser asked for. Behind a
+ *  proxy that host is X-Forwarded-Host (the first, when a chain appended more), as in Next's own check for
+ *  server actions. No Origin, no operation: every browser sends one with a POST. */
+export function sameOrigin(request) {
+    return originOf(request).same;
+}
+function originOf(request) {
+    const origin = request.headers.get("origin");
+    const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+    const host = forwarded || request.headers.get("host") || new URL(request.url).host;
+    let same = false;
+    try {
+        same = Boolean(origin) && new URL(origin).host === host;
+    }
+    catch { /* not a URL: not the same */ }
+    return { same, origin, host };
+}
+/** An operation's body: a whole page draft fits many times over; more than this is not an operation. */
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+/** The session token: `Authorization: Bearer <three dot-separated parts>`. Anything else is no token, so
+ *  junk never costs a call to the auth project. */
+function bearer(request) {
+    const match = /^Bearer ([\w-]+\.[\w-]+\.[\w-]+)$/.exec(request.headers.get("authorization") ?? "");
+    return match ? match[1] : null;
+}
+const decode = (base64) => Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+/** `deps` is read on every request, so nothing is read at import and a build with no keys succeeds. */
+export function createAdminHandler(deps) {
+    const registries = new WeakMap();
+    const registryOf = (config) => {
+        let registry = registries.get(config);
+        if (!registry)
+            registries.set(config, (registry = serializeAdminConfig(config)));
+        return registry;
+    };
+    /** A failure nobody planned for: logged whole; the caller is told only what Smoodly itself said. */
+    const failed = (request, e) => {
+        console.error("smoodly: the admin failed —", e);
+        const message = e instanceof Error && e.message.startsWith("smoodly:") ? e.message : "smoodly: the admin failed — see the server log.";
+        return request.method === "POST" ? json(500, { ok: false, code: "internal", message }) : html(500, adminErrorHtml(message));
+    };
+    async function page(pathname, d) {
+        const base = d.config.admin.path;
+        const mismatch = mountMismatch(pathname, base);
+        if (mismatch)
+            return html(500, adminErrorHtml(mismatch));
+        // A failed lookup (an unmigrated project, an unreachable database) is logged and turns presence off,
+        // so the shell still reaches sign-in and the schema notice.
+        let presence = null;
+        try {
+            presence = (await d.presence?.()) ?? null;
+        }
+        catch (e) {
+            console.error("smoodly: editing presence is off —", e instanceof Error ? e.message : e);
+        }
+        const files = d.files ?? (await loadAdminFiles());
+        const data = {
+            registry: registryOf(d.config),
+            auth: d.signIn,
+            presence,
+            opUrl: `${base}/${ADMIN_INTERNAL}/op`,
+            filesBase: `${base}/${ADMIN_INTERNAL}/${files.hash}`,
+            previewBase: d.previewBase ?? "",
+        };
+        return html(200, adminPageHtml(data));
+    }
+    /** `<hash>/<name>`. The current build's hash is cached for good; another hash is a tab opened before a
+     *  deploy, and gets the current file uncached rather than a 404 and a dead admin. */
+    async function file(rest, d) {
+        const [hash, name, ...more] = rest.split("/");
+        const files = d.files ?? (await loadAdminFiles());
+        const found = more.length === 0 && name && Object.prototype.hasOwnProperty.call(files.files, name) ? files.files[name] : undefined;
+        if (!found)
+            return new Response("Not found", { status: 404, headers: { "cache-control": NO_STORE } });
+        return new Response(found.encoding === "base64" ? decode(found.body) : found.body, {
+            headers: {
+                "content-type": found.type,
+                "cache-control": hash === files.hash ? "public, max-age=31536000, immutable" : NO_STORE,
+                "x-content-type-options": "nosniff",
+            },
+        });
+    }
+    /** The order is the defence: the origin, then the token, then the size, then the session — and only a
+     *  member's body is read and parsed. */
+    async function op(request, d) {
+        const from = originOf(request);
+        if (!from.same) {
+            return json(403, refused("unauthorized", `smoodly: operations are accepted from the site's own address only — this request's Origin is ${String(from.origin).slice(0, 200)} and the server was asked at ${from.host}. Behind a proxy, pass the Host header through or set X-Forwarded-Host.`));
+        }
+        const token = bearer(request);
+        if (!token)
+            return json(401, refused("unauthorized", "smoodly: sign in to use the admin."));
+        if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) {
+            return json(413, refused("validation", "smoodly: the operation is larger than 4 MB."));
+        }
+        const base = { config: d.config, pages: d.pages, entries: d.entries, href: d.href, assets: d.assets, members: d.members, projector: d.projector, effects: d.effects };
+        let status = 200;
+        // The gate needs the token alone; the call is read once it has admitted the session.
+        const result = await gateAdminOp(d.auth, { path: "", args: [], token }, async (_gate, session) => {
+            let body;
+            try {
+                body = await request.json();
+            }
+            catch {
+                status = 400;
+                return refused("validation", "smoodly: the operation was not JSON.");
+            }
+            // The token is the header's alone: a `token` in the body is dropped here.
+            const sent = typeof body === "object" && body !== null && !Array.isArray(body) ? body : {};
+            // Ops are built per call so the verified session rides into every store write as `by` (spec 2026-09-13 history §2).
+            return runAdminOp(createAdminOps({ ...base, actor: session }), { path: sent.path, args: sent.args });
+        });
+        return json(!result.ok && result.code === "unauthorized" ? 401 : status, result);
+    }
+    return async function handle(request) {
+        try {
+            const d = deps();
+            const { pathname } = new URL(request.url);
+            const internal = `${d.config.admin.path}/${ADMIN_INTERNAL}/`;
+            const method = request.method.toUpperCase();
+            if (method === "POST") {
+                return pathname === `${internal}op` ? await op(request, d) : json(404, refused("not_found", "smoodly: operations are posted to the admin's endpoint."));
+            }
+            if (method !== "GET" && method !== "HEAD")
+                return new Response(null, { status: 405, headers: { allow: "GET, HEAD, POST" } });
+            return pathname.startsWith(internal) ? await file(pathname.slice(internal.length), d) : await page(pathname, d);
+        }
+        catch (e) {
+            return failed(request, e);
+        }
+    };
+}

package/dist/admin/health.d.ts

@@ -13,11 +13,15 @@ export type HealthDocument = {
     collection: string | null;
     findings: HealthFinding[];
 };
+import type { DeliveryStatus } from "../project.ts";
+/** `delivery` (DESIGN §3, the document stamp): the delivery rows behind the current stamp, with the recorded one;
+ *  absent only in a report built without a projector (static tests). */
 export type HealthReport = {
     documents: HealthDocument[];
     collections: {
         name: string;
         count: number;
     }[];
+    delivery?: DeliveryStatus;
 };
 export declare function buildHealthReport(registry: AdminRegistry, pages: PageScan[], entries: EntryScan[]): HealthReport;

package/dist/admin/index.d.ts

@@ -7,7 +7,7 @@ export { ensureGlobalItems, initialGlobalFields } from "./global-items.ts";
 export { makeClientOps } from "./client-ops.ts";
 export { gateAdminOp, type AdminAuth } from "./auth.ts";
 export { supabaseAdminAuth } from "./supabase-auth.ts";
-export type { AuthConfig } from "./shell/session.ts";
+export type { AuthConfig } from "./auth-config.ts";
 export { serializeAdminConfig } from "./serialize.ts";
 export type { AdminRegistry, AdminSection, AdminCollection, AdminPageTemplate, AdminGlobal, AdminField } from "./serialize.ts";
 export * from "./tree-ops.ts";

package/dist/admin/ops-impl.d.ts

@@ -5,6 +5,7 @@ import type { MemberStore } from "../member-store.ts";
 import type { PageStore } from "../store.ts";
 import type { AdminOpCall, AdminOps, OpResult } from "./ops.ts";
 import type { AdminSession } from "./auth.ts";
+import type { Projector } from "../project.ts";
 export type AdminEffects = {
     /** Expire one cache tag (`pageTag(id)` / `entryTag(id)`). */
     revalidate?(tag: string): void;
@@ -26,7 +27,12 @@ export declare function createAdminOps(deps: {
     members?: MemberStore;
     /** The verified editor; their email is every write's `by`. Absent for the seed and tests (spec 2026-09-13 history §2). */
     actor?: AdminSession;
+    /** Writes the delivery rows (spec 2026-10-07 delivery model §2): the site's `site.projector`. Every op that
+     *  expires a page's or an entry's tag projects that page or entry first, so the first read after it finds
+     *  the new document — a draft save excepted (R17). The truth is written before; a projection that throws is
+     *  logged, its targets marked stale to heal on read, and the op succeeds. */
+    projector: Projector;
 }): AdminOps;
-/** Path-dispatch for the one-server-action seam. Own-property checks only —
+/** Path-dispatch for the one-endpoint seam. Own-property checks only —
  * "constructor.constructor" and prototype paths must not resolve. */
 export declare function runAdminOp(ops: AdminOps, call: AdminOpCall): Promise<OpResult<unknown>>;

package/dist/admin/ops-impl.js

@@ -125,7 +125,7 @@ function followSlug(fields, descriptors) {
     return slug === "" ? fields : { ...fields, slug };
 }
 export function createAdminOps(deps) {
-    const { config, pages, entries, effects } = deps;
+    const { config, pages, entries, effects, projector } = deps;
     const href = deps.href ?? ((path) => path);
     const by = deps.actor?.email ?? undefined;
     const collectionFields = (name) => config.registry.collections?.find((c) => c.name === name)?.fields ?? null;
@@ -150,9 +150,9 @@ export function createAdminOps(deps) {
     // The serialized registry drift walks (spec 2026-09-27 editor safety §2) — the admin client's shape.
     let adminRegistryMemo = null;
     const adminRegistry = () => (adminRegistryMemo ?? (adminRegistryMemo = serializeAdminConfig(config)));
-    const elementDescs = elementSchemas((config.registry.elements ?? []).map((e) => ({ name: e.schema.name, fields: e.schema.fields ?? {}, settings: e.schema.settings })));
+    const elementDescs = elementSchemas(config.registry.elements.map((e) => ({ name: e.name, fields: e.fields ?? {}, settings: e.settings })));
     // The custom section (spec 2026-09-14 §6) validates like a section, over its own schema.
-    const sectionFields = (type) => (type === CUSTOM_NODE_TYPE ? customSchema(config.custom.toolset) : config.registry.sections?.find((s) => s.schema.name === type)?.schema);
+    const sectionFields = (type) => (type === CUSTOM_NODE_TYPE ? customSchema(config.custom.toolset) : config.registry.sections.find((s) => s.name === type));
     const globalItem = (name) => config.registry.globals?.find((s) => s.name === name) ?? null;
     /** One row per registration; null when materialization could not create it. */
     const globalRecord = async (name) => (await entries.list(name))[0] ?? null;
@@ -164,10 +164,44 @@ export function createAdminOps(deps) {
         const snap = await entries.getVersion(name, row.publishedVersionId);
         return snap ? entryDrift(adminRegistry(), name, { fields: snap.fields }) : [];
     };
-    const fanOut = async (entryId) => {
+    /** A projection is derived work done after the truth is written (spec 2026-10-07 §2 Failure): when it throws, the
+     *  op still succeeds — the error is logged, the targets are marked stale (best effort) to rebuild on their next
+     *  read, and the caller expires the tags all the same. */
+    const project = async (op, kind, ids) => {
+        if (ids.length === 0)
+            return;
+        try {
+            await (kind === "page" ? projector.pages(ids) : projector.entries(ids));
+        }
+        catch (e) {
+            console.error(`smoodly: ${op}: projecting ${kind}s ${ids.join(", ")} failed; their rows are marked stale and rebuild on read.`, e);
+            try {
+                await projector.markStale(ids.map((id) => ({ kind, id })));
+            }
+            catch (m) {
+                console.error(`smoodly: ${op}: marking ${kind}s ${ids.join(", ")} stale failed too.`, m);
+            }
+        }
+    };
+    /** These entries' documents, the entries and pages that embed any of them (transitively), then their tags. Past
+     *  the projector's cap the rest are marked stale; their tags expire all the same (§2). `project: false` expires
+     *  the tags only: a save no published document can see (R17). */
+    const fanOut = async (roots, options = {}) => {
+        const entryIds = new Set();
+        const pageIds = new Set();
+        for (const root of typeof roots === "string" ? [roots] : roots) {
+            const affected = await affectedTargets({ pages, entries }, root);
+            for (const id of affected.entryIds)
+                entryIds.add(id);
+            for (const id of affected.pageIds)
+                pageIds.add(id);
+        }
+        if (options.project !== false) {
+            await project("entries", "entry", [...entryIds]);
+            await project("entries", "page", [...pageIds]);
+        }
         if (!effects?.revalidate)
             return;
-        const { pageIds, entryIds } = await affectedTargets({ pages, entries }, entryId);
         for (const id of entryIds)
             effects.revalidate(entryTag(id));
         for (const id of pageIds)
@@ -198,10 +232,12 @@ export function createAdminOps(deps) {
      *  the entry fan-out's, seeded with the asset's id — which is no entry, so
      *  it gets no tag of its own. */
     const expireAssetUsers = async (assetId) => {
-        if (!effects?.revalidate)
-            return;
         const { pageIds, entryIds } = await affectedTargets({ pages, entries }, assetId);
         const users = entryIds.filter((id) => id !== assetId);
+        await project("assets", "entry", users);
+        await project("assets", "page", pageIds);
+        if (!effects?.revalidate)
+            return;
         for (const id of users)
             effects.revalidate(entryTag(id));
         for (const id of pageIds)
@@ -221,11 +257,14 @@ export function createAdminOps(deps) {
             }
         }
     };
-    /** Expire the cached units a tree change touched, in order, once each. */
-    const expirePages = (ids) => {
+    /** Project the pages a tree change touched, then expire their cached units, in order, once each. Every id
+     *  expires, the ones past the projector's cap (marked stale) included. */
+    const expirePages = async (ids) => {
+        const unique = [...new Set(ids.filter((x) => typeof x === "string"))];
+        await project("pages", "page", unique);
         if (!effects?.revalidate)
             return;
-        for (const id of new Set(ids.filter((x) => typeof x === "string")))
+        for (const id of unique)
             effects.revalidate(pageTag(id));
     };
     /** The tree listing's unit (spec 2026-09-11 §2): every page op that changes what it shows. */
@@ -243,6 +282,8 @@ export function createAdminOps(deps) {
         }
         return out;
     };
+    /** The ids under one parent: a move renumbers every one of them (their stored sort). */
+    const childIds = async (parentId) => (await pages.listPages()).filter((p) => p.parentId === parentId).map((p) => p.id);
     /** Same walk over one collection's entries. */
     const entrySubtreeIds = async (collection, id) => {
         const all = await entries.list(collection);
@@ -274,8 +315,8 @@ export function createAdminOps(deps) {
         return out;
     };
     const assets = deps.assets;
-    const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
-    const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
+    const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to the admin's route (createAdminRoute).");
+    const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to the admin's route (createAdminRoute).");
     const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     /** unauthorized unless the actor may manage members; no actor (scripts, the seed) may. */
     const membersDenied = () => deps.actor && !can(deps.actor.role, "members.manage") ? err("unauthorized", "smoodly: only an admin can manage members.") : null;
@@ -329,7 +370,7 @@ export function createAdminOps(deps) {
     const supportedLocale = (locale) => typeof locale === "string" && config.locales.supported.includes(locale)
         ? null
         : err("validation", `smoodly: "${String(locale)}" is not a supported locale.`);
-    const openTemplate = (name) => config.registry.pages?.find((p) => p.schema.kind === "page" && p.schema.name === name);
+    const openTemplate = (name) => config.registry.pages.find((p) => p.kind === "page" && p.name === name);
     const mountGuard = (parent) => {
         const fixed = fixedNodeOf(parent, config);
         return fixed?.collection
@@ -439,7 +480,7 @@ export function createAdminOps(deps) {
                     const registration = openTemplate(input.template);
                     if (!registration)
                         return err("validation", `smoodly: no page type named "${input.template}".`);
-                    if (registration.schema.slug !== undefined) {
+                    if (registration.slug !== undefined) {
                         return err("validation", `smoodly: page type "${input.template}" is fixed — Smoodly creates that page for you.`);
                     }
                 }
@@ -468,6 +509,9 @@ export function createAdminOps(deps) {
                     locale: input.locale, slug: input.slug, template: input.template, parentId: input.parentId,
                     ...(input.title !== undefined ? { title: input.title } : {}),
                 }, by);
+                // A folder is public at once: its row, and its parent's children list. A page starts as a draft.
+                if (created.template === null)
+                    await expirePages([created.id, created.parentId]);
                 expireTree();
                 return ok(created);
             }),
@@ -507,7 +551,7 @@ export function createAdminOps(deps) {
                 }
                 const fieldErrors = [];
                 // Only the page type's zones (spec 2026-09-27 editor safety §1): a removed zone's nodes never block.
-                const shapeZones = Object.keys(openTemplate(record.template)?.schema?.zones ?? {});
+                const shapeZones = Object.keys(openTemplate(record.template)?.zones ?? {});
                 for (const zone of shapeZones) {
                     const nodes = Array.isArray(draft.zones[zone]) ? draft.zones[zone] : [];
                     for (const node of nodes) {
@@ -524,7 +568,7 @@ export function createAdminOps(deps) {
                     }
                 }
                 // The page's own fields (spec 2026-09-10 page fields §2); SEO meta is never validated.
-                const pageDescs = openTemplate(record.template)?.schema?.fields ?? {};
+                const pageDescs = openTemplate(record.template)?.fields ?? {};
                 for (const fe of validateFields(draft.fields ?? {}, pageDescs, elementDescs)) {
                     fieldErrors.push({ field: `page.fields.${fe.field}`, message: fe.message });
                 }
@@ -533,8 +577,8 @@ export function createAdminOps(deps) {
                     return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed problems first.`, refused);
                 }
                 const published = await pages.publish(id, locale, by, token);
-                // The parent's cached unit lists its published children.
-                expirePages([published.id, published.parentId]);
+                // The parent's cached unit lists its published children; every descendant embeds the page in its ancestors.
+                await expirePages([...(await subtreeIds(published.id)), published.parentId]);
                 expireTree();
                 return ok(published);
             }),
@@ -555,8 +599,8 @@ export function createAdminOps(deps) {
                 if (fixedNodeOf(record, config))
                     return owned(record, "it stays published");
                 const off = await pages.unpublish(id, locale, by);
-                // The parent's cached unit lists its published children; the tree listing shows status.
-                expirePages([off.id, off.parentId]);
+                // The parent's cached unit lists its published children, the descendants' ancestors show it; the tree listing shows status.
+                await expirePages([...(await subtreeIds(off.id)), off.parentId]);
                 expireTree();
                 return ok(off);
             }),
@@ -577,7 +621,7 @@ export function createAdminOps(deps) {
                     return err("blocked", `smoodly: "${nameOf(record)}" has nothing published in ${locale} — there is no version to restore.`);
                 }
                 const restored = await pages.discardDraft(id, locale, by, token);
-                expirePages([restored.id]); // the draft-mode render of this page changed
+                await expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
             listVersions: (id, locale) => guard(async () => {
@@ -607,7 +651,7 @@ export function createAdminOps(deps) {
                     return err("not_found", `smoodly: no version "${String(versionId)}" of this page in ${locale}.`);
                 }
                 const restored = await pages.restore(id, locale, versionId, by, token);
-                expirePages([restored.id]); // the draft-mode render of this page changed
+                await expirePages([restored.id]); // the draft-mode render of this page changed
                 return ok(restored);
             }),
             delete: (id) => guard(async () => {
@@ -623,7 +667,7 @@ export function createAdminOps(deps) {
                 await pages.deletePage(id);
                 // The cached unit is keyed by (locale, path) but tagged by the id
                 // found at the first miss; the parent's unit lists its children.
-                expirePages([id, record.parentId]);
+                await expirePages([id, record.parentId]);
                 expireTree();
                 return ok(null);
             }),
@@ -654,7 +698,7 @@ export function createAdminOps(deps) {
                 const renamed = await pages.rename(id, rest, by, { redirect: redirect ?? true });
                 // Every descendant's path changed with this segment; the parent
                 // lists this node's title and path.
-                expirePages([...(await subtreeIds(id)), record.parentId]);
+                await expirePages([...(await subtreeIds(id)), record.parentId]);
                 expireTree();
                 return ok(renamed);
             }),
@@ -689,7 +733,8 @@ export function createAdminOps(deps) {
                 }
                 const { redirect, ...dest } = to;
                 const moved = await pages.move(id, dest, { redirect: redirect ?? true });
-                expirePages([...(await subtreeIds(id)), record.parentId, moved.parentId]);
+                // The destination's children are renumbered: their stored sort (the tree's order) changes too.
+                await expirePages([...(await subtreeIds(id)), record.parentId, moved.parentId, ...(await childIds(moved.parentId))]);
                 expireTree();
                 return ok(moved);
             }),
@@ -707,10 +752,15 @@ export function createAdminOps(deps) {
                 const registration = openTemplate(template);
                 if (!registration)
                     return err("validation", `smoodly: no page type named "${template}".`);
-                if (registration.schema.slug !== undefined) {
+                if (registration.slug !== undefined) {
                     return err("validation", `smoodly: page type "${template}" is fixed — Smoodly creates that page for you.`);
                 }
                 const withTemplate = await pages.setTemplate(id, template, by);
+                // The folder becomes an unpublished page: its row goes, and with it its place in the parent's children and
+                // the subtree's ancestors. Its own address served nothing before and serves nothing now: no unit to expire.
+                const [, ...below] = await subtreeIds(id);
+                await project("pages.setTemplate", "page", [id]);
+                await expirePages([...below, record.parentId]);
                 expireTree();
                 return ok(withTemplate);
             }),
@@ -730,6 +780,9 @@ export function createAdminOps(deps) {
                     return lands;
                 // A new locale is a draft: nothing public changes but the tree listing (spec 2026-09-11 §2).
                 const added = await pages.addLocale(id, locale, { from: options.from }, by);
+                // A folder's new locale is public at once, in its parent's children too; a page's is a draft.
+                if (record.template === null)
+                    await expirePages([id, record.parentId]);
                 expireTree();
                 return ok(added);
             }),
@@ -749,7 +802,7 @@ export function createAdminOps(deps) {
                     return err("blocked", `smoodly: "${nameOf(record)}" is the site root — it exists in every locale.`);
                 const removed = await pages.removeLocale(id, locale);
                 // The locale may have been published: its unit and the parent's listing go.
-                expirePages([id, record.parentId]);
+                await expirePages([id, record.parentId]);
                 expireTree();
                 return ok(removed);
             }),
@@ -812,8 +865,9 @@ export function createAdminOps(deps) {
                 // A published row's slug is its live address and is never versioned, so this
                 // save is its publish: the grammar holds here (spec 2026-09-28 ASCII slugs §3).
                 const slug = typeof fields.slug === "string" && fields.slug !== "" ? fields.slug : null;
+                const before = (await entries.get(collection, id))?.locales[locale];
                 if (descriptors.slug !== undefined && (slug === null || !isSegment(slug))) {
-                    const row = (await entries.get(collection, id))?.locales[locale];
+                    const row = before;
                     if (row?.status === "published" && row.slug !== null && row.slug !== slug) {
                         const message = slug === null ? "Required while the entry is published." : SLUG_GRAMMAR_MESSAGE;
                         return err("validation", "Some fields need attention.", [{ field: "slug", message }]);
@@ -830,7 +884,21 @@ export function createAdminOps(deps) {
                     }
                     throw e;
                 }
-                await fanOut(id);
+                // A save projects only when a published document can see it (R17): a published row whose read is its live
+                // row, or a slug change (the slug is never versioned: it is live at once). In a tree collection every
+                // descendant's address hangs on the slug, published or not. Any other save is a draft: tags only.
+                const after = entry.locales[locale];
+                const slugChanged = after !== undefined && after.slug !== (before?.slug ?? null);
+                const tree = config.registry.collections?.find((c) => c.name === collection)?.tree !== undefined;
+                const below = tree && slugChanged ? (await entrySubtreeIds(collection, id)).slice(1) : [];
+                if (after?.status === "published" && (after.publishedVersionId === null || slugChanged)) {
+                    await fanOut([id, ...below]);
+                }
+                else {
+                    await fanOut(id, { project: false });
+                    if (below.length > 0)
+                        await fanOut(below);
+                }
                 expireCollection(collection);
                 return ok(entry);
             }),
@@ -909,8 +977,15 @@ export function createAdminOps(deps) {
             move: (collection, id, to) => guard(async () => {
                 const { redirect, ...dest } = to;
                 const moved = await entries.move(collection, id, dest, { redirect: redirect ?? true });
+                // The subtree's addresses changed, and with them every document embedding one of them.
+                const subtree = await entrySubtreeIds(collection, id);
+                await fanOut(subtree);
+                // The destination's children are renumbered: their stored sort (a manual list's order) changes too.
+                const inSubtree = new Set(subtree);
+                const siblings = (await entries.list(collection)).filter((e) => e.parentId === moved.parentId && !inSubtree.has(e.id)).map((e) => e.id);
+                await project("entries.move", "entry", siblings);
                 if (effects?.revalidate) {
-                    for (const entryId of await entrySubtreeIds(collection, id))
+                    for (const entryId of siblings)
                         effects.revalidate(entryTag(entryId));
                 }
                 expireCollection(collection);
@@ -970,8 +1045,10 @@ export function createAdminOps(deps) {
                 if (!record)
                     return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
                 const saved = await entries.update(name, record.id, locale, fields, by, token);
-                // fanOut expires `global:<name>` itself — this row IS the item's.
-                await fanOut(record.id);
+                // fanOut expires `global:<name>` itself — this row IS the item's. A global has no slug: it projects only when
+                // its published read is the live row (R17); a draft save expires the tags only.
+                const after = saved.locales[locale];
+                await fanOut(record.id, { project: after?.status === "published" && after.publishedVersionId === null });
                 return ok(saved);
             }),
             setStatus: (name, locale, status, expected) => guard(async () => {
@@ -1234,8 +1311,8 @@ export function createAdminOps(deps) {
         },
         health: {
             scan: () => guard(async () => {
-                const [trees, rows] = await Promise.all([pages.scanTrees(), entries.scanEntries()]);
-                return ok(buildHealthReport(adminRegistry(), trees, rows));
+                const [trees, rows, delivery] = await Promise.all([pages.scanTrees(), entries.scanEntries(), projector.delivery()]);
+                return ok({ ...buildHealthReport(adminRegistry(), trees, rows), delivery });
             }),
         },
         schema: {
@@ -1247,7 +1324,7 @@ export function createAdminOps(deps) {
         },
     };
 }
-/** Path-dispatch for the one-server-action seam. Own-property checks only —
+/** Path-dispatch for the one-endpoint seam. Own-property checks only —
  * "constructor.constructor" and prototype paths must not resolve. */
 export async function runAdminOp(ops, call) {
     if (!isPlainObject(call) || typeof call.path !== "string" || !Array.isArray(call.args)) {