smoodly 0.0.50 → 0.0.52

package/dist/assemble.js

@@ -1,19 +1,14 @@
 // The assembler (spec 2026-10-07 delivery model §3): the loaded page, entry, global, tree and entry list
 // as the site layer reads them, split out of site.ts so the live reads and the projector that fills the
 // delivery tables share one implementation. Framework-free and React-free, like the site layer.
-import { ARRAY_FIELD_TYPES, entryFieldsIn, schemaOf } from "./entry-store.js";
-import { buildPageTree, chainOf, entryAlternates, entryPathRows, pageAlternates, pagePath, } from "./paths.js";
-import { resolveFields, resolveFieldSets, resolveMedia, resolveTree } from "./resolve.js";
+// The assembler itself is the service's (packages/service/src/site/assemble.ts, plan 2026-10-14 the service holds
+// the stores); this file keeps the shape and the query checks the package's statics share with it.
+import { ARRAY_FIELD_TYPES } from "./entry-store.js";
 import { elementSchemas } from "./richtext-walk.js";
-import { globalNodeId, SETTINGS_KEY, STYLES_KEY, CSS_KEY } from "./global.js";
-import { SMD_KEY } from "./smd-key.js";
 import { resolveStyleValues } from "./styles.js";
 import { resolveCustom } from "./custom/index.js";
 import { addressMap, codeAddresses } from "./addresses.js";
-import { fullPath, servedAnchor } from "./anchors.js";
-import { withDefaults } from "./field-defaults.js";
-import { toEntryItem } from "./read-shapes.js";
-import { entrySeo, pageSeo, SEO_KEY } from "./seo.js";
+import { SEO_KEY } from "./seo.js";
 import { schemaOf as registeredSchema } from "./registration.js";
 /** Field types whose stored value is an object: not filterable (memory and SQL would disagree). */
 const OBJECT_FIELD_TYPES = new Set(["image", "video", "file", "richtext", "object"]);
@@ -64,296 +59,3 @@ export function checkEntryQuery(schema, collection, o) {
         throw new Error(`smoodly: getEntries("${collection}"): limit must be a non-negative integer.`);
     }
 }
-/** The reads a batch answers once per argument set (a projection asks the same ones for every page). */
-const MEMOIZED = { pages: ["listPages", "fieldsOf"], entries: ["getMany", "pathsIn"], assets: ["getMany"] };
-export function createAssembler(options, shape) {
-    const { locales, pageSchemas, styles, custom, elements, pathOpts, anchors } = shape;
-    const mounted = options.collections.filter((c) => c.path !== undefined);
-    /** The resolver's fetcher, bound to a locale: the merged fields of that
-     *  locale — published ones (a versioned collection's snapshot) on the
-     *  public path, the live rows in draft mode. */
-    const fetcher = (draft, locale) => (collection, ids) => options.stores().entries.getMany(collection, ids, locale, draft ? undefined : { status: "published" });
-    /** The resolver's path lookup, bound to a locale: each EntryRef's address (spec 2026-09-29 content API contract §2). */
-    const pathLookup = (locale) => (collection, ids) => options.stores().entries.pathsIn(collection, ids, locale);
-    /** The media fetcher (spec 2026-09-08 §9) — absent when the site runs without an asset store. */
-    const assetFetcher = () => {
-        const assets = options.stores().assets;
-        return assets ? (ids) => assets.getMany(ids) : undefined;
-    };
-    const sectionSettings = (name) => {
-        const s = options.sections.find((x) => ("schema" in x ? x.schema : x).name === name);
-        return (s && ("schema" in s ? s.schema : s).settings) ?? {};
-    };
-    /** Visible to the public in a locale: present there, and a folder or a
-     *  published page. Draft mode sees every present node. Presence is the
-     *  locale row — nothing falls back (spec 2026-09-06 §3). */
-    const visible = (node, locale, draft) => {
-        const row = node.locales[locale];
-        return row !== undefined && (draft || node.template === null || row.status === "published");
-    };
-    const hasPage = (node, locale, draft) => {
-        const row = node.locales[locale];
-        return node.template !== null && row !== undefined && (draft || row.status === "published");
-    };
-    const pageFields = (template) => pageFieldsOf(shape, template);
-    /** The version whose fields a link shows: the draft's in draft mode, else the published one. */
-    const versionFor = (node, locale, draft) => {
-        const row = node.locales[locale];
-        if (!row || node.template === null)
-            return null;
-        return draft ? row.draftVersionId : row.publishedVersionId;
-    };
-    /** Raw page fields (no asset resolution) of many nodes in ONE store read
-     *  (spec 2026-09-10 page fields §3), defaults applied; `{}` for a folder. */
-    async function linkFields(nodes, locale, draft) {
-        const { pages } = options.stores();
-        const wanted = new Map(); // node id → version id
-        for (const n of nodes) {
-            const v = versionFor(n, locale, draft);
-            if (v)
-                wanted.set(n.id, v);
-        }
-        const byVersion = wanted.size > 0 ? await pages.fieldsOf([...new Set(wanted.values())]) : {};
-        const out = new Map();
-        for (const n of nodes) {
-            const v = wanted.get(n.id);
-            out.set(n.id, n.template === null ? {} : withDefaults(v ? byVersion[v] : undefined, pageFields(n.template)));
-        }
-        return out;
-    }
-    /** Only ever called for a node PRESENT in the locale (visible() or an ancestor of one). */
-    const link = (node, byId, locale, draft, fields) => ({
-        title: node.locales[locale].title,
-        path: pagePath(node, byId, locale, pathOpts),
-        hasPage: hasPage(node, locale, draft),
-        fields: fields.get(node.id) ?? {},
-    });
-    async function loadPage(id, locale, path, draft, version) {
-        const { pages } = options.stores();
-        const record = await pages.getPage(id);
-        if (!record || record.template === null)
-            return null;
-        const row = record.locales[locale];
-        if (!row)
-            return null;
-        let raw;
-        if (version !== undefined) {
-            // History: a stored version of THIS page in THIS locale, and only inside draft mode.
-            const stored = draft ? await pages.getVersion(version) : null;
-            raw = stored && stored.pageId === id && stored.locale === locale ? stored.tree : null;
-        }
-        else {
-            raw = draft ? await pages.getDraftTree(id, locale) : row.status === "published" ? await pages.getPublishedTree(id, locale) : null;
-        }
-        if (!raw)
-            return null;
-        const tree = await resolveTree(raw, {
-            sections: options.sections,
-            collections: options.collections,
-            globals: options.globals,
-            elements: options.elements,
-            fetch: fetcher(draft, locale), paths: pathLookup(locale),
-            assets: assetFetcher(),
-            page: { fields: pageFields(record.template) },
-            custom,
-        });
-        const all = await pages.listPages();
-        const index = new Map(all.map((n) => [n.id, n]));
-        const byId = (x) => index.get(x);
-        const chain = chainOf(record, byId);
-        const kids = all.filter((n) => n.parentId === id && visible(n, locale, draft));
-        const fields = await linkFields([...chain.slice(0, -1), ...kids], locale, draft);
-        const ancestors = chain.slice(0, -1).map((n) => link(n, byId, locale, draft, fields));
-        const children = kids.map((n) => link(n, byId, locale, draft, fields));
-        // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present
-        // one. Derived from the tree already listed — no index lookup (spec 2026-09-15 §2).
-        const alternates = pageAlternates(record, byId, pathOpts, (l) => draft || record.locales[l]?.status === "published");
-        const withSeo = pageSchemas.some((x) => x.kind === "page" && x.name === record.template && x.seo === true);
-        return {
-            kind: "page",
-            locale,
-            record,
-            template: record.template,
-            tree,
-            title: row.title,
-            path,
-            fields: withDefaults(tree.fields, pageFields(record.template)),
-            ancestors,
-            children,
-            locales: alternates,
-            ...(withSeo ? { seo: pageSeo(tree.meta, row.title) } : {}),
-        };
-    }
-    async function loadEntry(id, locale, path, draft) {
-        const { entries } = options.stores();
-        for (const schema of mounted) {
-            const record = await entries.get(schema.name, id);
-            if (!record)
-                continue;
-            // No row, or a draft row outside draft mode, is a 404 for THIS locale.
-            const row = record.locales[locale];
-            if (!row)
-                return null;
-            if (!draft && row.status !== "published")
-                return null;
-            const raw = draft
-                ? entryFieldsIn(record, locale)
-                : (await entries.getMany(schema.name, [id], locale, { status: "published" }))[id];
-            if (!raw)
-                return null;
-            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
-            // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present one.
-            // One record is in memory (a nested entry's parents are not), so the `paths` index
-            // supplies the paths — the same single lookup as before (spec 2026-09-15 §2).
-            const known = await entries.pathsOf(schema.name, id);
-            const alternates = entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", (l) => known[l] ?? null);
-            return {
-                kind: "entry", locale, collection: schema.name, entry: { ...record, fields }, path, locales: alternates,
-                ...(schema.seo ? { seo: entrySeo(fields, schema) } : {}),
-            };
-        }
-        return null;
-    }
-    const localeOf = (o) => o?.locale ?? locales.default;
-    async function readEntries(collection, o = {}) {
-        const schema = schemaOf(options.collections, collection);
-        const locale = localeOf(o);
-        const draft = o.draft ?? false;
-        const { entries } = options.stores();
-        checkEntryQuery(schema, collection, o);
-        // The store filters, orders and limits over the snapshot shown (spec 2026-09-29 content API contract §5): the
-        // locale gate — presence in draft mode, published otherwise — is part of the query, so `limit` counts rows that are really there.
-        const rows = await entries.query(collection, {
-            locale, draft, where: o.where, order: o.order, limit: o.limit, ids: o.ids,
-            ...(o.parent !== undefined ? { parent: o.parent } : {}),
-        });
-        // Paths need every ancestor: a tree collection reads the whole collection for that, a flat one does not.
-        const all = schema.tree ? await entries.list(collection) : rows.map((r) => r.record);
-        // References and media resolve for the whole list in one pass (§2, §6).
-        const sets = rows.map((r) => ({ values: structuredClone(r.fields), descriptors: schema.fields }));
-        await resolveFieldSets(sets, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
-        const index = new Map(all.map((e) => [e.id, e]));
-        const byId = (x) => index.get(x);
-        return rows.map(({ record }, i) => {
-            const paths = entryPathRows([record], byId, schema.name);
-            const pathIn = (l) => {
-                const row = paths.find((r) => r.locale === l);
-                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
-            };
-            const item = toEntryItem(record, sets[i].values, {
-                path: pathIn(locale),
-                locale,
-                locales: entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", pathIn),
-                ...(schema.seo ? { seo: entrySeo(sets[i].values, schema) } : {}),
-            });
-            return { record, item };
-        });
-    }
-    /** A node the public tree leaves out, with its subtree: a record no longer in code (no path, spec
-     *  2026-09-29 nested paths §5), and a page where another code address wins, which visitors never
-     *  reach (anchored paths §4). */
-    const hiddenAt = (path, record, byId, locale) => path === null || servedAnchor(anchors, locale, path) !== (chainOf(record, byId)[0].fixed ?? "");
-    async function tree(locale, { draft }) {
-        const all = await options.stores().pages.listPages();
-        const shown = all.filter((n) => visible(n, locale, draft));
-        const index = new Map(shown.map((n) => [n.id, n]));
-        const fields = await linkFields(shown, locale, draft);
-        // Every node the walk reaches is present with a present chain.
-        const hidden = (node) => hiddenAt(node.path, node.record, (x) => index.get(x), locale);
-        const toItems = (nodes) => nodes.flatMap((node) => hidden(node) ? [] : [{
-                id: node.record.id,
-                title: node.record.locales[locale].title,
-                path: node.path,
-                hasPage: hasPage(node.record, locale, draft),
-                fields: fields.get(node.record.id) ?? {},
-                children: toItems(node.children),
-            }]);
-        return toItems(buildPageTree(shown, locale, pathOpts));
-    }
-    async function treeRow(record, all, locale) {
-        const index = new Map(all.map((n) => [n.id, n]));
-        const byId = (x) => index.get(x);
-        const path = pagePath(record, byId, locale, pathOpts);
-        const fields = await linkFields([record], locale, false);
-        return {
-            id: record.id,
-            locale,
-            parentId: record.parentId,
-            sort: record.sort,
-            path: hiddenAt(path, record, byId, locale) ? null : path,
-            title: record.locales[locale].title,
-            hasPage: hasPage(record, locale, false),
-            linkFields: fields.get(record.id) ?? {},
-        };
-    }
-    async function global(item, locale, { draft }) {
-        const { entries } = options.stores();
-        const [record] = await entries.list(item.name);
-        if (!record)
-            return null;
-        const row = record.locales[locale];
-        if (!row || (!draft && row.status !== "published"))
-            return null;
-        const raw = draft
-            ? entryFieldsIn(record, locale)
-            : (await entries.getMany(item.name, [record.id], locale, { status: "published" }))[record.id];
-        if (!raw)
-            return null;
-        const fields = await resolveFields(raw, item.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
-        if (!item.section)
-            return { locale, fields };
-        const { [SETTINGS_KEY]: settings, [STYLES_KEY]: steps, [CSS_KEY]: css, ...rest } = fields;
-        const fetch = assetFetcher();
-        const own = settings !== null && typeof settings === "object" ? settings : {};
-        if (fetch)
-            await resolveMedia(own, sectionSettings(item.section), fetch, elements);
-        // The layout node id, the css and the values ride the styles under the reserved key (spec 2026-09-13 §1, 2026-09-14 §2, §4):
-        // the wrapper strips it and emits data-smd-node, so the canvas selects the item and the css reaches it.
-        const stepsObject = steps !== null && typeof steps === "object" ? steps : {};
-        return {
-            locale,
-            fields: rest,
-            settings: own,
-            styles: { ...stepsObject, [SMD_KEY]: { node: globalNodeId(item.name), css: typeof css === "string" ? css : undefined, values: styles } },
-        };
-    }
-    /** A copy whose reads in MEMOIZED answer once per argument set — the promise is shared, so concurrent
-     *  identical calls make one store call. For the lifetime of the copy only; the base assembler never caches. */
-    function batch(primed) {
-        const memo = new Map();
-        if (primed?.pages)
-            memo.set(`pages.listPages:${JSON.stringify([])}`, Promise.resolve(primed.pages));
-        const wrap = (store, group) => new Proxy(store, {
-            get(target, prop) {
-                const value = Reflect.get(target, prop, target);
-                if (typeof value !== "function")
-                    return value;
-                if (!MEMOIZED[group].includes(prop))
-                    return value.bind(target);
-                return (...args) => {
-                    const key = `${group}.${String(prop)}:${JSON.stringify(args)}`;
-                    let hit = memo.get(key);
-                    if (!hit)
-                        memo.set(key, (hit = value.apply(target, args)));
-                    return hit;
-                };
-            },
-        });
-        return createAssembler({
-            ...options,
-            stores: () => {
-                const s = options.stores();
-                return { ...s, pages: wrap(s.pages, "pages"), entries: wrap(s.entries, "entries"), ...(s.assets ? { assets: wrap(s.assets, "assets") } : {}) };
-            },
-        }, shape);
-    }
-    return {
-        page: (id, locale, path, { draft, version }) => loadPage(id, locale, path, draft, version),
-        entry: (id, locale, path, { draft }) => loadEntry(id, locale, path, draft),
-        global,
-        tree,
-        entries: readEntries,
-        treeRow,
-        batch,
-    };
-}

package/dist/asset-store.d.ts

@@ -1,16 +1,17 @@
-import type { AssetKind, AssetMeta, AssetRecord } from "./media.ts";
-import { MemoryRefIndex } from "./ref-index.ts";
+import { type AssetKind, type AssetMeta, type AssetRecord } from "./media.ts";
+/** A pending asset and the path its bytes go to (spec 2026-10-18 media on R2 and Images §4): the Worker streams them
+ *  there, then finishes or aborts the row. */
 export type UploadTicket = {
     id: string;
-    uploadUrl: string;
-    token: string;
+    path: string;
 };
+/** What the browser measured, and the metadata the upload carried. */
 export type FinishInput = {
     width?: number;
     height?: number;
     duration?: number;
     posterId?: string;
-};
+} & AssetMeta;
 export type AssetQuery = {
     kind?: AssetKind;
     search?: string;
@@ -36,10 +37,12 @@ export type CreateAssetInput = BeginUploadInput & AssetMeta & {
 };
 export declare const PAGE_SIZE = 60;
 export interface AssetStore {
-    /** A pending row and a signed upload URL for `<space>/<id>.<ext>`. */
+    /** A pending row, which no list or read shows, at `<space>/<id>.<ext>`. */
     beginUpload(input: BeginUploadInput): Promise<UploadTicket>;
-    /** Marks the row ready with what the browser measured. */
+    /** Marks the row ready with what was measured. */
     finishUpload(id: string, dims: FinishInput): Promise<AssetRecord>;
+    /** A failed upload undone: the pending row and any bytes at its path are deleted; a ready row is refused. */
+    abortUpload(id: string): Promise<void>;
     /** Server-side: bytes in, a ready row out (the seed, scripts). */
     create(input: CreateAssetInput): Promise<AssetRecord>;
     /** Any status — the widget shows a pending row as "uploading". */
@@ -52,7 +55,13 @@ export interface AssetStore {
     /** Refused while any refs row points at the asset; a video's poster goes with it. Idempotent. */
     delete(id: string): Promise<void>;
 }
+/** A file the media rules refuse (spec 2026-10-16 the control plane §4): the prefix lets a caller across RPC tell it
+ *  from a failure and answer 400 with the text after it. */
+export declare const ASSET_REFUSED = "smoodly:refused:";
+export declare const isAssetRefused: (e: unknown) => e is Error;
 export declare const assetErrors: {
+    /** `reason` finishes the sentence after the file's name: `is larger than 25 MB`. */
+    refused: (filename: string, reason: string) => Error;
     notFound: (id: string) => Error;
     notPending: (id: string) => Error;
     referenced: (id: string, n: number) => Error;
@@ -61,26 +70,15 @@ export declare const kindOf: (mime: string) => AssetKind;
 /** The object's extension: the filename's when it has a sane one, else the mime's, else "bin". */
 export declare function extensionFor(filename: string, mime: string): string;
 export declare const objectPath: (space: string, id: string, filename: string, mime: string) => string;
-/** The public URL; an SVG carries ?download= so the bucket origin never renders it. */
-export declare const withDownload: (url: string, mime: string) => string;
-export declare class MemoryAssetStore implements AssetStore {
-    private refs;
-    private rows;
-    private objects;
-    private baseUrl;
-    private space;
-    constructor(refs?: MemoryRefIndex, options?: {
-        baseUrl?: string;
-        space?: string;
-    });
-    private url;
-    private row;
-    beginUpload(input: BeginUploadInput): Promise<UploadTicket>;
-    finishUpload(id: string, dims: FinishInput): Promise<AssetRecord>;
-    create(input: CreateAssetInput): Promise<AssetRecord>;
-    get(id: string): Promise<AssetRecord | null>;
-    getMany(ids: string[]): Promise<Record<string, AssetRecord>>;
-    list(query?: AssetQuery): Promise<AssetPage>;
-    update(id: string, meta: AssetMeta): Promise<AssetRecord>;
-    delete(id: string): Promise<void>;
-}
+/** The media library's rules (config.media: the accepted types, the size cap) as a store applies them at beginUpload and
+ *  create, so whoever writes a file meets them — the admin, a script, the service's upload routes. */
+export declare function assertMediaRules(rules: {
+    maxSize: number;
+    accept: readonly string[];
+}, input: {
+    filename: string;
+    mime: string;
+    size: number;
+}): void;
+/** A refusal for size alone, which the upload routes answer 413. */
+export declare const isTooLarge: (e: unknown) => e is Error;

package/dist/asset-store.js

@@ -1,8 +1,16 @@
-import { MemoryRefIndex } from "./ref-index.js";
-import { DEFAULT_SPACE_ID } from "./sql-space.js";
-import { ASSET_COLLECTION } from "./media.js";
+// The media persistence contract (spec 2026-09-08 media §6, §7); both
+// adapters live in packages/service/src/stores. An asset is one row plus one object; the store never
+// gates on drafts or locales. The delete guard reads the refs index the
+// same way entries do; the walk that writes asset edges lives in refs.ts.
+import { CUT_TYPES } from "./media.js";
 export const PAGE_SIZE = 60;
+/** A file the media rules refuse (spec 2026-10-16 the control plane §4): the prefix lets a caller across RPC tell it
+ *  from a failure and answer 400 with the text after it. */
+export const ASSET_REFUSED = "smoodly:refused:";
+export const isAssetRefused = (e) => e instanceof Error && e.message.startsWith(ASSET_REFUSED);
 export const assetErrors = {
+    /** `reason` finishes the sentence after the file's name: `is larger than 25 MB`. */
+    refused: (filename, reason) => new Error(`${ASSET_REFUSED} smoodly: "${filename}" ${reason}.`),
     notFound: (id) => new Error(`smoodly: no asset "${id}".`),
     notPending: (id) => new Error(`smoodly: asset "${id}" is not pending.`),
     referenced: (id, n) => new Error(`smoodly: "asset/${id}" is referenced by ${n} document(s) — remove those references first.`),
@@ -20,122 +28,19 @@ export function extensionFor(filename, mime) {
     return BY_MIME[mime] ?? "bin";
 }
 export const objectPath = (space, id, filename, mime) => `${space}/${id}.${extensionFor(filename, mime)}`;
-/** The public URL; an SVG carries ?download= so the bucket origin never renders it. */
-export const withDownload = (url, mime) => (mime === "image/svg+xml" ? `${url}?download=` : url);
-const lower = (s) => (s ?? "").toLowerCase();
-export class MemoryAssetStore {
-    constructor(refs = new MemoryRefIndex(), options = {}) {
-        this.refs = refs;
-        this.rows = new Map();
-        this.objects = new Map();
-        this.baseUrl = options.baseUrl ?? "http://localhost/media";
-        this.space = options.space ?? DEFAULT_SPACE_ID;
-    }
-    url(path, mime) {
-        return withDownload(`${this.baseUrl}/${path}`, mime);
-    }
-    row(input, status) {
-        const id = crypto.randomUUID();
-        const path = objectPath(this.space, id, input.filename, input.mime);
-        const now = Date.now();
-        return {
-            id, kind: kindOf(input.mime), status, path, mime: input.mime, size: input.size,
-            width: null, height: null, duration: null, posterId: null, filename: input.filename,
-            title: null, alt: null, caption: null, credit: null, url: this.url(path, input.mime), createdAt: now, updatedAt: now,
-        };
-    }
-    async beginUpload(input) {
-        const row = this.row(input, "pending");
-        this.rows.set(row.id, row);
-        return { id: row.id, uploadUrl: `memory://upload/${row.path}`, token: "memory" };
-    }
-    async finishUpload(id, dims) {
-        const row = this.rows.get(id);
-        if (!row)
-            throw assetErrors.notFound(id);
-        if (row.status !== "pending")
-            throw assetErrors.notPending(id);
-        const next = {
-            ...row, status: "ready", width: dims.width ?? null, height: dims.height ?? null,
-            duration: dims.duration ?? null, posterId: dims.posterId ?? null, updatedAt: Date.now(),
-        };
-        this.rows.set(id, next);
-        return structuredClone(next);
-    }
-    async create(input) {
-        const row = {
-            ...this.row(input, "ready"),
-            width: input.width ?? null, height: input.height ?? null, duration: input.duration ?? null,
-            posterId: input.posterId ?? null, title: input.title ?? null, alt: input.alt ?? null,
-            caption: input.caption ?? null, credit: input.credit ?? null,
-        };
-        // Distinct createdAt per row keeps "newest first" and the cursor honest
-        // when two creates land in one millisecond.
-        const last = [...this.rows.values()].reduce((m, r) => Math.max(m, r.createdAt), 0);
-        if (row.createdAt <= last) {
-            row.createdAt = last + 1;
-            row.updatedAt = row.createdAt;
-        }
-        this.rows.set(row.id, row);
-        this.objects.set(row.path, input.bytes);
-        return structuredClone(row);
-    }
-    async get(id) {
-        const row = this.rows.get(id);
-        return row ? structuredClone(row) : null;
-    }
-    async getMany(ids) {
-        const out = {};
-        for (const id of ids) {
-            const row = this.rows.get(id);
-            if (row?.status === "ready")
-                out[id] = structuredClone(row);
-        }
-        return out;
-    }
-    async list(query = {}) {
-        const limit = query.limit ?? PAGE_SIZE;
-        const q = lower(query.search);
-        const cursor = query.cursor ? Number(query.cursor) : Infinity;
-        const all = [...this.rows.values()]
-            .filter((r) => r.status === "ready")
-            .filter((r) => !query.kind || r.kind === query.kind)
-            .filter((r) => !q || lower(r.title).includes(q) || lower(r.filename).includes(q) || lower(r.alt).includes(q))
-            .filter((r) => r.createdAt < cursor)
-            .sort((a, b) => b.createdAt - a.createdAt);
-        const items = all.slice(0, limit).map((r) => structuredClone(r));
-        return { items, nextCursor: all.length > limit ? String(items[items.length - 1].createdAt) : null };
-    }
-    async update(id, meta) {
-        const row = this.rows.get(id);
-        if (!row)
-            throw assetErrors.notFound(id);
-        const next = {
-            ...row,
-            ...(meta.title !== undefined ? { title: meta.title } : {}),
-            ...(meta.alt !== undefined ? { alt: meta.alt } : {}),
-            ...(meta.caption !== undefined ? { caption: meta.caption } : {}),
-            ...(meta.credit !== undefined ? { credit: meta.credit } : {}),
-            updatedAt: Math.max(Date.now(), row.updatedAt),
-        };
-        this.rows.set(id, next);
-        return structuredClone(next);
-    }
-    async delete(id) {
-        const row = this.rows.get(id);
-        if (!row)
-            return;
-        const usage = this.refs.to(ASSET_COLLECTION, id);
-        if (usage.length > 0)
-            throw assetErrors.referenced(id, usage.length);
-        if (row.posterId) {
-            const poster = this.rows.get(row.posterId);
-            if (poster) {
-                this.rows.delete(poster.id);
-                this.objects.delete(poster.path);
-            }
-        }
-        this.rows.delete(id);
-        this.objects.delete(row.path);
-    }
+/** The media library's rules (config.media: the accepted types, the size cap) as a store applies them at beginUpload and
+ *  create, so whoever writes a file meets them — the admin, a script, the service's upload routes. */
+export function assertMediaRules(rules, input) {
+    if (!rules.accept.includes(input.mime))
+        throw assetErrors.refused(input.filename, `is ${input.mime}, not an accepted file type`);
+    if (input.size > rules.maxSize)
+        throw assetErrors.refused(input.filename, `${TOO_LARGE} ${Math.round(rules.maxSize / 1024 / 1024)} MB`);
+    if (CUT_TYPES.has(input.mime) && input.size > IMAGE_SIZE_CEILING)
+        throw assetErrors.refused(input.filename, `${TOO_LARGE} 20 MB, the most an image may be`);
 }
+/** Images' input limit (developers.cloudflare.com/images › Limits, "the maximum input size for .input() is 20 MB"):
+ *  an image past it could never be cut, so it is refused whatever the space's cap. */
+const IMAGE_SIZE_CEILING = 20 * 1024 * 1024;
+const TOO_LARGE = "is larger than";
+/** A refusal for size alone, which the upload routes answer 413. */
+export const isTooLarge = (e) => isAssetRefused(e) && e.message.includes(`" ${TOO_LARGE} `);

package/dist/astro/components/Head.astro

@@ -4,7 +4,9 @@
 // link per locale the page is published in, the Open Graph values, and noindex. Next writes the same through
 // smoodlyMetadata. Absolute addresses from `site` in astro.config, else the request's origin. A layout places
 // it inside <head>; `fallback` titles a document Smoodly has no title for (an entry whose collection has no
-// seo). A layout that writes its own <title> leaves `fallback` out and reads `of.title` itself.
+// seo). A layout that writes its own <title> leaves `fallback` out and reads `of.title` itself. A page that shows an
+// image preconnects to the media host, with no crossorigin: an <img> is fetched with credentials and would not use an
+// anonymous connection (spec 2026-10-18 media on R2 and Images §7).
 const { of: head, fallback } = Astro.props;
 const origin = (Astro.site ?? Astro.url).origin;
 const absolute = (path: string) => new URL(path, origin).href;
@@ -12,6 +14,7 @@ const title = head.title ?? fallback;
 const canonical = head.canonical ? absolute(head.canonical) : undefined;
 const image = head.image;
 ---
+{head.mediaOrigin && <link rel="preconnect" href={head.mediaOrigin} />}
 {title && <title>{title}</title>}
 {head.description && <meta name="description" content={head.description} />}
 {canonical && <link rel="canonical" href={canonical} />}

package/dist/astro/components/Image.astro

@@ -1,20 +1,15 @@
 ---
-// <Image>: a box at the aspect (declared, chosen or natural), the picture inside placed by crop and hotspot,
-// dimensions set so nothing shifts (spec 2026-09-08 media §9; the React one is image/SmoodlyImage.tsx). The
-// bytes come through Astro's image service: `getImage` turns the media URL into the /_image endpoint with a
-// srcset of widths, so a 4 MB upload is served at the size the page asks for. The media host is allowed by the
-// integration (index.ts). An SVG, or `unoptimized`, is the original. Data attributes land on the box.
-import { getImage } from "astro:assets";
-import { imageRequest, placeImage } from "smoodly/astro/runtime";
+// <Image>: the one image markup (src/image/markup.ts) written as HTML, attribute for attribute what React writes for
+// <SmoodlyImage> (spec 2026-10-18 media on R2 and Images §7): a box, a plain <img> over the cut's widths, or a <picture>
+// with a <source> per crop the view places in `media`. No Astro image service and no Smoodly JavaScript. Data
+// attributes land on the box. In a prerendered page of static output the addresses become files of the site's own
+// output, AVIF and WebP (static-media.ts, spec §8); the preview address, rendered on demand, keeps the media host's.
+import { imageHtml, imageMarkup, staticImage } from "smoodly/astro/runtime";
+import { output } from "smoodly:build";
 
-const { image, aspect, sizes, priority, loading, alt, unoptimized, class: className, style, ...data } = Astro.props;
-const placed = placeImage(image, { aspect });
-const request = imageRequest(image, { sizes, unoptimized });
-const transformed = request ? await getImage(request) : null;
-const src = transformed?.src ?? image.url;
-const srcset = transformed?.srcSet.attribute || undefined;
+const { image, aspect, media, sizes, priority, loading, alt, quality, maxWidth, class: className, style, ...data } = Astro.props;
+let markup = imageMarkup(image, { aspect, media, sizes, priority, loading, alt, quality, maxWidth });
+if (output === "static" && Astro.isPrerendered) markup = await staticImage(markup);
+const html = imageHtml(markup, { class: className, style: typeof style === "string" && style ? style : undefined, data });
 ---
-<span class={className} style={typeof style === "string" && style ? `${placed.box};${style}` : placed.box} {...data}>
-  <img src={src} srcset={srcset} sizes={srcset ? sizes : undefined} alt={alt ?? image.alt} width={image.width} height={image.height}
-    loading={priority ? "eager" : loading ?? "lazy"} fetchpriority={priority ? "high" : undefined} decoding="async" style={placed.frame} />
-</span>
+<Fragment set:html={html} />

package/dist/astro/components/Video.astro

@@ -1,5 +1,8 @@
 ---
-// A <video> over the bucket's CDN with its poster and size, no transcoding (spec 2026-09-08 media §9).
+// A <video> from the media host with its poster (a cut where there is one) and size, no transcoding (spec 2026-09-08
+// media §9).
+import { posterUrl } from "smoodly/astro/runtime";
+
 const { video, ...rest } = Astro.props;
 ---
-<video src={video.url} poster={video.poster?.url} width={video.width} height={video.height} playsinline {...rest}></video>
+<video src={video.url} poster={posterUrl(video)} width={video.width} height={video.height} playsinline {...rest}></video>

package/dist/astro/head.d.ts

@@ -9,5 +9,8 @@ export type PageHead = {
     canonical?: string;
     /** locale → the page's address there, for a multi-locale site; empty otherwise. */
     languages: Record<string, string>;
+    /** The media host of the first image the page shows, for a preconnect (spec 2026-10-18 media on R2 and Images §7):
+     *  the connection opens while the HTML is parsed. */
+    mediaOrigin?: string;
 };
 export declare function headOf(hit: SiteHit, locale: string, href: (path: string, locale: string) => string, locales: LocaleSet): PageHead;