smoodly 0.0.51 → 0.0.52

package/README.md

@@ -2,35 +2,36 @@
 
 A code-first CMS for Astro and Next.js. Define a component once in code and it
 becomes a typed, editable building block your editors compose, within
-the rails you set. Content lives in Supabase; the admin mounts into
-your own site at `/admin`.
+the rails you set. Content and media live in Smoodly's service, read over
+its API; the admin mounts into your own site at `/admin`.
 
 ## Install
 
     npx create-smoodly-app my-site
 
-This creates an Astro or Next.js site with the admin mounted, the database schema
-in place and a first editor who can sign in.
+This creates an Astro or Next.js site with the admin mounted, its content model
+pushed to your space and the starter content seeded.
 
 ## Environment
 
-A self-hosted app needs three variables:
+The installer writes them from the project at smoodly.io:
 
 | Variable | What it is |
 | --- | --- |
-| `SMOODLY_URL` | Your Supabase project's URL |
-| `SMOODLY_SECRET_KEY` | The project's secret key. Server-only. |
-| `SMOODLY_PUBLISHABLE_KEY` | The project's publishable key |
+| `SMOODLY_SPACE_ID` | The space your content lives in (`sp_…`) |
+| `SMOODLY_SECRET_KEY` | The space's secret key (`sk_…`). Server-only. |
+| `SMOODLY_PUBLISHABLE_KEY` | The space's publishable key (`pk_…`) |
+| `SITE_URL` | Your site's own address |
 
 ## Upgrading
 
-A new version can need a newer database schema. After updating the
-package, `npx smoodly migrate` writes the migration files; the
-Upgrading guide has the rest.
+Update the package and deploy: a space's schema lives in Smoodly's
+service, which brings it forward itself. The Upgrading guide names each
+version's code changes.
 
 ## Docs and source
 
-Guides: https://github.com/laniakea-studio/smoodly-cms/tree/main/guides
-Source: https://github.com/laniakea-studio/smoodly-cms
+Guides: https://github.com/smoodly-io/smoodly/tree/main/guides
+Source: https://github.com/smoodly-io/smoodly
 
 MIT licensed.

package/dist/admin/auth-config.d.ts

@@ -1,6 +1,7 @@
-/** What the browser needs to sign in — public values only (admin/shell/session.ts reads it; the handler and the page data carry it). */
-export type AuthConfig = {
-    url: string;
-    key: string;
-    providers?: ("google" | "github")[];
+/** Where the admin sends a person to sign in, and the dashboard its account menu and Members page link to (spec
+ *  2026-10-16 sign-in and the dashboard §1, §6): `GET /v1/auth` answers it from the Worker's env; the handler and the
+ *  page data carry it. Public values only. */
+export type SignInConfig = {
+    signInUrl: string;
+    consoleUrl: string;
 };

package/dist/admin/auth.d.ts

@@ -1,18 +1,10 @@
-import { type MemberRole } from "../permissions.ts";
-import type { AdminOpCall, OpResult } from "./ops.ts";
-/** What the auth project vouches for: the Auth user id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
+import type { MemberRole } from "../permissions.ts";
+/** Who the pass names: the account id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
 export type VerifiedUser = {
     userId: string;
     email: string | null;
 };
-/** The verified member: the user plus the normalized role from `members`. */
+/** The admitted member: the account plus the normalized role from `members`. */
 export type AdminSession = VerifiedUser & {
     role: MemberRole;
 };
-export type AdminAuth = {
-    /** The user behind a session token, or null when the auth project rejects it. */
-    verify(token: string): Promise<VerifiedUser | null>;
-    /** The stored role of this user in `members` for the current space, or null without a row. */
-    memberOf(userId: string): Promise<string | null>;
-};
-export declare function gateAdminOp(auth: AdminAuth, call: AdminOpCall, run: (call: AdminOpCall, session: AdminSession) => Promise<OpResult<unknown>>): Promise<OpResult<unknown>>;

package/dist/admin/auth.js

@@ -1,30 +1 @@
-// Admission to the admin (spec 2026-09-04 §5; roles 2026-09-25 members
-// management §2): a session token from the auth project, then a row in
-// `members` read with the write key, whose role rides on the session.
-// One gate around the ops seam — individual ops ask can(). Framework-
-// free; Supabase-backed implementation in supabase-auth.ts.
-import { normalizeRole } from "../permissions.js";
-const unauthorized = (message) => ({ ok: false, code: "unauthorized", message });
-export async function gateAdminOp(auth, call, run) {
-    const token = typeof call === "object" && call !== null && typeof call.token === "string"
-        ? call.token
-        : null;
-    if (!token)
-        return unauthorized("smoodly: sign in to use the admin.");
-    let user;
-    let stored;
-    try {
-        user = await auth.verify(token);
-        // Marked, so the browser signs itself out instead of showing this on every screen (2026-10-02).
-        if (!user)
-            return { ok: false, code: "unauthorized", message: "smoodly: your session has expired — sign in again.", expired: true };
-        stored = await auth.memberOf(user.userId);
-    }
-    catch (e) {
-        console.error("smoodly: auth check failed", e);
-        return { ok: false, code: "internal", message: "smoodly: could not check your session." };
-    }
-    if (stored === null)
-        return unauthorized("smoodly: this account is not an editor of this site.");
-    return run(call, { ...user, role: normalizeRole(stored) });
-}
+export {};

package/dist/admin/browser/fetch-op.js

@@ -11,7 +11,7 @@ export function wireArgs(args) {
     }
     return out;
 }
-const noResult = (status) => ({ ok: false, code: "internal", message: `smoodly: the admin's endpoint answered ${status} without a result — see the server log.` });
+const noResult = (status) => ({ ok: false, code: "internal", message: `smoodly: the admin API answered ${status} without a result — see the server log.` });
 /** `fetcher` is the test seam. A network failure rejects; every answer resolves to a typed result.
  *  One operation at a time, in call order: Next queued server actions per browser, and the admin's reads
  *  and writes rely on it (a read sent after a save must see that save's token; a save typed during a
@@ -20,7 +20,8 @@ export function fetchOp(url, fetcher = fetch) {
     const send = async (call) => {
         const res = await fetcher(url, {
             method: "POST",
-            credentials: "same-origin",
+            // The endpoint is the service's origin; the session rides the header, no cookie crosses.
+            credentials: "omit",
             headers: { "content-type": "application/json", ...(call.token ? { authorization: `Bearer ${call.token}` } : {}) },
             body: JSON.stringify({ path: call.path, args: wireArgs(call.args) }),
         });

package/dist/admin/browser/main.js

@@ -4,15 +4,19 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // stylesheet into the document and mounts the shell. Bundled by scripts/build-admin.ts; no app compiles it.
 import { createRoot } from "react-dom/client";
 import { ADMIN_DATA_ID, ADMIN_ROOT_ID } from "../page-data.js";
-import { setPreviewBase } from "../editor/canvas-address.js";
+import { setCanvasMarks, setPreviewBase, setPreviewUrl } from "../editor/canvas-address.js";
 import { setDelivery } from "../delivery-mode.js";
 import { AdminApp } from "../shell/AdminApp.js";
+import { setConsole } from "../shell/console-links.js";
 import { fontFaceCss } from "../ui/fonts.js";
 import { ADMIN_CSS } from "../ui/theme.js";
 import { fetchOp } from "./fetch-op.js";
 const data = JSON.parse(document.getElementById(ADMIN_DATA_ID).textContent ?? "");
 setPreviewBase(data.previewBase ?? "");
+setCanvasMarks(data.canvasMarks ?? "query");
+setPreviewUrl(data.previewUrl ?? "");
 setDelivery(data.delivery ?? "live");
+setConsole(data.signIn.consoleUrl, data.spaceId);
 // One <style>, fonts first: the canvas copies this element's text into the site's frame (editor/useInlineSession.ts).
 const style = document.createElement("style");
 style.setAttribute("data-smoodly-admin-styles", "");
@@ -20,4 +24,4 @@ style.textContent = `${fontFaceCss(data.filesBase)}\n${ADMIN_CSS}`;
 document.head.appendChild(style);
 // The page's own background rules did their job (admin/page.ts): the stylesheet owns the look now.
 document.querySelector("style[data-smoodly-boot]")?.remove();
-createRoot(document.getElementById(ADMIN_ROOT_ID)).render(_jsx(AdminApp, { registry: data.registry, op: fetchOp(data.opUrl), auth: data.auth, presenceConfig: data.presence ?? undefined }));
+createRoot(document.getElementById(ADMIN_ROOT_ID)).render(_jsx(AdminApp, { registry: data.registry, op: fetchOp(data.opUrl), signIn: data.signIn, api: { apiUrl: data.apiUrl, spaceId: data.spaceId }, presenceConfig: data.presence ?? undefined }));

package/dist/admin/client-ops.d.ts

@@ -1,5 +1,6 @@
 import type { AdminOpAction, AdminOps } from "./ops.ts";
-/** `onExpired` runs when the server refuses the token outright (gateAdminOp's `expired`): the browser
- *  still holds a session the auth project no longer knows — after a database reset, a deleted user —
- *  and only a local sign-out brings the sign-in form back (2026-10-02). */
-export declare function makeClientOps(action: AdminOpAction, token?: () => string | null, onExpired?: () => void): AdminOps;
+/** `onExpired` runs when the service refuses the pass outright (`expired`: it expired, or its session ended). When it
+ *  answers true (the session renewed), the call is sent once more with the fresh pass; otherwise the refusal is
+ *  returned and the session's own path (a redirect to sign in) takes over (spec 2026-10-16 sign-in and the dashboard
+ *  §2). */
+export declare function makeClientOps(action: AdminOpAction, token?: () => string | null, onExpired?: () => Promise<boolean> | void): AdminOps;

package/dist/admin/client-ops.js

@@ -2,29 +2,32 @@ const GROUPS = {
     pages: ["list", "get", "create", "saveDraft", "publish", "unpublish", "discardDraft", "delete", "rename", "move", "setTemplate", "addLocale", "removeLocale", "listVersions", "restore"],
     entries: ["list", "distinct", "get", "create", "save", "setStatus", "discardDraft", "delete", "move", "addLocale", "removeLocale", "listVersions", "getVersion", "restore"],
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
-    assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
+    assets: ["list", "get", "update", "delete", "usage"],
     members: ["list", "me", "invite", "setRole", "remove"],
     redirects: ["list", "targets", "add", "remove"],
     health: ["scan"],
-    schema: ["status"],
     preview: ["enable", "disable"],
     deploy: ["status", "trigger"],
 };
-/** `onExpired` runs when the server refuses the token outright (gateAdminOp's `expired`): the browser
- *  still holds a session the auth project no longer knows — after a database reset, a deleted user —
- *  and only a local sign-out brings the sign-in form back (2026-10-02). */
+/** `onExpired` runs when the service refuses the pass outright (`expired`: it expired, or its session ended). When it
+ *  answers true (the session renewed), the call is sent once more with the fresh pass; otherwise the refusal is
+ *  returned and the session's own path (a redirect to sign in) takes over (spec 2026-10-16 sign-in and the dashboard
+ *  §2). */
 export function makeClientOps(action, token, onExpired) {
     const out = {};
+    const send = (path, args) => {
+        const t = token?.() ?? null;
+        return action({ path, args, ...(t ? { token: t } : {}) });
+    };
     for (const [group, methods] of Object.entries(GROUPS)) {
         out[group] = {};
         for (const method of methods) {
-            out[group][method] = (...args) => {
-                const t = token?.() ?? null;
-                return action({ path: `${group}.${method}`, args, ...(t ? { token: t } : {}) }).then((r) => {
-                    if (!r.ok && r.expired)
-                        onExpired?.();
+            out[group][method] = async (...args) => {
+                const path = `${group}.${method}`;
+                const r = await send(path, args);
+                if (r.ok || !r.expired)
                     return r;
-                });
+                return (await onExpired?.()) === true ? send(path, args) : r;
             };
         }
     }

package/dist/admin/delivery-mode.d.ts

@@ -1,5 +1,5 @@
 export declare function setDelivery(value: "live" | "static"): void;
 export declare const delivery: () => "live" | "static";
-/** A publish succeeded somewhere in the admin: the shell re-reads deploy.status. */
+/** A publish (or an unpublish) succeeded somewhere in the admin. */
 export declare function notePublished(): void;
 export declare function onPublished(listener: () => void): () => void;

package/dist/admin/delivery-mode.js

@@ -2,14 +2,14 @@
 // Which delivery mode the site runs (spec 2026-10-09 static mode §6): the server names it once, in the
 // page's data, and the shell shows the Deploy tile for a static site. Module state, set by the browser
 // entry before the shell mounts, like the preview base (editor/canvas-address.ts). The publish controls
-// tell the shell when a publish landed, so the tile's count refreshes at once.
+// tell the shell when a publish succeeded, so the Deploy tile re-reads.
 let mode = "live";
 const listeners = new Set();
 export function setDelivery(value) {
     mode = value;
 }
 export const delivery = () => mode;
-/** A publish succeeded somewhere in the admin: the shell re-reads deploy.status. */
+/** A publish (or an unpublish) succeeded somewhere in the admin. */
 export function notePublished() {
     for (const listener of listeners)
         listener();

package/dist/admin/drift.d.ts

@@ -27,8 +27,6 @@ export type Finding = {
     };
 };
 export declare const isBroken: (f: Finding) => boolean;
-/** The validator's empty: an empty value is `required`'s question, never drift's. */
-export declare const isEmptyValue: (v: unknown) => boolean;
 /** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind
  *  this list does not know fits (the custom section's `spans`, whose structure is rowsProblems'). */
 export declare function fits(d: {

package/dist/admin/drift.js

@@ -12,7 +12,7 @@ export const SEVERITY = {
 };
 export const isBroken = (f) => SEVERITY[f.kind] === "broken";
 /** The validator's empty: an empty value is `required`'s question, never drift's. */
-export const isEmptyValue = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && v.length === 0);
+const isEmptyValue = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && v.length === 0);
 const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const isStrings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 /** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind

package/dist/admin/editor/EditorView.d.ts

@@ -1,8 +1,5 @@
 import type { AdminOps } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
-export declare const withEditorParam: (url: string) => string;
-/** The site URL of a stored version — History's iframe (spec 2026-09-13 history §5); no editor parameter, so no bridge. */
-export declare const withVersionParam: (url: string, versionId: string) => string;
 export declare function EditorView({ ops, registry, id }: {
     ops: AdminOps;
     registry: AdminRegistry;

package/dist/admin/editor/EditorView.js

@@ -39,7 +39,8 @@ import { tabOf, tabsFor } from "../forms/tabs.js";
 import { InspectorFields, valueOf } from "./InspectorFields.js";
 import { allowedSections, canInsert, fillLockedZones, findNode, insertNode, moveNode, moveNodeTo, newNodeId, nodeFromSample, patchNode, patchNodeCss, patchNodePath, patchPage, placementNode, removeNode, zoneOf, clearZone, unsetNodePath, } from "../tree-ops.js";
 import { useDraftAutosave } from "./autosave.js";
-import { draftAddress } from "./canvas-address.js";
+import { canvasAddress, previewUrl, versionAddress } from "./canvas-address.js";
+import { enableDraft } from "./preview-grant.js";
 import { CanvasOverlay } from "./CanvasOverlay.js";
 import { InlineRichtext } from "./InlineRichtext.js";
 import { InsertPicker } from "./InsertPicker.js";
@@ -78,9 +79,6 @@ import { usePresence, usePresenceState, useSavedElsewhere, useTrackPresence } fr
 import { editorsOf } from "../shell/presence.js";
 import { PresenceLine } from "../ui/PresenceLine.js";
 import { Banner as BannerBox, Breadcrumb, Button, FieldErrorList, IconButton, LinkButton, SaveIndicator, Tabs, TopBar, } from "../ui/primitives.js";
-export const withEditorParam = (url) => (url.includes("?") ? `${url}&smoodly-editor=1` : `${url}?smoodly-editor=1`);
-/** The site URL of a stored version — History's iframe (spec 2026-09-13 history §5); no editor parameter, so no bridge. */
-export const withVersionParam = (url, versionId) => `${url}${url.includes("?") ? "&" : "?"}smoodly-version=${encodeURIComponent(versionId)}`;
 export function EditorView({ ops, registry, id }) {
     const adminHref = useAdminHref();
     const [record, setRecord] = useState(null);
@@ -200,7 +198,7 @@ export function EditorView({ ops, registry, id }) {
     const path = paths[locale] ?? "/";
     const label = path;
     const siteUrl = urls[locale] ?? path;
-    const iframeSrc = ready ? withEditorParam(draftAddress(siteUrl)) : null;
+    const iframeSrc = ready ? canvasAddress(siteUrl) : null;
     // Canvas-originated selection: the node is under the cursor already, so
     // this path deliberately skips the scroll every other selection does.
     // (`onCanvasSelect` is declared further down; the handler runs at event time.)
@@ -240,16 +238,9 @@ export function EditorView({ ops, registry, id }) {
             setTouched(false);
             setGlobalDirty(false);
             setGlobalTouched(false);
-            // ops is a fetch to the admin's endpoint — it can reject outright (offline,
-            // aborted), not just resolve to a typed error. Either failure mode
-            // must land on the same full-pane error, never a hung load.
-            let previewResult;
-            try {
-                previewResult = await ops.preview.enable();
-            }
-            catch {
-                previewResult = { ok: false, code: "internal", message: "Couldn't reach the server." };
-            }
+            // The service signs a grant, the site's preview route sets the cookie with it (preview-grant.ts).
+            // A rejected call and a refusal at either end land on the same full-pane error, never a hung load.
+            const previewResult = await enableDraft(() => ops.preview.enable(), previewUrl());
             if (cancelled)
                 return;
             if (!previewResult.ok) {
@@ -781,6 +772,8 @@ export function EditorView({ ops, registry, id }) {
         setGlobalBusy("publish");
         const r = await globalEdit.setStatus(name, "published");
         setGlobalBusy(null);
+        if (r.ok)
+            notePublished();
         if (!r.ok && !isStale(r))
             setBanner({ text: r.message, fields: r.fields }); // a stale refusal arrives through globalEdit.stale
     };
@@ -789,6 +782,8 @@ export function EditorView({ ops, registry, id }) {
         setGlobalBusy("unpublish");
         const r = await globalEdit.setStatus(name, "draft");
         setGlobalBusy(null);
+        if (r.ok)
+            notePublished();
         if (!r.ok)
             setBanner({ text: r.message, fields: r.fields });
     };
@@ -901,7 +896,7 @@ export function EditorView({ ops, registry, id }) {
                                 trailing: registry.locales.supported.length > 1 && (_jsx(LocaleSwitcher, { registry: registry, present: record ? registry.locales.supported.filter((l) => record.locales[l]) : [locale], parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => { void doAddLocale(l); } })),
                             },
                             { label },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(draftAddress(siteUrl), versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || diagnosis || crashedLines.length > 0) && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), diagnosis && _jsx(CanvasWarning, { cause: diagnosis.cause, path: diagnosis.path }), crashedLines.length > 0 && (_jsx(BannerBox, { tone: "warn", children: crashedLines.map((line, i) => _jsx("p", { children: line }, i)) }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error" || saveState === "refused") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsx(DriftNotice, { draft: findings, live: liveFindings }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: versionAddress(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || diagnosis || crashedLines.length > 0) && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), diagnosis && _jsx(CanvasWarning, { cause: diagnosis.cause, path: diagnosis.path }), crashedLines.length > 0 && (_jsx(BannerBox, { tone: "warn", children: crashedLines.map((line, i) => _jsx("p", { children: line }, i)) }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
                                     setSelectedId(null); }, children: _jsxs("div", { className: "sm-page", style: { overflow: "hidden" }, children: [iframeSrc ? (_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: "Page canvas", onLoad: onFrameLoad, style: { width: "100%", height: docH, border: 0, display: "block" } })) : (_jsx("div", { className: "sm-canvas__loading", children: "Loading canvas\u2026" })), _jsx(CanvasOverlay, { emptyZones: emptyZones, hoverRect: hoverRect, hoverGlobal: hoverGlobal, selection: selection, fieldHover: fieldHover, editing: editing, plusButtons: plusButtons, onPlus: (p, x, y) => setPicker({ zone: p.zone, index: p.index, x: x - 150, y: y + 12 }), onMove: doMove, onDuplicate: doDuplicate, onRemove: doRemove }), inline.richtext && (() => {
                                             const { session } = inline.richtext;
                                             const item = globalItemOf(session.node);

package/dist/admin/editor/FloatingToolbar.d.ts

@@ -1,7 +1,6 @@
 import type { ReactNode } from "react";
 import type { Allowed } from "../../toolset.ts";
 import { type ActiveState, type ToolbarCommand } from "../forms/RichtextToolbar.tsx";
-export declare const FLOATBAR_W = 340;
 export declare function FloatingToolbar({ x, top, bottom, pageWidth, allowed, active, canInsert, onCommand, popover }: {
     /** The caret's left, top and bottom in overlay coordinates. */
     x: number;

package/dist/admin/editor/FloatingToolbar.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { RichtextToolbar } from "../forms/RichtextToolbar.js";
-export const FLOATBAR_W = 340;
+const FLOATBAR_W = 340;
 const GAP = 10;
 const FLIP_AT = 56;
 export function FloatingToolbar({ x, top, bottom, pageWidth, allowed, active, canInsert, onCommand, popover }) {

package/dist/admin/editor/SeoSettings.d.ts

@@ -1,5 +1,3 @@
-export declare const SEO_TITLE_MAX = 60;
-export declare const SEO_DESCRIPTION_MAX = 160;
 export type SeoKey = "title" | "description" | "ogImage" | "noindex";
 export declare function SeoSettings({ meta, onPatch, titleHint, descriptionHint, imageHint }: {
     meta: Record<string, unknown>;

package/dist/admin/editor/SeoSettings.js

@@ -2,8 +2,8 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { MediaWidget } from "../forms/MediaWidget.js";
 import { Field, Switch } from "../ui/primitives.js";
-export const SEO_TITLE_MAX = 60;
-export const SEO_DESCRIPTION_MAX = 160;
+const SEO_TITLE_MAX = 60;
+const SEO_DESCRIPTION_MAX = 160;
 const str = (v) => (typeof v === "string" ? v : "");
 function Counter({ n, max }) {
     return _jsxs("span", { className: n > max ? "sm-counter--over" : undefined, children: [n, "/", max] });

package/dist/admin/editor/canvas-address.d.ts

@@ -1,2 +1,10 @@
 export declare function setPreviewBase(value: string): void;
 export declare const draftAddress: (siteUrl: string) => string;
+export declare function setCanvasMarks(value: "path" | "query"): void;
+/** The canvas: the draft with the editor bridge. */
+export declare const canvasAddress: (siteUrl: string) => string;
+/** History's frame (spec 2026-09-13 history §5): a stored version, no bridge. */
+export declare const versionAddress: (siteUrl: string, versionId: string) => string;
+/** The site's preview route, from the page data: where the grant goes. */
+export declare function setPreviewUrl(value: string): void;
+export declare function previewUrl(): string;

package/dist/admin/editor/canvas-address.js

@@ -1,8 +1,24 @@
 // Where a page's draft is loaded (DESIGN.md Vision, preview per framework): the server names a base once,
-// in the page's data, and the canvas and the History frame put it before the page's address. Module
-// state, set by the browser entry before the shell mounts: the admin is one script on one page.
+// in the page's data, and the canvas and the History frame put it before the page's address, and says how
+// they mark what they want: in the query, or in the path's last segment where the host strips the query
+// (Next on Vercel; canvas-marker.ts). Module state, set by the browser entry before the shell mounts: the
+// admin is one script on one page.
+import { markCanvasPath } from "../../canvas-marker.js";
 let base = "";
+let marks = "query";
 export function setPreviewBase(value) {
     base = value;
 }
 export const draftAddress = (siteUrl) => base + siteUrl;
+export function setCanvasMarks(value) {
+    marks = value;
+}
+const withQuery = (url, key, value) => `${url}${url.includes("?") ? "&" : "?"}${key}=${encodeURIComponent(value)}`;
+/** The canvas: the draft with the editor bridge. */
+export const canvasAddress = (siteUrl) => marks === "path" ? markCanvasPath(draftAddress(siteUrl), { editor: true }) : withQuery(draftAddress(siteUrl), "smoodly-editor", "1");
+/** History's frame (spec 2026-09-13 history §5): a stored version, no bridge. */
+export const versionAddress = (siteUrl, versionId) => marks === "path" ? markCanvasPath(draftAddress(siteUrl), { version: versionId }) : withQuery(draftAddress(siteUrl), "smoodly-version", versionId);
+let url = "";
+/** The site's preview route, from the page data: where the grant goes. */
+export function setPreviewUrl(value) { url = value; }
+export function previewUrl() { return url; }

package/dist/admin/editor/canvas-diagnosis.d.ts

@@ -42,6 +42,8 @@ export type CanvasCause = {
 export declare function probeOf(requested: string, res: Response): Promise<CanvasProbe>;
 /** The first matching cause, in the spec's order (§4). */
 export declare function diagnoseCanvas(probe: CanvasProbe): CanvasCause;
+/** The page's address from the canvas's: a path-marked canvas (canvas-marker.ts) without its last segment. */
+export declare const pagePathOf: (pathname: string) => string;
 /** The warning's two lines for a cause (§5, verbatim). */
 export declare function canvasMessage(cause: CanvasCause, path: string): {
     editor: string;

package/dist/admin/editor/canvas-diagnosis.js

@@ -37,10 +37,13 @@ export function diagnoseCanvas(probe) {
         return { kind: "framing", ...framing };
     return { kind: "script" };
 }
+/** The page's address from the canvas's: a path-marked canvas (canvas-marker.ts) without its last segment. */
+export const pagePathOf = (pathname) => pathname.replace(/\/(~|%7[Ee])editor$/, "") || "/";
 /** The redirect's end as a visitor would read it: path + search without the editor parameter, the full URL off-origin. */
 function redirectTarget(url, requested) {
     const u = new URL(url);
     u.searchParams.delete("smoodly-editor");
+    u.pathname = pagePathOf(u.pathname);
     return u.origin === new URL(requested).origin ? u.pathname + u.search : u.href;
 }
 /** The header that keeps the canvas iframe out, if any: X-Frame-Options DENY, or a frame-ancestors without the site's own origin. */

package/dist/admin/editor/inline-dom.d.ts

@@ -18,10 +18,6 @@ export declare const isPlainTextHost: (el: {
  *  refresh reconciles into it; else as new text content. False when the
  *  element is not a plain text host. */
 export declare function writeTextInto(el: TextHost, value: string): boolean;
-/** The container's layout the richtext editor root copies (spec §5), so a
- *  flex-column or grid container keeps its block spacing while its
- *  children are hidden behind the editor. Kebab-cased, for setProperty. */
-export declare const LAYOUT_PROPS: readonly ["display", "flex-direction", "gap", "row-gap", "column-gap", "grid-template-columns", "grid-auto-flow", "align-items", "justify-content"];
 export declare function layoutToCopy(computed: {
     getPropertyValue(name: string): string;
 }): Record<string, string>;

package/dist/admin/editor/inline-dom.js

@@ -25,7 +25,7 @@ export function writeTextInto(el, value) {
 /** The container's layout the richtext editor root copies (spec §5), so a
  *  flex-column or grid container keeps its block spacing while its
  *  children are hidden behind the editor. Kebab-cased, for setProperty. */
-export const LAYOUT_PROPS = [
+const LAYOUT_PROPS = [
     "display", "flex-direction", "gap", "row-gap", "column-gap",
     "grid-template-columns", "grid-auto-flow", "align-items", "justify-content",
 ];

package/dist/admin/editor/preview-grant.d.ts

@@ -0,0 +1,6 @@
+import type { OpResult, PreviewGrant } from "../ops.ts";
+export declare function postPreviewGrant(url: string, action: "enable" | "disable", grant: PreviewGrant, fetcher?: typeof fetch): Promise<OpResult<null>>;
+/** The editor's load: the operation, then the grant to the site. The operation is a fetch to the service
+ *  and can reject outright (offline, aborted), not just resolve to a typed error; both land on one typed
+ *  result. A null grant means the server set the cookie itself: nothing to post. */
+export declare function enableDraft(enable: () => Promise<OpResult<PreviewGrant | null>>, url: string, fetcher?: typeof fetch): Promise<OpResult<null>>;

package/dist/admin/editor/preview-grant.js

@@ -0,0 +1,25 @@
+export async function postPreviewGrant(url, action, grant, fetcher = fetch) {
+    try {
+        const res = await fetcher(url, { method: "POST", credentials: "same-origin", headers: { "content-type": "application/json" }, body: JSON.stringify({ action, grant }) });
+        const body = (await res.json());
+        return typeof body === "object" && body !== null && typeof body.ok === "boolean" ? body : { ok: false, code: "internal", message: `smoodly: the preview route answered ${res.status} without a result.` };
+    }
+    catch {
+        return { ok: false, code: "internal", message: "Couldn't reach the site's preview route." };
+    }
+}
+/** The editor's load: the operation, then the grant to the site. The operation is a fetch to the service
+ *  and can reject outright (offline, aborted), not just resolve to a typed error; both land on one typed
+ *  result. A null grant means the server set the cookie itself: nothing to post. */
+export async function enableDraft(enable, url, fetcher = fetch) {
+    let result;
+    try {
+        result = await enable();
+    }
+    catch {
+        return { ok: false, code: "internal", message: "Couldn't reach the server." };
+    }
+    if (!result.ok)
+        return result;
+    return result.data ? postPreviewGrant(url, "enable", result.data, fetcher) : { ok: true, data: null };
+}

package/dist/admin/editor/useCanvasDiagnosis.js

@@ -4,7 +4,7 @@
 // along and the server renders what the frame got — and name the cause.
 // A new src, or the bridge speaking after all, drops the answer.
 import { useEffect, useState } from "react";
-import { diagnoseCanvas, probeOf } from "./canvas-diagnosis.js";
+import { diagnoseCanvas, pagePathOf, probeOf } from "./canvas-diagnosis.js";
 export function useCanvasDiagnosis(iframeSrc, geometry) {
     const [diagnosis, setDiagnosis] = useState(null);
     useEffect(() => {
@@ -17,7 +17,7 @@ export function useCanvasDiagnosis(iframeSrc, geometry) {
             .then((res) => probeOf(requested.href, res))
             .catch(() => ({ kind: "failed" }))
             .then((probe) => { if (live)
-            setDiagnosis({ cause: diagnoseCanvas(probe), path: requested.pathname }); });
+            setDiagnosis({ cause: diagnoseCanvas(probe), path: pagePathOf(requested.pathname) }); });
         return () => { live = false; };
     }, [iframeSrc, geometry]);
     return diagnosis;