smoodly 0.0.51 → 0.0.53

package/dist/resolve.js

@@ -7,7 +7,7 @@
 // chain gets a shallow copy (refs as ids), so traversal terminates by
 // construction and the output stays JSON-serializable.
 import { globalLink, GLOBAL_NODE_TYPE, SETTINGS_KEY, STYLES_KEY, CSS_KEY } from "./global.js";
-import { applyAssets, collectAssetIds } from "./media.js";
+import { applyAssets, collectAssetIds, signCuts } from "./media.js";
 import { elementSchemas } from "./richtext-walk.js";
 import { SEO_KEY } from "./seo.js";
 import { CUSTOM_NODE_TYPE, customSchema, customToolset } from "./custom/index.js";
@@ -62,7 +62,7 @@ export async function resolveTree(tree, options) {
             sets.push({ values: resolved.fields, descriptors: options.page.fields });
         if (resolved.meta)
             sets.push({ values: resolved.meta, descriptors: META_DESCRIPTORS });
-        await resolveMediaSets([...sets, ...hydrated], options.assets, elementSchemas(options.elements));
+        await resolveMediaSets([...sets, ...hydrated], options.assets, elementSchemas(options.elements), options.signer, options.images);
     }
     return resolved;
 }
@@ -83,19 +83,22 @@ async function fetchAssets(fetch, ids) {
     return out;
 }
 /** One value set's media, resolved in place. Exported for the site layer's global-item settings. */
-export async function resolveMedia(values, descriptors, fetch, elements = {}) {
-    await resolveMediaSets([{ values, descriptors }], fetch, elements);
+export async function resolveMedia(values, descriptors, fetch, elements = {}, signer, defaults) {
+    await resolveMediaSets([{ values, descriptors }], fetch, elements, signer, defaults);
 }
 /** Many value sets, one asset round (plus one for posters): the tree's
  *  nodes and every entry hydrated through a ref, or a list page's items.
  *  Exported for the site layer's content API. */
-export async function resolveMediaSets(sets, fetch, elements = {}) {
+async function resolveMediaSets(sets, fetch, elements = {}, signer, defaults) {
     const ids = new Set();
     for (const { values, descriptors } of sets)
         collectAssetIds(values, descriptors, ids, elements);
     const assets = await fetchAssets(fetch, ids);
+    const cuts = signer ? [] : undefined;
     for (const { values, descriptors } of sets)
-        applyAssets(values, descriptors, assets, elements);
+        applyAssets(values, descriptors, assets, elements, cuts, defaults);
+    if (signer && cuts)
+        await signCuts(cuts, signer);
 }
 /** Placements first (spec 2026-09-07 §4): fetch every linked item in one
  *  call per item, rewrite each node into the item's section node — the
@@ -148,7 +151,7 @@ export async function resolveFields(fields, descriptors, options) {
     collectTasks(resolved, descriptors, tasks);
     const hydrated = await runResolution(tasks, { ...options, maxDepth: options.maxDepth ?? Infinity });
     if (options.assets)
-        await resolveMediaSets([{ values: resolved, descriptors }, ...hydrated], options.assets, elementSchemas(options.elements));
+        await resolveMediaSets([{ values: resolved, descriptors }, ...hydrated], options.assets, elementSchemas(options.elements), options.signer, options.images);
     return resolved;
 }
 /** Many value sets (a list's entries), one resolution: every ref batched per
@@ -159,7 +162,7 @@ export async function resolveFieldSets(sets, options) {
         collectTasks(values, descriptors, tasks);
     const hydrated = await runResolution(tasks, { ...options, maxDepth: options.maxDepth ?? Infinity });
     if (options.assets)
-        await resolveMediaSets([...sets, ...hydrated], options.assets, elementSchemas(options.elements));
+        await resolveMediaSets([...sets, ...hydrated], options.assets, elementSchemas(options.elements), options.signer, options.images);
 }
 /** Hydrates every task's refs in place and returns each hydrated entry
  *  copy with its collection's descriptors — the media pass walks those

package/dist/revalidate.d.ts

@@ -21,8 +21,15 @@ export declare const collectionTag: (name: string) => string;
 /** Every address that may begin or stop resolving: a miss, a redirect and a code-owned page cache
  *  under it on Next (reads.ts `missUnit`), since Next caches a 404 like a hit (plan 2026-10-09 next
  *  cached routes, decision 4). Fired by every page op that fires the tree tag, every entry write and
- *  every redirect change (admin/ops-impl.ts). */
+ *  every redirect change (the service's ops/ops-impl.ts). */
 export declare const addressesTag: () => string;
+/** Every published response of a space carries it (spec 2026-10-16 the control plane §4): a push that changed the
+ *  registry purges this one tag, and the new schema applies on the next read. */
+export declare const spaceTag: (space: string) => string;
+/** An asset's original and every cut of it at the edge (spec 2026-10-18 media on R2 and Images §5): its delete purges it. */
+export declare const mediaTag: (asset: string) => string;
+/** Every media file of a space at the edge: the space's delete purges it. Never a content tag, so a publish purges no bytes. */
+export declare const mediaSpaceTag: (space: string) => string;
 export declare function affectedTargets(stores: {
     pages: PageStore;
     entries: EntryStore;

package/dist/revalidate.js

@@ -20,8 +20,15 @@ export const collectionTag = (name) => `entries:${name}`;
 /** Every address that may begin or stop resolving: a miss, a redirect and a code-owned page cache
  *  under it on Next (reads.ts `missUnit`), since Next caches a 404 like a hit (plan 2026-10-09 next
  *  cached routes, decision 4). Fired by every page op that fires the tree tag, every entry write and
- *  every redirect change (admin/ops-impl.ts). */
+ *  every redirect change (the service's ops/ops-impl.ts). */
 export const addressesTag = () => "addresses";
+/** Every published response of a space carries it (spec 2026-10-16 the control plane §4): a push that changed the
+ *  registry purges this one tag, and the new schema applies on the next read. */
+export const spaceTag = (space) => `space:${space}`;
+/** An asset's original and every cut of it at the edge (spec 2026-10-18 media on R2 and Images §5): its delete purges it. */
+export const mediaTag = (asset) => `media:${asset}`;
+/** Every media file of a space at the edge: the space's delete purges it. Never a content tag, so a publish purges no bytes. */
+export const mediaSpaceTag = (space) => `media-space:${space}`;
 export async function affectedTargets(stores, entryId, options = {}) {
     const maxDepth = options.maxDepth ?? Infinity;
     const seen = new Set([entryId]);

package/dist/richtext/index.d.ts

@@ -3,7 +3,7 @@ import { type RichTextElement } from "../richtext-render.tsx";
 export type CreateRichTextOptions = {
     /** The registered Elements a body may embed. */
     elements?: RichTextElement[];
-    /** next/image `sizes` for body images; the site's text column width. */
+    /** `sizes` for body images; the site's text column width. */
     sizes?: string;
 };
 /** The bound renderer; `elements` is the list it renders, which defineViews checks against the config's richtext elements. */

package/dist/section-wrapper.d.ts

@@ -1,7 +1,7 @@
 import type { CSSProperties, ReactNode } from "react";
 import { type StyleProps } from "./styles.ts";
 import { SMD_KEY, type SmdInternal } from "./smd-key.ts";
-export { SMD_KEY, type SmdInternal };
+export { type SmdInternal };
 export declare function Section({ as, styles, className, style, children, ...rest }: {
     as?: keyof React.JSX.IntrinsicElements;
     styles: StyleProps & {

package/dist/section-wrapper.js

@@ -3,15 +3,6 @@ import { NODE_ATTR } from "./marks.js";
 import { DEFAULT_STYLE_VALUES, inlineStyles } from "./styles.js";
 import { safeCss, scopedCss } from "./css.js";
 import { SMD_KEY } from "./smd-key.js";
-// The root wrapper every section renders through (spec 2026-09-14 §2, §4).
-// Owns the real root element, no extra div: element choice via `as`,
-// Smoodly's styles set rendered INLINE (an editor's step beats the
-// section's own class rule with no ordering and no !important), the
-// node id as data-smd-node always (the custom-CSS scope needs it on the
-// live site), the scoped <style> child, and every other prop spread onto
-// the root — settings never become attributes; the view writes its own.
-// The reserved key lives in smd-key.ts (pure), re-exported here.
-export { SMD_KEY };
 export function Section({ as = "section", styles, className, style, children, ...rest }) {
     const { [SMD_KEY]: smd, ...steps } = (styles ?? {});
     const inline = inlineStyles(steps, smd?.values ?? DEFAULT_STYLE_VALUES);

package/dist/signed-message.d.ts

@@ -0,0 +1,26 @@
+export declare const MESSAGE_MAX_AGE_MS = 60000;
+/** The service's private key, with the id the site finds its public half by. */
+export type SigningKey = {
+    kid: string;
+    privateKey: JsonWebKey;
+};
+export type PublicKey = {
+    kid: string;
+    publicKey: JsonWebKey;
+};
+export type Signed = {
+    ts: number;
+    kid: string;
+    sig: string;
+};
+/** The public keys a site trusts; `refresh` asks for the published set again (an unknown key id after a rotation). */
+export type KeySet = (refresh?: boolean) => Promise<PublicKey[]>;
+/** A new keypair. The key id defaults to 8 hex characters of the public key's SHA-256. */
+export declare function generateSigningKey(kid?: string): Promise<SigningKey & PublicKey>;
+/** The public half of a signing key: the private JWK carries it as `x`. Never the `d` member. */
+export declare function publicOf(key: SigningKey): PublicKey;
+export declare function signMessage(key: SigningKey, purpose: string, space: string, body: string, now?: number): Promise<Signed>;
+/** True when a key of the set signed this purpose, space and body within the window. An unknown key id asks the set
+ *  once more (a rotation published a new key); a bad shape is false, never a throw. */
+export declare function verifyMessage(keys: KeySet, purpose: string, space: string, body: string, signed: Signed, now?: number, maxAgeMs?: number): Promise<boolean>;
+export declare function fetchedKeySet(apiUrl: string, doFetch?: typeof fetch, now?: () => number): KeySet;

package/dist/signed-message.js

@@ -0,0 +1,103 @@
+// A message the service signs for the site (spec 2026-10-16 the control plane §2): the service telling the site which
+// tags to expire, the service granting the browser a draft cookie. The service signs with its own Ed25519 key; the
+// site verifies with the public keys it fetches once from Smoodly's API, so no secret is shared between them. The
+// message names its purpose, the key, the time and the space: the window keeps a captured message from being
+// replayed later, the purpose keeps one kind from being replayed as another, and the space keeps one site's message
+// from being accepted by another. The draft cookie is not one of these: the site makes and reads it alone, an HMAC
+// under its own secret key. WebCrypto, so it runs in a Worker, in Node and in a Next route handler alike.
+export const MESSAGE_MAX_AGE_MS = 60000;
+const ED25519 = { name: "Ed25519" };
+const encoder = new TextEncoder();
+const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function fromBase64url(text) {
+    if (!/^[A-Za-z0-9_-]*$/.test(text))
+        return null;
+    try {
+        const raw = atob(text.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - (text.length % 4)) % 4));
+        return Uint8Array.from(raw, (c) => c.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+/** The bare OKP members of a key. Runtimes disagree on `alg` (newer Node writes "Ed25519", workerd refuses it and
+ *  wants "EdDSA" or none) and on `key_ops`/`ext`, so a key is written, published and imported with none of them. */
+const bare = (jwk) => ({ kty: "OKP", crv: "Ed25519", x: jwk.x, ...(jwk.d ? { d: jwk.d } : {}) });
+const message = (purpose, kid, ts, space, body) => `${purpose}\n${kid}\n${ts}\n${space}\n${body}`;
+/** A new keypair. The key id defaults to 8 hex characters of the public key's SHA-256. */
+export async function generateSigningKey(kid) {
+    const pair = (await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]));
+    const privateKey = (await crypto.subtle.exportKey("jwk", pair.privateKey));
+    const publicKey = (await crypto.subtle.exportKey("jwk", pair.publicKey));
+    const id = kid ?? Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(publicKey.x))).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+    return { kid: id, privateKey: bare(privateKey), publicKey: bare(publicKey) };
+}
+/** The public half of a signing key: the private JWK carries it as `x`. Never the `d` member. */
+export function publicOf(key) {
+    return { kid: key.kid, publicKey: bare({ x: key.privateKey.x }) };
+}
+export async function signMessage(key, purpose, space, body, now = Date.now()) {
+    if (!key?.privateKey?.d)
+        throw new Error("smoodly: signing needs SMOODLY_SIGNING_KEY.");
+    const privateKey = await crypto.subtle.importKey("jwk", bare(key.privateKey), ED25519, false, ["sign"]);
+    const sig = new Uint8Array(await crypto.subtle.sign(ED25519, privateKey, encoder.encode(message(purpose, key.kid, now, space, body))));
+    return { ts: now, kid: key.kid, sig: base64url(sig) };
+}
+/** True when a key of the set signed this purpose, space and body within the window. An unknown key id asks the set
+ *  once more (a rotation published a new key); a bad shape is false, never a throw. */
+export async function verifyMessage(keys, purpose, space, body, signed, now = Date.now(), maxAgeMs = MESSAGE_MAX_AGE_MS) {
+    const { ts, kid, sig } = signed ?? {};
+    if (!Number.isFinite(ts) || typeof kid !== "string" || !kid || typeof sig !== "string")
+        return false;
+    if (Math.abs(now - ts) > maxAgeMs)
+        return false;
+    const bytes = fromBase64url(sig);
+    if (!bytes || bytes.length !== 64)
+        return false;
+    const found = (await keys()).find((k) => k.kid === kid) ?? (await keys(true)).find((k) => k.kid === kid);
+    if (!found)
+        return false;
+    try {
+        const publicKey = await crypto.subtle.importKey("jwk", bare(found.publicKey), ED25519, false, ["verify"]);
+        return await crypto.subtle.verify(ED25519, publicKey, bytes, encoder.encode(message(purpose, kid, ts, space, body)));
+    }
+    catch {
+        return false;
+    }
+}
+/** The service's published keys (`GET /v1/signing-keys`), fetched on the first verify and kept for the process. A
+ *  refresh (an unknown key id) fetches again at most once a minute, and concurrent asks share one fetch: the key id
+ *  comes from an unauthenticated caller, who must not be able to make the site call the API per request. A failed
+ *  fetch keeps what it had. */
+const KEY_REFRESH_MS = 60000;
+export function fetchedKeySet(apiUrl, doFetch = fetch, now = Date.now) {
+    let held = null;
+    let inflight = null;
+    let refreshedAt = -Infinity;
+    const load = () => (inflight ?? (inflight = (async () => {
+        try {
+            const res = await doFetch(`${apiUrl.replace(/\/+$/, "")}/v1/signing-keys`);
+            const body = (await res.json());
+            if (res.ok && Array.isArray(body.keys))
+                held = body.keys;
+        }
+        catch (e) {
+            console.error(`smoodly: fetching the service's signing keys from ${apiUrl} failed —`, e instanceof Error ? e.message : e);
+        }
+        finally {
+            inflight = null;
+        }
+        // A first fetch that failed still counts as loaded: the next one waits for a refresh's minute.
+        return (held ?? (held = []));
+    })()));
+    return async (refresh = false) => {
+        if (inflight)
+            return inflight;
+        if (!held)
+            return load();
+        if (!refresh || now() - refreshedAt < KEY_REFRESH_MS)
+            return held;
+        refreshedAt = now();
+        return load();
+    };
+}

package/dist/site.d.ts

@@ -1,8 +1,10 @@
 import type { AssetStore } from "./asset-store.ts";
+import type { CutSigner } from "./media-cut.ts";
+import type { ImageDefaults } from "./media.ts";
 import type { CollectionSchema, EntryOrder } from "./collections.ts";
 import type { Descriptor } from "./fields.ts";
-import { type EntryRecord, type EntryStore, type Where } from "./entry-store.ts";
-import { type LocaleAlternate, type LocaleSet, type PageAlternate, type PathTarget } from "./paths.ts";
+import type { EntryRecord, EntryStore, Where } from "./entry-store.ts";
+import type { LocaleAlternate, LocaleSet, PageAlternate, PathTarget } from "./paths.ts";
 import type { SectionLike } from "./refs.ts";
 import type { PageContext, PageLink, PageTree } from "./page-context.ts";
 import type { GlobalSchema } from "./global.ts";
@@ -10,8 +12,9 @@ import type { StyleValues, StyleValuesInput } from "./styles.ts";
 import type { CustomConfigInput, ResolvedCustom } from "./custom/index.ts";
 import type { PageRecord, PageStore } from "./store.ts";
 import type { PathHit } from "./path-index.ts";
-import { type EntryItem, type PageItem, type Seo } from "./read-shapes.ts";
+import type { EntryItem, PageItem, Seo } from "./read-shapes.ts";
 import type { SchemaOr } from "./registration.ts";
+import type { ResolvedConfig } from "./config.ts";
 /** An address read with its layout's globals: the hit as `lookup` answers it, and each item's value by name. */
 export type AddressWithGlobals = {
     hit: SiteHit | {
@@ -20,15 +23,11 @@ export type AddressWithGlobals = {
     } | null;
     globals: Map<string, unknown>;
 };
-import type { PublishedStore } from "./published.ts";
-import { type Projector } from "./project.ts";
 export type SiteOptions = {
-    /** `published`: the delivery documents outside draft mode read (spec 2026-10-07 delivery model §3). */
     stores: () => {
         pages: PageStore;
         entries: EntryStore;
         assets?: AssetStore;
-        published: PublishedStore;
     };
     collections: CollectionSchema<any>[];
     sections: SectionLike[];
@@ -45,6 +44,10 @@ export type SiteOptions = {
      *  and of the fixed pages' addresses (spec 2026-09-29 nested paths §3) — `config.registry.pages`. Required: a site that
      *  missed one would take its code-owned record for an orphan and drop its URLs at the first lookup. */
     pages: ReadonlyArray<SchemaOr<SitePageSchema>>;
+    /** Signs every image's cut where the service cuts (spec 2026-10-18 media on R2 and Images §5); absent, reads carry no cut. */
+    signer?: CutSigner;
+    /** The project's image quality and srcset cap, `config.media`'s (spec 2026-10-18 image quality and max width §6). */
+    images?: ImageDefaults;
 };
 /** A page type as the site needs it: its page fields, and a fixed page's address. */
 export type SitePageSchema = {
@@ -73,6 +76,9 @@ export type SitePage = {
     locales: Record<string, PageAlternate | null>;
     /** The effective SEO values, for a template with `seo: true` (spec 2026-09-29 content API contract §7). */
     seo?: Seo;
+    /** The tags of every record this read touched (spec 2026-10-15 the space object §4): its own, every entry its tree
+     *  resolved at any depth, its ancestors and children. Absent on a draft read. */
+    tags?: string[];
 };
 export type SiteEntry = {
     kind: "entry";
@@ -87,6 +93,8 @@ export type SiteEntry = {
     locales: Record<string, LocaleAlternate | null>;
     /** The effective SEO values, for a collection with `seo` (§7). */
     seo?: Seo;
+    /** The tags of every record this read touched: its own and every entry it resolved. Absent on a draft read. */
+    tags?: string[];
 };
 export type SiteHit = SitePage | SiteEntry;
 export type PageTreeItem = {
@@ -116,14 +124,14 @@ export type LoadOptions = {
     draft?: boolean;
     version?: string;
 };
-export interface SmoodlySite {
+/** The read face of a site (spec 2026-10-14 §1): what the read layer, the shells and the renderer use. The service's
+ *  own site (createSmoodlySite, the stores underneath) and the API client (api-client.ts, HTTP) both implement it. */
+export interface ContentReads {
     readonly locales: LocaleSet;
     readonly homePageSlug: string;
     /** The package version and a hash of the registered model: a part of every cache key, so an upgrade or a
      *  model change never serves a unit cached in the old shape (spec 2026-09-30 tester findings §3). */
     readonly cacheKey: string;
-    /** The document stamp a delivery row carries (DESIGN §3): the format number and the model hash, never the version. */
-    readonly stamp: string;
     /** The resolved styles values the renderer and `getGlobal` hand the wrapper. */
     readonly styles: StyleValues;
     /** The custom section's resolved options the renderer hands renderPage. */
@@ -134,18 +142,15 @@ export interface SmoodlySite {
     targetPaths(target: PathTarget): Promise<Record<string, string>>;
     /** Everything the renderer needs for one target: null when it is a folder, unpublished (outside draft), or gone. */
     load(target: PathTarget, locale: string, path: string, options?: LoadOptions): Promise<SiteHit | null>;
-    resolve(locale: string, path: string, options?: LoadOptions): Promise<SiteHit | null>;
-    /** The published read of an address (spec 2026-10-07 delivery model §3): one lookup of the stored document; on a miss
-     *  the code-owned page, then one locate that tells a redirect row from a record to assemble and from a 404. */
+    /** The published read of an address: one locate that tells a record to assemble from a redirect row, and the
+     *  code-owned page where the index has no row. */
     lookup(locale: string, path: string): Promise<SiteHit | {
         kind: "redirect";
         target: PathTarget;
     } | null>;
-    /** The same lookup with the layout's global items riding along (schema v9): one store call answers the page and
-     *  each item's value by name, a row behind the model healed as `getGlobal` heals it. A miss brings no globals. */
+    /** The same lookup with the layout's global items riding along: the page and each published item's value by name.
+     *  A miss and a redirect bring no globals. */
     lookupWithGlobals(locale: string, path: string, items: readonly GlobalSchema<any>[]): Promise<AddressWithGlobals>;
-    /** Writes delivery rows from the editing tables: Publish calls it, and heal on read goes through it. */
-    readonly projector: Projector;
     /** A fixed page type (or a collection's index page) as code alone describes it, when `path` is its address in
      *  `locale`: an empty tree, the page fields' defaults, the registration's title. The renderer serves it where
      *  the index has no row — a page type added after install, a locale added to the config — until the admin
@@ -176,7 +181,43 @@ export interface SmoodlySite {
         draft?: boolean;
     }): Promise<V | null>;
 }
+/** What a static build and the Deploy tile read (spec 2026-10-09 static mode §3, §5), over the API. Paths are
+ *  locale-relative CMS paths; the adapter applies `href`. */
+export interface DeliveryReads {
+    addresses(locale: string): Promise<{
+        pages: string[];
+        entries: string[];
+        redirects: {
+            from: string;
+            to: string;
+        }[];
+    }>;
+    newestPublishedAt(): Promise<number | null>;
+}
 /** The `page` prop for a loaded page. `href` is the app's seam from a
  *  locale-relative path to a site URL; the default keeps CMS paths as URLs. */
 export declare function pageContextOf(hit: SitePage, href?: (path: string, locale: string) => string): PageContext;
-export declare function createSmoodlySite(options: SiteOptions): SmoodlySite;
+/** The members of a site that need no store (the API client computes them from the same config, so a cache key or a
+ *  code page never disagrees across the wire). */
+export declare function siteStatics(options: Omit<SiteOptions, "stores">): {
+    shape: {
+        locales: LocaleSet;
+        pageSchemas: SitePageSchema[];
+        homePageSlug: string;
+        styles: StyleValues;
+        custom: ResolvedCustom;
+        elements: import("./richtext-walk.ts").ElementSchemas;
+        codeOwned: import("./addresses.ts").CodeAddress[];
+        addresses: import("./addresses.ts").Addresses;
+        pathOpts: import("./paths.ts").PagePathOptions;
+        anchors: import("./anchors.ts").Anchors;
+    };
+    locales: LocaleSet;
+    homePageSlug: string;
+    styles: StyleValues;
+    custom: ResolvedCustom;
+    cacheKey: string;
+    codePage: (locale: string, path: string) => SitePage | null;
+};
+/** What createSmoodlySite takes, read off the config. */
+export declare function siteOptions(config: ResolvedConfig, stores?: SiteOptions["stores"]): SiteOptions;