smoodly 0.0.51 → 0.0.53

package/dist/admin/ops-impl.js

@@ -1,1403 +0,0 @@
-import { entryErrors, entryFieldsIn, entryTitleIn } from "../entry-store.js";
-import { chainOf, isSegment, pagePathIn, slugify } from "../paths.js";
-import { servedAnchor } from "../anchors.js";
-import { canonicalTags, distinctTags } from "../tags.js";
-import { can, isMemberRole, normalizeRole } from "../permissions.js";
-import { ASSET_COLLECTION } from "../media.js";
-import { adminHref, adminSlugTaken, isAdminSlug } from "../admin-path.js";
-import { addressesTag, affectedTargets, collectionTag, entryTag, pageTag, pagesTreeTag, globalTag } from "../revalidate.js";
-import { ensureFixedNodes, fixedNodeOf, fixedNodeSpecs } from "./fixed-nodes.js";
-import { ensureGlobalItems } from "./global-items.js";
-import { SLUG_GRAMMAR_MESSAGE, validateCustomNode, validateFields, validateNode } from "./validate.js";
-import { serializeAdminConfig } from "./serialize.js";
-import { entryDrift, pageDrift } from "./drift.js";
-import { publishErrors } from "./drift-copy.js";
-import { buildHealthReport } from "./health.js";
-import { CUSTOM_NODE_TYPE, customSchema } from "../custom/index.js";
-import { SETTINGS_KEY, CSS_KEY } from "../global.js";
-import { withDefaults } from "../field-defaults.js";
-import { elementSchemas } from "../richtext-walk.js";
-import { deployState, parseMarker, MARKER_PATH } from "../deploy-state.js";
-import { REDIRECT_PATH_MESSAGE, normalizeRedirectPath, redirectPathProblem } from "./redirect-path.js";
-import { SCHEMA_VERSION } from "../schema-version.js";
-import { draftToken, isDraftToken, StaleDraftError } from "../draft-token.js";
-const ok = (data) => ({ ok: true, data });
-/** A history row without its content (spec 2026-09-13 history §6). */
-const summary = ({ id, savedAt }) => ({ id, savedAt });
-const err = (code, message, fields) => ({ ok: false, code, message, ...(fields ? { fields } : {}) });
-/** The client's token is untrusted data: undefined skips, null is "no draft", the shape is the token, anything else is refused. */
-const BAD_TOKEN = Symbol("bad token");
-const tokenArg = (v) => v === undefined ? undefined : v === null ? null : isDraftToken(v) ? v : BAD_TOKEN;
-const badToken = () => err("validation", "smoodly: malformed draft token.");
-/** Own-property, non-array plain object — same shape guard the tree checks
- * below and `runAdminOp`'s envelope check both lean on. */
-const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-/** A client-submitted tree is untyped data until proven otherwise — a
- * malformed shape here would corrupt the stored draft and crash every
- * later reader (canvas, publish-integrity walk). Structural only: does
- * not validate per-section field schemas (that's publish's job). */
-function isPageTree(tree) {
-    if (!isPlainObject(tree) || !isPlainObject(tree.zones))
-        return false;
-    if (tree.meta !== undefined && !isPlainObject(tree.meta))
-        return false;
-    for (const nodes of Object.values(tree.zones)) {
-        if (!Array.isArray(nodes))
-            return false;
-        for (const node of nodes) {
-            if (!isPlainObject(node))
-                return false;
-            if (typeof node.id !== "string" || typeof node.type !== "string")
-                return false;
-        }
-    }
-    return true;
-}
-/** Store throws are stringly-typed; classify the known guards, default to internal. */
-const classify = (e) => {
-    // The guard's refusal (spec 2026-09-26 concurrency §2): typed, so it never depends on message matching.
-    if (e instanceof StaleDraftError)
-        return { ok: false, code: "conflict", stale: true, by: e.by, at: e.at, message: e.message };
-    const message = e instanceof Error ? e.message : String(e);
-    if (message.includes("already exists in locale"))
-        return err("conflict", message);
-    if (message.includes("not a supported locale"))
-        return err("validation", message);
-    if (message.includes("add it there first") ||
-        message.includes("remove it from") ||
-        message.includes("at least one locale") ||
-        message.includes("cannot move under it")) {
-        return err("blocked", message);
-    }
-    if (message.includes("does not exist in locale"))
-        return err("not_found", message);
-    if (message.includes("cannot take a slug"))
-        return err("validation", message);
-    if (message.includes("is a live address"))
-        return err("validation", message);
-    // Ahead of the generic "already exists" check below: the singleton
-    // refusal's message ("...already exists — it is a singleton.") contains
-    // "already exists" as a substring, so it must classify here first or it
-    // would be misread as a plain conflict.
-    if (message.includes("is owned by code") || message.includes("it is a singleton") || message.includes("exists in every locale")) {
-        return err("blocked", message);
-    }
-    if (message.includes("already exists"))
-        return err("conflict", message);
-    if (message.includes("is referenced by"))
-        return err("blocked", message);
-    if (message.includes("cannot publish"))
-        return err("blocked", message);
-    if (message.includes("nothing published"))
-        return err("blocked", message);
-    if (message.includes("already taken"))
-        return err("conflict", message);
-    if (message.includes("already has a page type"))
-        return err("conflict", message);
-    if (message.includes("exceed the tree depth") || message.includes("has child"))
-        return err("blocked", message);
-    // The tree guards: editing a folder as a page, moving a node into its
-    // own subtree, and the home page's no-children invariant.
-    if (message.includes("is a path") ||
-        message.includes("cannot be moved under itself") ||
-        message.includes("cannot have child pages")) {
-        return err("blocked", message);
-    }
-    if (message.includes("must be in the same collection"))
-        return err("validation", message);
-    if (message.includes("not a valid slug"))
-        return err("validation", message);
-    if (message.includes("no page") || message.includes("no entry") || message.includes("no collection") || message.includes("no asset") || message.includes("no member"))
-        return err("not_found", message);
-    if (message.includes("not pending"))
-        return err("conflict", message);
-    return err("internal", message);
-};
-/** A new entry without a slug gets one from the field `f.slug({ from })` follows, as the admin's form
- *  fills it (spec 2026-09-28 ASCII slugs §5), so a script needs no slug of its own. A given slug stays. */
-function followSlug(fields, descriptors) {
-    const d = descriptors.slug;
-    if (d?.type !== "slug" || d.from === undefined)
-        return fields;
-    if (typeof fields.slug === "string" && fields.slug !== "")
-        return fields;
-    const source = fields[d.from];
-    const slug = typeof source === "string" ? slugify(source) : "";
-    return slug === "" ? fields : { ...fields, slug };
-}
-export function createAdminOps(deps) {
-    const { config, pages, entries, effects, projector } = deps;
-    const href = deps.href ?? ((path) => path);
-    const by = deps.actor?.email ?? undefined;
-    const collectionFields = (name) => config.registry.collections?.find((c) => c.name === name)?.fields ?? null;
-    /** The distinct tags a field holds across the collection: a localized field reads `locale`'s rows, a shared one every entry. */
-    const tagsIn = (records, field, localized, locale, except) => distinctTags(localized
-        ? records.flatMap((r) => (r.id !== except && r.locales[locale] ? [r.locales[locale].fields[field]] : []))
-        : records.flatMap((r) => (r.id !== except ? [r.fields[field]] : [])));
-    /** Every f.tags() value takes the collection's existing spelling (spec 2026-09-30 tester findings §5).
-     *  `except` is the entry being saved: its own old spelling is not a precedent. */
-    async function foldTags(collection, locale, fields, descriptors, except) {
-        const tagKeys = Object.entries(descriptors).filter(([key, d]) => d.type === "tags" && Array.isArray(fields[key]));
-        if (tagKeys.length === 0)
-            return fields;
-        const records = await entries.list(collection);
-        const out = { ...fields };
-        for (const [key, d] of tagKeys) {
-            out[key] = canonicalTags(out[key], tagsIn(records, key, d.localized === true, locale, except));
-        }
-        return out;
-    }
-    // Element nodes inside richtext validate against these (spec 2026-09-08 block nodes §2).
-    // The serialized registry drift walks (spec 2026-09-27 editor safety §2) — the admin client's shape.
-    let adminRegistryMemo = null;
-    const adminRegistry = () => (adminRegistryMemo ?? (adminRegistryMemo = serializeAdminConfig(config)));
-    const elementDescs = elementSchemas(config.registry.elements.map((e) => ({ name: e.name, fields: e.fields ?? {}, settings: e.settings })));
-    // The custom section (spec 2026-09-14 §6) validates like a section, over its own schema.
-    const sectionFields = (type) => (type === CUSTOM_NODE_TYPE ? customSchema(config.custom.toolset) : config.registry.sections.find((s) => s.name === type));
-    const globalItem = (name) => config.registry.globals?.find((s) => s.name === name) ?? null;
-    /** One row per registration; null when materialization could not create it. */
-    const globalRecord = async (name) => (await entries.list(name))[0] ?? null;
-    /** The published snapshot's drift for the editors' live-only line (spec 2026-09-27 editor safety §5). */
-    const liveEntryFindings = async (name, record, locale) => {
-        const row = record.locales[locale];
-        if (row?.status !== "published" || !row.publishedVersionId)
-            return [];
-        const snap = await entries.getVersion(name, row.publishedVersionId);
-        return snap ? entryDrift(adminRegistry(), name, { fields: snap.fields }) : [];
-    };
-    /** A projection is derived work done after the truth is written (spec 2026-10-07 §2 Failure): when it throws, the
-     *  op still succeeds — the error is logged, the targets are marked stale (best effort) to rebuild on their next
-     *  read, and the caller expires the tags all the same. */
-    const project = async (op, kind, ids) => {
-        if (ids.length === 0)
-            return;
-        try {
-            await (kind === "page" ? projector.pages(ids) : projector.entries(ids));
-        }
-        catch (e) {
-            console.error(`smoodly: ${op}: projecting ${kind}s ${ids.join(", ")} failed; their rows are marked stale and rebuild on read.`, e);
-            try {
-                await projector.markStale(ids.map((id) => ({ kind, id })));
-            }
-            catch (m) {
-                console.error(`smoodly: ${op}: marking ${kind}s ${ids.join(", ")} stale failed too.`, m);
-            }
-        }
-    };
-    /** These entries' documents, the entries and pages that embed any of them (transitively), then their tags. Past
-     *  the projector's cap the rest are marked stale; their tags expire all the same (§2). `project: false` expires
-     *  the tags only: a save no published document can see (R17). */
-    const fanOut = async (roots, options = {}) => {
-        const entryIds = new Set();
-        const pageIds = new Set();
-        for (const root of typeof roots === "string" ? [roots] : roots) {
-            const affected = await affectedTargets({ pages, entries }, root);
-            for (const id of affected.entryIds)
-                entryIds.add(id);
-            for (const id of affected.pageIds)
-                pageIds.add(id);
-        }
-        if (options.project !== false) {
-            await project("entries", "entry", [...entryIds]);
-            await project("entries", "page", [...pageIds]);
-        }
-        if (!effects?.revalidate)
-            return;
-        for (const id of entryIds)
-            effects.revalidate(entryTag(id));
-        for (const id of pageIds)
-            effects.revalidate(pageTag(id));
-        // A global item's row is an entry like any other: when the item
-        // itself changes OR when something it REFERENCES does, the unit
-        // `getSmoodlyGlobal` caches under `global:<name>` is stale too — and
-        // that unit is a layout, on every page. `affectedTargets` returns row
-        // ids, so resolve name → row id here. Once per fan-out, not memoized
-        // per ops instance: a row can be materialized between two calls, and
-        // an entry write is rare enough that one `entries.list` per
-        // registration beats reasoning about a stale cache. Last, so the
-        // existing entry-then-page order is untouched.
-        const registered = config.registry.globals ?? [];
-        if (registered.length === 0)
-            return;
-        const touched = new Set(entryIds);
-        for (const item of registered) {
-            const row = (await entries.list(item.name))[0];
-            if (row && touched.has(row.id))
-                effects.revalidate(globalTag(item.name));
-        }
-    };
-    /** An asset's metadata (alt, title, caption, credit) is read wherever media
-     *  resolves (spec 2026-09-08 §9): the entry and page units that reference the
-     *  asset, directly or through an entry, the global items among those rows,
-     *  and the list units of every referencing entry's collection. The walk is
-     *  the entry fan-out's, seeded with the asset's id — which is no entry, so
-     *  it gets no tag of its own. */
-    const expireAssetUsers = async (assetId) => {
-        const { pageIds, entryIds } = await affectedTargets({ pages, entries }, assetId);
-        const users = entryIds.filter((id) => id !== assetId);
-        await project("assets", "entry", users);
-        await project("assets", "page", pageIds);
-        if (!effects?.revalidate)
-            return;
-        for (const id of users)
-            effects.revalidate(entryTag(id));
-        for (const id of pageIds)
-            effects.revalidate(pageTag(id));
-        const touched = new Set(users);
-        for (const item of config.registry.globals ?? []) {
-            const row = (await entries.list(item.name))[0];
-            if (row && touched.has(row.id))
-                effects.revalidate(globalTag(item.name));
-        }
-        for (const c of config.registry.collections ?? []) {
-            for (const id of users) {
-                if (await entries.get(c.name, id)) {
-                    effects.revalidate(collectionTag(c.name));
-                    break;
-                }
-            }
-        }
-    };
-    /** Project the pages a tree change touched, then expire their cached units, in order, once each. Every id
-     *  expires, the ones past the projector's cap (marked stale) included. */
-    const expirePages = async (ids) => {
-        const unique = [...new Set(ids.filter((x) => typeof x === "string"))];
-        await project("pages", "page", unique);
-        if (!effects?.revalidate)
-            return;
-        for (const id of unique)
-            effects.revalidate(pageTag(id));
-    };
-    /** The tree listing's unit (spec 2026-09-11 §2): every page op that changes what it shows. The same ops
-     *  change which addresses resolve, so the addresses tag fires with it (plan 2026-10-09 next cached routes). */
-    const expireTree = () => {
-        effects?.revalidate?.(pagesTreeTag());
-        effects?.revalidate?.(addressesTag());
-    };
-    /** A collection's list units: every entry write, since a non-versioned collection's published read is its live
-     *  row. An entry write can give an address a document or take it away, so the addresses tag fires with it —
-     *  except on a save that changed no slug (`addresses: false`): an autosave of fields moves no address, and a
-     *  tag that fired per keystroke would re-render every cached miss and code-owned page for nothing. */
-    const expireCollection = (name, options = {}) => {
-        effects?.revalidate?.(collectionTag(name));
-        if (options.addresses !== false)
-            effects?.revalidate?.(addressesTag());
-    };
-    /** A node and every descendant, node first, in listPages() order. */
-    const subtreeIds = async (id) => {
-        const all = await pages.listPages();
-        const out = [id];
-        for (let i = 0; i < out.length; i++) {
-            for (const p of all)
-                if (p.parentId === out[i])
-                    out.push(p.id);
-        }
-        return out;
-    };
-    /** The ids under one parent: a move renumbers every one of them (their stored sort). */
-    const childIds = async (parentId) => (await pages.listPages()).filter((p) => p.parentId === parentId).map((p) => p.id);
-    /** Same walk over one collection's entries. */
-    const entrySubtreeIds = async (collection, id) => {
-        const all = await entries.list(collection);
-        const out = [id];
-        for (let i = 0; i < out.length; i++) {
-            for (const e of all)
-                if (e.parentId === out[i])
-                    out.push(e.id);
-        }
-        return out;
-    };
-    const def = config.locales.default;
-    /** The name messages use for a node: its default-locale slug, else any locale's, else the id. */
-    const nameOf = (r) => r.locales[def]?.slug ?? Object.values(r.locales)[0]?.slug ?? r.id;
-    /** "kind:id" → title in the locale (+ collection for an entry): every page with a template, every entry of a routed collection. */
-    const targetTitles = async (locale) => {
-        const out = new Map();
-        for (const p of await pages.listPages()) {
-            if (p.template === null)
-                continue;
-            out.set(`page:${p.id}`, { title: p.locales[locale]?.title ?? nameOf(p), collection: null });
-        }
-        for (const c of config.registry.collections ?? []) {
-            if (!c.path)
-                continue;
-            for (const e of await entries.list(c.name))
-                out.set(`entry:${e.id}`, { title: entryTitleIn(e, locale, c), collection: c.name });
-        }
-        return out;
-    };
-    const assets = deps.assets;
-    const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to the admin's route (createAdminRoute).");
-    const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to the admin's route (createAdminRoute).");
-    const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    /** unauthorized unless the actor may manage members; no actor (scripts, the seed) may. */
-    const membersDenied = () => deps.actor && !can(deps.actor.role, "members.manage") ? err("unauthorized", "smoodly: only an admin can manage members.") : null;
-    /** blocked when the control plane manages this space's members (a row, never a mode check). */
-    const membersManaged = async () => (await deps.members.consoleUrl()) ? err("blocked", "smoodly: members are managed at smoodly.io.") : null;
-    /** The two guards on setRole and remove: never your own row, never the last admin (unless the change keeps them admin). */
-    const memberGuards = async (userId, staysAdmin) => {
-        if (deps.actor?.userId === userId)
-            return err("blocked", "smoodly: you cannot change your own membership.");
-        if (staysAdmin)
-            return null;
-        const rows = await deps.members.list();
-        const target = rows.find((m) => m.userId === userId);
-        if (!target)
-            return null; // the store answers not_found
-        const admins = rows.filter((m) => normalizeRole(m.role) === "admin");
-        if (normalizeRole(target.role) === "admin" && admins.length <= 1)
-            return err("blocked", "smoodly: this site needs at least one admin.");
-        return null;
-    };
-    const mb = (bytes) => `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
-    const isDim = (v) => v === undefined || (typeof v === "number" && Number.isFinite(v) && v >= 0);
-    /** What an asset's usage row points at, labelled for the Media screen. */
-    const describeSource = async (sourceKind, sourceId) => {
-        if (sourceKind === "page") {
-            const record = await pages.getPage(sourceId);
-            if (!record)
-                return { title: sourceId, href: null };
-            return { title: record.locales[def]?.title ?? Object.values(record.locales)[0]?.title ?? sourceId, href: adminHref(config.admin.path, `/pages/${sourceId}`) };
-        }
-        for (const item of config.registry.globals ?? []) {
-            if (await entries.get(item.name, sourceId))
-                return { title: item.title, href: adminHref(config.admin.path, `/globals/${encodeURIComponent(item.name)}`) };
-        }
-        for (const c of config.registry.collections ?? []) {
-            const record = await entries.get(c.name, sourceId);
-            if (record)
-                return { title: entryTitleIn(record, def, c), href: adminHref(config.admin.path, `/${c.name}/${sourceId}`) };
-        }
-        return { title: sourceId, href: null };
-    };
-    const owned = (record, verb) => err("blocked", `smoodly: "${nameOf(record)}" is owned by code — ${verb}.`);
-    /** The record serving "/" — guarded whether or not a registration claims
-     *  its slug: the config's homePageSlug is what routes it. Judged by the
-     *  DEFAULT locale's slug (paths.ts isHomeNode, the same rule). */
-    const isHomeNode = (r) => r.parentId === null && r.locales[def]?.slug === config.homePageSlug;
-    /** A ROOT page at the admin's segment can never be opened: Next serves
-     *  the static admin folder first (spec 2026-09-17 slug guard §4). */
-    const adminSlug = (slug) => isAdminSlug(slug, config.admin.path);
-    const slugTaken = () => err("validation", adminSlugTaken(config.admin.path));
-    const supportedLocale = (locale) => typeof locale === "string" && config.locales.supported.includes(locale)
-        ? null
-        : err("validation", `smoodly: "${String(locale)}" is not a supported locale.`);
-    const openTemplate = (name) => config.registry.pages.find((p) => p.kind === "page" && p.name === name);
-    const mountGuard = (parent) => {
-        const fixed = fixedNodeOf(parent, config);
-        return fixed?.collection
-            ? err("blocked", `smoodly: pages cannot be created under "${nameOf(parent)}" — the "${fixed.collection}" collection owns that URL space.`)
-            : null;
-    };
-    /** Who wins a path in a locale over a node hanging on `own` — its chain root's owner key, `''` in the editors'
-     *  tree (spec 2026-09-29 anchored paths §5): the longest code address the path is or lies below, as the index
-     *  serves it (§2). Null when that is the node's own anchor, or the editors' tree. */
-    const ownerOf = (path, locale, own = "") => {
-        const served = servedAnchor(config.anchors, locale, path);
-        return served === "" || served === own ? null : fixedNodeSpecs(config).find((s) => s.key === served) ?? null;
-    };
-    const pathOpts = { locales: config.locales, homePageSlug: config.homePageSlug, addresses: config.addresses };
-    /** A record's own anchor: its chain root's owner key, `''` in the editors' tree. */
-    const anchorOf = async (record) => {
-        let r = record;
-        while (r.parentId !== null) {
-            const up = await pages.getPage(r.parentId);
-            if (!up)
-                break;
-            r = up;
-        }
-        return r.fixed ?? "";
-    };
-    /** The refusal for a write that would put the node or its subtree where another code address wins (spec 2026-09-29
-     *  anchored paths §5): the tree after `change`, derived in memory, checked against the config. Only a path the write
-     *  changes counts: a page already hidden in one locale may still be renamed in another, or off the address. */
-    const landsOnCode = async (id, change) => {
-        const before = await pages.listPages();
-        const was = new Map(before.map((r) => [r.id, r]));
-        const all = before.map((r) => (r.id === id ? change(r) : r));
-        const byId = new Map(all.map((r) => [r.id, r]));
-        // A move into its own subtree is a cycle here; the store refuses it with its own message.
-        for (let up = byId.get(id).parentId; up !== null; up = byId.get(up)?.parentId ?? null)
-            if (up === id)
-                return null;
-        const inSubtree = (r) => r.id === id || (r.parentId !== null && byId.has(r.parentId) && inSubtree(byId.get(r.parentId)));
-        for (const node of all.filter(inSubtree)) {
-            const own = chainOf(node, (x) => byId.get(x))[0].fixed ?? "";
-            for (const locale of Object.keys(node.locales)) {
-                const path = pagePathIn(node, (x) => byId.get(x), locale, pathOpts);
-                if (path === null || path === pagePathIn(was.get(node.id), (x) => was.get(x), locale, pathOpts))
-                    continue;
-                const owner = ownerOf(path, locale, own);
-                if (owner)
-                    return belongsTo(path, owner);
-            }
-        }
-        return null;
-    };
-    const belongsTo = (path, owner) => err("validation", `smoodly: "${path}" belongs to the ${owner.title} ${owner.collection ? "collection" : "page"}.`);
-    /** A parent where another code address wins — a page that sits there, hidden (§4) — takes no new children. */
-    const insideCode = async (parent) => {
-        const own = await anchorOf(parent);
-        for (const [locale, path] of Object.entries(await pages.pathsOf(parent.id))) {
-            const owner = ownerOf(path, locale, own);
-            if (owner)
-                return belongsTo(`/${owner.segments[locale]}`, owner);
-        }
-        return null;
-    };
-    /** A record whose owner no registration names any more: deleting it is all that is open (§5). */
-    const orphan = (record) => record.fixed && !fixedNodeOf(record, config)
-        ? err("blocked", `smoodly: "${nameOf(record)}" is no longer in code — delete it, or register it again.`)
-        : null;
-    const guard = async (work) => {
-        try {
-            return await work();
-        }
-        catch (e) {
-            return classify(e);
-        }
-    };
-    /** Where a new child may not go: a collection's record, a record no longer in code, a page where a code address wins. */
-    const parentGuard = async (parent) => mountGuard(parent) ?? orphan(parent) ?? (await insideCode(parent));
-    return {
-        pages: {
-            list: () => guard(async () => ok(await ensureFixedNodes(pages, config))),
-            get: (id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const draft = record.template === null || !record.locales[locale] ? null : await pages.getDraftTree(id, locale);
-                const paths = await pages.pathsOf(id);
-                const urls = Object.fromEntries(Object.entries(paths).map(([l, path]) => [l, href(path, l)]));
-                const redirects = await pages.redirectsOf(id);
-                // A locale can only be added where the parent already has it; a
-                // root has no parent, so every supported locale is open.
-                const parentLocales = record.parentId === null
-                    ? config.locales.supported
-                    : Object.keys((await pages.getPage(record.parentId))?.locales ?? {});
-                const liveTree = record.locales[locale]?.publishedVersionId ? await pages.getPublishedTree(id, locale) : null;
-                const liveFindings = liveTree ? pageDrift(adminRegistry(), record.template, liveTree) : [];
-                return ok({ record, locale, draft, paths, urls, redirects, parentLocales, liveFindings });
-            }),
-            create: (input) => guard(async () => {
-                const unsupported = supportedLocale(input.locale);
-                if (unsupported)
-                    return unsupported;
-                if (input.parentId === null && adminSlug(input.slug))
-                    return slugTaken();
-                if (input.template !== null) {
-                    const registration = openTemplate(input.template);
-                    if (!registration)
-                        return err("validation", `smoodly: no page type named "${input.template}".`);
-                    if (registration.slug !== undefined) {
-                        return err("validation", `smoodly: page type "${input.template}" is fixed — Smoodly creates that page for you.`);
-                    }
-                }
-                let parentPath = "";
-                let own = "";
-                if (input.parentId !== null) {
-                    const parent = await pages.getPage(input.parentId);
-                    if (!parent)
-                        return err("not_found", `smoodly: no page "${input.parentId}".`);
-                    const blocked = await parentGuard(parent);
-                    if (blocked)
-                        return blocked;
-                    parentPath = (await pages.pathsOf(parent.id))[input.locale];
-                    own = await anchorOf(parent);
-                }
-                // A code address is code's whether or not its record has landed yet (spec 2026-09-29 anchored paths §5).
-                if (parentPath !== undefined) {
-                    // A root on the home slug serves "/" (isHomeNode), where a registered home page wins.
-                    const home = input.parentId === null && input.locale === def && input.slug === config.homePageSlug;
-                    const path = home ? "/" : `${parentPath}/${input.slug}`;
-                    const owner = ownerOf(path, input.locale, own);
-                    if (owner)
-                        return belongsTo(path, owner);
-                }
-                const created = await pages.createPage({
-                    locale: input.locale, slug: input.slug, template: input.template, parentId: input.parentId,
-                    ...(input.title !== undefined ? { title: input.title } : {}),
-                }, by);
-                // A folder is public at once: its row, and its parent's children list. A page starts as a draft.
-                if (created.template === null)
-                    await expirePages([created.id, created.parentId]);
-                expireTree();
-                return ok(created);
-            }),
-            saveDraft: (id, locale, tree, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                if (!isPageTree(tree))
-                    return err("validation", "smoodly: malformed page tree.");
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                if (!(await pages.getPage(id)))
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const version = await pages.saveDraft(id, locale, tree, by, token);
-                const after = await pages.getPage(id);
-                return ok({ versionId: version.id, draft: after?.locales[locale] ? draftToken(after.locales[locale]) : null });
-            }),
-            publish: (id, locale, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const row = record.locales[locale];
-                if (!row)
-                    return err("not_found", `smoodly: page "${id}" does not exist in locale "${locale}".`);
-                const draft = record.template === null ? null : await pages.getDraftTree(id, locale);
-                if (!draft) {
-                    return record.template === null
-                        ? err("blocked", `smoodly: "${nameOf(record)}" is a path — give it a page type first.`)
-                        : err("blocked", `smoodly: "${row.slug}" has no draft to publish.`);
-                }
-                const fieldErrors = [];
-                // Only the page type's zones (spec 2026-09-27 editor safety §1): a removed zone's nodes never block.
-                const shapeZones = Object.keys(openTemplate(record.template)?.zones ?? {});
-                for (const zone of shapeZones) {
-                    const nodes = Array.isArray(draft.zones[zone]) ? draft.zones[zone] : [];
-                    for (const node of nodes) {
-                        const schema = sectionFields(node.type);
-                        if (!schema?.fields)
-                            continue;
-                        // Fields, settings (prefixed) and the css snippet (spec 2026-09-14 §3, §4); a custom section adds its row structure (§6).
-                        const errors = node.type === CUSTOM_NODE_TYPE
-                            ? validateCustomNode(node, schema.fields, elementDescs)
-                            : validateNode(node, { fields: schema.fields, settings: schema.settings }, elementDescs);
-                        for (const fe of errors) {
-                            fieldErrors.push({ field: `${node.id}.${fe.field}`, message: fe.message });
-                        }
-                    }
-                }
-                // The page's own fields (spec 2026-09-10 page fields §2); SEO meta is never validated.
-                const pageDescs = openTemplate(record.template)?.fields ?? {};
-                for (const fe of validateFields(draft.fields ?? {}, pageDescs, elementDescs)) {
-                    fieldErrors.push({ field: `page.fields.${fe.field}`, message: fe.message });
-                }
-                const refused = publishErrors(fieldErrors, pageDrift(adminRegistry(), record.template, draft));
-                if (refused.length > 0) {
-                    return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed problems first.`, refused);
-                }
-                const published = await pages.publish(id, locale, by, token);
-                // The parent's cached unit lists its published children; every descendant embeds the page in its ancestors.
-                await expirePages([...(await subtreeIds(published.id)), published.parentId]);
-                expireTree();
-                return ok(published);
-            }),
-            unpublish: (id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                if (!record.locales[locale])
-                    return err("not_found", `smoodly: page "${id}" does not exist in locale "${locale}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                if (isHomeNode(record))
-                    return err("blocked", `smoodly: "${nameOf(record)}" is the site root — it cannot be unpublished.`);
-                if (fixedNodeOf(record, config))
-                    return owned(record, "it stays published");
-                const off = await pages.unpublish(id, locale, by);
-                // The parent's cached unit lists its published children, the descendants' ancestors show it; the tree listing shows status.
-                await expirePages([...(await subtreeIds(off.id)), off.parentId]);
-                expireTree();
-                return ok(off);
-            }),
-            discardDraft: (id, locale, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const row = record.locales[locale];
-                if (!row)
-                    return err("not_found", `smoodly: page "${id}" does not exist in locale "${locale}".`);
-                if (!row.publishedVersionId) {
-                    return err("blocked", `smoodly: "${nameOf(record)}" has nothing published in ${locale} — there is no version to restore.`);
-                }
-                const restored = await pages.discardDraft(id, locale, by, token);
-                await expirePages([restored.id]); // the draft-mode render of this page changed
-                return ok(restored);
-            }),
-            listVersions: (id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                if (!(await pages.getPage(id)))
-                    return err("not_found", `smoodly: no page "${id}".`);
-                return ok((await pages.listVersions(id, locale)).map(summary));
-            }),
-            restore: (id, locale, versionId, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                if (!record.locales[locale])
-                    return err("not_found", `smoodly: page "${id}" does not exist in locale "${locale}".`);
-                if (record.template === null)
-                    return err("blocked", `smoodly: "${nameOf(record)}" is a path — it has no versions.`);
-                const version = typeof versionId === "string" ? await pages.getVersion(versionId) : null;
-                if (!version || version.pageId !== id || version.locale !== locale) {
-                    return err("not_found", `smoodly: no version "${String(versionId)}" of this page in ${locale}.`);
-                }
-                const restored = await pages.restore(id, locale, versionId, by, token);
-                await expirePages([restored.id]); // the draft-mode render of this page changed
-                return ok(restored);
-            }),
-            delete: (id) => guard(async () => {
-                const record = await pages.getPage(id);
-                if (!record)
-                    return ok(null); // nothing to delete is not a failure
-                if (fixedNodeOf(record, config)) {
-                    return err("blocked", `smoodly: "${nameOf(record)}" is owned by code — remove the registration to remove it.`);
-                }
-                // A home page no longer in code may go too (§5): the registration that serves "/" now lands after it.
-                if (isHomeNode(record) && !orphan(record))
-                    return err("blocked", `smoodly: "${nameOf(record)}" is the site root — it cannot be deleted.`);
-                await pages.deletePage(id);
-                // The cached unit is keyed by (locale, path) but tagged by the id
-                // found at the first miss; the parent's unit lists its children.
-                await expirePages([id, record.parentId]);
-                expireTree();
-                return ok(null);
-            }),
-            rename: (id, patch) => guard(async () => {
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                if (fixedNodeOf(record, config))
-                    return owned(record, "rename it in the registration");
-                if (isHomeNode(record) && patch.slug !== undefined) {
-                    return err("blocked", `smoodly: "${nameOf(record)}" is the site root — its slug is the config's homePageSlug.`);
-                }
-                const unsupported = supportedLocale(patch.locale);
-                if (unsupported)
-                    return unsupported;
-                if (record.parentId === null && patch.slug !== undefined && adminSlug(patch.slug))
-                    return slugTaken();
-                if (patch.slug !== undefined) {
-                    const slug = patch.slug;
-                    const lands = await landsOnCode(id, (r) => r.locales[patch.locale] ? { ...r, locales: { ...r.locales, [patch.locale]: { ...r.locales[patch.locale], slug } } } : r);
-                    if (lands)
-                        return lands;
-                }
-                const { redirect, ...rest } = patch;
-                const renamed = await pages.rename(id, rest, by, { redirect: redirect ?? true });
-                // Every descendant's path changed with this segment; the parent
-                // lists this node's title and path.
-                await expirePages([...(await subtreeIds(id)), record.parentId]);
-                expireTree();
-                return ok(renamed);
-            }),
-            move: (id, to) => guard(async () => {
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                if (to.parentId === null && Object.values(record.locales).some((row) => adminSlug(row.slug)))
-                    return slugTaken();
-                if (to.parentId !== null) {
-                    // Code owns a fixed node's URL, never the root's listing order:
-                    // reparenting is refused, reordering among the root siblings is not.
-                    if (fixedNodeOf(record, config))
-                        return owned(record, "it stays at the root");
-                    if (isHomeNode(record))
-                        return err("blocked", `smoodly: "${nameOf(record)}" is the site root — it stays at the root.`);
-                    const parent = await pages.getPage(to.parentId);
-                    if (!parent)
-                        return err("not_found", `smoodly: no page "${to.parentId}".`);
-                    // A reorder among a holding page's children is no new placement.
-                    const blocked = to.parentId === record.parentId ? null : await parentGuard(parent);
-                    if (blocked)
-                        return blocked;
-                }
-                if (to.parentId !== record.parentId) {
-                    const lands = await landsOnCode(id, (r) => ({ ...r, parentId: to.parentId }));
-                    if (lands)
-                        return lands;
-                }
-                const { redirect, ...dest } = to;
-                const moved = await pages.move(id, dest, { redirect: redirect ?? true });
-                // The destination's children are renumbered: their stored sort (the tree's order) changes too.
-                await expirePages([...(await subtreeIds(id)), record.parentId, moved.parentId, ...(await childIds(moved.parentId))]);
-                expireTree();
-                return ok(moved);
-            }),
-            setTemplate: (id, template) => guard(async () => {
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                const fixed = fixedNodeOf(record, config);
-                if (fixed?.collection) {
-                    return err("blocked", `smoodly: "${nameOf(record)}" is the "${fixed.collection}" collection's mount — its index page is a fixed registration.`);
-                }
-                const registration = openTemplate(template);
-                if (!registration)
-                    return err("validation", `smoodly: no page type named "${template}".`);
-                if (registration.slug !== undefined) {
-                    return err("validation", `smoodly: page type "${template}" is fixed — Smoodly creates that page for you.`);
-                }
-                const withTemplate = await pages.setTemplate(id, template, by);
-                // The folder becomes an unpublished page: its row goes, and with it its place in the parent's children and
-                // the subtree's ancestors. Its own address served nothing before and serves nothing now: no unit to expire.
-                const [, ...below] = await subtreeIds(id);
-                await project("pages.setTemplate", "page", [id]);
-                await expirePages([...below, record.parentId]);
-                expireTree();
-                return ok(withTemplate);
-            }),
-            addLocale: (id, locale, options) => guard(async () => {
-                const unsupported = supportedLocale(locale) ?? supportedLocale(options?.from);
-                if (unsupported)
-                    return unsupported;
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                // The new locale copies the source's slug: it may not land where code wins the address (spec 2026-09-29 anchored paths §5).
-                const lands = await landsOnCode(id, (r) => r.locales[options.from] && !r.locales[locale] ? { ...r, locales: { ...r.locales, [locale]: r.locales[options.from] } } : r);
-                if (lands)
-                    return lands;
-                // A new locale is a draft: nothing public changes but the tree listing (spec 2026-09-11 §2).
-                const added = await pages.addLocale(id, locale, { from: options.from }, by);
-                // A folder's new locale is public at once, in its parent's children too; a page's is a draft.
-                if (record.template === null)
-                    await expirePages([id, record.parentId]);
-                expireTree();
-                return ok(added);
-            }),
-            removeLocale: (id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const record = await pages.getPage(id);
-                if (!record)
-                    return err("not_found", `smoodly: no page "${id}".`);
-                const gone = orphan(record);
-                if (gone)
-                    return gone;
-                if (fixedNodeOf(record, config))
-                    return owned(record, "it exists in every locale");
-                if (isHomeNode(record))
-                    return err("blocked", `smoodly: "${nameOf(record)}" is the site root — it exists in every locale.`);
-                const removed = await pages.removeLocale(id, locale);
-                // The locale may have been published: its unit and the parent's listing go.
-                await expirePages([id, record.parentId]);
-                expireTree();
-                return ok(removed);
-            }),
-        },
-        entries: {
-            list: (collection) => guard(async () => ok(await entries.list(collection))),
-            // In JS over the list the admin already reads: PostgREST has no DISTINCT over
-            // jsonb_array_elements without an RPC (spec 2026-09-17 §6; the RPC is in the register).
-            distinct: (collection, field, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const descriptors = collectionFields(collection);
-                if (!descriptors)
-                    return err("not_found", `smoodly: no collection named "${collection}".`);
-                const d = descriptors[field];
-                if (d?.type !== "tags")
-                    return err("validation", `smoodly: "${field}" is not a tags field of "${collection}".`);
-                return ok(tagsIn(await entries.list(collection), field, d.localized === true, locale));
-            }),
-            get: (collection, id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const record = await entries.get(collection, id);
-                if (!record)
-                    return err("not_found", `smoodly: no entry "${id}" in "${collection}".`);
-                const fields = record.locales[locale] ? entryFieldsIn(record, locale) : null;
-                // A locale can only be added where the parent already has it; a root has no parent.
-                const parentLocales = record.parentId === null
-                    ? config.locales.supported
-                    : Object.keys((await entries.get(collection, record.parentId))?.locales ?? {});
-                const paths = await entries.pathsOf(collection, id);
-                const urls = Object.fromEntries(Object.entries(paths).map(([l, p]) => [l, href(p, l)]));
-                const redirects = await entries.redirectsOf(collection, id);
-                const liveFindings = await liveEntryFindings(collection, record, locale);
-                return ok({ record, locale, fields, parentLocales, urls, redirects, liveFindings });
-            }),
-            create: (collection, input) => guard(async () => {
-                const unsupported = supportedLocale(input.locale);
-                if (unsupported)
-                    return unsupported;
-                const descriptors = collectionFields(collection);
-                if (!descriptors)
-                    return err("not_found", `smoodly: no collection named "${collection}".`);
-                const created = await entries.create(collection, withDefaults(await foldTags(collection, input.locale, followSlug(input.fields, descriptors), descriptors), descriptors), { locale: input.locale, parentId: input.parentId ?? null }, by);
-                expireCollection(collection);
-                return ok(created);
-            }),
-            save: (collection, id, locale, fields, expected, options) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const descriptors = collectionFields(collection);
-                if (!descriptors)
-                    return err("not_found", `smoodly: no collection named "${collection}".`);
-                // A published row's slug is its live address and is never versioned, so this
-                // save is its publish: the grammar holds here (spec 2026-09-28 ASCII slugs §3).
-                const slug = typeof fields.slug === "string" && fields.slug !== "" ? fields.slug : null;
-                const before = (await entries.get(collection, id))?.locales[locale];
-                if (descriptors.slug !== undefined && (slug === null || !isSegment(slug))) {
-                    const row = before;
-                    if (row?.status === "published" && row.slug !== null && row.slug !== slug) {
-                        const message = slug === null ? "Required while the entry is published." : SLUG_GRAMMAR_MESSAGE;
-                        return err("validation", "Some fields need attention.", [{ field: "slug", message }]);
-                    }
-                }
-                let entry;
-                try {
-                    entry = await entries.update(collection, id, locale, await foldTags(collection, locale, fields, descriptors, id), by, token, { redirect: options?.redirect ?? true });
-                }
-                catch (e) {
-                    // A sibling's slug is the slug field's problem, not the whole draft's (spec 2026-09-28 ASCII slugs §5).
-                    if (e instanceof Error && e.message === entryErrors.slugTaken(collection).message) {
-                        return err("validation", "Some fields need attention.", [{ field: "slug", message: "Another entry here already uses this slug." }]);
-                    }
-                    throw e;
-                }
-                // A save projects only when a published document can see it (R17): a published row whose read is its live
-                // row, or a slug change (the slug is never versioned: it is live at once). In a tree collection every
-                // descendant's address hangs on the slug, published or not. Any other save is a draft: tags only.
-                const after = entry.locales[locale];
-                const slugChanged = after !== undefined && after.slug !== (before?.slug ?? null);
-                const tree = config.registry.collections?.find((c) => c.name === collection)?.tree !== undefined;
-                const below = tree && slugChanged ? (await entrySubtreeIds(collection, id)).slice(1) : [];
-                if (after?.status === "published" && (after.publishedVersionId === null || slugChanged)) {
-                    await fanOut([id, ...below]);
-                }
-                else {
-                    await fanOut(id, { project: false });
-                    if (below.length > 0)
-                        await fanOut(below);
-                }
-                expireCollection(collection, { addresses: slugChanged }); // the slug is the address; nothing else in a save moves one
-                return ok(entry);
-            }),
-            setStatus: (collection, id, locale, status, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                if (status === "published") {
-                    // A draft may be incomplete; what goes live may not (spec 2026-09-14 §2).
-                    const descriptors = collectionFields(collection);
-                    if (!descriptors)
-                        return err("not_found", `smoodly: no collection named "${collection}".`);
-                    const record = await entries.get(collection, id);
-                    if (!record)
-                        return err("not_found", `smoodly: no entry "${id}" in "${collection}".`);
-                    if (!record.locales[locale])
-                        return err("not_found", `smoodly: entry "${id}" does not exist in locale "${locale}".`);
-                    const merged = entryFieldsIn(record, locale);
-                    const fieldErrors = publishErrors(validateFields(merged, descriptors, elementDescs), entryDrift(adminRegistry(), collection, { fields: merged }));
-                    if (fieldErrors.length > 0)
-                        return err("validation", "Some fields need attention.", fieldErrors);
-                }
-                const entry = await entries.setStatus(collection, id, locale, status, by, token);
-                await fanOut(id);
-                expireCollection(collection);
-                return ok(entry);
-            }),
-            discardDraft: (collection, id, locale, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const restored = await entries.discardDraft(collection, id, locale, by, token);
-                await fanOut(id);
-                expireCollection(collection);
-                return ok(restored);
-            }),
-            listVersions: (collection, id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                if (!(await entries.get(collection, id)))
-                    return err("not_found", `smoodly: no entry "${id}" in "${collection}".`);
-                return ok((await entries.listVersions(collection, id, locale)).map(summary));
-            }),
-            getVersion: (collection, id, versionId) => guard(async () => {
-                const version = typeof versionId === "string" ? await entries.getVersion(collection, versionId) : null;
-                if (!version || version.entryId !== id) {
-                    return err("not_found", `smoodly: no version "${String(versionId)}" of entry "${id}" in "${collection}".`);
-                }
-                return ok({ ...summary(version), fields: version.fields });
-            }),
-            restore: (collection, id, locale, versionId, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const version = typeof versionId === "string" ? await entries.getVersion(collection, versionId) : null;
-                if (!version || version.entryId !== id || version.locale !== locale) {
-                    return err("not_found", `smoodly: no version "${String(versionId)}" of entry "${id}" in "${collection}", locale ${locale}.`);
-                }
-                const restored = await entries.restore(collection, id, locale, versionId, by, token);
-                await fanOut(id);
-                expireCollection(collection);
-                return ok(restored);
-            }),
-            // The tag expires only after the delete succeeded; a blocked delete expires nothing.
-            delete: (collection, id) => guard(async () => (await entries.delete(collection, id), await fanOut(id), expireCollection(collection), ok(null))),
-            move: (collection, id, to) => guard(async () => {
-                const { redirect, ...dest } = to;
-                const moved = await entries.move(collection, id, dest, { redirect: redirect ?? true });
-                // The subtree's addresses changed, and with them every document embedding one of them.
-                const subtree = await entrySubtreeIds(collection, id);
-                await fanOut(subtree);
-                // The destination's children are renumbered: their stored sort (a manual list's order) changes too.
-                const inSubtree = new Set(subtree);
-                const siblings = (await entries.list(collection)).filter((e) => e.parentId === moved.parentId && !inSubtree.has(e.id)).map((e) => e.id);
-                await project("entries.move", "entry", siblings);
-                if (effects?.revalidate) {
-                    for (const entryId of siblings)
-                        effects.revalidate(entryTag(entryId));
-                }
-                expireCollection(collection);
-                return ok(moved);
-            }),
-            // A new locale starts as a draft: nothing public changes, but the collection's
-            // list units are expired anyway (spec 2026-09-11 §2) so they can never go stale.
-            addLocale: (collection, id, locale, options) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const added = await entries.addLocale(collection, id, locale, { from: options.from }, by);
-                expireCollection(collection);
-                return ok(added);
-            }),
-            removeLocale: (collection, id, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const entry = await entries.removeLocale(collection, id, locale);
-                await fanOut(id);
-                expireCollection(collection);
-                return ok(entry);
-            }),
-        },
-        globals: {
-            list: () => guard(async () => {
-                const records = await ensureGlobalItems(entries, config);
-                return ok((config.registry.globals ?? []).flatMap((s) => (records[s.name] ? [{ name: s.name, record: records[s.name] }] : [])));
-            }),
-            get: (name, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const item = globalItem(name);
-                if (!item)
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                await ensureGlobalItems(entries, config);
-                const record = await globalRecord(name);
-                if (!record?.locales[locale])
-                    return err("not_found", `smoodly: global item "${name}" does not exist in locale "${locale}".`);
-                const usage = await entries.referencesTo(name, record.id);
-                const liveFindings = await liveEntryFindings(name, record, locale);
-                return ok({ name, record, locale, fields: entryFieldsIn(record, locale), usage, liveFindings });
-            }),
-            save: (name, locale, fields, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const item = globalItem(name);
-                if (!item)
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const saved = await entries.update(name, record.id, locale, fields, by, token);
-                // fanOut expires `global:<name>` itself — this row IS the item's. A global has no slug: it projects only when
-                // its published read is the live row (R17); a draft save expires the tags only.
-                const after = saved.locales[locale];
-                await fanOut(record.id, { project: after?.status === "published" && after.publishedVersionId === null });
-                return ok(saved);
-            }),
-            setStatus: (name, locale, status, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                const item = globalItem(name);
-                if (!item)
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                if (status === "published") {
-                    // A draft may be incomplete; what goes live may not (spec 2026-09-14 §2).
-                    if (!record.locales[locale])
-                        return err("not_found", `smoodly: global item "${name}" does not exist in locale "${locale}".`);
-                    // A visual item validates like a tree node: its fields, its section's settings under `$settings`
-                    // (prefixed `settings.`), its `$css` (spec 2026-09-14 §3, §4).
-                    const { [SETTINGS_KEY]: settings, [CSS_KEY]: css, ...fields } = entryFieldsIn(record, locale);
-                    const settingsDescs = item.section !== undefined ? sectionFields(item.section)?.settings : undefined;
-                    const fieldErrors = validateNode({ fields, settings: settings !== null && typeof settings === "object" ? settings : {}, css }, { fields: item.fields, settings: settingsDescs }, elementDescs);
-                    const refused = publishErrors(fieldErrors, entryDrift(adminRegistry(), name, { fields: entryFieldsIn(record, locale) }));
-                    if (refused.length > 0)
-                        return err("validation", "Some fields need attention.", refused);
-                }
-                const changed = await entries.setStatus(name, record.id, locale, status, by, token);
-                // see save: the fan-out carries the item's own tag.
-                await fanOut(record.id);
-                return ok(changed);
-            }),
-            discardDraft: (name, locale, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                if (!globalItem(name))
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const restored = await entries.discardDraft(name, record.id, locale, by, token);
-                await fanOut(record.id);
-                return ok(restored);
-            }),
-            listVersions: (name, locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                if (!globalItem(name))
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                return ok((await entries.listVersions(name, record.id, locale)).map(summary));
-            }),
-            getVersion: (name, versionId) => guard(async () => {
-                if (!globalItem(name))
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const version = typeof versionId === "string" ? await entries.getVersion(name, versionId) : null;
-                if (!version || version.entryId !== record.id) {
-                    return err("not_found", `smoodly: no version "${String(versionId)}" of global item "${name}".`);
-                }
-                return ok({ ...summary(version), fields: version.fields });
-            }),
-            restore: (name, locale, versionId, expected) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const token = tokenArg(expected);
-                if (token === BAD_TOKEN)
-                    return badToken();
-                if (!globalItem(name))
-                    return err("not_found", `smoodly: no global item named "${name}".`);
-                const record = await globalRecord(name);
-                if (!record)
-                    return err("not_found", `smoodly: global item "${name}" is not materialized — open Globals first.`);
-                const version = typeof versionId === "string" ? await entries.getVersion(name, versionId) : null;
-                if (!version || version.entryId !== record.id || version.locale !== locale) {
-                    return err("not_found", `smoodly: no version "${String(versionId)}" of global item "${name}" in ${locale}.`);
-                }
-                const restored = await entries.restore(name, record.id, locale, versionId, by, token);
-                await fanOut(record.id);
-                return ok(restored);
-            }),
-        },
-        assets: {
-            list: (query) => guard(async () => (assets ? ok(await assets.list(query)) : noMedia())),
-            get: (id) => guard(async () => {
-                if (!assets)
-                    return noMedia();
-                const record = await assets.get(id);
-                return record ? ok(record) : err("not_found", `smoodly: no asset "${id}".`);
-            }),
-            beginUpload: (input) => guard(async () => {
-                if (!assets)
-                    return noMedia();
-                if (typeof input?.name !== "string" || typeof input.mime !== "string" || typeof input.size !== "number") {
-                    return err("validation", "smoodly: an upload needs a name, a mime type and a size.");
-                }
-                if (!config.media.accept.includes(input.mime))
-                    return err("validation", `smoodly: "${input.mime}" is not an accepted file type.`);
-                if (input.size > config.media.maxSize)
-                    return err("validation", `smoodly: the file is larger than ${mb(config.media.maxSize)}.`);
-                return ok(await assets.beginUpload({ filename: input.name, mime: input.mime, size: input.size }));
-            }),
-            finishUpload: (id, dims) => guard(async () => {
-                if (!assets)
-                    return noMedia();
-                const d = dims ?? {};
-                if (!isDim(d.width) || !isDim(d.height) || !isDim(d.duration) || (d.posterId !== undefined && typeof d.posterId !== "string")) {
-                    return err("validation", "smoodly: malformed dimensions.");
-                }
-                return ok(await assets.finishUpload(id, d));
-            }),
-            update: (id, meta) => guard(async () => {
-                if (!assets)
-                    return noMedia();
-                const patch = {};
-                for (const key of ["title", "alt", "caption", "credit"]) {
-                    const v = (meta ?? {})[key];
-                    if (v === undefined)
-                        continue;
-                    if (v !== null && typeof v !== "string")
-                        return err("validation", `smoodly: ${key} must be text.`);
-                    patch[key] = v;
-                }
-                const updated = await assets.update(id, patch);
-                await expireAssetUsers(id);
-                return ok(updated);
-            }),
-            delete: (id) => guard(async () => (assets ? (await assets.delete(id), ok(null)) : noMedia())),
-            usage: (id) => guard(async () => {
-                if (!assets)
-                    return noMedia();
-                const rows = await entries.referencesTo(ASSET_COLLECTION, id);
-                const out = [];
-                for (const r of rows)
-                    out.push({ ...r, ...(await describeSource(r.sourceKind, r.sourceId)) });
-                return ok(out);
-            }),
-        },
-        members: {
-            list: () => guard(async () => {
-                if (!deps.members)
-                    return noMembers();
-                const denied = membersDenied();
-                if (denied)
-                    return denied;
-                const [members, consoleUrl] = await Promise.all([deps.members.list(), deps.members.consoleUrl()]);
-                return ok({ members, consoleUrl });
-            }),
-            me: () => guard(async () => ok({ role: deps.actor?.role ?? "admin" })),
-            invite: (input) => guard(async () => {
-                if (!deps.members)
-                    return noMembers();
-                const refused = membersDenied() ?? (await membersManaged());
-                if (refused)
-                    return refused;
-                const email = typeof input?.email === "string" ? input.email.trim() : "";
-                if (!EMAIL_RE.test(email))
-                    return err("validation", "smoodly: enter a valid email address.");
-                if (!isMemberRole(input.role))
-                    return err("validation", "smoodly: the role must be admin or editor.");
-                if (typeof input.redirectTo !== "string" || !input.redirectTo)
-                    return err("validation", "smoodly: the invite needs a return URL.");
-                const rows = await deps.members.list();
-                if (rows.some((m) => m.email?.toLowerCase() === email.toLowerCase()))
-                    return err("conflict", "smoodly: already a member.");
-                return ok(await deps.members.invite({ email, role: input.role, redirectTo: input.redirectTo }));
-            }),
-            setRole: (userId, role) => guard(async () => {
-                if (!deps.members)
-                    return noMembers();
-                const refused = membersDenied() ?? (await membersManaged());
-                if (refused)
-                    return refused;
-                if (!isMemberRole(role))
-                    return err("validation", "smoodly: the role must be admin or editor.");
-                const guardHit = await memberGuards(userId, role === "admin");
-                if (guardHit)
-                    return guardHit;
-                return ok(await deps.members.setRole(userId, role));
-            }),
-            remove: (userId) => guard(async () => {
-                if (!deps.members)
-                    return noMembers();
-                const refused = membersDenied() ?? (await membersManaged());
-                if (refused)
-                    return refused;
-                const guardHit = await memberGuards(userId, false);
-                if (guardHit)
-                    return guardHit;
-                await deps.members.remove(userId);
-                return ok(null);
-            }),
-        },
-        redirects: {
-            list: (locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const rows = await pages.listRedirects(locale);
-                const titles = await targetTitles(locale);
-                const items = [];
-                for (const r of rows) {
-                    const t = titles.get(`${r.kind}:${r.id}`);
-                    const currentPath = (await pages.targetPaths({ kind: r.kind, id: r.id }))[locale] ?? null;
-                    items.push({ locale, path: r.path, target: { kind: r.kind, id: r.id }, collection: t?.collection ?? null, title: t?.title ?? r.id, currentPath, url: currentPath ? href(currentPath, locale) : null });
-                }
-                return ok(items.sort((a, b) => a.path.localeCompare(b.path)));
-            }),
-            targets: (locale) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const titles = await targetTitles(locale);
-                const out = [];
-                for (const r of await pages.listLive(locale)) {
-                    const t = titles.get(`${r.kind}:${r.id}`);
-                    if (!t)
-                        continue; // a folder, or an entry outside a routed collection
-                    out.push({ target: { kind: r.kind, id: r.id }, collection: t.collection, title: t.title, path: r.path });
-                }
-                return ok(out.sort((a, b) => a.path.localeCompare(b.path)));
-            }),
-            add: (locale, typed, target) => guard(async () => {
-                const path = normalizeRedirectPath(typed);
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                const problem = redirectPathProblem(path, { adminPath: config.admin.path, multilingual: config.locales.supported.length > 1 });
-                if (problem)
-                    return err("validation", REDIRECT_PATH_MESSAGE[problem]);
-                const titles = await targetTitles(locale);
-                if (!titles.has(`${target.kind}:${target.id}`))
-                    return err("not_found", `smoodly: no ${target.kind} "${target.id}" to redirect to.`);
-                const holder = await pages.resolvePath(locale, path);
-                if (holder && !holder.redirect) {
-                    const owner = titles.get(`${holder.kind}:${holder.id}`)?.title ?? holder.id;
-                    return err("validation", `smoodly: "${path}" is the address of "${owner}".`);
-                }
-                await pages.addRedirect({ kind: target.kind, id: target.id, locale, path });
-                effects?.revalidate?.(addressesTag()); // a cached 404 at the old address must become the 308
-                return ok(null);
-            }),
-            remove: (locale, path) => guard(async () => {
-                const unsupported = supportedLocale(locale);
-                if (unsupported)
-                    return unsupported;
-                await pages.removeRedirect(locale, path); // the stored address, as list gave it
-                effects?.revalidate?.(addressesTag()); // a cached 308 must become the 404
-                return ok(null);
-            }),
-        },
-        health: {
-            scan: () => guard(async () => {
-                const [trees, rows, delivery] = await Promise.all([pages.scanTrees(), entries.scanEntries(), projector.delivery()]);
-                return ok({ ...buildHealthReport(adminRegistry(), trees, rows), delivery });
-            }),
-        },
-        schema: {
-            status: () => guard(async () => ok({ database: await pages.schemaVersion(), required: SCHEMA_VERSION })),
-        },
-        preview: {
-            enable: () => guard(async () => (await effects?.draft?.enable(), ok(null))),
-            disable: () => guard(async () => (await effects?.draft?.disable(), ok(null))),
-        },
-        deploy: deployOps(deps.deploy, by, guard),
-    };
-}
-/** The marker is fetched with a throwaway query and no-store, so no cache between answers with the old
- *  file (§5). A site that does not answer is "unreachable", never a throw; a 404 (a site built before this
- *  version, or live mode by mistake) is reachable with no marker, so every row counts as waiting. */
-function deployOps(d, by, guard) {
-    const notConfigured = () => err("not_found", "smoodly: this site has no deploy step (live mode).");
-    if (!d)
-        return { status: async () => notConfigured(), trigger: async () => notConfigured() };
-    const get = d.fetch ?? fetch;
-    const now = () => d.now?.() ?? Date.now();
-    const read = async () => {
-        const at = now();
-        let marker = null;
-        let reachable = true;
-        try {
-            // A hanging address is "unreachable" after five seconds, never a held operation.
-            const res = await get(`${d.siteUrl.replace(/\/$/, "")}/${MARKER_PATH}?t=${at}`, { cache: "no-store", signal: AbortSignal.timeout(5000) });
-            marker = res.ok ? parseMarker(await res.text()) : null;
-            reachable = res.ok || res.status === 404;
-        }
-        catch {
-            reachable = false;
-        }
-        const through = marker?.publishedThrough ?? 0;
-        const [press, newer, removedAt] = await Promise.all([d.store.deployRequest(), d.store.countPublishedAfter(through), d.store.lastRemovalAt()]);
-        // An unpublish or a delete after the build is a change too: one the count of newer rows cannot see.
-        const waiting = newer + (removedAt !== null && removedAt > through ? 1 : 0);
-        return { ...deployState({ marker, reachable, press, waiting, now: at }), hook: Boolean(d.hook) };
-    };
-    return {
-        status: () => guard(async () => ok(await read())),
-        trigger: () => guard(async () => {
-            if (!d.hook)
-                return err("blocked", "smoodly: SMOODLY_DEPLOY_HOOK is not set — see the deploying guide.");
-            const current = await read();
-            if (current.state === "building")
-                return err("blocked", "smoodly: a build is already in flight.");
-            const res = await get(d.hook, { method: "POST", signal: AbortSignal.timeout(10000) });
-            if (!res.ok)
-                return err("blocked", `smoodly: the deploy hook answered ${res.status}.`);
-            await d.store.requestDeploy(by ?? null, now());
-            return ok(await read());
-        }),
-    };
-}
-/** Path-dispatch for the one-endpoint seam. Own-property checks only —
- * "constructor.constructor" and prototype paths must not resolve. */
-export async function runAdminOp(ops, call) {
-    if (!isPlainObject(call) || typeof call.path !== "string" || !Array.isArray(call.args)) {
-        return { ok: false, code: "not_found", message: "smoodly: malformed op call." };
-    }
-    const [group, method, ...rest] = call.path.split(".");
-    const groupObj = rest.length === 0 && group && Object.prototype.hasOwnProperty.call(ops, group)
-        ? ops[group]
-        : undefined;
-    const fn = groupObj && method && Object.prototype.hasOwnProperty.call(groupObj, method)
-        ? groupObj[method]
-        : undefined;
-    if (typeof fn !== "function") {
-        return { ok: false, code: "not_found", message: `smoodly: unknown op "${call.path}".` };
-    }
-    return fn(...call.args);
-}