smoodly 0.0.51 → 0.0.53

package/dist/admin/ops.d.ts

@@ -2,8 +2,8 @@ import type { PageRecord } from "../store.ts";
 import type { PageTree } from "../page-context.ts";
 import type { EntryRecord, EntryUsage } from "../entry-store.ts";
 import type { AssetRecord, AssetMeta } from "../media.ts";
-import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-store.ts";
-import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+import type { AssetPage, AssetQuery } from "../asset-store.ts";
+import type { MemberRecord } from "../member-store.ts";
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 import type { DeployState } from "../deploy-state.ts";
@@ -11,9 +11,11 @@ import type { DraftToken } from "../draft-token.ts";
 import type { PathTarget } from "../paths.ts";
 import type { Finding } from "./drift.ts";
 import type { HealthReport } from "./health.ts";
+import type { DeployStore } from "../deploy-store.ts";
 export type OpError = {
     ok: false;
-    code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized";
+    /** `no_schema`: the space has no registry yet — its site has not pushed one (spec 2026-10-16 the control plane §4). */
+    code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized" | "no_schema";
     message: string;
     fields?: FieldError[];
     /** A `conflict` from the token guard (spec 2026-09-26 concurrency §2): the draft moved since the client loaded it. */
@@ -28,6 +30,15 @@ export type OpResult<T> = {
     ok: true;
     data: T;
 } | OpError;
+/** A draft-cookie grant: the service signs it under the site's secret key (purpose "preview", body the
+ *  action), the browser posts it to the site's preview route, which sets the cookie (spec 2026-10-14 §1). */
+/** The service's signature over the preview action, for the site to verify (signed-message.ts), and the space it names. */
+export type PreviewGrant = {
+    ts: number;
+    kid: string;
+    sig: string;
+    space: string;
+};
 export type PageCreateInput = {
     parentId: string | null;
     /** The one locale the page is created in; others are added with addLocale. */
@@ -115,16 +126,11 @@ export type AssetUsageItem = {
     title: string;
     href: string | null;
 };
-/** The Members page's read (spec 2026-09-25 §4): the rows and, when the control plane manages them, where. */
+/** The Members page's read (spec 2026-09-25 §4): the rows; the dashboard manages them. */
 export type MembersListResult = {
     members: MemberRecord[];
-    consoleUrl: string | null;
 };
 /** `database` null = no smoodly_meta table (older than v1). Behind blocks the shell; ahead is silent (spec 2026-09-26 §5). */
-export type SchemaStatus = {
-    database: number | null;
-    required: number;
-};
 /** The Deploy tile's state (spec 2026-10-09 static mode §6); `hook` false = SMOODLY_DEPLOY_HOOK is unset, Deploy disabled. */
 export type DeployStatus = DeployState & {
     hook: boolean;
@@ -241,32 +247,19 @@ export type AdminOps = {
         /** Ready assets, newest first, paged by cursor; `kind` and `search` filter. */
         list(query?: AssetQuery): Promise<OpResult<AssetPage>>;
         get(id: string): Promise<OpResult<AssetRecord>>;
-        /** Validates type and size against config.media, inserts a pending row, mints the signed upload URL (spec 2026-09-08 §6). */
-        beginUpload(input: {
-            name: string;
-            mime: string;
-            size: number;
-        }): Promise<OpResult<UploadTicket>>;
-        /** Marks the row ready with what the browser measured. */
-        finishUpload(id: string, dims: FinishInput): Promise<OpResult<AssetRecord>>;
         update(id: string, meta: AssetMeta): Promise<OpResult<AssetRecord>>;
         /** Blocked while any draft or published version references the asset. */
         delete(id: string): Promise<OpResult<null>>;
         usage(id: string): Promise<OpResult<AssetUsageItem[]>>;
     };
     members: {
-        /** The space's members; admins only. `consoleUrl` set means smoodly.io manages them and every write below is blocked. */
+        /** The space's members, a read-only list; admins only. Invites, roles and removals are the dashboard's
+         *  (spec 2026-10-16 sign-in and the dashboard §6). */
         list(): Promise<OpResult<MembersListResult>>;
         /** The caller's role; every member. The shell hides Settings from editors with it. */
         me(): Promise<OpResult<{
             role: MemberRole;
         }>>;
-        /** Admins only, self-host only: invites (or adds an existing account), refuses a duplicate row (spec 2026-09-25 members management §3). */
-        invite(input: InviteInput): Promise<OpResult<InviteResult>>;
-        /** Admins only, self-host only; never your own row, never the last admin. */
-        setRole(userId: string, role: MemberRole): Promise<OpResult<MemberRecord>>;
-        /** Admins only, self-host only; the same two guards. The Auth account stays. */
-        remove(userId: string): Promise<OpResult<null>>;
     };
     /** Redirects by hand (spec 2026-09-26 redirects §5): open to every member, as renaming is; nothing here expires a cache. */
     redirects: {
@@ -284,12 +277,9 @@ export type AdminOps = {
         /** Every page, entry and global item against the registry, draft and live; unregistered collections counted. */
         scan(): Promise<OpResult<HealthReport>>;
     };
-    schema: {
-        /** Every member. The shell calls it once on mount and blocks when behind. */
-        status(): Promise<OpResult<SchemaStatus>>;
-    };
+    /** enable answers the grant the service signed, which the browser posts to the site's preview route. */
     preview: {
-        enable(): Promise<OpResult<null>>;
+        enable(): Promise<OpResult<PreviewGrant | null>>;
         disable(): Promise<OpResult<null>>;
     };
     /** Static mode's Deploy tile (spec 2026-10-09 static mode §5–§7); on a live site both answer not_found. */
@@ -299,12 +289,30 @@ export type AdminOps = {
         trigger(): Promise<OpResult<DeployStatus>>;
     };
 };
-/** `token`: the editor's Supabase Auth session token, attached by the
- *  client facade, sent as the Authorization header and verified by the
- *  server gate (admin/auth.ts). */
+/** `token`: the editor's pass for this space, attached by the client facade, sent as the Authorization header and
+ *  verified by the service (spec 2026-10-16 sign-in and the dashboard §2). */
 export type AdminOpCall = {
     path: string;
     args: unknown[];
     token?: string;
 };
 export type AdminOpAction = (call: AdminOpCall) => Promise<OpResult<unknown>>;
+export type AdminEffects = {
+    /** Expire one cache tag (`pageTag(id)` / `entryTag(id)`). */
+    revalidate?(tag: string): void;
+    /** enable may answer a grant (the service's effect); a site's own effect sets the cookie and answers nothing. */
+    draft?: {
+        enable(): Promise<PreviewGrant | void> | PreviewGrant | void;
+        disable(): void | Promise<void>;
+    };
+};
+/** What the deploy operations need (spec 2026-10-09 static mode §7): the live site's origin, where the marker is
+ *  read from; the host's hook from SMOODLY_DEPLOY_HOOK (absent = Deploy disabled); the deploy store's four facts. */
+export type DeployDeps = {
+    siteUrl: string;
+    hook?: string;
+    store: DeployStore;
+    /** Test seams. */
+    fetch?: typeof fetch;
+    now?: () => number;
+};

package/dist/admin/page-data.d.ts

@@ -1,23 +1,31 @@
 import type { PresenceConfig } from "../env.ts";
 import type { AdminRegistry } from "./serialize.ts";
-import type { AuthConfig } from "./auth-config.ts";
+import type { SignInConfig } from "./session-flow.ts";
 export type AdminPageData = {
     registry: AdminRegistry;
-    /** What the browser needs to sign in: public values only. */
-    auth: AuthConfig;
-    /** What the browser needs to join the editing-presence channel; null = presence is off. */
+    /** Where the browser sends a person to sign in and the dashboard it links to: public values only. */
+    signIn: SignInConfig;
+    /** Smoodly's API, without a trailing slash, and the site's space: the admin's session routes live under it. */
+    apiUrl: string;
+    spaceId: string;
+    /** Where the browser opens the editing-presence socket; null = presence is off. */
     presence: PresenceConfig | null;
-    /** Where operations are posted. */
+    /** Where operations are posted: the service's admin API. */
     opUrl: string;
+    /** The site's own route the browser posts a preview grant to, which sets the draft cookie. */
+    previewUrl: string;
     /** The folder the package's files are served from, without a trailing slash. */
     filesBase: string;
     /** What the editor puts before a page's address to load its draft: "" where the framework serves drafts
      *  at the page's own address (Next), the preview address's base where it does not (Astro). */
     previewBase: string;
+    /** How the canvas and History's frame mark what they want of a draft render: in the query, or in the path's
+     *  last segment where the host strips the query (Next: Vercel keeps only a prerendered route's own params). */
+    canvasMarks: "path" | "query";
     /** Static mode shows the Deploy tile (spec 2026-10-09 static mode §6); live by default. */
     delivery: "live" | "static";
 };
 export declare const ADMIN_DATA_ID = "smoodly-admin-data";
 export declare const ADMIN_ROOT_ID = "smoodly-admin-root";
-/** The reserved segment under the admin path: the endpoint and the files live here. */
+/** The reserved segment under the admin path: the files and the revalidate and preview routes live here. */
 export declare const ADMIN_INTERNAL = "_smoodly";

package/dist/admin/page-data.js

@@ -1,4 +1,4 @@
 export const ADMIN_DATA_ID = "smoodly-admin-data";
 export const ADMIN_ROOT_ID = "smoodly-admin-root";
-/** The reserved segment under the admin path: the endpoint and the files live here. */
+/** The reserved segment under the admin path: the files and the revalidate and preview routes live here. */
 export const ADMIN_INTERNAL = "_smoodly";

package/dist/admin/session-flow.d.ts

@@ -0,0 +1,65 @@
+import type { MemberRole } from "../permissions.ts";
+/** Where the admin sends a person to sign in, and the dashboard its account menu and Members page link to (spec
+ *  2026-10-16 sign-in and the dashboard §1, §6): `GET /v1/auth` answers it from the Worker's env; the handler and the
+ *  page data carry it. Public values only. */
+export type SignInConfig = {
+    signInUrl: string;
+    consoleUrl: string;
+};
+export declare const STORAGE_KEY: (space: string) => string;
+/** The PKCE verifier, in this tab's `sessionStorage` only: the code is good for the browser tab that asked for it. */
+export declare const VERIFIER_KEY = "smoodly-verifier";
+/** Renew this long before the pass expires (spec §2). */
+export declare const RENEW_BEFORE_MS = 300000;
+export type StoredSession = {
+    pass: string;
+    refresh: string;
+    expiresAt: number;
+    user: {
+        userId: string;
+        email: string | null;
+        role: MemberRole;
+    };
+};
+/** Where the session lives (`localStorage`, shared by the site's tabs) and where the verifier waits (`sessionStorage`). */
+export type SessionStores = {
+    local: Storage;
+    tab: Storage;
+};
+/** The session the site's tabs share, or null (none, or a value that is not one). */
+export declare function readSession(local: Storage, space: string): StoredSession | null;
+/** Where to send the person to sign in: a fresh verifier kept in this tab, its S256 as the challenge. */
+export declare function signInAddress(config: SignInConfig, space: string, returnUrl: string, stores: Pick<SessionStores, "tab">): Promise<string>;
+/** The one-time code the sign-in page put in the fragment, or null. */
+export declare function codeFrom(hash: string): string | null;
+/** What the admin shows when the service cannot be reached at sign-in: a refusal with a way back, never a blank screen. */
+export declare const UNREACHABLE = "smoodly: couldn't reach Smoodly to sign you in \u2014 check the connection and sign in again.";
+/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. A service
+ *  that cannot be reached is a refusal too (UNREACHABLE), so the shell shows it rather than waiting forever. */
+export declare function exchange(api: string, space: string, code: string, stores: SessionStores, doFetch?: typeof fetch): Promise<StoredSession | {
+    refused: string;
+}>;
+/** The load-time step with no code in the fragment: the stored session adopted as it is while its pass has more than
+ *  RENEW_BEFORE_MS left, else renewed; a renewal the service refuses sends the person to sign in; one that cannot reach
+ *  the service keeps a pass that is still valid (the next timer tries again) and refuses with UNREACHABLE only once the
+ *  pass has expired. No stored session: sign in. */
+export declare function resume(api: string, space: string, stores: Pick<SessionStores, "local">, now: number, doFetch?: typeof fetch, lock?: TabLock): Promise<{
+    kind: "adopt";
+    session: StoredSession;
+} | {
+    kind: "sign_in";
+} | {
+    kind: "refused";
+    message: string;
+}>;
+/** Runs `fn` while holding a lock no other tab of this origin holds (Web Locks); with no Web Locks (an insecure
+ *  context), at once. */
+export type TabLock = <T>(name: string, fn: () => Promise<T>) => Promise<T>;
+/** A renewed session, or null when the space refused the refresh (the stored session is then cleared). `held` is the
+ *  refresh this tab holds: when the stored one differs, another tab renewed first and its session is adopted rather
+ *  than posting a refresh that is already spent. The read and the post run under one lock per space across the site's
+ *  tabs, so the tab that renews writes before the others read (spec §2), even when every tab's timer fires at once
+ *  after a laptop wakes. A network failure throws and keeps the session. */
+export declare function renew(api: string, space: string, stores: Pick<SessionStores, "local">, held: string | null, doFetch?: typeof fetch, lock?: TabLock): Promise<StoredSession | null>;
+/** Sign out of this site: the space ends the session, and this browser forgets it even when the call fails. */
+export declare function endSession(api: string, space: string, stores: Pick<SessionStores, "local">, doFetch?: typeof fetch): Promise<void>;

package/dist/admin/session-flow.js

@@ -0,0 +1,121 @@
+export const STORAGE_KEY = (space) => `smoodly-session:${space}`;
+/** The PKCE verifier, in this tab's `sessionStorage` only: the code is good for the browser tab that asked for it. */
+export const VERIFIER_KEY = "smoodly-verifier";
+/** Renew this long before the pass expires (spec §2). */
+export const RENEW_BEFORE_MS = 300000;
+const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const s256 = async (verifier) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+const sessionUrl = (api, space, path) => `${api.replace(/\/+$/, "")}/v1/spaces/${encodeURIComponent(space)}/admin/${path}`;
+const isSession = (v) => {
+    const s = v;
+    return typeof s === "object" && s !== null && typeof s.pass === "string" && typeof s.refresh === "string" && typeof s.expiresAt === "number"
+        && typeof s.user === "object" && s.user !== null && typeof s.user.userId === "string";
+};
+/** The session the site's tabs share, or null (none, or a value that is not one). */
+export function readSession(local, space) {
+    try {
+        const value = JSON.parse(local.getItem(STORAGE_KEY(space)) ?? "null");
+        return isSession(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+const writeSession = (local, space, s) => local.setItem(STORAGE_KEY(space), JSON.stringify(s));
+/** Where to send the person to sign in: a fresh verifier kept in this tab, its S256 as the challenge. */
+export async function signInAddress(config, space, returnUrl, stores) {
+    const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    stores.tab.setItem(VERIFIER_KEY, verifier);
+    const query = new URLSearchParams({ space, return: returnUrl, challenge: await s256(verifier) });
+    return `${config.signInUrl}?${query}`;
+}
+/** The one-time code the sign-in page put in the fragment, or null. */
+export function codeFrom(hash) {
+    return new URLSearchParams(hash.replace(/^#/, "")).get("smoodly_code") || null;
+}
+async function post(doFetch, url, body) {
+    const res = await doFetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+    const json = (await res.json().catch(() => null));
+    return { status: res.status, data: json?.ok ? json.data : null, message: typeof json?.message === "string" ? json.message : null };
+}
+/** What the admin shows when the service cannot be reached at sign-in: a refusal with a way back, never a blank screen. */
+export const UNREACHABLE = "smoodly: couldn't reach Smoodly to sign you in — check the connection and sign in again.";
+/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. A service
+ *  that cannot be reached is a refusal too (UNREACHABLE), so the shell shows it rather than waiting forever. */
+export async function exchange(api, space, code, stores, doFetch = fetch) {
+    const verifier = stores.tab.getItem(VERIFIER_KEY);
+    stores.tab.removeItem(VERIFIER_KEY);
+    if (!verifier)
+        return { refused: "smoodly: this sign-in was started in another tab or has already been used — sign in again." };
+    let answer;
+    try {
+        answer = await post(doFetch, sessionUrl(api, space, "session"), { code, verifier });
+    }
+    catch {
+        return { refused: UNREACHABLE };
+    }
+    if (answer.status !== 200 || !isSession(answer.data))
+        return { refused: answer.message ?? `smoodly: the sign-in was refused (${answer.status}).` };
+    writeSession(stores.local, space, answer.data);
+    return answer.data;
+}
+/** The load-time step with no code in the fragment: the stored session adopted as it is while its pass has more than
+ *  RENEW_BEFORE_MS left, else renewed; a renewal the service refuses sends the person to sign in; one that cannot reach
+ *  the service keeps a pass that is still valid (the next timer tries again) and refuses with UNREACHABLE only once the
+ *  pass has expired. No stored session: sign in. */
+export async function resume(api, space, stores, now, doFetch = fetch, lock = tabLock) {
+    const stored = readSession(stores.local, space);
+    if (!stored)
+        return { kind: "sign_in" };
+    if (stored.expiresAt - now > RENEW_BEFORE_MS)
+        return { kind: "adopt", session: stored };
+    try {
+        const renewed = await renew(api, space, stores, stored.refresh, doFetch, lock);
+        return renewed ? { kind: "adopt", session: renewed } : { kind: "sign_in" };
+    }
+    catch {
+        return stored.expiresAt > now ? { kind: "adopt", session: stored } : { kind: "refused", message: UNREACHABLE };
+    }
+}
+const tabLock = (name, fn) => {
+    const locks = globalThis.navigator?.locks;
+    return locks ? locks.request(name, fn) : fn();
+};
+/** A renewed session, or null when the space refused the refresh (the stored session is then cleared). `held` is the
+ *  refresh this tab holds: when the stored one differs, another tab renewed first and its session is adopted rather
+ *  than posting a refresh that is already spent. The read and the post run under one lock per space across the site's
+ *  tabs, so the tab that renews writes before the others read (spec §2), even when every tab's timer fires at once
+ *  after a laptop wakes. A network failure throws and keeps the session. */
+export function renew(api, space, stores, held, doFetch = fetch, lock = tabLock) {
+    return lock(`smoodly-renew:${space}`, () => renewHeld(api, space, stores, held, doFetch));
+}
+async function renewHeld(api, space, stores, held, doFetch) {
+    const stored = readSession(stores.local, space);
+    if (!stored)
+        return null;
+    if (held !== null && stored.refresh !== held)
+        return stored;
+    const answer = await post(doFetch, sessionUrl(api, space, "session/refresh"), { refresh: stored.refresh });
+    if (answer.status === 200 && isSession(answer.data)) {
+        writeSession(stores.local, space, answer.data);
+        return answer.data;
+    }
+    if (answer.status === 401 || answer.status === 403) {
+        // Cleared only if no other tab stored a newer one meanwhile.
+        if (readSession(stores.local, space)?.refresh === stored.refresh)
+            stores.local.removeItem(STORAGE_KEY(space));
+        return null;
+    }
+    throw new Error(answer.message ?? `smoodly: the session could not be renewed (${answer.status}).`);
+}
+/** Sign out of this site: the space ends the session, and this browser forgets it even when the call fails. */
+export async function endSession(api, space, stores, doFetch = fetch) {
+    const stored = readSession(stores.local, space);
+    stores.local.removeItem(STORAGE_KEY(space));
+    if (!stored)
+        return;
+    try {
+        await post(doFetch, sessionUrl(api, space, "session/end"), { refresh: stored.refresh });
+    }
+    catch { /* the session lapses on its own */ }
+}

package/dist/admin/shell/AdminApp.d.ts

@@ -1,10 +1,15 @@
 import type { AdminOpAction } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
-import { type AuthConfig } from "./session.ts";
+import type { SignInConfig } from "../session-flow.ts";
 import type { PresenceConfig } from "../../env.ts";
-export declare function AdminApp({ registry, op, auth, presenceConfig }: {
+export declare function AdminApp({ registry, op, signIn, api, presenceConfig }: {
     registry: AdminRegistry;
     op: AdminOpAction;
-    auth: AuthConfig;
+    signIn: SignInConfig;
+    /** Smoodly's API and the site's space: the session routes live under it. */
+    api: {
+        apiUrl: string;
+        spaceId: string;
+    };
     presenceConfig?: PresenceConfig;
 }): import("react").JSX.Element;

package/dist/admin/shell/AdminApp.js

@@ -20,9 +20,8 @@ import { EntryForm } from "./EntryForm.js";
 import { GlobalList } from "./GlobalList.js";
 import { GlobalForm } from "./GlobalForm.js";
 import { EditorView } from "../editor/EditorView.js";
-import { LoginView } from "./LoginView.js";
-import { SetPasswordView } from "./SetPasswordView.js";
-import { useAdminSession } from "./session.js";
+import { SignedOutView } from "./SignedOutView.js";
+import { useSpaceSession } from "./session.js";
 import { IconRail } from "./IconRail.js";
 import { ConfirmHost } from "../ui/ConfirmDialog.js";
 import { notify } from "../ui/confirm.js";
@@ -33,23 +32,27 @@ import { ErrorPane } from "./ErrorPane.js";
 import { MediaScreen } from "./MediaScreen.js";
 import { SettingsView } from "./SettingsView.js";
 import { AssetsProvider } from "../forms/assets-context.js";
+import { xhrSend } from "../forms/upload.js";
 import { ElementsProvider } from "../forms/elements-context.js";
 import { TimeZoneProvider } from "../forms/time-zone-context.js";
-import { SchemaNotice } from "./SchemaNotice.js";
-import { schemaBehind } from "../../schema-version.js";
 import { delivery, onPublished } from "../delivery-mode.js";
 import { pollEvery } from "./deploy-tile.js";
-import { createPresence, followTokenRefresh } from "./presence.js";
-import { connectRealtime } from "./presence-realtime.js";
+import { createPresence } from "./presence.js";
+import { connectSocket } from "./presence-socket.js";
 import { PresenceProvider } from "./presence-context.js";
-export function AdminApp({ registry, op, auth, presenceConfig }) {
-    const session = useAdminSession(auth);
-    // An expired session signs out here, locally: the user it names may no longer exist to log out.
-    const [ops] = useState(() => makeClientOps(op, session.token, () => { void session.client.auth.signOut({ scope: "local" }); }));
+export function AdminApp({ registry, op, signIn, api, presenceConfig }) {
+    const session = useSpaceSession({ apiUrl: api.apiUrl, spaceId: api.spaceId, signIn });
+    // The session's getters read refs, so the facade made once always sends the current pass; a refused pass renews
+    // once and the call is sent again, or the person is sent to sign in.
+    const renewRef = useRef(session.renew);
+    renewRef.current = session.renew;
+    const [ops] = useState(() => makeClientOps(op, session.token, () => renewRef.current()));
+    // Uploads go to the service's media route with the same pass and the same renewal (spec 2026-10-18 media §4).
+    const [upload] = useState(() => ({ send: xhrSend(`${api.apiUrl.replace(/\/+$/, "")}/v1/spaces/${encodeURIComponent(api.spaceId)}/admin/media`, session.token, () => renewRef.current()) }));
     const route = useRoute(registry.adminPath);
     const [head = "pages", tail] = route.segments.length ? route.segments : ["pages"];
     const isCollection = registry.collections.some((c) => c.name === head);
-    const email = session.state.status === "signed_in" ? session.state.session.user.email : undefined;
+    const email = session.state.status === "signed_in" ? session.state.user.email ?? undefined : undefined;
     // The role rides on members.me (members management §2): Settings hides
     // from an editor, and the area itself refuses. Unknown until it answers.
     const signedIn = session.state.status === "signed_in";
@@ -67,28 +70,13 @@ export function AdminApp({ registry, op, auth, presenceConfig }) {
             setRole("editor"); });
         return () => { live = false; };
     }, [signedIn, ops]);
-    // The one version check (spec 2026-09-26 §5): behind blocks the shell,
-    // equal or ahead renders as usual. Unknown until it answers; a failed
-    // call renders as usual too — the notice is for a known-behind schema.
-    const [schema, setSchema] = useState(null);
-    useEffect(() => {
-        if (!signedIn) {
-            setSchema(null);
-            return;
-        }
-        let live = true;
-        ops.schema.status()
-            .then((r) => { if (live && r.ok)
-            setSchema(r.data); })
-            .catch(() => { });
-        return () => { live = false; };
-    }, [signedIn, ops]);
     // The Deploy tile (spec 2026-10-09 static mode §6): on a static site, deploy.status every 30 s, every 5 s
     // while a build is in flight, and at once after any publish; the press records and re-reads.
     const [deploy, setDeploy] = useState(null);
     const [deployBusy, setDeployBusy] = useState(false);
-    const [publishes, setPublishes] = useState(0);
-    useEffect(() => onPublished(() => setPublishes((n) => n + 1)), []);
+    // A publish is done when its pointer moved (spec 2026-10-15 the space object §3): the tile re-reads at once.
+    const [deployTick, setDeployTick] = useState(0);
+    useEffect(() => onPublished(() => setDeployTick((n) => n + 1)), []);
     useEffect(() => {
         if (!signedIn || delivery() !== "static")
             return;
@@ -112,7 +100,7 @@ export function AdminApp({ registry, op, auth, presenceConfig }) {
         void tick();
         return () => { live = false; if (timer)
             clearTimeout(timer); };
-    }, [signedIn, ops, publishes]);
+    }, [signedIn, ops, deployTick]);
     const onDeploy = async () => {
         setDeployBusy(true);
         try {
@@ -126,37 +114,31 @@ export function AdminApp({ registry, op, auth, presenceConfig }) {
             setDeployBusy(false);
         }
     };
-    const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
-    // Presence (spec 2026-09-26 concurrency §5; gated 2026-09-26 security pass §1):
-    // one channel per signed-in session, the content project's public config as the
-    // gateway and the SESSION token on the socket; absent config = presence off.
-    // The token getter is a new closure every render — read it through a ref so
-    // the effect keys on the session, not on the render.
+    // Presence (spec 2026-09-26 concurrency §5; spec 2026-10-16 sign-in and the dashboard §3): one socket per signed-in
+    // tab to the service, opened with a one-time ticket asked with the current pass; every renewal reconnects with a
+    // fresh one. Absent config = presence off. The getters are new closures every render — read them through refs so the
+    // effect keys on the session, not on the render.
     const [presence, setPresence] = useState(null);
     const tokenRef = useRef(session.token);
     tokenRef.current = session.token;
-    const authClient = session.client;
-    const contentUrl = presenceConfig?.url, contentKey = presenceConfig?.key, contentSpace = presenceConfig?.spaceId;
+    const onRenew = useRef(session.onRenew);
+    onRenew.current = session.onRenew;
+    const presenceApi = presenceConfig?.apiUrl, presenceSpace = presenceConfig?.spaceId;
     useEffect(() => {
-        if (!signedIn || !contentUrl || !contentKey || !contentSpace || !email) {
+        if (!signedIn || !presenceApi || !presenceSpace || !email) {
             setPresence(null);
             return;
         }
-        const config = { url: contentUrl, key: contentKey, spaceId: contentSpace };
+        const config = { apiUrl: presenceApi, spaceId: presenceSpace };
         const p = createPresence({
             email,
-            connect: () => {
-                const token = tokenRef.current();
-                if (!token)
-                    throw new Error("smoodly: no session token for presence");
-                return connectRealtime(config, email, token);
-            },
+            connect: () => connectSocket(config, email, { pass: () => tokenRef.current(), renew: () => renewRef.current() }),
         });
         p.join();
         setPresence(p);
-        const stop = followTokenRefresh(authClient.auth, p);
+        const stop = onRenew.current((pass) => p.setAuth(pass));
         return () => { stop(); p.dispose(); setPresence(null); };
-    }, [signedIn, contentUrl, contentKey, contentSpace, email, authClient]);
+    }, [signedIn, presenceApi, presenceSpace, email]);
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }
@@ -164,13 +146,10 @@ export function AdminApp({ registry, op, auth, presenceConfig }) {
     if (mismatch) {
         return _jsx("div", { style: { height: "100vh", display: "flex" }, children: _jsx(ErrorPane, { message: mismatch, back: false }) });
     }
-    if (session.state.status === "signed_out")
-        return _jsx(LoginView, { client: session.client, providers: auth.providers });
-    // An invite or reset link signed the person in: Set password before the shell (members management §6).
-    if (session.arrival)
-        return _jsx(SetPasswordView, { client: session.client, mode: session.arrival, onDone: session.clearArrival });
-    if (schema && schemaBehind(schema.database, schema.required))
-        return _jsx(SchemaNotice, { status: schema });
+    if (session.state.status === "signed_out") {
+        const message = session.state.reason === "refused" ? session.state.message : undefined;
+        return _jsx(SignedOutView, { host: window.location.host, message: message, onSignIn: () => { void session.signInAgain(); } });
+    }
     let main;
     if (head === "pages" && !tail)
         main = _jsx(PagesList, { ops: ops, registry: registry });
@@ -185,10 +164,10 @@ export function AdminApp({ registry, op, auth, presenceConfig }) {
     else if (head === "globals" && tail)
         main = _jsx(GlobalForm, { ops: ops, registry: registry, name: decodeURIComponent(tail) });
     else if (head === "settings")
-        main = _jsx(SettingsView, { ops: ops, registry: registry, tail: tail, role: role, userId: userId });
+        main = _jsx(SettingsView, { ops: ops, registry: registry, tail: tail, role: role });
     else if (head === "media")
         main = _jsx(MediaScreen, {});
     else
         main = _jsx(ErrorPane, { message: "Not found." });
-    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(PresenceProvider, { value: presence, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(TimeZoneProvider, { zone: registry.timeZone, children: _jsxs(AssetsProvider, { ops: ops, media: registry.media, children: [_jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null, deploy: deploy ? { status: deploy, busy: deployBusy, onDeploy: () => { void onDeploy(); } } : undefined, onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }), _jsx(ConfirmHost, {})] }) }) }) }) }));
+    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(PresenceProvider, { value: presence, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(TimeZoneProvider, { zone: registry.timeZone, children: _jsxs(AssetsProvider, { ops: ops, media: registry.media, upload: upload, children: [_jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null, deploy: deploy ? { status: deploy, busy: deployBusy, onDeploy: () => { void onDeploy(); } } : undefined, onSignOut: () => { void session.signOut(); } }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }), _jsx(ConfirmHost, {})] }) }) }) }) }));
 }

package/dist/admin/shell/ContentHealthPage.js

@@ -26,9 +26,7 @@ export function ContentHealthPage({ ops, registry, initial = null }) {
         return _jsx(ErrorPane, { message: error, back: false, onRetry: scan });
     const sections = report ? healthSections(report, registry) : null;
     const brokenCount = sections ? sections.broken.length + sections.collections.length : 0;
-    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Content health" }), right: _jsxs(_Fragment, { children: [report && _jsx("span", { className: "sm-hint", children: "Checked just now" }), _jsx(Button, { variant: "secondary", onClick: scan, disabled: !report, children: "Rescan" })] }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table sm-health", children: [!sections && _jsx("div", { className: "sm-empty", children: "Checking content\u2026" }), report?.delivery && (_jsx("p", { className: "sm-health__delivery", children: report.delivery.behind === 0
-                                ? "Every published document is current."
-                                : _jsxs(_Fragment, { children: [report.delivery.behind, " ", report.delivery.behind === 1 ? "document is" : "documents are", " behind the current stamp. Run ", _jsx("code", { children: "npx smoodly rebuild" }), " in the site's folder."] }) })), sections && brokenCount === 0 && sections.orphan.length === 0 && _jsx("div", { className: "sm-empty", children: "Everything matches the code." }), sections && brokenCount > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Blocks publishing \u00B7 ", brokenCount] }), sections.collections.map((c) => _jsx("p", { className: "sm-health__headline", children: c.headline }, c.name)), sections.broken.map((g) => _jsx(Group, { group: g }, g.key))] })), sections && sections.orphan.length > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Left over \u00B7 ", sections.orphan.length] }), sections.orphan.map((g) => _jsx(Group, { group: g }, g.key))] }))] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Content health" }), right: _jsxs(_Fragment, { children: [report && _jsx("span", { className: "sm-hint", children: "Checked just now" }), _jsx(Button, { variant: "secondary", onClick: scan, disabled: !report, children: "Rescan" })] }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table sm-health", children: [!sections && _jsx("div", { className: "sm-empty", children: "Checking content\u2026" }), sections && brokenCount === 0 && sections.orphan.length === 0 && _jsx("div", { className: "sm-empty", children: "Everything matches the code." }), sections && brokenCount > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Blocks publishing \u00B7 ", brokenCount] }), sections.collections.map((c) => _jsx("p", { className: "sm-health__headline", children: c.headline }, c.name)), sections.broken.map((g) => _jsx(Group, { group: g }, g.key))] })), sections && sections.orphan.length > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Left over \u00B7 ", sections.orphan.length] }), sections.orphan.map((g) => _jsx(Group, { group: g }, g.key))] }))] }) })] }));
 }
 function Group({ group }) {
     const adminHref = useAdminHref();

package/dist/admin/shell/GlobalFields.d.ts

@@ -1,10 +1,7 @@
 import type { AdminGlobal } from "../serialize.ts";
 import type { Group } from "../forms/tabs.ts";
-import { type NodeValues } from "../editor/InspectorFields.tsx";
 import type { RefOption } from "../forms/ref-picker.ts";
 export type { RefOption };
-/** The item's value map as the inspector reads it: the reserved keys pulled out into their namespaces. */
-export declare function globalValues(fields: Record<string, unknown>): NodeValues;
 export declare function GlobalFields({ item, groups, fields, errors, refOptions, multilingual, inlinePath, onEditHere, onChange }: {
     item: AdminGlobal;
     groups: Group[];

package/dist/admin/shell/GlobalFields.js

@@ -5,7 +5,7 @@ import { FieldWidget } from "../forms/FieldWidget.js";
 import { InspectorFields, valueOf } from "../editor/InspectorFields.js";
 import { UnlocalizedMark } from "../ui/primitives.js";
 /** The item's value map as the inspector reads it: the reserved keys pulled out into their namespaces. */
-export function globalValues(fields) {
+function globalValues(fields) {
     const ns = (key) => (fields[key] && typeof fields[key] === "object" ? fields[key] : {});
     return { fields, settings: ns(SETTINGS_KEY), styles: ns(STYLES_KEY), css: typeof fields[CSS_KEY] === "string" ? fields[CSS_KEY] : undefined };
 }