smoodly 0.0.52 → 0.0.54

package/dist/admin/handler.d.ts

@@ -3,7 +3,7 @@ import type { PresenceConfig } from "../env.ts";
 import { type KeySet } from "../signed-message.ts";
 import { type AdminFiles } from "./files.ts";
 import type { AdminEffects } from "./ops.ts";
-import type { SignInConfig } from "./auth-config.ts";
+import type { SignInConfig } from "./session-flow.ts";
 export type AdminHandlerDeps = {
     config: ResolvedConfig;
     /** Where the browser sends a person to sign in, and the dashboard it links to: public values only. Absent, the page

package/dist/admin/index.d.ts

@@ -1,10 +1,10 @@
 export type { AdminEffects, AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
-export type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+export type { MemberRecord } from "../member-store.ts";
 export type { MemberRole } from "../permissions.ts";
 export { fixedNodeSpecs, fixedNodeOf, type FixedNode } from "./fixed-nodes.ts";
 export { initialGlobalFields } from "./global-items.ts";
 export { makeClientOps } from "./client-ops.ts";
-export type { SignInConfig } from "./auth-config.ts";
+export type { SignInConfig } from "./session-flow.ts";
 export { serializeAdminConfig } from "./serialize.ts";
 export type { AdminRegistry, AdminSection, AdminCollection, AdminPageTemplate, AdminGlobal, AdminField } from "./serialize.ts";
 export * from "./tree-ops.ts";

package/dist/admin/ops.d.ts

@@ -3,7 +3,7 @@ import type { PageTree } from "../page-context.ts";
 import type { EntryRecord, EntryUsage } from "../entry-store.ts";
 import type { AssetRecord, AssetMeta } from "../media.ts";
 import type { AssetPage, AssetQuery } from "../asset-store.ts";
-import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+import type { MemberRecord } from "../member-store.ts";
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 import type { DeployState } from "../deploy-state.ts";
@@ -126,10 +126,9 @@ export type AssetUsageItem = {
     title: string;
     href: string | null;
 };
-/** The Members page's read (spec 2026-09-25 §4): the rows and, when the control plane manages them, where. */
+/** The Members page's read (spec 2026-09-25 §4): the rows; the dashboard manages them. */
 export type MembersListResult = {
     members: MemberRecord[];
-    consoleUrl: string | null;
 };
 /** `database` null = no smoodly_meta table (older than v1). Behind blocks the shell; ahead is silent (spec 2026-09-26 §5). */
 /** The Deploy tile's state (spec 2026-10-09 static mode §6); `hook` false = SMOODLY_DEPLOY_HOOK is unset, Deploy disabled. */
@@ -254,18 +253,13 @@ export type AdminOps = {
         usage(id: string): Promise<OpResult<AssetUsageItem[]>>;
     };
     members: {
-        /** The space's members; admins only. `consoleUrl` set means smoodly.io manages them and every write below is blocked. */
+        /** The space's members, a read-only list; admins only. Invites, roles and removals are the dashboard's
+         *  (spec 2026-10-16 sign-in and the dashboard §6). */
         list(): Promise<OpResult<MembersListResult>>;
         /** The caller's role; every member. The shell hides Settings from editors with it. */
         me(): Promise<OpResult<{
             role: MemberRole;
         }>>;
-        /** Admins only, self-host only: invites (or adds an existing account), refuses a duplicate row (spec 2026-09-25 members management §3). */
-        invite(input: InviteInput): Promise<OpResult<InviteResult>>;
-        /** Admins only, self-host only; never your own row, never the last admin. */
-        setRole(userId: string, role: MemberRole): Promise<OpResult<MemberRecord>>;
-        /** Admins only, self-host only; the same two guards. The Auth account stays. */
-        remove(userId: string): Promise<OpResult<null>>;
     };
     /** Redirects by hand (spec 2026-09-26 redirects §5): open to every member, as renaming is; nothing here expires a cache. */
     redirects: {

package/dist/admin/page-data.d.ts

@@ -1,6 +1,6 @@
 import type { PresenceConfig } from "../env.ts";
 import type { AdminRegistry } from "./serialize.ts";
-import type { SignInConfig } from "./auth-config.ts";
+import type { SignInConfig } from "./session-flow.ts";
 export type AdminPageData = {
     registry: AdminRegistry;
     /** Where the browser sends a person to sign in and the dashboard it links to: public values only. */

package/dist/admin/session-flow.d.ts

@@ -1,5 +1,11 @@
 import type { MemberRole } from "../permissions.ts";
-import type { SignInConfig } from "./auth-config.ts";
+/** Where the admin sends a person to sign in, and the dashboard its account menu and Members page link to (spec
+ *  2026-10-16 sign-in and the dashboard §1, §6): `GET /v1/auth` answers it from the Worker's env; the handler and the
+ *  page data carry it. Public values only. */
+export type SignInConfig = {
+    signInUrl: string;
+    consoleUrl: string;
+};
 export declare const STORAGE_KEY: (space: string) => string;
 /** The PKCE verifier, in this tab's `sessionStorage` only: the code is good for the browser tab that asked for it. */
 export declare const VERIFIER_KEY = "smoodly-verifier";
@@ -26,10 +32,26 @@ export declare function readSession(local: Storage, space: string): StoredSessio
 export declare function signInAddress(config: SignInConfig, space: string, returnUrl: string, stores: Pick<SessionStores, "tab">): Promise<string>;
 /** The one-time code the sign-in page put in the fragment, or null. */
 export declare function codeFrom(hash: string): string | null;
-/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. */
+/** What the admin shows when the service cannot be reached at sign-in: a refusal with a way back, never a blank screen. */
+export declare const UNREACHABLE = "smoodly: couldn't reach Smoodly to sign you in \u2014 check the connection and sign in again.";
+/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. A service
+ *  that cannot be reached is a refusal too (UNREACHABLE), so the shell shows it rather than waiting forever. */
 export declare function exchange(api: string, space: string, code: string, stores: SessionStores, doFetch?: typeof fetch): Promise<StoredSession | {
     refused: string;
 }>;
+/** The load-time step with no code in the fragment: the stored session adopted as it is while its pass has more than
+ *  RENEW_BEFORE_MS left, else renewed; a renewal the service refuses sends the person to sign in; one that cannot reach
+ *  the service keeps a pass that is still valid (the next timer tries again) and refuses with UNREACHABLE only once the
+ *  pass has expired. No stored session: sign in. */
+export declare function resume(api: string, space: string, stores: Pick<SessionStores, "local">, now: number, doFetch?: typeof fetch, lock?: TabLock): Promise<{
+    kind: "adopt";
+    session: StoredSession;
+} | {
+    kind: "sign_in";
+} | {
+    kind: "refused";
+    message: string;
+}>;
 /** Runs `fn` while holding a lock no other tab of this origin holds (Web Locks); with no Web Locks (an insecure
  *  context), at once. */
 export type TabLock = <T>(name: string, fn: () => Promise<T>) => Promise<T>;

package/dist/admin/session-flow.js

@@ -38,18 +38,45 @@ async function post(doFetch, url, body) {
     const json = (await res.json().catch(() => null));
     return { status: res.status, data: json?.ok ? json.data : null, message: typeof json?.message === "string" ? json.message : null };
 }
-/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. */
+/** What the admin shows when the service cannot be reached at sign-in: a refusal with a way back, never a blank screen. */
+export const UNREACHABLE = "smoodly: couldn't reach Smoodly to sign you in — check the connection and sign in again.";
+/** The code and this tab's verifier for a session, stored; or why not. The verifier is spent either way. A service
+ *  that cannot be reached is a refusal too (UNREACHABLE), so the shell shows it rather than waiting forever. */
 export async function exchange(api, space, code, stores, doFetch = fetch) {
     const verifier = stores.tab.getItem(VERIFIER_KEY);
     stores.tab.removeItem(VERIFIER_KEY);
     if (!verifier)
         return { refused: "smoodly: this sign-in was started in another tab or has already been used — sign in again." };
-    const answer = await post(doFetch, sessionUrl(api, space, "session"), { code, verifier });
+    let answer;
+    try {
+        answer = await post(doFetch, sessionUrl(api, space, "session"), { code, verifier });
+    }
+    catch {
+        return { refused: UNREACHABLE };
+    }
     if (answer.status !== 200 || !isSession(answer.data))
         return { refused: answer.message ?? `smoodly: the sign-in was refused (${answer.status}).` };
     writeSession(stores.local, space, answer.data);
     return answer.data;
 }
+/** The load-time step with no code in the fragment: the stored session adopted as it is while its pass has more than
+ *  RENEW_BEFORE_MS left, else renewed; a renewal the service refuses sends the person to sign in; one that cannot reach
+ *  the service keeps a pass that is still valid (the next timer tries again) and refuses with UNREACHABLE only once the
+ *  pass has expired. No stored session: sign in. */
+export async function resume(api, space, stores, now, doFetch = fetch, lock = tabLock) {
+    const stored = readSession(stores.local, space);
+    if (!stored)
+        return { kind: "sign_in" };
+    if (stored.expiresAt - now > RENEW_BEFORE_MS)
+        return { kind: "adopt", session: stored };
+    try {
+        const renewed = await renew(api, space, stores, stored.refresh, doFetch, lock);
+        return renewed ? { kind: "adopt", session: renewed } : { kind: "sign_in" };
+    }
+    catch {
+        return stored.expiresAt > now ? { kind: "adopt", session: stored } : { kind: "refused", message: UNREACHABLE };
+    }
+}
 const tabLock = (name, fn) => {
     const locks = globalThis.navigator?.locks;
     return locks ? locks.request(name, fn) : fn();

package/dist/admin/shell/AdminApp.d.ts

@@ -1,6 +1,6 @@
 import type { AdminOpAction } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
-import type { SignInConfig } from "../auth-config.ts";
+import type { SignInConfig } from "../session-flow.ts";
 import type { PresenceConfig } from "../../env.ts";
 export declare function AdminApp({ registry, op, signIn, api, presenceConfig }: {
     registry: AdminRegistry;

package/dist/admin/shell/IconRail.js

@@ -1,10 +1,11 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // packages/smoodly/src/admin/shell/IconRail.tsx
-// The admin's primary navigation: the design system's 72px IconRail
-// (design_handoff_smoodly_cms/components/navigation/IconRail), which
-// replaced the 200px SideNav so the visual editor gets the width. Ported
-// markup-for-markup; the handoff's click handlers are the shell's router.
+// The admin's primary navigation: the design handoff's 72px IconRail (the
+// cool-blue look's components/navigation/IconRail, in the tree until 2026-10-19;
+// the shipped tokens are design_handoff_smoodly_neutral/), which replaced the
+// 200px SideNav so the visual editor gets the width. Ported markup-for-markup;
+// the handoff's click handlers are the shell's router.
 //
 // Items are registry-derived, never separately configured: Pages, then
 // Collections — one rail item whose flyout lists every collection — then

package/dist/admin/shell/presence.d.ts

@@ -15,7 +15,7 @@ export type PresenceState = {
     status: PresenceStatus;
     others: PresenceEntry[];
 };
-/** The channel presence uses: once a Realtime channel's slice, now the service's socket (presence-socket.ts). */
+/** The channel presence uses: the service's socket (presence-socket.ts). */
 export type PresenceChannel = {
     subscribe(onStatus: (status: string) => void): void;
     /** The session renewed (its new pass): reconnect with a fresh ticket. The space's object admits a live session of a

package/dist/admin/shell/session.d.ts

@@ -1,5 +1,4 @@
-import type { SignInConfig } from "../auth-config.ts";
-import { type StoredSession } from "../session-flow.ts";
+import { type SignInConfig, type StoredSession } from "../session-flow.ts";
 export type SessionUser = StoredSession["user"];
 export type SessionState = {
     status: "loading";

package/dist/admin/shell/session.js

@@ -7,7 +7,7 @@
 // straight back in while their smoodly.io session lives. Another tab's renewal or sign out is adopted from the
 // `storage` event. The pure steps are admin/session-flow.ts.
 import { useCallback, useEffect, useRef, useState } from "react";
-import { codeFrom, endSession, exchange, readSession, renew, RENEW_BEFORE_MS, signInAddress, STORAGE_KEY } from "../session-flow.js";
+import { codeFrom, endSession, exchange, readSession, renew, RENEW_BEFORE_MS, resume, signInAddress, STORAGE_KEY } from "../session-flow.js";
 /** A renewal's timer fires up to this much later, so two tabs rarely post the same refresh at once. */
 const JITTER_MS = 30000;
 export function useSpaceSession({ apiUrl, spaceId, signIn }) {
@@ -69,16 +69,17 @@ export function useSpaceSession({ apiUrl, spaceId, signIn }) {
                     adopt(got);
                 return;
             }
-            const stored = readSession(window.localStorage, spaceId);
-            if (!stored) {
-                await signInAgain();
+            // The stored session, as it is or renewed; a service that cannot be reached keeps a still-valid pass and
+            // refuses, with a way back, only once it has expired (session-flow.ts resume).
+            const step = await resume(apiUrl, spaceId, stores(), Date.now());
+            if (!live)
                 return;
-            }
-            held.current = stored;
-            if (stored.expiresAt - Date.now() > RENEW_BEFORE_MS)
-                adopt(stored);
+            if (step.kind === "adopt")
+                adopt(step.session);
+            else if (step.kind === "refused")
+                setState({ status: "signed_out", reason: "refused", message: step.message });
             else
-                await renewNow();
+                await signInAgain();
         })();
         const onStorage = (e) => {
             if (e.key !== STORAGE_KEY(spaceId))

package/dist/admin/ui/ActionMenu.d.ts

@@ -3,6 +3,8 @@ export type ActionMenuItem = {
     run(): void;
     disabled?: boolean;
     danger?: boolean;
+    /** The reason on a disabled entry (a paste the zone refuses), shown as the button's title. */
+    title?: string;
 };
 /** The button's box in viewport pixels, `right` measured from the viewport's right edge. */
 type Anchor = {

package/dist/admin/ui/ActionMenu.js

@@ -68,5 +68,5 @@ export function ActionMenu({ label, items, disabled, small = false }) {
             document.removeEventListener("scroll", onScroll, true);
         };
     }, [open]);
-    return (_jsxs("div", { ref: ref, style: { position: "relative", flex: "none" }, children: [_jsx("button", { ref: button, type: "button", className: cx("sm-dotmenu", small && "sm-dotmenu--sm"), "aria-label": label, title: label, "aria-haspopup": "menu", "aria-expanded": open !== null, disabled: disabled, onClick: toggle, children: "\u00B7\u00B7\u00B7" }), open && (_jsx("div", { ref: menu, role: "menu", className: "sm-picker sm-picker--menu", style: place ?? { top: open.bottom + 6, right: open.right, visibility: "hidden" }, children: items.map((item) => (_jsx("button", { type: "button", role: "menuitem", className: cx("sm-picker__item", item.danger && "sm-picker__item--danger"), disabled: item.disabled, onClick: () => { setOpen(null); item.run(); }, children: item.label }, item.label))) }))] }));
+    return (_jsxs("div", { ref: ref, style: { position: "relative", flex: "none" }, children: [_jsx("button", { ref: button, type: "button", className: cx("sm-dotmenu", small && "sm-dotmenu--sm"), "aria-label": label, title: label, "aria-haspopup": "menu", "aria-expanded": open !== null, disabled: disabled, onClick: toggle, children: "\u00B7\u00B7\u00B7" }), open && (_jsx("div", { ref: menu, role: "menu", className: "sm-picker sm-picker--menu", style: place ?? { top: open.bottom + 6, right: open.right, visibility: "hidden" }, children: items.map((item) => (_jsx("button", { type: "button", role: "menuitem", className: cx("sm-picker__item", item.danger && "sm-picker__item--danger"), disabled: item.disabled, title: item.title, onClick: () => { setOpen(null); item.run(); }, children: item.label }, item.label))) }))] }));
 }

package/dist/admin/ui/primitives.d.ts

@@ -103,6 +103,7 @@ export declare function Segmented<T extends string>({ options, value, onChange,
         disabled?: boolean;
         title?: string;
         className?: string;
+        "aria-label"?: string;
     } | undefined;
 }): import("react").JSX.Element;
 export declare function StatusBadge({ status }: {

package/dist/admin/ui/primitives.js

@@ -1,7 +1,8 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // The design system's primitives, ported 1:1 from the handoff's
-// components/ set (design_handoff_smoodly_cms). Structure and dynamic
+// components/ set (the cool-blue look, in the tree until 2026-10-19; the shipped
+// tokens are design_handoff_smoodly_neutral/). Structure and dynamic
 // values live here; every static rule, and all hover/focus state, lives in
 // theme.tsx's stylesheet.
 import { Fragment, useEffect, useRef } from "react";
@@ -102,7 +103,7 @@ export function Tabs({ tabs, value, onChange }) {
 export function Segmented({ options, value, onChange, stretch, disabled, label, option, className }) {
     return (_jsx("div", { className: cx("sm-seg", stretch && "sm-seg--stretch", disabled && "sm-seg--disabled", className), children: options.map((o) => {
             const extra = option?.(o);
-            return (_jsx("button", { type: "button", className: cx("sm-seg__opt", extra?.className), "aria-pressed": o === value, disabled: disabled || extra?.disabled, title: extra?.title, onClick: () => onChange(o), children: label ? label(o) : o }, o));
+            return (_jsx("button", { type: "button", className: cx("sm-seg__opt", extra?.className), "aria-pressed": o === value, disabled: disabled || extra?.disabled, title: extra?.title, "aria-label": extra?.["aria-label"], onClick: () => onChange(o), children: label ? label(o) : o }, o));
         }) }));
 }
 /* ── data ────────────────────────────────────────────────────────────── */

package/dist/admin/ui/theme.js

@@ -638,6 +638,8 @@ body:has(.sm-admin){margin:0}
 .sm-seg{display:flex;gap:2px;padding:3px;background:var(--seg-bg);border-radius:var(--radius-btn)}
 /* A locale switch: each option wide enough to read as a tab, not a chip. */
 .sm-seg--locale .sm-seg__opt{min-width:64px}
+/* The Canvas | Structure switch: two icon options. */
+.sm-seg--view .sm-seg__opt{padding:4px 8px;display:grid;place-items:center}
 .sm-seg--stretch{width:100%}
 .sm-seg--disabled{opacity:.6}
 .sm-seg__opt:disabled{cursor:default}
@@ -768,6 +770,11 @@ body:has(.sm-admin){margin:0}
   position:relative;background:var(--page-bg);border-radius:var(--page-radius);
   box-shadow:var(--shadow-page);min-height:100%;
 }
+/* Structure (spec 2026-10-19 editor at launch §1): the structure layer takes the scroller; the frame stays mounted
+   and hidden under it: the wrapper is a zero-height absolute box that clips the frame (so the scroller does not grow by the
+   page's height), while the frame's own box keeps its width and height for the bridge. After .sm-page: it overrides its position. */
+.sm-canvas__scroll--structure{position:relative}
+.sm-page.sm-canvas__hidden{visibility:hidden;position:absolute;left:0;top:0;width:100%;height:0;min-height:0;pointer-events:none}
 .sm-canvas__loading{
   height:240px;display:grid;place-items:center;color:var(--text-subtle);font-family:var(--meta-font);
   font-size:var(--meta-size);letter-spacing:var(--caps-tracking);text-transform:var(--caps-transform);
@@ -834,6 +841,67 @@ body:has(.sm-admin){margin:0}
 /* A row with a grip: the grip takes the left padding's place and the label follows it. */
 .sm-outline-row--grip{padding-left:2px}
 .sm-outline-row--grip .sm-outline-row__label{flex:1}
+/* The structure view (spec 2026-10-19 editor at launch §1): the canvas column as rows of cards, the
+   outline's boxes grown up — a zone's caps label, a card per section on the outline's white, the
+   outline's selected fill and drift stripes. The add affordance between cards is the "+" pill at
+   label size, faint until its row is hovered. */
+.sm-structure{max-width:720px;margin:0 auto;padding:var(--canvas-pad);padding-bottom:40px;display:flex;flex-direction:column;gap:20px}
+.sm-structure__group{display:flex;flex-direction:column;gap:4px}
+.sm-structure__zone{display:flex;align-items:center;justify-content:space-between;gap:8px;min-height:24px}
+.sm-structure__zone .sm-sectionlabel{flex:1;min-width:0}
+.sm-structure__rows{display:flex;flex-direction:column}
+.sm-structure__row{display:flex;flex-direction:column}
+.sm-structure__card{
+  display:grid;grid-template-columns:24px 32px minmax(0,1fr) auto auto;gap:10px;align-items:center;
+  width:100%;min-height:56px;padding:8px 6px 8px 2px;text-align:left;font:inherit;
+  border-radius:var(--outline-row-radius);background:var(--outline-row-bg);border:var(--outline-row-border);
+  color:var(--text);cursor:pointer;
+}
+.sm-structure__card:hover{background:var(--control-hover)}
+.sm-structure__card:hover .sm-grip{opacity:1}
+.sm-structure__card:focus-visible{outline:2px solid var(--accent);outline-offset:-2px}
+.sm-structure__card--selected,.sm-structure__card--selected:hover{background:var(--nav-active-bg);color:var(--nav-active-fg);border-color:transparent}
+.sm-structure__card--locked{background:var(--surface-inset);color:var(--text-muted);border-color:transparent}
+.sm-structure__card--broken{box-shadow:inset 3px 0 0 var(--danger)}
+.sm-structure__card--orphan{box-shadow:inset 3px 0 0 var(--line-dashed)}
+.sm-structure__gripslot{width:24px;height:24px}
+.sm-structure__icon{
+  width:32px;height:32px;display:grid;place-items:center;border-radius:var(--radius-sm);
+  background:var(--surface-inset);font-size:var(--text-lg);line-height:1;flex:none;
+}
+.sm-structure__card--selected .sm-structure__icon,.sm-structure__card--locked .sm-structure__icon{background:color-mix(in srgb,currentColor 10%,transparent)}
+.sm-structure__text{display:flex;flex-direction:column;gap:2px;min-width:0}
+.sm-structure__title{font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;display:flex;align-items:center;gap:6px;min-width:0}
+.sm-structure__badge{
+  font-size:var(--text-sm);font-weight:500;letter-spacing:var(--caps-tracking);text-transform:var(--caps-transform);
+  color:var(--text-muted);flex:none;
+}
+.sm-structure__card--selected .sm-structure__badge{color:inherit;opacity:.8}
+.sm-structure__preview{font-size:var(--text-sm);color:var(--text-muted);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-weight:400}
+.sm-structure__card--selected .sm-structure__preview{color:inherit;opacity:.8}
+.sm-structure__thumb{width:44px;height:30px;border-radius:4px;overflow:hidden;background:var(--surface-inset);flex:none;display:block}
+.sm-structure__img{width:100%;height:100%;object-fit:cover;display:block}
+.sm-structure__menu{display:flex;flex:none}
+.sm-structure__slot{display:flex;justify-content:center;padding:4px 0}
+.sm-structure__add{
+  display:inline-flex;align-items:center;gap:6px;height:24px;padding:0 10px 0 4px;border-radius:999px;border:0;
+  background:var(--plus-bg);color:var(--plus-fg);font:500 var(--text-sm)/1 var(--font-sans);cursor:pointer;
+  box-shadow:var(--plus-shadow);white-space:nowrap;opacity:.35;transition:opacity .12s,background .12s;
+}
+.sm-structure__add-icon{
+  width:16px;height:16px;flex:none;border-radius:50%;background:var(--plus-icon-bg);color:var(--plus-icon-fg);
+  display:grid;place-items:center;font-size:12px;line-height:1;
+}
+.sm-structure__row:hover .sm-structure__add,.sm-structure__slot:hover .sm-structure__add,.sm-structure__add:focus-visible,.sm-structure__empty .sm-structure__add{opacity:1}
+.sm-structure__add:hover{background:var(--plus-hover)}
+/* The lifted row keeps the hook's transform and z-index; its card carries the shadow, its add slot hides. */
+.sm-structure__row.sm-drag--lifted{background:transparent;box-shadow:none}
+.sm-structure__row.sm-drag--lifted .sm-structure__card{box-shadow:var(--shadow-pop)}
+.sm-structure__row.sm-drag--lifted .sm-structure__slot{visibility:hidden}
+.sm-structure__empty{
+  display:flex;align-items:center;justify-content:space-between;gap:8px;min-height:var(--outline-row-h);padding:4px 12px;
+  border:1px dashed var(--line-dashed);border-radius:var(--outline-row-radius);color:var(--text-muted);font-weight:500;
+}
 
 .sm-picker{
   width:300px;background:var(--menu-bg);border:var(--menu-border);border-radius:var(--radius-md);
@@ -847,6 +915,8 @@ body:has(.sm-admin){margin:0}
 /* after the base item rule: same specificity, so source order decides (ActionMenu states) */
 .sm-picker__item:disabled{opacity:.4;cursor:default}
 .sm-picker__item:disabled:hover{background:transparent}
+/* The clipboard's entry leads the picker (spec 2026-10-19 editor at launch §3), set off from the sections under it. */
+.sm-picker__item--paste{border-bottom:1px solid var(--line);margin-bottom:4px;border-radius:var(--radius-sm) var(--radius-sm) 0 0}
 .sm-picker__item--danger{color:var(--danger)}
 .sm-picker__icon{
   width:26px;height:26px;flex:none;border-radius:var(--radius-sm);background:var(--accent-soft);

package/dist/admin/ui/useSortable.js

@@ -172,7 +172,9 @@ export function useSortable(options) {
         window.addEventListener("keydown", key);
     };
     const onKeyDown = (index) => (e) => {
-        e.stopPropagation(); // the row's own Enter/Space handler must not see the grip's keys
+        // The row's own Enter/Space handler must not see the grip's keys; every other key (the editor's Cmd+Z, review 2026-10-20) bubbles on.
+        if (e.key === "Enter" || e.key === " " || e.key === "ArrowUp" || e.key === "ArrowDown")
+            e.stopPropagation();
         if (e.key !== "ArrowUp" && e.key !== "ArrowDown")
             return;
         e.preventDefault();

package/dist/api-client.js

@@ -65,7 +65,7 @@ export function createSmoodlyApi(options) {
             return (await call("/target-paths", { kind: target.kind, id: target.id })).data;
         },
         async load(target, locale, path, o) {
-            const draft = !!o?.draft || o?.version !== undefined;
+            const draft = !!o?.draft || !!o?.version;
             const r = await call("/load", { kind: target.kind, id: target.id, locale, path, draft: o?.draft ? "1" : undefined, version: o?.version });
             return withTags(r.data, r.tags, draft);
         },

package/dist/assemble.js

@@ -49,7 +49,7 @@ export function checkEntryQuery(schema, collection, o) {
         if (OBJECT_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
             throw new Error(`smoodly: getEntries("${collection}"): "${key}" holds an object — filter on a scalar field instead.`);
         }
-        // Any-of reads the text form of the whole field (PostgREST's `->>`), which for
+        // Any-of reads the text form of the whole field (an array as its JSON text), which for
         // an array is its JSON — `["a"]` never matches "a" — so refuse rather than match nothing.
         if (Array.isArray(o.where[key]) && ARRAY_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
             throw new Error(`smoodly: getEntries("${collection}"): "${key}" is array-valued — any-of is for scalar fields; pass one value to match entries containing it.`);

package/dist/astro/cache.d.ts

@@ -17,7 +17,7 @@ export type Settled = {
     draft: boolean;
     /** The request is under the preview address, cookie or not. */
     preview: boolean;
-    /** The shell rendered a page read from the database and gave it a lifetime. */
+    /** The shell rendered a page read from the service and gave it a lifetime. */
     cacheable: boolean;
     /** When the request began, in milliseconds. */
     started: number;

package/dist/astro/index.js

@@ -79,11 +79,16 @@ export default function smoodly(options = {}) {
     let staticMedia = new Map();
     /** astro.config's `i18n`, which the build holds the config's `routing` against. */
     let i18n;
-    /** The project's API client at build, from its config file (the one `options.config` names) and the env the setup hook loaded. */
-    const buildApi = async () => {
-        const loaded = options.config ? await loadConfigFile(join(root, options.config), root) : await loadConfig(root);
+    /** The project's config at build, from its config file (the one `options.config` names), loaded once and shared by
+     *  every hook; and its API client, from the env the setup hook loaded, made once. Two steps, since the routing
+     *  check wants the config before any env is needed. */
+    let builtConfig = null;
+    const buildConfig = () => (builtConfig ?? (builtConfig = options.config ? loadConfigFile(join(root, options.config), root) : loadConfig(root)));
+    let builtApi = null;
+    const buildApi = () => (builtApi ?? (builtApi = (async () => {
+        const loaded = await buildConfig();
         return { loaded, api: createSmoodlyApi({ ...apiEnv(process.env), config: loaded }) };
-    };
+    })()));
     /** A build read that fails names the service's address and stops the build before any page renders (a static build
      *  with the Worker down would otherwise fail page by page). */
     const fromApi = async (read) => {
@@ -115,7 +120,7 @@ export default function smoodly(options = {}) {
                     injectRoute(route);
                 addMiddleware({ entrypoint: here(`./middleware${ext}`), order: "pre" });
                 if (output === "server" && !config.cache?.provider) {
-                    logger.warn("smoodly: no cache provider in astro.config — every page renders from the database. Add `cache: { provider: memoryCache() }` (from \"astro/config\").");
+                    logger.warn("smoodly: no cache provider in astro.config — every page renders from the service. Add `cache: { provider: memoryCache() }` (from \"astro/config\").");
                 }
                 // astro.config is evaluated before Astro loads .env, so `site: process.env.SITE_URL` there sees only the
                 // shell's value; the env files were read above, and SITE_URL from them sets `site` here. A value
@@ -149,7 +154,7 @@ export default function smoodly(options = {}) {
             // The schema push (spec 2026-10-16 the control plane §4) comes first, in either output: the space then holds the
             // registry this build renders with. A failed push never fails the build; the site runs against the schema the space has.
             "astro:build:start": async ({ logger }) => {
-                const loaded = options.config ? await loadConfigFile(join(root, options.config), root) : await loadConfig(root);
+                const loaded = await buildConfig();
                 // The runtime's startup check, at build in either output: a deploy that builds must not refuse every request.
                 astroRouting(i18n, loaded.locales, loaded.routing);
                 try {

package/dist/astro/runtime.d.ts

@@ -19,7 +19,7 @@ export type { PageHead } from "./head.ts";
 export type { ViewFiles } from "./views-check.ts";
 import { type Shell, type SmoodlyLocals } from "./shell.ts";
 /** The shell's decision with the project's bound site: what routes/page.astro calls, with `Astro.cache`.
- *  A page read from the database gets its lifetime here, before its view renders. The first call compares
+ *  A page read from the service gets its lifetime here, before its view renders. The first call compares
  *  the project's view files to the registry and names every disagreement once. */
 export declare function shell(pathname: string, search: string, state: SmoodlyLocals, views: ViewFiles, cache?: unknown): Promise<Shell>;
 /** getStaticPaths for the static page shell (spec 2026-10-09 static mode §3): every published address of the bound site. */

package/dist/astro/runtime.js

@@ -25,7 +25,7 @@ import { missingViews } from "./views-check.js";
 import { resolveShell } from "./shell.js";
 let viewsChecked = false;
 /** The shell's decision with the project's bound site: what routes/page.astro calls, with `Astro.cache`.
- *  A page read from the database gets its lifetime here, before its view renders. The first call compares
+ *  A page read from the service gets its lifetime here, before its view renders. The first call compares
  *  the project's view files to the registry and names every disagreement once. */
 export async function shell(pathname, search, state, views, cache) {
     if (!viewsChecked) {

package/dist/astro/shell.d.ts

@@ -14,7 +14,7 @@ export type SmoodlyLocals = {
     editor: boolean;
     /** History's stored version, inside a preview only. */
     version?: string;
-    /** Set by the shell when it rendered a page read from the database: the response may be cached under its tags. */
+    /** Set by the shell when it rendered a page read from the service: the response may be cached under its tags. */
     cacheable: boolean;
     /** Set by the shell when it rendered a page at all: in a preview, only that response is a canvas. */
     shell: boolean;

package/dist/astro/shell.js

@@ -52,7 +52,7 @@ export async function resolveShell(deps, pathname, search, state, views) {
         console.warn(`smoodly: no src/page-types/${hit.template}.astro — the record at ${hit.path} is a 404.`);
         return NOT_FOUND;
     }
-    // Only a page read from the database has a tag to expire it by.
+    // Only a page read from the service has a tag to expire it by.
     state.cacheable = !hit.record.id.startsWith("code:") && !state.draft;
     state.shell = true;
     const zoneNames = Object.keys(schema.zones ?? {});

package/dist/content/content-api.d.ts

@@ -22,6 +22,7 @@ export declare class SmoodlyContentError extends Error {
 /** What content() writes through: the operations, the paths index's lookup, an upload. */
 export type ContentTransport = {
     op(call: AdminOpCall): Promise<OpResult<unknown>>;
+    /** The target at an address, as a draft read: what the script is writing, never an edge copy. */
     locate(locale: string, path: string): Promise<PathHit | null>;
     upload(bytes: Uint8Array, filename: string, mime: string | undefined, meta: UploadMeta): Promise<ImageValue>;
 };

package/dist/content/content-api.js

@@ -45,7 +45,9 @@ export function apiTransport(options) {
     const json = (body) => ({ method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
     return {
         op: (call) => send("/op", json({ path: call.path, args: call.args })),
-        locate: (locale, path) => must(send(`/locate?${new URLSearchParams({ locale, path })}`)),
+        // A draft read (DESIGN §1 Content API › Writes): the caller holds the secret key and asks about what it is writing,
+        // and a draft read is never stored at the edge, so a script sees its own create at once.
+        locate: (locale, path) => must(send(`/locate?${new URLSearchParams({ locale, path, draft: "1" })}`)),
         // The bytes as the body with their length, the rest in the query (spec 2026-10-18 media on R2 and Images §4).
         async upload(bytes, filename, mime, meta) {
             const type = mime ?? mimeOf(filename);

package/dist/css.js

@@ -1,7 +1,7 @@
 // The custom-CSS box (spec 2026-09-14 §4): a per-section snippet the
 // wrapper nests under the section's own [data-smd-node] selector. CSS
 // can do two things beyond styling — pull a remote stylesheet and beacon
-// to a host — so those, the two legacy code hooks and the tag-closing
+// to a host — so those, the two old code hooks (`expression()`, `behavior:`) and the tag-closing
 // sequence are refused at save and stripped at render, in that order.
 // The checks run on the snippet with its CSS escapes decoded, so
 // `\75 rl(` cannot spell `url(` past them; and the braces must balance,

package/dist/entry-store.d.ts

@@ -58,8 +58,8 @@ export type Where = Record<string, WhereValue | WhereValue[]>;
  *  adapters read the text form of the whole array, never its elements). */
 export declare const ARRAY_FIELD_TYPES: ReadonlySet<string>;
 /** The memory adapter's and the tests' reading of `where`: a scalar matches an
- *  equal value or an array holding it (JSONB containment); an array is any-of,
- *  compared as text like PostgREST's `->>`. */
+ *  equal value or an array holding it (containment); an array is any-of,
+ *  compared as text (textForm). */
 export declare function matchesWhere(fields: Record<string, unknown>, where: Where): boolean;
 export type ListOptions = {
     /** Equality / any-of on shared fields, executed by the store (spec 2026-09-11 §3). */
@@ -256,8 +256,8 @@ export declare function entryTitleIn(record: EntryRecord, locale: string, schema
  * directions (the SQLite list compiler sorts nulls last to match);
  * the creation tiebreak follows `direction` for non-manual orders.
  * Declared fields compare numerically when both values are numbers,
- * otherwise as strings via `localeCompare` — the same order Postgres
- * gives the jsonb VALUE (`fields->x`) for one type; see MAINTAINERS.md's
- * follow-ups for the mixed-type and JSON-null edges.
+ * otherwise as strings via `localeCompare` — the order the SQLite store's
+ * `COLLATE NOCASE` gives for one type (ASCII only; see MAINTAINERS.md's
+ * follow-ups for the mixed-type, JSON-null and non-ASCII edges).
  */
 export declare function compareEntries(order: EntryOrder, seq: (e: EntryRecord) => number): (a: EntryRecord, b: EntryRecord) => number;

package/dist/entry-store.js

@@ -15,12 +15,12 @@ import { slugOf, unsupportedLocale } from "./paths.js";
  *  containment, and any-of on one is refused by the site layer (both
  *  adapters read the text form of the whole array, never its elements). */
 export const ARRAY_FIELD_TYPES = new Set(["checkboxes", "refList", "list", "tags"]);
-/** PostgREST's `->>`: a scalar's text, an array's or object's JSON text (Postgres
- *  spaces an object's text differently, but no scalar equals either form). */
+/** A field's text form: a scalar's text, an array's or object's JSON text (no scalar
+ *  equals either form), the same in every store. */
 const textForm = (value) => (value !== null && typeof value === "object" ? JSON.stringify(value) : String(value));
 /** The memory adapter's and the tests' reading of `where`: a scalar matches an
- *  equal value or an array holding it (JSONB containment); an array is any-of,
- *  compared as text like PostgREST's `->>`. */
+ *  equal value or an array holding it (containment); an array is any-of,
+ *  compared as text (textForm). */
 export function matchesWhere(fields, where) {
     return Object.entries(where).every(([key, want]) => {
         const have = fields[key];
@@ -134,9 +134,9 @@ export function entryTitleIn(record, locale, schema) {
  * directions (the SQLite list compiler sorts nulls last to match);
  * the creation tiebreak follows `direction` for non-manual orders.
  * Declared fields compare numerically when both values are numbers,
- * otherwise as strings via `localeCompare` — the same order Postgres
- * gives the jsonb VALUE (`fields->x`) for one type; see MAINTAINERS.md's
- * follow-ups for the mixed-type and JSON-null edges.
+ * otherwise as strings via `localeCompare` — the order the SQLite store's
+ * `COLLATE NOCASE` gives for one type (ASCII only; see MAINTAINERS.md's
+ * follow-ups for the mixed-type, JSON-null and non-ASCII edges).
  */
 export function compareEntries(order, seq) {
     return (a, b) => {