smoodly 0.0.7 → 0.0.9

package/dist/richtext-render.js

@@ -0,0 +1,62 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+// The site-side richtext renderer (spec 2026-09-07, list field §5):
+// TipTap JSON → React, a fragment with no wrapper so the developer owns
+// the surrounding element and its class. Pure React, no Node imports, so
+// it works in shared, server and client components alike. Unknown nodes
+// render their children — a document from a later, richer editor degrades
+// instead of crashing. Elements as node views are Phase 3.
+import { Fragment, createElement } from "react";
+/** Only schemes an editor's link may carry reach the page: http(s), mailto, tel,
+ *  and site-relative targets. Anything else (javascript:, data:, an empty href,
+ *  a protocol-relative `//host` or a backslash form `/\host` that a browser
+ *  treats the same way) renders the text without an anchor. */
+const SAFE_HREF = /^(https?:|mailto:|tel:|\/(?![/\\])|#|\?|\.)/i;
+function safeHref(raw) {
+    if (typeof raw !== "string")
+        return null;
+    // URL parsers drop tab, LF and CR, so normalise before testing to see what the parser sees.
+    const href = raw.replace(/[\t\n\r]/g, "").trim();
+    return href !== "" && SAFE_HREF.test(href) ? href : null;
+}
+export function RichText({ doc }) {
+    const d = doc;
+    if (!d || typeof d !== "object" || d.type !== "doc" || !Array.isArray(d.content))
+        return null;
+    return _jsx(_Fragment, { children: renderNodes(d.content) });
+}
+function renderNodes(nodes) {
+    return nodes.map((n, i) => _jsx(Fragment, { children: renderNode(n) }, i));
+}
+function renderNode(node) {
+    if (!node || typeof node !== "object")
+        return null;
+    const children = Array.isArray(node.content) ? renderNodes(node.content) : null;
+    switch (node.type) {
+        case "text": return withMarks(node.text ?? "", node.marks ?? []);
+        case "paragraph": return _jsx("p", { children: children });
+        case "heading": {
+            const level = Math.min(6, Math.max(1, Math.round(Number(node.attrs?.level ?? 1) || 1)));
+            return createElement(`h${level}`, null, children);
+        }
+        case "bulletList": return _jsx("ul", { children: children });
+        case "orderedList": return _jsx("ol", { children: children });
+        case "listItem": return _jsx("li", { children: children });
+        case "blockquote": return _jsx("blockquote", { children: children });
+        case "hardBreak": return _jsx("br", {});
+        default: return children;
+    }
+}
+/** Marks wrap from the first outward: [bold, italic] → <em><strong>…</strong></em>. */
+function withMarks(text, marks) {
+    return marks.reduce((inner, m) => {
+        switch (m.type) {
+            case "bold": return _jsx("strong", { children: inner });
+            case "italic": return _jsx("em", { children: inner });
+            case "link": {
+                const href = safeHref(m.attrs?.href);
+                return href === null ? inner : _jsx("a", { href: href, children: inner });
+            }
+            default: return inner;
+        }
+    }, text);
+}

package/dist/shared-id.d.ts

@@ -0,0 +1,3 @@
+/** RFC 4122 §4.3 uuid v5: sha1(namespace bytes ‖ name bytes), version 5,
+ *  variant 10xx, first 16 bytes of the digest. */
+export declare function sharedEntryId(space: string, name: string): Promise<string>;

package/dist/shared-id.js

@@ -0,0 +1,36 @@
+// The row id of a shared item (spec 2026-09-07 §10 "§3 row id"): uuid v5
+// of (space id as the namespace, item name as the name). Deterministic in
+// both adapters, so a second concurrent materialization of the same item
+// hits the `entries` primary key instead of adding an unremovable
+// duplicate — `delete` refuses every shared row. The space is part of it
+// because the primary key is `id` alone and, in the cloud, many spaces
+// share one table: a name-only id would make space B's footer collide
+// with space A's.
+//
+// No imports — Web Crypto (`globalThis.crypto.subtle`) exists in Node
+// >= 20 and in every browser, so this module carries no node builtin
+// into the package root's graph. It matters because every scaffolded
+// section does `import { f, smoodly } from "smoodly"`, and a "use client"
+// section's browser build would fail on `node:crypto`.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The namespace's 16 raw bytes — RFC 4122 hashes the bytes, not the text. */
+function uuidBytes(uuid) {
+    if (!UUID_RE.test(uuid))
+        throw new Error(`smoodly: "${uuid}" is not a uuid — a shared item's namespace is the space id.`);
+    const hex = uuid.replace(/-/g, "");
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++)
+        bytes[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+    return bytes;
+}
+/** RFC 4122 §4.3 uuid v5: sha1(namespace bytes ‖ name bytes), version 5,
+ *  variant 10xx, first 16 bytes of the digest. */
+export async function sharedEntryId(space, name) {
+    const input = new Uint8Array([...uuidBytes(space), ...new TextEncoder().encode(name)]);
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-1", input));
+    const bytes = digest.subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50; // version 5 in the high nibble of octet 6
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10xx in the top bits of octet 8
+    const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/dist/shared.d.ts

@@ -0,0 +1,46 @@
+import type { CollectionSchema } from "./collections.ts";
+import type { Descriptor } from "./fields.ts";
+import type { PairedComponent } from "./pairing.tsx";
+import type { BuilderMap, NamespaceValues, SectionSchema } from "./schema.ts";
+/** The reserved tree node type of a placement. */
+export declare const SHARED_NODE_TYPE = "shared";
+/** The reserved key a visual item's styles live under in the node's shared JSONB. */
+export declare const STYLES_KEY = "$styles";
+export type SharedSchema<V = Record<string, unknown>> = CollectionSchema<any> & {
+    kind: "shared";
+    /** The registered section a visual item renders through; absent = an object item. */
+    section?: string;
+    /** The section's style descriptors (empty for an object item). */
+    styles: Record<string, Descriptor>;
+    sample?: Record<string, unknown>;
+    /** phantom: what getShared returns */
+    readonly __value?: V;
+};
+export type SharedLink = {
+    item: string;
+    ref: string;
+};
+/** The placement a tree node is, or null for any other node. Accepts a
+ *  bare `{ type, fields }` shape or a full tree node — `id` (and any
+ *  other tree-node property) is ignored. */
+export declare function sharedLink(node: {
+    id?: string;
+    type: string;
+    fields?: Record<string, unknown>;
+}): SharedLink | null;
+type SharedInput = {
+    name: string;
+    title: string;
+    versions?: boolean;
+};
+export declare function shared<F extends BuilderMap>(input: SharedInput & {
+    fields: F;
+    section?: undefined;
+}): SharedSchema<NamespaceValues<F>>;
+export declare function shared<F extends BuilderMap, St extends BuilderMap>(input: SharedInput & {
+    section: PairedComponent<SectionSchema<F, St>, F, St>;
+    fields?: undefined;
+}): SharedSchema<NamespaceValues<F> & {
+    styles: NamespaceValues<St>;
+}>;
+export {};

package/dist/shared.js

@@ -0,0 +1,36 @@
+/** The reserved tree node type of a placement. */
+export const SHARED_NODE_TYPE = "shared";
+/** The reserved key a visual item's styles live under in the node's shared JSONB. */
+export const STYLES_KEY = "$styles";
+/** The placement a tree node is, or null for any other node. Accepts a
+ *  bare `{ type, fields }` shape or a full tree node — `id` (and any
+ *  other tree-node property) is ignored. */
+export function sharedLink(node) {
+    if (node.type !== SHARED_NODE_TYPE)
+        return null;
+    const { item, ref } = node.fields ?? {};
+    return typeof item === "string" && typeof ref === "string" ? { item, ref } : null;
+}
+export function shared(input) {
+    if (!input?.name)
+        throw new Error("smoodly: a shared item requires a name.");
+    if ((input.fields === undefined) === (input.section === undefined)) {
+        throw new Error(`smoodly: shared item "${input.name}" must declare exactly one of \`section\` or \`fields\`.`);
+    }
+    const fields = input.section
+        ? input.section.schema.fields
+        : Object.fromEntries(Object.entries(input.fields).map(([k, b]) => [k, b.descriptor]));
+    if (Object.prototype.hasOwnProperty.call(fields, STYLES_KEY)) {
+        throw new Error(`smoodly: shared item "${input.name}" has a field named "${STYLES_KEY}" — that key is reserved for a visual item's styles.`);
+    }
+    return {
+        kind: "shared",
+        name: input.name,
+        title: input.title,
+        fields,
+        styles: input.section ? input.section.schema.styles : {},
+        ...(input.section ? { section: input.section.schema.name } : {}),
+        ...(input.section?.schema.sample ? { sample: input.section.schema.sample } : {}),
+        ...(input.versions ? { versions: true } : {}),
+    };
+}

package/dist/site.d.ts

@@ -3,6 +3,7 @@ import { type EntryRecord, type EntryStore } from "./entry-store.ts";
 import { type LocaleSet, type PathTarget } from "./paths.ts";
 import type { SectionLike } from "./refs.ts";
 import type { PageContext, PageLink, PageTree } from "./render.tsx";
+import { type SharedSchema } from "./shared.ts";
 import type { PageRecord, PageStore } from "./store.ts";
 export type SiteOptions = {
     stores: () => {
@@ -11,6 +12,7 @@ export type SiteOptions = {
     };
     collections: CollectionSchema<any>[];
     sections: SectionLike[];
+    shared?: SharedSchema[];
     locales: LocaleSet;
     homePageSlug?: string;
 };
@@ -82,6 +84,14 @@ export interface SmoodlySite {
     getEntriesTree(collection: string, options?: {
         locale?: string;
     }): Promise<EntryTreeItem[]>;
+    /** A shared item's content in a locale (spec 2026-09-07 §4): an object
+     *  item's merged fields, or a visual item's section props (fields plus
+     *  `styles`), refs hydrated; null when the item has no row there or is
+     *  unpublished (outside draft mode). */
+    getShared<V>(item: SharedSchema<V>, options?: {
+        locale?: string;
+        draft?: boolean;
+    }): Promise<V | null>;
 }
 /** The `page` prop for a loaded page. `toUrl` is the app's `href` seam
  *  bound to the render locale; the default keeps CMS paths as URLs. */

package/dist/site.js

@@ -1,6 +1,7 @@
 import { entryFieldsIn, schemaOf } from "./entry-store.js";
 import { buildPageTree, chainOf, entryPathRows, entrySegment, pagePath, } from "./paths.js";
 import { resolveFields, resolveTree } from "./resolve.js";
+import { STYLES_KEY } from "./shared.js";
 /** The `page` prop for a loaded page. `toUrl` is the app's `href` seam
  *  bound to the render locale; the default keeps CMS paths as URLs. */
 export function pageContextOf(hit, toUrl = (p) => p) {
@@ -51,7 +52,12 @@ export function createSmoodlySite(options) {
         const raw = draft ? await pages.getDraftTree(id, locale) : row.status === "published" ? await pages.getPublishedTree(id, locale) : null;
         if (!raw)
             return null;
-        const tree = await resolveTree(raw, { sections: options.sections, collections: options.collections, fetch: fetcher(draft, locale) });
+        const tree = await resolveTree(raw, {
+            sections: options.sections,
+            collections: options.collections,
+            shared: options.shared,
+            fetch: fetcher(draft, locale),
+        });
         const all = await pages.listPages();
         const index = new Map(all.map((n) => [n.id, n]));
         const byId = (x) => index.get(x);
@@ -171,6 +177,27 @@ export function createSmoodlySite(options) {
             const build = (parentId) => items.filter((i) => i.entry.parentId === parentId).map((i) => ({ ...i, children: build(i.entry.id) }));
             return build(null);
         },
+        async getShared(item, o) {
+            const locale = localeOf(o);
+            const draft = o?.draft ?? false;
+            const { entries } = options.stores();
+            const [record] = await entries.list(item.name);
+            if (!record)
+                return null;
+            const row = record.locales[locale];
+            if (!row || (!draft && row.status !== "published"))
+                return null;
+            const raw = draft
+                ? entryFieldsIn(record, locale)
+                : (await entries.getMany(item.name, [record.id], locale, { status: "published" }))[record.id];
+            if (!raw)
+                return null;
+            const fields = await resolveFields(raw, item.fields, { collections: options.collections, fetch: fetcher(draft, locale) });
+            if (!item.section)
+                return fields;
+            const { [STYLES_KEY]: styles, ...rest } = fields;
+            return { ...rest, styles: styles !== null && typeof styles === "object" ? styles : {} };
+        },
     };
     const site = {
         locales,

package/dist/sql-space.d.ts

@@ -1,6 +1,10 @@
+/** The one space a self-host install has; the space a request with no
+ *  claim resolves to. The bare uuid — code needs the value (a shared
+ *  item's id namespace), SQL needs it quoted. */
+export declare const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
 export declare const DEFAULT_SPACE = "'00000000-0000-0000-0000-000000000000'";
 export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0000-0000-0000-000000000000'";
-export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "saved_sections", "global_sections", "entries", "entry_locales", "entry_versions", "refs", "paths"];
+export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths"];
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 export declare function currentSpaceSQL(): string;
 export declare function spaceLayerSQL(): string;

package/dist/sql-space.js

@@ -2,14 +2,16 @@
 // is one cloud environment; a self-host install is one space with the
 // default id. Everything that needs "which space is this request in"
 // reads smoodly_current_space() — the adapters never mention spaces.
-export const DEFAULT_SPACE = `'00000000-0000-0000-0000-000000000000'`;
+/** The one space a self-host install has; the space a request with no
+ *  claim resolves to. The bare uuid — code needs the value (a shared
+ *  item's id namespace), SQL needs it quoted. */
+export const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
+export const DEFAULT_SPACE = `'${DEFAULT_SPACE_ID}'`;
 export const SPACE_COL = `"space_id" uuid not null default ${DEFAULT_SPACE}`;
 export const CONTENT_TABLES = [
     "pages",
     "page_locales",
     "page_versions",
-    "saved_sections",
-    "global_sections",
     "entries",
     "entry_locales",
     "entry_versions",
@@ -27,10 +29,9 @@ language sql stable as $$
 $$;`.trim();
 }
 /** Which rows a read key (or the anon key, which has no claim) may see.
- *  null = write keys only — refs and the section library are editor
- *  tooling; editors is admission data; nothing a browser needs. The
- *  empty string means "read policy, no extra predicate" (global_sections
- *  is fully readable once it's in-space) — distinct from null. */
+ *  null = write keys only — refs is editor tooling; editors is admission
+ *  data; nothing a browser needs. Shared content (spec 2026-09-07) rides
+ *  the three entry predicates: it is stored as entries. */
 const PUBLISHED_READ = {
     pages: `exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published')`,
     page_locales: `"status" = 'published'`,
@@ -38,15 +39,13 @@ const PUBLISHED_READ = {
     entries: `exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published')`,
     entry_locales: `"status" = 'published'`,
     entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
-    global_sections: ``,
-    saved_sections: null,
     refs: null,
     editors: null,
     paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
 };
 /** Tables whose existing indexes do not lead with space_id. */
 const NEEDS_SPACE_INDEX = [
-    "page_locales", "page_versions", "entry_locales", "entry_versions", "saved_sections", "global_sections", "refs",
+    "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
 ];
 export function spaceLayerSQL() {
     const statements = [];

package/dist/sql.js

@@ -31,7 +31,7 @@ function fieldExpr(key, d, source) {
         case "date":
             return `(${source}->>'${key}')::timestamptz`;
         default:
-            return `${source}->'${key}'`; // image, video, file, object, richtext, dataAttributes, refList
+            return `${source}->'${key}'`; // image, video, file, object, list, richtext, dataAttributes, refList
     }
 }
 export function collectionSQL(collection) {
@@ -132,22 +132,6 @@ create table if not exists "page_versions" (
 create index if not exists "page_versions_page_locale_idx"
   on "page_versions" ("page_id", "locale", "created_at");
 
-create table if not exists "saved_sections" (
-  "id" uuid primary key default gen_random_uuid(),
-  ${SPACE_COL},
-  "title" text not null,
-  "fragment" jsonb not null,
-  "created_at" timestamptz not null default now()
-);
-
-create table if not exists "global_sections" (
-  "id" uuid primary key default gen_random_uuid(),
-  ${SPACE_COL},
-  "type" text not null,
-  "content" jsonb not null,
-  "updated_at" timestamptz not null default now()
-);
-
 create table if not exists "entries" (
   "id" uuid primary key default gen_random_uuid(),
   ${SPACE_COL},
@@ -273,8 +257,6 @@ $$;
 alter table "pages" enable row level security;
 alter table "page_locales" enable row level security;
 alter table "page_versions" enable row level security;
-alter table "saved_sections" enable row level security;
-alter table "global_sections" enable row level security;
 alter table "entries" enable row level security;
 alter table "entry_locales" enable row level security;
 alter table "entry_versions" enable row level security;

package/dist/supabase-entry-store.d.ts

@@ -3,12 +3,20 @@ import type { CollectionSchema } from "./collections.ts";
 import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryUsage, EntryVersion, ListOptions } from "./entry-store.ts";
 export declare class SupabaseEntryStore implements EntryStore {
     private db;
-    private collections;
     private paths;
     private locales;
+    private schemas;
+    private spaceId?;
     constructor(db: SupabaseClient, collections: CollectionSchema<any>[], options?: EntryStoreOptions);
     private fail;
     private schema;
+    /** The space this client acts in — the ONE function the policies and
+     *  the insert trigger read (src/sql-space.ts): a key's claim in the
+     *  cloud, the default space under the service role. Constant for the
+     *  life of the client, so the PROMISE is cached and concurrent creates
+     *  share one round trip; a failed lookup is not cached. */
+    private space;
+    private fetchSpace;
     private fetch;
     private must;
     private siblings;

package/dist/supabase-entry-store.js

@@ -7,9 +7,10 @@
 // calls the smoodly_reorder SQL function: one statement, updated_at
 // untouched.
 import { collectionDepth, collectionOrder } from "./collections.js";
-import { DEFAULT_ENTRY_LOCALES, entryErrors, entryFieldsIn, entryLocaleRow, entryRefEdges, entryTitleIn, schemaOf, splitFields, } from "./entry-store.js";
+import { DEFAULT_ENTRY_LOCALES, entryErrors, entryFieldsIn, entryLocaleRow, entryRefEdges, entryTitleIn, isSharedSchema, schemaOf, splitFields, } from "./entry-store.js";
+import { sharedEntryId } from "./shared-id.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
-import { assertDepth, assertSupportedLocale, entryPathRows } from "./paths.js";
+import { assertDepth, assertSupportedLocale, entryPathRows, slugOf } from "./paths.js";
 // entries.id is a Postgres uuid column: filtering on a non-UUID string
 // throws invalid_text_representation. A non-UUID id can't exist in the
 // table, so treat it the same as a missing one.
@@ -44,15 +45,38 @@ function toVersion(row) {
 export class SupabaseEntryStore {
     constructor(db, collections, options = {}) {
         this.db = db;
-        this.collections = collections;
         this.paths = options.paths ?? new SupabasePathIndex(db);
         this.locales = options.locales ?? DEFAULT_ENTRY_LOCALES;
+        this.schemas = [...collections, ...(options.shared ?? [])];
     }
     fail(message) {
         throw new Error(`smoodly: ${message}`);
     }
     schema(collection) {
-        return schemaOf(this.collections, collection);
+        return schemaOf(this.schemas, collection);
+    }
+    /** The space this client acts in — the ONE function the policies and
+     *  the insert trigger read (src/sql-space.ts): a key's claim in the
+     *  cloud, the default space under the service role. Constant for the
+     *  life of the client, so the PROMISE is cached and concurrent creates
+     *  share one round trip; a failed lookup is not cached. */
+    space() {
+        if (!this.spaceId) {
+            this.spaceId = this.fetchSpace().catch((e) => {
+                // A failed lookup is not cached: the next write retries it.
+                this.spaceId = undefined;
+                throw e;
+            });
+        }
+        return this.spaceId;
+    }
+    async fetchSpace() {
+        const res = await this.db.rpc("smoodly_current_space");
+        if (res.error)
+            this.fail(res.error.message);
+        if (typeof res.data !== "string")
+            this.fail("smoodly_current_space() returned no space — is the schema up to date?");
+        return res.data;
     }
     // ── reads ──
     async fetch(collection, id) {
@@ -240,13 +264,33 @@ export class SupabaseEntryStore {
         const schema = this.schema(collection);
         assertSupportedLocale(options.locale, this.locales);
         const parentId = options.parentId ?? null;
+        if (isSharedSchema(schema)) {
+            const existing = await this.db.from("entries").select("id").eq("collection", collection).limit(1);
+            if (existing.error)
+                this.fail(existing.error.message);
+            if (existing.data.length > 0)
+                throw entryErrors.singleton(collection);
+            if (slugOf(fields) !== null)
+                throw entryErrors.noSlug(collection);
+        }
         const parent = await this.assertParent(collection, parentId, 1);
         this.assertParentHasLocale(parent, options.locale);
         const { shared, localized, slug } = splitFields(fields, schema);
         await this.assertSiblingSlug(collection, parentId, options.locale, slug);
-        const inserted = await this.db.from("entries").insert({ collection, parent_id: parentId, fields: shared }).select("id").single();
-        if (inserted.error)
+        // A shared item's row id is DERIVED from (space, name), not generated
+        // (spec 2026-09-07 §10): the SELECT above is a fast path two racing
+        // materializations can both pass, so the primary key is the backstop
+        // — a duplicate would be unremovable, since `delete` refuses every
+        // shared row.
+        const row = { collection, parent_id: parentId, fields: shared };
+        if (isSharedSchema(schema))
+            row.id = await sharedEntryId(await this.space(), collection);
+        const inserted = await this.db.from("entries").insert(row).select("id").single();
+        if (inserted.error) {
+            if (isSharedSchema(schema) && inserted.error.code === UNIQUE_VIOLATION)
+                throw entryErrors.singleton(collection);
             this.fail(inserted.error.message);
+        }
         const id = inserted.data.id;
         try {
             await this.insertLocale(id, options.locale, { slug, fields: localized });
@@ -327,6 +371,8 @@ export class SupabaseEntryStore {
         const before = await this.must(collection, id);
         const row = entryLocaleRow(before, locale);
         const { shared, localized, slug } = splitFields(fields, schema);
+        if (isSharedSchema(schema) && slug !== null)
+            throw entryErrors.noSlug(collection);
         await this.assertSiblingSlug(collection, before.parentId, locale, slug, id);
         await this.updateNode(id, { fields: shared });
         await this.updateLocale(id, locale, { slug, fields: localized });
@@ -393,6 +439,8 @@ export class SupabaseEntryStore {
     }
     async removeLocale(collection, id, locale) {
         const schema = this.schema(collection);
+        if (isSharedSchema(schema))
+            throw entryErrors.everyLocale(collection);
         const entry = await this.must(collection, id);
         entryLocaleRow(entry, locale);
         if (Object.keys(entry.locales).length === 1)
@@ -428,6 +476,8 @@ export class SupabaseEntryStore {
         return res.data.map(toVersion);
     }
     async move(collection, id, to) {
+        if (isSharedSchema(this.schema(collection)))
+            throw entryErrors.owned(collection, "it has no tree position");
         const entry = await this.must(collection, id);
         const subtree = await this.subtree(entry);
         if (to.parentId !== null && (to.parentId === id || subtree.some((e) => e.id === to.parentId)))
@@ -473,6 +523,8 @@ export class SupabaseEntryStore {
         const entry = await this.fetch(collection, id);
         if (!entry)
             return;
+        if (isSharedSchema(this.schema(collection)))
+            throw entryErrors.owned(collection, "remove the registration to remove it");
         const children = await this.db.from("entries").select("id").eq("parent_id", id).limit(1);
         if (children.error)
             this.fail(children.error.message);
@@ -498,7 +550,8 @@ export class SupabaseEntryStore {
         return (await this.fetch(collection, id)) ? this.paths.pathsOf({ kind: "entry", id }) : {};
     }
     async reorder(collection, orderedIds) {
-        this.schema(collection);
+        if (isSharedSchema(this.schema(collection)))
+            throw entryErrors.owned(collection, "it has no order");
         const res = await this.db.rpc("smoodly_reorder", { p_collection: collection, p_ids: orderedIds });
         if (res.error)
             this.fail(res.error.message);

package/dist/zones.d.ts

@@ -1,3 +1,4 @@
+import type { SharedSchema } from "./shared.ts";
 type WithSchema = {
     schema: {
         name: string;
@@ -11,9 +12,12 @@ export type ZonePolicy = {
     kind: "freeform";
     allow: string[] | "*";
     rows: boolean;
-} | {
+}
+/** `shared` names the item a bound zone shows (spec 2026-09-07 §4); `component` is its section either way. */
+ | {
     kind: "locked";
     component: string;
+    shared?: string;
 };
 export declare const z: {
     sections(components: WithSchema[]): {
@@ -26,6 +30,6 @@ export declare const z: {
         sections: WithSchema[] | "*";
         rows?: boolean;
     }): ZonePolicy;
-    locked(component: WithSchema): ZonePolicy;
+    locked(target: WithSchema | SharedSchema): ZonePolicy;
 };
 export {};

package/dist/zones.js

@@ -1,5 +1,6 @@
 // Zone policies — the freedom dial. Policies reference paired components
 // directly; only their registered names are stored (plain data).
+const isShared = (target) => "kind" in target && target.kind === "shared";
 const names = (components) => components.map((c) => c.schema.name);
 export const z = {
     sections(components) {
@@ -17,7 +18,12 @@ export const z = {
             rows: opts.rows ?? false,
         };
     },
-    locked(component) {
-        return { kind: "locked", component: component.schema.name };
+    locked(target) {
+        if (isShared(target)) {
+            if (!target.section)
+                throw new Error(`smoodly: shared item "${target.name}" has no section — a locked zone needs a visual item.`);
+            return { kind: "locked", component: target.section, shared: target.name };
+        }
+        return { kind: "locked", component: target.schema.name };
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {