smoodly 0.0.8 → 0.0.10

package/dist/index.js

@@ -1,11 +1,13 @@
 import { schema } from "./schema.js";
 import { section, element } from "./pairing.js";
-import { collection, toolset } from "./collections.js";
+import { collection } from "./collections.js";
+import { toolset } from "./toolset.js";
 import { Section } from "./section-wrapper.js";
 import { page } from "./render.js";
 import { entryPage } from "./entry-page.js";
 import { shared } from "./shared.js";
 export { Zone, renderPage, EMPTY_PAGE_CONTEXT } from "./render.js";
+export { RichText } from "./richtext-render.js";
 export { fixedSlug } from "./page.js";
 export { f } from "./fields.js";
 export { z } from "./zones.js";
@@ -25,8 +27,11 @@ export { resolveTree, resolveFields } from "./resolve.js";
 export { SEGMENT_RE, isSegment, assertSegment, joinPath, splitPath, segmentFor, isHomeNode, pagePathIn, chainOf, assertDepth, pagePath, pagePathRows, entryPathRows, collectionSegment, buildPageTree, perLocaleSegments, assertSupportedLocale, unsupportedLocale, } from "./paths.js";
 export { fixedPathFor } from "./localize.js";
 export { pathOptions, pageErrors, localeRow, pageRefEdges, DEFAULT_LOCALES } from "./store.js";
+export { DEFAULT_TOOLSET } from "./toolset.js";
 export { collectionOrder, collectionDepth, DEFAULT_ORDER } from "./collections.js";
 export { SHARED_NODE_TYPE, STYLES_KEY, sharedLink } from "./shared.js";
+export { sharedEntryId } from "./shared-id.js";
+export { DEFAULT_SPACE_ID } from "./sql-space.js";
 export const smoodly = {
     schema,
     section,

package/dist/refs.js

@@ -25,6 +25,11 @@ function collectFrom(values, descriptors, out) {
                     out.push({ field, targetCollection: targetOf(d), targetId: id });
             }
         }
+        else if (d.type === "object" || d.type === "list") {
+            // Deliberate: refs are top-level only — f.list/f.object refuse them at
+            // build time (spec 2026-09-07, list field §1), so there is nothing to walk.
+            continue;
+        }
     }
 }
 export function collectEntryRefs(fields, schema) {

package/dist/resolve.js

@@ -174,5 +174,8 @@ function collectTasks(values, descriptors, out) {
         else if (d.type === "refList" && Array.isArray(value)) {
             out.push({ holder: values, key, collection: targetOf(d), id: value, isList: true, mode: modeOf(d), ancestors: [] });
         }
+        else if (d.type === "object" || d.type === "list") {
+            continue; // refs are top-level only; containers hold none (spec 2026-09-07)
+        }
     }
 }

package/dist/richtext-render.d.ts

@@ -0,0 +1,3 @@
+export declare function RichText({ doc }: {
+    doc: unknown;
+}): import("react").JSX.Element | null;

package/dist/richtext-render.js

@@ -0,0 +1,62 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+// The site-side richtext renderer (spec 2026-09-07, list field §5):
+// TipTap JSON → React, a fragment with no wrapper so the developer owns
+// the surrounding element and its class. Pure React, no Node imports, so
+// it works in shared, server and client components alike. Unknown nodes
+// render their children — a document from a later, richer editor degrades
+// instead of crashing. Elements as node views are Phase 3.
+import { Fragment, createElement } from "react";
+/** Only schemes an editor's link may carry reach the page: http(s), mailto, tel,
+ *  and site-relative targets. Anything else (javascript:, data:, an empty href,
+ *  a protocol-relative `//host` or a backslash form `/\host` that a browser
+ *  treats the same way) renders the text without an anchor. */
+const SAFE_HREF = /^(https?:|mailto:|tel:|\/(?![/\\])|#|\?|\.)/i;
+function safeHref(raw) {
+    if (typeof raw !== "string")
+        return null;
+    // URL parsers drop tab, LF and CR, so normalise before testing to see what the parser sees.
+    const href = raw.replace(/[\t\n\r]/g, "").trim();
+    return href !== "" && SAFE_HREF.test(href) ? href : null;
+}
+export function RichText({ doc }) {
+    const d = doc;
+    if (!d || typeof d !== "object" || d.type !== "doc" || !Array.isArray(d.content))
+        return null;
+    return _jsx(_Fragment, { children: renderNodes(d.content) });
+}
+function renderNodes(nodes) {
+    return nodes.map((n, i) => _jsx(Fragment, { children: renderNode(n) }, i));
+}
+function renderNode(node) {
+    if (!node || typeof node !== "object")
+        return null;
+    const children = Array.isArray(node.content) ? renderNodes(node.content) : null;
+    switch (node.type) {
+        case "text": return withMarks(node.text ?? "", node.marks ?? []);
+        case "paragraph": return _jsx("p", { children: children });
+        case "heading": {
+            const level = Math.min(6, Math.max(1, Math.round(Number(node.attrs?.level ?? 1) || 1)));
+            return createElement(`h${level}`, null, children);
+        }
+        case "bulletList": return _jsx("ul", { children: children });
+        case "orderedList": return _jsx("ol", { children: children });
+        case "listItem": return _jsx("li", { children: children });
+        case "blockquote": return _jsx("blockquote", { children: children });
+        case "hardBreak": return _jsx("br", {});
+        default: return children;
+    }
+}
+/** Marks wrap from the first outward: [bold, italic] → <em><strong>…</strong></em>. */
+function withMarks(text, marks) {
+    return marks.reduce((inner, m) => {
+        switch (m.type) {
+            case "bold": return _jsx("strong", { children: inner });
+            case "italic": return _jsx("em", { children: inner });
+            case "link": {
+                const href = safeHref(m.attrs?.href);
+                return href === null ? inner : _jsx("a", { href: href, children: inner });
+            }
+            default: return inner;
+        }
+    }, text);
+}

package/dist/shared-id.d.ts

@@ -0,0 +1,3 @@
+/** RFC 4122 §4.3 uuid v5: sha1(namespace bytes ‖ name bytes), version 5,
+ *  variant 10xx, first 16 bytes of the digest. */
+export declare function sharedEntryId(space: string, name: string): Promise<string>;

package/dist/shared-id.js

@@ -0,0 +1,36 @@
+// The row id of a shared item (spec 2026-09-07 §10 "§3 row id"): uuid v5
+// of (space id as the namespace, item name as the name). Deterministic in
+// both adapters, so a second concurrent materialization of the same item
+// hits the `entries` primary key instead of adding an unremovable
+// duplicate — `delete` refuses every shared row. The space is part of it
+// because the primary key is `id` alone and, in the cloud, many spaces
+// share one table: a name-only id would make space B's footer collide
+// with space A's.
+//
+// No imports — Web Crypto (`globalThis.crypto.subtle`) exists in Node
+// >= 20 and in every browser, so this module carries no node builtin
+// into the package root's graph. It matters because every scaffolded
+// section does `import { f, smoodly } from "smoodly"`, and a "use client"
+// section's browser build would fail on `node:crypto`.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The namespace's 16 raw bytes — RFC 4122 hashes the bytes, not the text. */
+function uuidBytes(uuid) {
+    if (!UUID_RE.test(uuid))
+        throw new Error(`smoodly: "${uuid}" is not a uuid — a shared item's namespace is the space id.`);
+    const hex = uuid.replace(/-/g, "");
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++)
+        bytes[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+    return bytes;
+}
+/** RFC 4122 §4.3 uuid v5: sha1(namespace bytes ‖ name bytes), version 5,
+ *  variant 10xx, first 16 bytes of the digest. */
+export async function sharedEntryId(space, name) {
+    const input = new Uint8Array([...uuidBytes(space), ...new TextEncoder().encode(name)]);
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-1", input));
+    const bytes = digest.subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50; // version 5 in the high nibble of octet 6
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10xx in the top bits of octet 8
+    const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/dist/sql-space.d.ts

@@ -1,3 +1,7 @@
+/** The one space a self-host install has; the space a request with no
+ *  claim resolves to. The bare uuid — code needs the value (a shared
+ *  item's id namespace), SQL needs it quoted. */
+export declare const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
 export declare const DEFAULT_SPACE = "'00000000-0000-0000-0000-000000000000'";
 export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0000-0000-0000-000000000000'";
 export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths"];

package/dist/sql-space.js

@@ -2,7 +2,11 @@
 // is one cloud environment; a self-host install is one space with the
 // default id. Everything that needs "which space is this request in"
 // reads smoodly_current_space() — the adapters never mention spaces.
-export const DEFAULT_SPACE = `'00000000-0000-0000-0000-000000000000'`;
+/** The one space a self-host install has; the space a request with no
+ *  claim resolves to. The bare uuid — code needs the value (a shared
+ *  item's id namespace), SQL needs it quoted. */
+export const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
+export const DEFAULT_SPACE = `'${DEFAULT_SPACE_ID}'`;
 export const SPACE_COL = `"space_id" uuid not null default ${DEFAULT_SPACE}`;
 export const CONTENT_TABLES = [
     "pages",

package/dist/sql.js

@@ -31,7 +31,7 @@ function fieldExpr(key, d, source) {
         case "date":
             return `(${source}->>'${key}')::timestamptz`;
         default:
-            return `${source}->'${key}'`; // image, video, file, object, richtext, dataAttributes, refList
+            return `${source}->'${key}'`; // image, video, file, object, list, richtext, dataAttributes, refList
     }
 }
 export function collectionSQL(collection) {

package/dist/supabase-entry-store.d.ts

@@ -6,9 +6,17 @@ export declare class SupabaseEntryStore implements EntryStore {
     private paths;
     private locales;
     private schemas;
+    private spaceId?;
     constructor(db: SupabaseClient, collections: CollectionSchema<any>[], options?: EntryStoreOptions);
     private fail;
     private schema;
+    /** The space this client acts in — the ONE function the policies and
+     *  the insert trigger read (src/sql-space.ts): a key's claim in the
+     *  cloud, the default space under the service role. Constant for the
+     *  life of the client, so the PROMISE is cached and concurrent creates
+     *  share one round trip; a failed lookup is not cached. */
+    private space;
+    private fetchSpace;
     private fetch;
     private must;
     private siblings;

package/dist/supabase-entry-store.js

@@ -8,6 +8,7 @@
 // untouched.
 import { collectionDepth, collectionOrder } from "./collections.js";
 import { DEFAULT_ENTRY_LOCALES, entryErrors, entryFieldsIn, entryLocaleRow, entryRefEdges, entryTitleIn, isSharedSchema, schemaOf, splitFields, } from "./entry-store.js";
+import { sharedEntryId } from "./shared-id.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
 import { assertDepth, assertSupportedLocale, entryPathRows, slugOf } from "./paths.js";
 // entries.id is a Postgres uuid column: filtering on a non-UUID string
@@ -54,6 +55,29 @@ export class SupabaseEntryStore {
     schema(collection) {
         return schemaOf(this.schemas, collection);
     }
+    /** The space this client acts in — the ONE function the policies and
+     *  the insert trigger read (src/sql-space.ts): a key's claim in the
+     *  cloud, the default space under the service role. Constant for the
+     *  life of the client, so the PROMISE is cached and concurrent creates
+     *  share one round trip; a failed lookup is not cached. */
+    space() {
+        if (!this.spaceId) {
+            this.spaceId = this.fetchSpace().catch((e) => {
+                // A failed lookup is not cached: the next write retries it.
+                this.spaceId = undefined;
+                throw e;
+            });
+        }
+        return this.spaceId;
+    }
+    async fetchSpace() {
+        const res = await this.db.rpc("smoodly_current_space");
+        if (res.error)
+            this.fail(res.error.message);
+        if (typeof res.data !== "string")
+            this.fail("smoodly_current_space() returned no space — is the schema up to date?");
+        return res.data;
+    }
     // ── reads ──
     async fetch(collection, id) {
         if (!UUID_RE.test(id))
@@ -253,9 +277,20 @@ export class SupabaseEntryStore {
         this.assertParentHasLocale(parent, options.locale);
         const { shared, localized, slug } = splitFields(fields, schema);
         await this.assertSiblingSlug(collection, parentId, options.locale, slug);
-        const inserted = await this.db.from("entries").insert({ collection, parent_id: parentId, fields: shared }).select("id").single();
-        if (inserted.error)
+        // A shared item's row id is DERIVED from (space, name), not generated
+        // (spec 2026-09-07 §10): the SELECT above is a fast path two racing
+        // materializations can both pass, so the primary key is the backstop
+        // — a duplicate would be unremovable, since `delete` refuses every
+        // shared row.
+        const row = { collection, parent_id: parentId, fields: shared };
+        if (isSharedSchema(schema))
+            row.id = await sharedEntryId(await this.space(), collection);
+        const inserted = await this.db.from("entries").insert(row).select("id").single();
+        if (inserted.error) {
+            if (isSharedSchema(schema) && inserted.error.code === UNIQUE_VIOLATION)
+                throw entryErrors.singleton(collection);
             this.fail(inserted.error.message);
+        }
         const id = inserted.data.id;
         try {
             await this.insertLocale(id, options.locale, { slug, fields: localized });

package/dist/toolset.d.ts

@@ -0,0 +1,30 @@
+export declare const TOOLSET_MARKS: readonly ["bold", "italic", "link"];
+export declare const TOOLSET_NODES: readonly ["h1", "h2", "h3", "h4", "h5", "h6", "bulletList", "orderedList", "blockquote"];
+export type ToolsetMark = (typeof TOOLSET_MARKS)[number];
+export type ToolsetNode = (typeof TOOLSET_NODES)[number];
+export type Toolset = {
+    marks?: ToolsetMark[];
+    nodes?: ToolsetNode[];
+    elements?: string[];
+};
+/** What a richtext field gets when it declares nothing. `h1` is left out:
+ *  the section or page shape owns the page's first heading. */
+export declare const DEFAULT_TOOLSET: Toolset;
+export declare function toolset(input: {
+    marks?: readonly ToolsetMark[];
+    nodes?: readonly ToolsetNode[];
+    elements?: {
+        schema: {
+            name: string;
+        };
+    }[];
+}): Toolset;
+/** The resolved toolset the widget reads: which marks and nodes an editor
+ *  may CREATE. The schema itself is always the full one (spec §2). */
+export type Allowed = {
+    marks: ReadonlySet<ToolsetMark>;
+    nodes: ReadonlySet<ToolsetNode>;
+    /** The allowed heading levels, ascending. */
+    headingLevels: number[];
+};
+export declare function allowedOf(input: unknown): Allowed;

package/dist/toolset.js

@@ -0,0 +1,49 @@
+// Toolsets are plain shared values, not registrations (DESIGN.md §3): a
+// richtext field imports one by value and it travels inside the field
+// descriptor to the admin. The vocabulary is typed and checked at
+// registration; a field without a toolset carries the default. `Allowed`
+// is the resolved form the widget reads (spec 2026-09-08 §1).
+export const TOOLSET_MARKS = ["bold", "italic", "link"];
+export const TOOLSET_NODES = ["h1", "h2", "h3", "h4", "h5", "h6", "bulletList", "orderedList", "blockquote"];
+/** What a richtext field gets when it declares nothing. `h1` is left out:
+ *  the section or page shape owns the page's first heading. */
+export const DEFAULT_TOOLSET = {
+    marks: ["bold", "italic", "link"],
+    nodes: ["h2", "h3", "h4", "bulletList", "orderedList", "blockquote"],
+};
+const isMark = (s) => TOOLSET_MARKS.includes(s);
+const isNode = (s) => TOOLSET_NODES.includes(s);
+export function toolset(input) {
+    const out = {};
+    if (input.marks) {
+        for (const m of input.marks) {
+            if (!isMark(m))
+                throw new Error(`smoodly: toolset mark "${m}" is not one of ${TOOLSET_MARKS.join(", ")}.`);
+        }
+        out.marks = [...input.marks];
+    }
+    if (input.nodes) {
+        for (const n of input.nodes) {
+            if (!isNode(n))
+                throw new Error(`smoodly: toolset node "${n}" is not one of ${TOOLSET_NODES.join(", ")}.`);
+        }
+        out.nodes = [...input.nodes];
+    }
+    if (input.elements)
+        out.elements = input.elements.map((e) => e.schema.name);
+    return out;
+}
+const HEADING = /^h([1-6])$/;
+export function allowedOf(input) {
+    // A missing or malformed toolset is the default; a declared one is exact,
+    // so a group it leaves out allows nothing (a marks-only toolset has no headings).
+    const t = input && typeof input === "object" ? input : DEFAULT_TOOLSET;
+    const marks = Array.isArray(t.marks) ? t.marks.filter((m) => typeof m === "string" && isMark(m)) : [];
+    const nodes = Array.isArray(t.nodes) ? t.nodes.filter((n) => typeof n === "string" && isNode(n)) : [];
+    const headingLevels = nodes
+        .map((n) => HEADING.exec(n)?.[1])
+        .filter((l) => l !== undefined)
+        .map(Number)
+        .sort((a, b) => a - b);
+    return { marks: new Set(marks), nodes: new Set(nodes), headingLevels };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {
@@ -65,6 +65,16 @@
   },
   "dependencies": {
     "@supabase/supabase-js": "^2.113.0",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-blockquote": "3.31.3",
+    "@tiptap/extension-bold": "3.31.3",
+    "@tiptap/extension-heading": "3.31.3",
+    "@tiptap/extension-italic": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "lucide-react": "^1.41.0"
   }
 }

package/dist/admin/richtext.d.ts

@@ -1,14 +0,0 @@
-type TextNode = {
-    type: "text";
-    text: string;
-};
-type Paragraph = {
-    type: "paragraph";
-    content?: TextNode[];
-};
-export declare function richtextToPlain(doc: unknown): string;
-export declare function plainToRichtext(text: string): {
-    type: "doc";
-    content: Paragraph[];
-};
-export {};

package/dist/admin/richtext.js

@@ -1,17 +0,0 @@
-export function richtextToPlain(doc) {
-    const d = doc;
-    if (!d || d.type !== "doc" || !Array.isArray(d.content))
-        return "";
-    return d.content
-        .map((p) => (p.content ?? []).map((t) => t.text ?? "").join(""))
-        .join("\n");
-}
-export function plainToRichtext(text) {
-    return {
-        type: "doc",
-        content: text.split("\n").map((line) => ({
-            type: "paragraph",
-            ...(line ? { content: [{ type: "text", text: line }] } : {}),
-        })),
-    };
-}