smoodly 0.0.9 → 0.0.11

package/dist/resolve.js

@@ -7,6 +7,7 @@
 // chain gets a shallow copy (refs as ids), so traversal terminates by
 // construction and the output stays JSON-serializable.
 import { sharedLink, SHARED_NODE_TYPE, STYLES_KEY } from "./shared.js";
+import { applyAssets, collectAssetIds } from "./media.js";
 function targetOf(d) {
     const t = d.target?.();
     if (!t?.name)
@@ -38,9 +39,51 @@ export async function resolveTree(tree, options) {
             collectTasks(node.fields, schema.fields, tasks);
         }
     }
-    await runResolution(tasks, { collections: options.collections, fetch: options.fetch, maxDepth });
+    const hydrated = await runResolution(tasks, { collections: options.collections, fetch: options.fetch, maxDepth });
+    if (options.assets) {
+        const sets = [];
+        for (const node of Object.values(resolved.zones ?? {}).flat()) {
+            const schema = sectionSchemas.get(node.type);
+            if (!schema)
+                continue;
+            sets.push({ values: node.fields, descriptors: schema.fields });
+            sets.push({ values: node.styles, descriptors: schema.styles ?? {} });
+        }
+        await resolveMediaSets([...sets, ...hydrated], options.assets);
+    }
     return resolved;
 }
+/** Every wanted asset, then the posters those videos name — two rounds at most. */
+async function fetchAssets(fetch, ids) {
+    const out = new Map();
+    if (ids.size === 0)
+        return out;
+    for (const [id, a] of Object.entries(await fetch([...ids])))
+        out.set(id, a);
+    const posters = new Set();
+    for (const a of out.values())
+        if (a.posterId && !out.has(a.posterId))
+            posters.add(a.posterId);
+    if (posters.size > 0)
+        for (const [id, a] of Object.entries(await fetch([...posters])))
+            out.set(id, a);
+    return out;
+}
+/** One value set's media, resolved in place. Exported for the site layer's shared-item styles. */
+export async function resolveMedia(values, descriptors, fetch) {
+    await resolveMediaSets([{ values, descriptors }], fetch);
+}
+/** Many value sets, one asset round (plus one for posters): the tree's
+ *  nodes and every entry hydrated through a ref, or a list page's items.
+ *  Exported for the site layer's content API. */
+export async function resolveMediaSets(sets, fetch) {
+    const ids = new Set();
+    for (const { values, descriptors } of sets)
+        collectAssetIds(values, descriptors, ids);
+    const assets = await fetchAssets(fetch, ids);
+    for (const { values, descriptors } of sets)
+        applyAssets(values, descriptors, assets);
+}
 /** Placements first (spec 2026-09-07 §4): fetch every linked item in one
  *  call per item, rewrite each node into the item's section node — the
  *  placement's id stays, so the canvas selects it — and drop what the
@@ -83,13 +126,19 @@ export async function resolveFields(fields, descriptors, options) {
     const resolved = structuredClone(fields);
     const tasks = [];
     collectTasks(resolved, descriptors, tasks);
-    await runResolution(tasks, { ...options, maxDepth: options.maxDepth ?? Infinity });
+    const hydrated = await runResolution(tasks, { ...options, maxDepth: options.maxDepth ?? Infinity });
+    if (options.assets)
+        await resolveMediaSets([{ values: resolved, descriptors }, ...hydrated], options.assets);
     return resolved;
 }
+/** Hydrates every task's refs in place and returns each hydrated entry
+ *  copy with its collection's descriptors — the media pass walks those
+ *  too, so a card reached through a ref carries its image URL. */
 async function runResolution(seeds, options) {
     const collectionSchemas = new Map(options.collections.map((c) => [c.name, c]));
     // every entry is fetched once; cycle cuts reuse cached ancestors
     const cache = new Map();
+    const hydrated = [];
     let tasks = seeds;
     for (let round = 0; round < options.maxDepth && tasks.length > 0; round++) {
         // batch: one fetch per collection with unique uncached ids
@@ -118,6 +167,9 @@ async function runResolution(seeds, options) {
                 if (!raw)
                     return null;
                 const entry = structuredClone(raw);
+                const schema = collectionSchemas.get(task.collection);
+                if (schema)
+                    hydrated.push({ values: entry, descriptors: schema.fields });
                 const pathKey = `${task.collection}:${id}`;
                 // cycle: this entry is its own ancestor — shallow copy, no recursion
                 if (task.ancestors.includes(pathKey))
@@ -162,6 +214,7 @@ async function runResolution(seeds, options) {
         }
         tasks = next;
     }
+    return hydrated;
 }
 function collectTasks(values, descriptors, out) {
     for (const [key, d] of Object.entries(descriptors)) {

package/dist/site.d.ts

@@ -1,3 +1,4 @@
+import type { AssetStore } from "./asset-store.ts";
 import type { CollectionSchema, EntryOrder } from "./collections.ts";
 import { type EntryRecord, type EntryStore } from "./entry-store.ts";
 import { type LocaleSet, type PathTarget } from "./paths.ts";
@@ -9,6 +10,7 @@ export type SiteOptions = {
     stores: () => {
         pages: PageStore;
         entries: EntryStore;
+        assets?: AssetStore;
     };
     collections: CollectionSchema<any>[];
     sections: SectionLike[];

package/dist/site.js

@@ -1,6 +1,6 @@
 import { entryFieldsIn, schemaOf } from "./entry-store.js";
 import { buildPageTree, chainOf, entryPathRows, entrySegment, pagePath, } from "./paths.js";
-import { resolveFields, resolveTree } from "./resolve.js";
+import { resolveFields, resolveMedia, resolveMediaSets, resolveTree } from "./resolve.js";
 import { STYLES_KEY } from "./shared.js";
 /** The `page` prop for a loaded page. `toUrl` is the app's `href` seam
  *  bound to the render locale; the default keeps CMS paths as URLs. */
@@ -24,6 +24,15 @@ export function createSmoodlySite(options) {
      *  locale — published ones (a versioned collection's snapshot) on the
      *  public path, the live rows in draft mode. */
     const fetcher = (draft, locale) => (collection, ids) => options.stores().entries.getMany(collection, ids, locale, draft ? undefined : { status: "published" });
+    /** The media fetcher (spec 2026-09-08 §9) — absent when the site runs without an asset store. */
+    const assetFetcher = () => {
+        const assets = options.stores().assets;
+        return assets ? (ids) => assets.getMany(ids) : undefined;
+    };
+    const sectionStyles = (name) => {
+        const s = options.sections.find((x) => ("schema" in x ? x.schema : x).name === name);
+        return (s && ("schema" in s ? s.schema : s).styles) ?? {};
+    };
     /** Visible to the public in a locale: present there, and a folder or a
      *  published page. Draft mode sees every present node. Presence is the
      *  locale row — nothing falls back (spec 2026-09-06 §3). */
@@ -57,6 +66,7 @@ export function createSmoodlySite(options) {
             collections: options.collections,
             shared: options.shared,
             fetch: fetcher(draft, locale),
+            assets: assetFetcher(),
         });
         const all = await pages.listPages();
         const index = new Map(all.map((n) => [n.id, n]));
@@ -97,7 +107,7 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(schema.name, [id], locale, { status: "published" }))[id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, fetch: fetcher(draft, locale) });
+            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, fetch: fetcher(draft, locale), assets: assetFetcher() });
             // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present one.
             const paths = Object.fromEntries(Object.entries(await entries.pathsOf(schema.name, id)).filter(([l]) => draft || record.locales[l]?.status === "published"));
             return { kind: "entry", collection: schema.name, entry: { ...record, fields }, path, paths };
@@ -127,6 +137,11 @@ export function createSmoodlySite(options) {
         const all = await entries.list(collection, { order: o.order });
         const wanted = all.filter((e) => publicEntry(e, locale) && (o.parent === undefined || e.parentId === o.parent));
         const published = await entries.getMany(collection, wanted.map((e) => e.id), locale, { status: "published" });
+        // Refs stay ids on the content API; media resolves (one asset round for
+        // the whole list), because a list page's cards need their image URLs.
+        const fetchAssets = assetFetcher();
+        if (fetchAssets)
+            await resolveMediaSets(Object.values(published).map((values) => ({ values, descriptors: schema.fields })), fetchAssets);
         return entryItems(schema, wanted, all, locale, published);
     }
     const api = {
@@ -192,10 +207,13 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(item.name, [record.id], locale, { status: "published" }))[record.id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, item.fields, { collections: options.collections, fetch: fetcher(draft, locale) });
+            const fields = await resolveFields(raw, item.fields, { collections: options.collections, fetch: fetcher(draft, locale), assets: assetFetcher() });
             if (!item.section)
                 return fields;
             const { [STYLES_KEY]: styles, ...rest } = fields;
+            const fetch = assetFetcher();
+            if (fetch && styles && typeof styles === "object")
+                await resolveMedia(styles, sectionStyles(item.section), fetch);
             return { ...rest, styles: styles !== null && typeof styles === "object" ? styles : {} };
         },
     };

package/dist/sql-space.d.ts

@@ -4,7 +4,14 @@
 export declare const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
 export declare const DEFAULT_SPACE = "'00000000-0000-0000-0000-000000000000'";
 export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0000-0000-0000-000000000000'";
-export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths"];
+export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths", "assets"];
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 export declare function currentSpaceSQL(): string;
 export declare function spaceLayerSQL(): string;
+/** The media bucket and its object policies (spec 2026-09-08 media §3,
+ *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
+ *  a write key under its own space's prefix only; the service role
+ *  bypasses; signed uploads are minted server-side with that same key.
+ *  Schema-qualified calls: storage policies do not run with public on
+ *  the search path. Last in the migration, after the functions exist. */
+export declare function storageSQL(): string;

package/dist/sql-space.js

@@ -17,6 +17,7 @@ export const CONTENT_TABLES = [
     "entry_versions",
     "refs",
     "paths",
+    "assets",
 ];
 export function currentSpaceSQL() {
     return `
@@ -41,6 +42,7 @@ const PUBLISHED_READ = {
     entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
     refs: null,
     editors: null,
+    assets: `"status" = 'ready'`,
     paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
 };
 /** Tables whose existing indexes do not lead with space_id. */
@@ -177,5 +179,31 @@ $$;`.trim());
                 `  using (${predicate});`);
         }
     }
+    statements.push(storageSQL());
     return statements.join("\n\n");
 }
+/** The media bucket and its object policies (spec 2026-09-08 media §3,
+ *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
+ *  a write key under its own space's prefix only; the service role
+ *  bypasses; signed uploads are minted server-side with that same key.
+ *  Schema-qualified calls: storage policies do not run with public on
+ *  the search path. Last in the migration, after the functions exist. */
+export function storageSQL() {
+    const write = `"bucket_id" = 'media'` +
+        ` and (select public."smoodly_key_kind"()) = 'write'` +
+        ` and not (select public."smoodly_space_key_revoked"())` +
+        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
+    return `
+insert into storage.buckets ("id", "name", "public", "file_size_limit")
+  values ('media', 'media', true, 104857600)
+  on conflict ("id") do update set "public" = excluded."public", "file_size_limit" = excluded."file_size_limit";
+
+drop policy if exists "smoodly_media_read" on storage.objects;
+create policy "smoodly_media_read" on storage.objects for select
+  using ("bucket_id" = 'media');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+create policy "smoodly_media_write" on storage.objects for all
+  using (${write})
+  with check (${write});`.trim();
+}

package/dist/sql.js

@@ -233,6 +233,35 @@ create table if not exists "paths" (
 create index if not exists "paths_target_idx"
   on "paths" ("space_id", "kind", "target_id");
 
+-- Media (spec 2026-09-08): one row per upload, bytes in the "media"
+-- bucket at "path". Immediate — never draft-gated, never versioned —
+-- so there is no locale row and no version table. status 'pending' is
+-- a row whose signed upload has not been confirmed; list never shows it.
+create table if not exists "assets" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "kind" text not null check ("kind" in ('image', 'video', 'file')),
+  "status" text not null default 'pending' check ("status" in ('pending', 'ready')),
+  "path" text not null,
+  "mime" text not null,
+  "size" bigint not null,
+  "width" integer,
+  "height" integer,
+  "duration" numeric,
+  "poster_id" uuid references "assets" ("id") on delete set null,
+  "filename" text not null,
+  "title" text,
+  "alt" text,
+  "caption" text,
+  "credit" text,
+  "created_by" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+create index if not exists "assets_space_created_idx"
+  on "assets" ("space_id", "status", "created_at" desc);
+
 -- Replace the targets' rows with the given rows in ONE call: a SQL
 -- function runs in the caller's transaction, so a primary-key collision
 -- rolls the whole rewrite back. Inserted rows get their space from the
@@ -262,6 +291,7 @@ alter table "entry_locales" enable row level security;
 alter table "entry_versions" enable row level security;
 alter table "refs" enable row level security;
 alter table "paths" enable row level security;
+alter table "assets" enable row level security;
 `.trim(),
         spaceLayerSQL(),
     ].join("\n\n");

package/dist/store.js

@@ -9,6 +9,7 @@
 // locale row owns its slug, title, publish state and version pointers,
 // and each locale has its own history. Nothing falls back to another
 // locale — presence IS the row.
+import { ASSET_COLLECTION } from "./media.js";
 import { collectTreeRefs } from "./refs.js";
 import { MemoryPathIndex } from "./path-index.js";
 import { assertDepth, assertSegment, assertSupportedLocale, chainOf, isHomeNode, pagePathRows, unsupportedLocale, } from "./paths.js";
@@ -62,6 +63,8 @@ export function pageRefEdges(trees, sections) {
 export async function assertPublishable(label, tree, sections, entries, locale) {
     const targets = new Map();
     for (const edge of collectTreeRefs(tree, sections)) {
+        if (edge.targetCollection === ASSET_COLLECTION)
+            continue; // assets are immediate, never draft-gated
         if (!targets.has(edge.targetId))
             targets.set(edge.targetId, { collection: edge.targetCollection, field: edge.field });
     }

package/dist/supabase-asset-store.d.ts

@@ -0,0 +1,21 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type AssetPage, type AssetQuery, type AssetStore, type BeginUploadInput, type CreateAssetInput, type FinishInput, type UploadTicket } from "./asset-store.ts";
+import { type AssetMeta, type AssetRecord } from "./media.ts";
+export declare class SupabaseAssetStore implements AssetStore {
+    private db;
+    constructor(db: SupabaseClient);
+    private fail;
+    private bucket;
+    private toRecord;
+    /** The space this client writes into — the claim, or the default. */
+    private space;
+    private insert;
+    beginUpload(input: BeginUploadInput): Promise<UploadTicket>;
+    finishUpload(id: string, dims: FinishInput): Promise<AssetRecord>;
+    create(input: CreateAssetInput): Promise<AssetRecord>;
+    get(id: string): Promise<AssetRecord | null>;
+    getMany(ids: string[]): Promise<Record<string, AssetRecord>>;
+    list(query?: AssetQuery): Promise<AssetPage>;
+    update(id: string, meta: AssetMeta): Promise<AssetRecord>;
+    delete(id: string): Promise<void>;
+}

package/dist/supabase-asset-store.js

@@ -0,0 +1,170 @@
+import { assetErrors, kindOf, objectPath, withDownload, PAGE_SIZE, } from "./asset-store.js";
+import { ASSET_COLLECTION, MEDIA_CACHE_SECONDS } from "./media.js";
+const BUCKET = "media";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SELECT = "id, kind, status, path, mime, size, width, height, duration, poster_id, filename, title, alt, caption, credit, created_at, updated_at";
+export class SupabaseAssetStore {
+    constructor(db) {
+        this.db = db;
+    }
+    fail(message) {
+        throw new Error(`smoodly: ${message}`);
+    }
+    bucket() {
+        return this.db.storage.from(BUCKET);
+    }
+    toRecord(row) {
+        return {
+            id: row.id, kind: row.kind, status: row.status, path: row.path, mime: row.mime, size: Number(row.size),
+            width: row.width, height: row.height, duration: row.duration === null ? null : Number(row.duration),
+            posterId: row.poster_id, filename: row.filename, title: row.title, alt: row.alt, caption: row.caption, credit: row.credit,
+            url: withDownload(this.bucket().getPublicUrl(row.path).data.publicUrl, row.mime),
+            createdAt: Date.parse(row.created_at), updatedAt: Date.parse(row.updated_at),
+        };
+    }
+    /** The space this client writes into — the claim, or the default. */
+    async space() {
+        const res = await this.db.rpc("smoodly_current_space");
+        if (res.error)
+            this.fail(res.error.message);
+        return String(res.data);
+    }
+    async insert(input, status, extra = {}) {
+        const id = crypto.randomUUID();
+        const path = objectPath(await this.space(), id, input.filename, input.mime);
+        const res = await this.db
+            .from("assets")
+            .insert({
+            id, kind: kindOf(input.mime), status, path, mime: input.mime, size: input.size, filename: input.filename,
+            ...(input.createdBy ? { created_by: input.createdBy } : {}), ...extra,
+        })
+            .select(SELECT)
+            .single();
+        if (res.error)
+            this.fail(res.error.message);
+        return this.toRecord(res.data);
+    }
+    async beginUpload(input) {
+        const row = await this.insert(input, "pending");
+        const signed = await this.bucket().createSignedUploadUrl(row.path);
+        if (signed.error)
+            this.fail(signed.error.message);
+        return { id: row.id, uploadUrl: signed.data.signedUrl, token: signed.data.token };
+    }
+    async finishUpload(id, dims) {
+        const current = await this.get(id);
+        if (!current)
+            throw assetErrors.notFound(id);
+        if (current.status !== "pending")
+            throw assetErrors.notPending(id);
+        const res = await this.db
+            .from("assets")
+            .update({
+            status: "ready", width: dims.width ?? null, height: dims.height ?? null, duration: dims.duration ?? null,
+            poster_id: dims.posterId ?? null, updated_at: new Date().toISOString(),
+        })
+            .eq("id", id)
+            .select(SELECT)
+            .single();
+        if (res.error)
+            this.fail(res.error.message);
+        return this.toRecord(res.data);
+    }
+    async create(input) {
+        const row = await this.insert(input, "ready", {
+            width: input.width ?? null, height: input.height ?? null, duration: input.duration ?? null,
+            poster_id: input.posterId ?? null, title: input.title ?? null, alt: input.alt ?? null,
+            caption: input.caption ?? null, credit: input.credit ?? null,
+        });
+        const up = await this.bucket().upload(row.path, input.bytes, { contentType: input.mime, upsert: false, cacheControl: String(MEDIA_CACHE_SECONDS) });
+        if (up.error) {
+            await this.db.from("assets").delete().eq("id", row.id);
+            this.fail(up.error.message);
+        }
+        return row;
+    }
+    async get(id) {
+        if (!UUID_RE.test(id))
+            return null;
+        const res = await this.db.from("assets").select(SELECT).eq("id", id).maybeSingle();
+        if (res.error)
+            this.fail(res.error.message);
+        return res.data ? this.toRecord(res.data) : null;
+    }
+    async getMany(ids) {
+        const wanted = ids.filter((id) => UUID_RE.test(id));
+        if (wanted.length === 0)
+            return {};
+        const res = await this.db.from("assets").select(SELECT).in("id", wanted).eq("status", "ready");
+        if (res.error)
+            this.fail(res.error.message);
+        const out = {};
+        for (const row of res.data)
+            out[row.id] = this.toRecord(row);
+        return out;
+    }
+    async list(query = {}) {
+        const limit = query.limit ?? PAGE_SIZE;
+        let q = this.db.from("assets").select(SELECT).eq("status", "ready").order("created_at", { ascending: false }).limit(limit + 1);
+        if (query.kind)
+            q = q.eq("kind", query.kind);
+        if (query.cursor)
+            q = q.lt("created_at", query.cursor);
+        if (query.search) {
+            // PostgREST's or() splits on commas; the pattern must not carry one.
+            const term = `%${query.search.replace(/[,%]/g, " ").trim()}%`;
+            q = q.or(`title.ilike.${term},filename.ilike.${term},alt.ilike.${term}`);
+        }
+        const res = await q;
+        if (res.error)
+            this.fail(res.error.message);
+        const rows = res.data;
+        const page = rows.slice(0, limit);
+        return {
+            items: page.map((r) => this.toRecord(r)),
+            nextCursor: rows.length > limit ? page[page.length - 1].created_at : null,
+        };
+    }
+    async update(id, meta) {
+        if (!UUID_RE.test(id))
+            throw assetErrors.notFound(id);
+        const patch = { updated_at: new Date().toISOString() };
+        for (const key of ["title", "alt", "caption", "credit"])
+            if (meta[key] !== undefined)
+                patch[key] = meta[key];
+        const res = await this.db.from("assets").update(patch).eq("id", id).select(SELECT).maybeSingle();
+        if (res.error)
+            this.fail(res.error.message);
+        if (!res.data)
+            throw assetErrors.notFound(id);
+        return this.toRecord(res.data);
+    }
+    async delete(id) {
+        const row = await this.get(id);
+        if (!row)
+            return;
+        const usage = await this.db.from("refs").select("source_id").eq("target_collection", ASSET_COLLECTION).eq("target_id", id);
+        if (usage.error)
+            this.fail(usage.error.message);
+        if (usage.data.length > 0)
+            throw assetErrors.referenced(id, usage.data.length);
+        const paths = [row.path];
+        if (row.posterId) {
+            const poster = await this.get(row.posterId);
+            if (poster)
+                paths.push(poster.path);
+        }
+        // The row first (its poster_id reference goes with it), then the poster row, then the objects.
+        const gone = await this.db.from("assets").delete().eq("id", id);
+        if (gone.error)
+            this.fail(gone.error.message);
+        if (row.posterId) {
+            const posterGone = await this.db.from("assets").delete().eq("id", row.posterId);
+            if (posterGone.error)
+                this.fail(posterGone.error.message);
+        }
+        const removed = await this.bucket().remove(paths);
+        if (removed.error)
+            this.fail(removed.error.message);
+    }
+}

package/dist/toolset.d.ts

@@ -0,0 +1,30 @@
+export declare const TOOLSET_MARKS: readonly ["bold", "italic", "link"];
+export declare const TOOLSET_NODES: readonly ["h1", "h2", "h3", "h4", "h5", "h6", "bulletList", "orderedList", "blockquote"];
+export type ToolsetMark = (typeof TOOLSET_MARKS)[number];
+export type ToolsetNode = (typeof TOOLSET_NODES)[number];
+export type Toolset = {
+    marks?: ToolsetMark[];
+    nodes?: ToolsetNode[];
+    elements?: string[];
+};
+/** What a richtext field gets when it declares nothing. `h1` is left out:
+ *  the section or page shape owns the page's first heading. */
+export declare const DEFAULT_TOOLSET: Toolset;
+export declare function toolset(input: {
+    marks?: readonly ToolsetMark[];
+    nodes?: readonly ToolsetNode[];
+    elements?: {
+        schema: {
+            name: string;
+        };
+    }[];
+}): Toolset;
+/** The resolved toolset the widget reads: which marks and nodes an editor
+ *  may CREATE. The schema itself is always the full one (spec §2). */
+export type Allowed = {
+    marks: ReadonlySet<ToolsetMark>;
+    nodes: ReadonlySet<ToolsetNode>;
+    /** The allowed heading levels, ascending. */
+    headingLevels: number[];
+};
+export declare function allowedOf(input: unknown): Allowed;

package/dist/toolset.js

@@ -0,0 +1,49 @@
+// Toolsets are plain shared values, not registrations (DESIGN.md §3): a
+// richtext field imports one by value and it travels inside the field
+// descriptor to the admin. The vocabulary is typed and checked at
+// registration; a field without a toolset carries the default. `Allowed`
+// is the resolved form the widget reads (spec 2026-09-08 §1).
+export const TOOLSET_MARKS = ["bold", "italic", "link"];
+export const TOOLSET_NODES = ["h1", "h2", "h3", "h4", "h5", "h6", "bulletList", "orderedList", "blockquote"];
+/** What a richtext field gets when it declares nothing. `h1` is left out:
+ *  the section or page shape owns the page's first heading. */
+export const DEFAULT_TOOLSET = {
+    marks: ["bold", "italic", "link"],
+    nodes: ["h2", "h3", "h4", "bulletList", "orderedList", "blockquote"],
+};
+const isMark = (s) => TOOLSET_MARKS.includes(s);
+const isNode = (s) => TOOLSET_NODES.includes(s);
+export function toolset(input) {
+    const out = {};
+    if (input.marks) {
+        for (const m of input.marks) {
+            if (!isMark(m))
+                throw new Error(`smoodly: toolset mark "${m}" is not one of ${TOOLSET_MARKS.join(", ")}.`);
+        }
+        out.marks = [...input.marks];
+    }
+    if (input.nodes) {
+        for (const n of input.nodes) {
+            if (!isNode(n))
+                throw new Error(`smoodly: toolset node "${n}" is not one of ${TOOLSET_NODES.join(", ")}.`);
+        }
+        out.nodes = [...input.nodes];
+    }
+    if (input.elements)
+        out.elements = input.elements.map((e) => e.schema.name);
+    return out;
+}
+const HEADING = /^h([1-6])$/;
+export function allowedOf(input) {
+    // A missing or malformed toolset is the default; a declared one is exact,
+    // so a group it leaves out allows nothing (a marks-only toolset has no headings).
+    const t = input && typeof input === "object" ? input : DEFAULT_TOOLSET;
+    const marks = Array.isArray(t.marks) ? t.marks.filter((m) => typeof m === "string" && isMark(m)) : [];
+    const nodes = Array.isArray(t.nodes) ? t.nodes.filter((n) => typeof n === "string" && isNode(n)) : [];
+    const headingLevels = nodes
+        .map((n) => HEADING.exec(n)?.[1])
+        .filter((l) => l !== undefined)
+        .map(Number)
+        .sort((a, b) => a - b);
+    return { marks: new Set(marks), nodes: new Set(nodes), headingLevels };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {
@@ -20,6 +20,10 @@
       "types": "./dist/next/index.d.ts",
       "default": "./dist/next/index.js"
     },
+    "./image": {
+      "types": "./dist/image/index.d.ts",
+      "default": "./dist/image/index.js"
+    },
     "./admin": {
       "types": "./dist/admin/index.d.ts",
       "default": "./dist/admin/index.js"
@@ -65,6 +69,16 @@
   },
   "dependencies": {
     "@supabase/supabase-js": "^2.113.0",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-blockquote": "3.31.3",
+    "@tiptap/extension-bold": "3.31.3",
+    "@tiptap/extension-heading": "3.31.3",
+    "@tiptap/extension-italic": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "lucide-react": "^1.41.0"
   }
 }

package/dist/admin/richtext.d.ts

@@ -1,16 +0,0 @@
-export type RichtextNode = {
-    type: string;
-    attrs?: Record<string, unknown>;
-    content?: RichtextNode[];
-    text?: string;
-    marks?: {
-        type: string;
-        attrs?: Record<string, unknown>;
-    }[];
-};
-export type RichtextDoc = {
-    type: "doc";
-    content: RichtextNode[];
-};
-export declare function plainToRichtext(text: string): RichtextDoc;
-export declare function richtextToPlain(doc: unknown): string;