create-smoodly-app 0.0.13 → 0.0.15

package/templates/blank/supabase/migrations/00000000000000_smoodly.sql

@@ -0,0 +1,518 @@
+set client_min_messages = warning;
+
+-- The space a request acts in: the key's claim in Smoodly Cloud, the
+-- default space in self-host (service role, anon key). Policies, the
+-- insert trigger and the reorder RPC all read this ONE function.
+create or replace function "smoodly_current_space"() returns uuid
+language sql stable as $$
+  select coalesce((auth.jwt() ->> 'space_id')::uuid, '00000000-0000-0000-0000-000000000000');
+$$;
+
+create table if not exists "pages" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "parent_id" uuid references "pages" ("id") on delete restrict,
+  "template" text,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The tree is the URL (spec 2026-09-05 §1): a node stores its parent and
+-- its position; template null = folder. Everything a locale owns — the
+-- node's own segment, title, publish state and version pointers — lives
+-- in page_locales, one row per locale the page exists in (spec 2026-09-06
+-- §2). There is no sibling-slug index: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same operation.
+create index if not exists "pages_parent_idx"
+  on "pages" ("space_id", "parent_id", "sort");
+
+create table if not exists "page_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text not null,
+  "title" text not null,
+  "status" text not null default 'draft',
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  primary key ("page_id", "locale")
+);
+
+-- Sibling reorder for pages: same shape as smoodly_reorder for entries.
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+  update "pages" pg set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where pg."id" = u.id
+    and pg."space_id" = "smoodly_current_space"();
+$$;
+
+-- A version belongs to ONE locale of one page: each locale has its own
+-- draft, its own publish and its own history.
+create table if not exists "page_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "tree" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create index if not exists "page_versions_page_locale_idx"
+  on "page_versions" ("page_id", "locale", "created_at");
+
+create table if not exists "entries" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "collection" text not null,
+  "parent_id" uuid references "entries" ("id") on delete restrict,
+  "fields" jsonb not null default '{}'::jsonb,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The node holds identity, tree position and the SHARED fields — every
+-- field without .localized() (spec 2026-09-06 §7): a Person's photo is
+-- the same in every language. Everything a locale owns — its segment,
+-- publish state, the .localized() fields and the version pointers —
+-- lives in entry_locales, one row per locale the entry exists in. There
+-- is no sibling-slug index any more: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same
+-- operation, and both adapters pre-check siblings per locale in code.
+create index if not exists "entries_collection_sort_idx"
+  on "entries" ("space_id", "collection", "sort");
+
+create index if not exists "entries_parent_idx"
+  on "entries" ("space_id", "collection", "parent_id");
+
+create table if not exists "entry_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text,
+  "status" text not null default 'draft',
+  "fields" jsonb not null default '{}'::jsonb,
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  primary key ("entry_id", "locale")
+);
+
+create index if not exists "entry_locales_status_idx"
+  on "entry_locales" ("space_id", "locale", "status");
+
+-- A version belongs to ONE locale of one entry and stores the MERGED
+-- fields (shared + localized + slug) as they were at that save, so
+-- restoring an old Finnish version restores the shared fields too.
+-- Rows exist only for collections registered with `versions: true`.
+create table if not exists "entry_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "fields" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create index if not exists "entry_versions_entry_locale_idx"
+  on "entry_versions" ("entry_id", "locale", "created_at");
+
+-- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
+-- statement. Deliberately does not touch updated_at — a drag must not
+-- make the whole collection look freshly edited. Scoped to the current
+-- space by the same function the policies use.
+create or replace function "smoodly_reorder"(
+  p_collection text,
+  p_ids uuid[]
+) returns void language sql as $$
+  update "entries" e set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where e."id" = u.id
+    and e."collection" = p_collection
+    and e."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "refs" (
+  "source_kind" text not null,
+  "source_id" uuid not null,
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "source_field" text not null,
+  "target_collection" text not null,
+  "target_id" uuid not null,
+  primary key ("source_kind", "source_id", "source_field", "target_id")
+);
+
+-- The URL index (spec 2026-09-05 §4): the refs counterpart for paths.
+-- Derived — the stores rewrite a target's rows on every create, rename,
+-- move and delete — so one primary-key hit resolves any URL in any locale
+-- and no page or entry can share a URL with another in any locale.
+-- Rows exist for drafts too (the editor needs them); the read policy
+-- admits a row only when its target is published.
+create table if not exists "paths" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "locale" text not null,
+  "path" text not null,
+  "kind" text not null check ("kind" in ('page', 'entry')),
+  "target_id" uuid not null,
+  primary key ("space_id", "locale", "path")
+);
+
+create index if not exists "paths_target_idx"
+  on "paths" ("space_id", "kind", "target_id");
+
+-- Media (spec 2026-09-08): one row per upload, bytes in the "media"
+-- bucket at "path". Immediate — never draft-gated, never versioned —
+-- so there is no locale row and no version table. status 'pending' is
+-- a row whose signed upload has not been confirmed; list never shows it.
+create table if not exists "assets" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "kind" text not null check ("kind" in ('image', 'video', 'file')),
+  "status" text not null default 'pending' check ("status" in ('pending', 'ready')),
+  "path" text not null,
+  "mime" text not null,
+  "size" bigint not null,
+  "width" integer,
+  "height" integer,
+  "duration" numeric,
+  "poster_id" uuid references "assets" ("id") on delete set null,
+  "filename" text not null,
+  "title" text,
+  "alt" text,
+  "caption" text,
+  "credit" text,
+  "created_by" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+create index if not exists "assets_space_created_idx"
+  on "assets" ("space_id", "status", "created_at" desc);
+
+-- Replace the targets' rows with the given rows in ONE call: a SQL
+-- function runs in the caller's transaction, so a primary-key collision
+-- rolls the whole rewrite back. Inserted rows get their space from the
+-- a_set_space trigger (the claim, or the default space).
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+  delete from "paths" p
+  using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
+  where p."kind" = t.kind and p."target_id" = t.id
+    and p."space_id" = "smoodly_current_space"();
+  insert into "paths" ("locale", "path", "kind", "target_id")
+  select r.locale, r.path, r.kind, r.id
+  from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid);
+$$;
+
+-- RLS on every core table. The service role bypasses it (self-host
+-- adapters untouched). The policy set that follows (space layer) admits
+-- a key to its own space: everything for a write key, published rows for
+-- a read key or the anon key (default space). Drafts stay unreachable
+-- to anything but a write key. The generated per-collection views
+-- (collectionSQL) run with security_invoker = true, so they are subject
+-- to this same smoodly_read policy rather than their owner's privileges.
+alter table "pages" enable row level security;
+alter table "page_locales" enable row level security;
+alter table "page_versions" enable row level security;
+alter table "entries" enable row level security;
+alter table "entry_locales" enable row level security;
+alter table "entry_versions" enable row level security;
+alter table "refs" enable row level security;
+alter table "paths" enable row level security;
+alter table "assets" enable row level security;
+
+-- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
+-- for everyone with ONE definition. Self-host fills them by hand or
+-- leaves them empty; smoodly.io writes rows with the service role.
+-- There is never cloud-only SQL on a content database.
+create table if not exists "editors" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "user_id" uuid not null,
+  "role" text not null default 'editor',
+  primary key ("space_id", "user_id")
+);
+
+create table if not exists "space_keys" (
+  "id" uuid primary key,
+  "space_id" uuid not null,
+  "kind" text not null check ("kind" in ('read', 'write')),
+  "revoked_at" timestamptz
+);
+
+create table if not exists "space_caps" (
+  "space_id" uuid primary key,
+  "row_cap" integer not null
+);
+
+alter table "editors" enable row level security;
+alter table "space_keys" enable row level security;
+alter table "space_caps" enable row level security;
+
+-- ── Claim readers. The two lookups run as definer so they can read the
+-- service-role-only tables from inside a policy; search_path is pinned.
+create or replace function "smoodly_key_kind"() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'kind';
+$$;
+
+create or replace function "smoodly_space_key_revoked"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select coalesce(
+    (select k."revoked_at" is not null from "space_keys" k
+      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
+    false);
+$$;
+
+create or replace function "smoodly_space_row_cap"() returns integer
+language sql stable security definer set search_path = public as $$
+  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+$$;
+
+-- ── Triggers. A key's claim wins over whatever the insert said, so an
+-- adapter never has to know its space and cannot write into another.
+-- No claim (service role, anon) leaves the given or default value —
+-- that is how smoodly.io writes cloud-state rows for a chosen space.
+create or replace function "smoodly_set_space"() returns trigger
+language plpgsql as $$
+begin
+  if auth.jwt() ->> 'space_id' is not null then
+    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
+  end if;
+  return new;
+end;
+$$;
+
+-- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- a_ (smoodly_set_space) runs first, so new.space_id already equals the
+-- current space for a keyed insert; smoodly_space_row_cap() reads the
+-- current space itself, so this never needs the row's space_id as an
+-- argument (which would let one space's insert probe another's cap).
+-- A service-role insert that names another space explicitly is a
+-- different case: there is no JWT claim, so smoodly_current_space()
+-- still resolves to the default space, and the cap read is the default
+-- space's (none) — the service role is never capped by another space's row.
+-- search_path is pinned empty, so every reference below is schema-qualified.
+create or replace function "smoodly_enforce_row_cap"() returns trigger
+language plpgsql set search_path = '' as $$
+declare
+  cap integer;
+  n bigint;
+begin
+  cap := public."smoodly_space_row_cap"();
+  if cap is null then
+    return new;
+  end if;
+  -- Advisory only (free-tier abuse guard), not a hard invariant: two
+  -- concurrent inserts can both observe n = cap - 1 and both pass.
+  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
+    into n using new."space_id";
+  if n >= cap then
+    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
+      using errcode = 'check_violation';
+  end if;
+  return new;
+end;
+$$;
+
+create index if not exists "page_locales_space_idx" on "page_locales" ("space_id");
+
+create index if not exists "page_versions_space_idx" on "page_versions" ("space_id");
+
+create index if not exists "entry_locales_space_idx" on "entry_locales" ("space_id");
+
+create index if not exists "entry_versions_space_idx" on "entry_versions" ("space_id");
+
+create index if not exists "refs_space_idx" on "refs" ("space_id");
+
+drop trigger if exists "smoodly_a_set_space" on "pages";
+create trigger "smoodly_a_set_space" before insert on "pages"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_locales";
+create trigger "smoodly_a_set_space" before insert on "page_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_versions";
+create trigger "smoodly_a_set_space" before insert on "page_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entries";
+create trigger "smoodly_a_set_space" before insert on "entries"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_locales";
+create trigger "smoodly_a_set_space" before insert on "entry_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_versions";
+create trigger "smoodly_a_set_space" before insert on "entry_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "refs";
+create trigger "smoodly_a_set_space" before insert on "refs"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "paths";
+create trigger "smoodly_a_set_space" before insert on "paths"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "assets";
+create trigger "smoodly_a_set_space" before insert on "assets"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "editors";
+create trigger "smoodly_a_set_space" before insert on "editors"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_b_row_cap" on "pages";
+create trigger "smoodly_b_row_cap" before insert on "pages"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_locales";
+create trigger "smoodly_b_row_cap" before insert on "page_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_versions";
+create trigger "smoodly_b_row_cap" before insert on "page_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entries";
+create trigger "smoodly_b_row_cap" before insert on "entries"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_locales";
+create trigger "smoodly_b_row_cap" before insert on "entry_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_versions";
+create trigger "smoodly_b_row_cap" before insert on "entry_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "refs";
+create trigger "smoodly_b_row_cap" before insert on "refs"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "paths";
+create trigger "smoodly_b_row_cap" before insert on "paths"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "assets";
+create trigger "smoodly_b_row_cap" before insert on "assets"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop policy if exists "smoodly_write" on "pages";
+create policy "smoodly_write" on "pages" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "page_locales";
+create policy "smoodly_write" on "page_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "page_versions";
+create policy "smoodly_write" on "page_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id"));
+
+drop policy if exists "smoodly_write" on "entries";
+create policy "smoodly_write" on "entries" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "entry_locales";
+create policy "smoodly_write" on "entry_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "entry_versions";
+create policy "smoodly_write" on "entry_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id"));
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+create policy "smoodly_write" on "paths" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published'))));
+
+drop policy if exists "smoodly_write" on "assets";
+create policy "smoodly_write" on "assets" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'ready');
+
+drop policy if exists "smoodly_write" on "editors";
+create policy "smoodly_write" on "editors" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+insert into storage.buckets ("id", "name", "public", "file_size_limit")
+  values ('media', 'media', true, 104857600)
+  on conflict ("id") do update set "public" = excluded."public", "file_size_limit" = excluded."file_size_limit";
+
+drop policy if exists "smoodly_media_read" on storage.objects;
+create policy "smoodly_media_read" on storage.objects for select
+  using ("bucket_id" = 'media');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+create policy "smoodly_media_write" on storage.objects for all
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text)
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+create or replace view "posts" with (security_invoker = true) as
+select
+  e."id",
+  l."locale",
+  l."slug",
+  e."sort",
+  e."created_at",
+  l."updated_at",
+  v."fields"->>'title' as "title",
+  (v."fields"->>'date')::timestamptz as "date",
+  v."fields"->'body' as "body"
+from "entries" e
+join "entry_locales" l on l."entry_id" = e."id"
+join "entry_versions" v on v."id" = l."published_version_id"
+where e."collection" = 'posts' and l."status" = 'published';
+
+create index if not exists "entries_posts_date_idx"
+  on "entries" (("fields"->'date')) where "collection" = 'posts';

package/templates/blank-intl/AGENTS.md

@@ -0,0 +1,50 @@
+# Working in this Smoodly site
+
+This is a Next.js app with Smoodly installed: content lives in Supabase,
+the admin is mounted at /admin from the `smoodly` package, and the site
+reads content through `smoodly/server.ts`. Read README.md first: it says
+where things are.
+
+## Rules
+
+- **Register everything in `smoodly/`.** Every section, element,
+  collection and shared item is listed in its barrel (`sections.ts`,
+  `elements.ts`, `collections.ts`, `shared.ts`) and `smoodly/config.ts`
+  is the one registry. A component that is not registered does not exist
+  for the admin.
+- **A new collection is a new migration.** Write its view with
+  `collectionSQL` from `smoodly` into a new file under
+  `supabase/migrations/`, then apply it: `supabase db push` (hosted) or
+  `supabase db reset` (local). The admin cannot list a collection whose
+  view is missing.
+- **Seed through the stores.** `scripts/seed.ts` is starter content,
+  written through the page and entry stores, never raw SQL. It is
+  idempotent; run it with `npm run seed`.
+- **Never import the admin into the site.** Nothing under `app/(site)`,
+  `app/[locale]` or `components/` may import `@/smoodly/admin` or
+  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+- **Two root layouts.** The site's layout lives in its route group or
+  locale segment and is never the admin's parent; `app/(smoodly)/admin`
+  is a second root layout. Do not add an `app/layout.tsx`.
+- **Toolsets and elements.** A richtext field names a toolset
+  (`smoodly/toolsets.ts`); a toolset embeds elements by value; the config
+  must register those elements too. Files the toolset imports use
+  relative paths, not `@/`.
+- **Section styles are data attributes.** `<smoodly.Section>` renders the
+  root element and emits the config's section styles as `data-*`
+  attributes; `app/globals.css` styles them. Marks
+  (`smoodly.marks(schema)`) tie rendered elements to fields so the
+  editor can select and edit them in place.
+- **Multilingual sites.** Content locales are Smoodly's; URL locales are
+  next-intl's. The locale set is `i18n/routing.ts`. UI strings of the
+  site's own go through next-intl's messages in `messages/<locale>.json`.
+- **Fixed versus open pages.** A page shape with a `slug` is fixed: one
+  record, created for you, never deleted. Without one it is open: editors
+  create as many as they like.
+
+## Commands
+
+    npm run dev          # http://localhost:3000, /admin is the editor
+    npm run build        # next build
+    npm run seed         # starter content, idempotent
+    npm run typecheck    # tsc --noEmit

package/templates/blank-intl/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/blank-intl/README.md

@@ -0,0 +1,76 @@
+# Smoodly site
+
+Created by `create-smoodly-app`. Content lives in Supabase; the admin is
+mounted at `/admin` from the `smoodly` package. AGENTS.md holds the rules
+for an agent (or a person) building the site.
+
+    npm run dev          # http://localhost:3000 — /admin is the editor
+
+## Where things are
+
+- `app/[locale]/page.tsx` — the home page: one line calling renderSmoodlyPath([], { locale }).
+- `app/[locale]/[...path]/page.tsx` — every other page and every collection entry, at any depth, with translated segments per locale.
+- `app/[locale]/layout.tsx` — the site's root layout: `app/globals.css`, the locale links, the footer line from the `site` item; the admin has its own under `app/(smoodly)/admin/`.
+- `i18n/routing.ts` — the locales and the default; `smoodly/config.ts` reads them from here. `i18n/request.ts` and `i18n/navigation.ts` are next-intl's stock files; `proxy.ts` is its locale routing (`/admin` excluded). UI strings go in `messages/<locale>.json`.
+- `components/pages/` — the page shapes and the entry page: `Home` (fixed at /, one freeform zone), `Page` (open, editors create many), `Post` (the entry page for posts).
+- `components/sections/Text.tsx` — the one section: a title and a richtext body. Listed in `smoodly/sections.ts`.
+- `components/elements/Button.tsx` — the one element: a link styled as a button, embedded in richtext through `smoodly/toolsets.ts`.
+- `smoodly/` — the wiring: `config.ts` (the registry and settings), `collections.ts` (posts), `shared.ts` (the site item), `sections.ts`, `elements.ts`, `toolsets.ts`, `server.ts` (stores, site layer, renderer, the read API `q`), `ops.ts` (the admin's one server action), `admin.tsx` (the admin mount), `richtext.tsx` (the bound renderer).
+- `scripts/seed.ts` — the home page and the site item, written through the stores. `npm run seed` is idempotent.
+- `app/globals.css` — a reset, a container, the two tones. Replace it.
+- `.env.local` — `SMOODLY_URL`, `SMOODLY_SECRET_KEY`, `SMOODLY_PUBLISHABLE_KEY`.
+
+## Add a section
+
+Copy `components/sections/Text.tsx`, give the schema a new `name` and
+`title`, declare its fields, render them inside `<smoodly.Section>` with
+marks on each field. Add it to `sections` in `smoodly/sections.ts`, then
+to the `sections` list of every zone that may hold it in
+`components/pages/*.tsx`. It appears in the editor's "+" picker.
+
+## Add an element
+
+Copy `components/elements/Button.tsx` (relative imports only). Add it to
+`elements` in `smoodly/elements.ts` and to the `elements` of the toolset
+in `smoodly/toolsets.ts` that may embed it. It appears in the richtext
+editor's "/" menu.
+
+## Add a collection
+
+Copy the `posts` block in `smoodly/collections.ts`, add the new
+collection to `collections`, and write its entry page by copying
+`components/pages/Post.tsx` (register it in `config.ts` under `pages`).
+Then create a migration with its view:
+
+    import { collectionSQL } from "smoodly";
+    import { people } from "./smoodly/collections";
+    console.log(collectionSQL(people));
+
+Save the output as `supabase/migrations/<timestamp>_people.sql` and apply
+it with `supabase db push` (hosted) or `supabase db reset` (local).
+
+## Add a shared item
+
+Copy the `site` block in `smoodly/shared.ts` and add it to `shared`. An
+object item (`fields`) is read in code with `q().getShared("name")`; a
+visual item (`section: SomeSection`) renders through its section and can
+be placed on pages from the picker's Shared group. Edit both under
+Globals in the admin.
+
+Reseed an empty database any time with `npm run seed`.
+
+## Editors
+
+Anyone who may open `/admin` is a Supabase Auth user with a row in the
+`editors` table. To add one: create the user in Supabase Studio
+(Authentication → Users), then in the SQL editor:
+
+    insert into editors (user_id, role) values ('<the user id>', 'editor');
+
+## Hosted Supabase
+
+    supabase init        # if the CLI has not been set up here yet
+    supabase link        # pick the project
+    supabase db push     # applies supabase/migrations/
+
+Then put the project's URL and keys in `.env.local`.