create-smoodly-app 0.0.13 → 0.0.15

package/templates/blank-intl/supabase/migrations/00000000000000_smoodly.sql

@@ -0,0 +1,518 @@
+set client_min_messages = warning;
+
+-- The space a request acts in: the key's claim in Smoodly Cloud, the
+-- default space in self-host (service role, anon key). Policies, the
+-- insert trigger and the reorder RPC all read this ONE function.
+create or replace function "smoodly_current_space"() returns uuid
+language sql stable as $$
+  select coalesce((auth.jwt() ->> 'space_id')::uuid, '00000000-0000-0000-0000-000000000000');
+$$;
+
+create table if not exists "pages" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "parent_id" uuid references "pages" ("id") on delete restrict,
+  "template" text,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The tree is the URL (spec 2026-09-05 §1): a node stores its parent and
+-- its position; template null = folder. Everything a locale owns — the
+-- node's own segment, title, publish state and version pointers — lives
+-- in page_locales, one row per locale the page exists in (spec 2026-09-06
+-- §2). There is no sibling-slug index: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same operation.
+create index if not exists "pages_parent_idx"
+  on "pages" ("space_id", "parent_id", "sort");
+
+create table if not exists "page_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text not null,
+  "title" text not null,
+  "status" text not null default 'draft',
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  primary key ("page_id", "locale")
+);
+
+-- Sibling reorder for pages: same shape as smoodly_reorder for entries.
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+  update "pages" pg set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where pg."id" = u.id
+    and pg."space_id" = "smoodly_current_space"();
+$$;
+
+-- A version belongs to ONE locale of one page: each locale has its own
+-- draft, its own publish and its own history.
+create table if not exists "page_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "tree" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create index if not exists "page_versions_page_locale_idx"
+  on "page_versions" ("page_id", "locale", "created_at");
+
+create table if not exists "entries" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "collection" text not null,
+  "parent_id" uuid references "entries" ("id") on delete restrict,
+  "fields" jsonb not null default '{}'::jsonb,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The node holds identity, tree position and the SHARED fields — every
+-- field without .localized() (spec 2026-09-06 §7): a Person's photo is
+-- the same in every language. Everything a locale owns — its segment,
+-- publish state, the .localized() fields and the version pointers —
+-- lives in entry_locales, one row per locale the entry exists in. There
+-- is no sibling-slug index any more: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same
+-- operation, and both adapters pre-check siblings per locale in code.
+create index if not exists "entries_collection_sort_idx"
+  on "entries" ("space_id", "collection", "sort");
+
+create index if not exists "entries_parent_idx"
+  on "entries" ("space_id", "collection", "parent_id");
+
+create table if not exists "entry_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text,
+  "status" text not null default 'draft',
+  "fields" jsonb not null default '{}'::jsonb,
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  primary key ("entry_id", "locale")
+);
+
+create index if not exists "entry_locales_status_idx"
+  on "entry_locales" ("space_id", "locale", "status");
+
+-- A version belongs to ONE locale of one entry and stores the MERGED
+-- fields (shared + localized + slug) as they were at that save, so
+-- restoring an old Finnish version restores the shared fields too.
+-- Rows exist only for collections registered with `versions: true`.
+create table if not exists "entry_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "fields" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create index if not exists "entry_versions_entry_locale_idx"
+  on "entry_versions" ("entry_id", "locale", "created_at");
+
+-- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
+-- statement. Deliberately does not touch updated_at — a drag must not
+-- make the whole collection look freshly edited. Scoped to the current
+-- space by the same function the policies use.
+create or replace function "smoodly_reorder"(
+  p_collection text,
+  p_ids uuid[]
+) returns void language sql as $$
+  update "entries" e set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where e."id" = u.id
+    and e."collection" = p_collection
+    and e."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "refs" (
+  "source_kind" text not null,
+  "source_id" uuid not null,
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "source_field" text not null,
+  "target_collection" text not null,
+  "target_id" uuid not null,
+  primary key ("source_kind", "source_id", "source_field", "target_id")
+);
+
+-- The URL index (spec 2026-09-05 §4): the refs counterpart for paths.
+-- Derived — the stores rewrite a target's rows on every create, rename,
+-- move and delete — so one primary-key hit resolves any URL in any locale
+-- and no page or entry can share a URL with another in any locale.
+-- Rows exist for drafts too (the editor needs them); the read policy
+-- admits a row only when its target is published.
+create table if not exists "paths" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "locale" text not null,
+  "path" text not null,
+  "kind" text not null check ("kind" in ('page', 'entry')),
+  "target_id" uuid not null,
+  primary key ("space_id", "locale", "path")
+);
+
+create index if not exists "paths_target_idx"
+  on "paths" ("space_id", "kind", "target_id");
+
+-- Media (spec 2026-09-08): one row per upload, bytes in the "media"
+-- bucket at "path". Immediate — never draft-gated, never versioned —
+-- so there is no locale row and no version table. status 'pending' is
+-- a row whose signed upload has not been confirmed; list never shows it.
+create table if not exists "assets" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "kind" text not null check ("kind" in ('image', 'video', 'file')),
+  "status" text not null default 'pending' check ("status" in ('pending', 'ready')),
+  "path" text not null,
+  "mime" text not null,
+  "size" bigint not null,
+  "width" integer,
+  "height" integer,
+  "duration" numeric,
+  "poster_id" uuid references "assets" ("id") on delete set null,
+  "filename" text not null,
+  "title" text,
+  "alt" text,
+  "caption" text,
+  "credit" text,
+  "created_by" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+create index if not exists "assets_space_created_idx"
+  on "assets" ("space_id", "status", "created_at" desc);
+
+-- Replace the targets' rows with the given rows in ONE call: a SQL
+-- function runs in the caller's transaction, so a primary-key collision
+-- rolls the whole rewrite back. Inserted rows get their space from the
+-- a_set_space trigger (the claim, or the default space).
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+  delete from "paths" p
+  using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
+  where p."kind" = t.kind and p."target_id" = t.id
+    and p."space_id" = "smoodly_current_space"();
+  insert into "paths" ("locale", "path", "kind", "target_id")
+  select r.locale, r.path, r.kind, r.id
+  from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid);
+$$;
+
+-- RLS on every core table. The service role bypasses it (self-host
+-- adapters untouched). The policy set that follows (space layer) admits
+-- a key to its own space: everything for a write key, published rows for
+-- a read key or the anon key (default space). Drafts stay unreachable
+-- to anything but a write key. The generated per-collection views
+-- (collectionSQL) run with security_invoker = true, so they are subject
+-- to this same smoodly_read policy rather than their owner's privileges.
+alter table "pages" enable row level security;
+alter table "page_locales" enable row level security;
+alter table "page_versions" enable row level security;
+alter table "entries" enable row level security;
+alter table "entry_locales" enable row level security;
+alter table "entry_versions" enable row level security;
+alter table "refs" enable row level security;
+alter table "paths" enable row level security;
+alter table "assets" enable row level security;
+
+-- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
+-- for everyone with ONE definition. Self-host fills them by hand or
+-- leaves them empty; smoodly.io writes rows with the service role.
+-- There is never cloud-only SQL on a content database.
+create table if not exists "editors" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "user_id" uuid not null,
+  "role" text not null default 'editor',
+  primary key ("space_id", "user_id")
+);
+
+create table if not exists "space_keys" (
+  "id" uuid primary key,
+  "space_id" uuid not null,
+  "kind" text not null check ("kind" in ('read', 'write')),
+  "revoked_at" timestamptz
+);
+
+create table if not exists "space_caps" (
+  "space_id" uuid primary key,
+  "row_cap" integer not null
+);
+
+alter table "editors" enable row level security;
+alter table "space_keys" enable row level security;
+alter table "space_caps" enable row level security;
+
+-- ── Claim readers. The two lookups run as definer so they can read the
+-- service-role-only tables from inside a policy; search_path is pinned.
+create or replace function "smoodly_key_kind"() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'kind';
+$$;
+
+create or replace function "smoodly_space_key_revoked"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select coalesce(
+    (select k."revoked_at" is not null from "space_keys" k
+      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
+    false);
+$$;
+
+create or replace function "smoodly_space_row_cap"() returns integer
+language sql stable security definer set search_path = public as $$
+  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+$$;
+
+-- ── Triggers. A key's claim wins over whatever the insert said, so an
+-- adapter never has to know its space and cannot write into another.
+-- No claim (service role, anon) leaves the given or default value —
+-- that is how smoodly.io writes cloud-state rows for a chosen space.
+create or replace function "smoodly_set_space"() returns trigger
+language plpgsql as $$
+begin
+  if auth.jwt() ->> 'space_id' is not null then
+    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
+  end if;
+  return new;
+end;
+$$;
+
+-- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- a_ (smoodly_set_space) runs first, so new.space_id already equals the
+-- current space for a keyed insert; smoodly_space_row_cap() reads the
+-- current space itself, so this never needs the row's space_id as an
+-- argument (which would let one space's insert probe another's cap).
+-- A service-role insert that names another space explicitly is a
+-- different case: there is no JWT claim, so smoodly_current_space()
+-- still resolves to the default space, and the cap read is the default
+-- space's (none) — the service role is never capped by another space's row.
+-- search_path is pinned empty, so every reference below is schema-qualified.
+create or replace function "smoodly_enforce_row_cap"() returns trigger
+language plpgsql set search_path = '' as $$
+declare
+  cap integer;
+  n bigint;
+begin
+  cap := public."smoodly_space_row_cap"();
+  if cap is null then
+    return new;
+  end if;
+  -- Advisory only (free-tier abuse guard), not a hard invariant: two
+  -- concurrent inserts can both observe n = cap - 1 and both pass.
+  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
+    into n using new."space_id";
+  if n >= cap then
+    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
+      using errcode = 'check_violation';
+  end if;
+  return new;
+end;
+$$;
+
+create index if not exists "page_locales_space_idx" on "page_locales" ("space_id");
+
+create index if not exists "page_versions_space_idx" on "page_versions" ("space_id");
+
+create index if not exists "entry_locales_space_idx" on "entry_locales" ("space_id");
+
+create index if not exists "entry_versions_space_idx" on "entry_versions" ("space_id");
+
+create index if not exists "refs_space_idx" on "refs" ("space_id");
+
+drop trigger if exists "smoodly_a_set_space" on "pages";
+create trigger "smoodly_a_set_space" before insert on "pages"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_locales";
+create trigger "smoodly_a_set_space" before insert on "page_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_versions";
+create trigger "smoodly_a_set_space" before insert on "page_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entries";
+create trigger "smoodly_a_set_space" before insert on "entries"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_locales";
+create trigger "smoodly_a_set_space" before insert on "entry_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_versions";
+create trigger "smoodly_a_set_space" before insert on "entry_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "refs";
+create trigger "smoodly_a_set_space" before insert on "refs"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "paths";
+create trigger "smoodly_a_set_space" before insert on "paths"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "assets";
+create trigger "smoodly_a_set_space" before insert on "assets"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "editors";
+create trigger "smoodly_a_set_space" before insert on "editors"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_b_row_cap" on "pages";
+create trigger "smoodly_b_row_cap" before insert on "pages"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_locales";
+create trigger "smoodly_b_row_cap" before insert on "page_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_versions";
+create trigger "smoodly_b_row_cap" before insert on "page_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entries";
+create trigger "smoodly_b_row_cap" before insert on "entries"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_locales";
+create trigger "smoodly_b_row_cap" before insert on "entry_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_versions";
+create trigger "smoodly_b_row_cap" before insert on "entry_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "refs";
+create trigger "smoodly_b_row_cap" before insert on "refs"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "paths";
+create trigger "smoodly_b_row_cap" before insert on "paths"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "assets";
+create trigger "smoodly_b_row_cap" before insert on "assets"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop policy if exists "smoodly_write" on "pages";
+create policy "smoodly_write" on "pages" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "page_locales";
+create policy "smoodly_write" on "page_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "page_versions";
+create policy "smoodly_write" on "page_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id"));
+
+drop policy if exists "smoodly_write" on "entries";
+create policy "smoodly_write" on "entries" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "entry_locales";
+create policy "smoodly_write" on "entry_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "entry_versions";
+create policy "smoodly_write" on "entry_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id"));
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+create policy "smoodly_write" on "paths" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published'))));
+
+drop policy if exists "smoodly_write" on "assets";
+create policy "smoodly_write" on "assets" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'ready');
+
+drop policy if exists "smoodly_write" on "editors";
+create policy "smoodly_write" on "editors" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+insert into storage.buckets ("id", "name", "public", "file_size_limit")
+  values ('media', 'media', true, 104857600)
+  on conflict ("id") do update set "public" = excluded."public", "file_size_limit" = excluded."file_size_limit";
+
+drop policy if exists "smoodly_media_read" on storage.objects;
+create policy "smoodly_media_read" on storage.objects for select
+  using ("bucket_id" = 'media');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+create policy "smoodly_media_write" on storage.objects for all
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text)
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+create or replace view "posts" with (security_invoker = true) as
+select
+  e."id",
+  l."locale",
+  l."slug",
+  e."sort",
+  e."created_at",
+  l."updated_at",
+  v."fields"->>'title' as "title",
+  (v."fields"->>'date')::timestamptz as "date",
+  v."fields"->'body' as "body"
+from "entries" e
+join "entry_locales" l on l."entry_id" = e."id"
+join "entry_versions" v on v."id" = l."published_version_id"
+where e."collection" = 'posts' and l."status" = 'published';
+
+create index if not exists "entries_posts_date_idx"
+  on "entries" (("fields"->'date')) where "collection" = 'posts';

package/templates/blank-intl.tsconfig.json

@@ -0,0 +1,28 @@
+{
+  "extends": "./blank-intl/tsconfig.json",
+  "compilerOptions": {
+    "incremental": false,
+    "allowImportingTsExtensions": true,
+    "paths": {
+      "@/*": [
+        "./blank-intl/*"
+      ],
+      "smoodly": [
+        "../../smoodly/src/index.ts"
+      ],
+      "smoodly/bridge": [
+        "../../smoodly/src/admin/next/bridge.tsx"
+      ],
+      "smoodly/image/config": [
+        "../../smoodly/src/image/next-config.ts"
+      ],
+      "smoodly/*": [
+        "../../smoodly/src/*"
+      ]
+    }
+  },
+  "include": [
+    "./blank-intl/**/*.ts",
+    "./blank-intl/**/*.tsx"
+  ]
+}

package/templates/blank.tsconfig.json

@@ -0,0 +1,28 @@
+{
+  "extends": "./blank/tsconfig.json",
+  "compilerOptions": {
+    "incremental": false,
+    "allowImportingTsExtensions": true,
+    "paths": {
+      "@/*": [
+        "./blank/*"
+      ],
+      "smoodly": [
+        "../../smoodly/src/index.ts"
+      ],
+      "smoodly/bridge": [
+        "../../smoodly/src/admin/next/bridge.tsx"
+      ],
+      "smoodly/image/config": [
+        "../../smoodly/src/image/next-config.ts"
+      ],
+      "smoodly/*": [
+        "../../smoodly/src/*"
+      ]
+    }
+  },
+  "include": [
+    "./blank/**/*.ts",
+    "./blank/**/*.tsx"
+  ]
+}

package/templates/lorem/AGENTS.md

@@ -0,0 +1,50 @@
+# Working in this Smoodly site
+
+This is a Next.js app with Smoodly installed: content lives in Supabase,
+the admin is mounted at /admin from the `smoodly` package, and the site
+reads content through `smoodly/server.ts`. Read README.md first: it says
+where things are.
+
+## Rules
+
+- **Register everything in `smoodly/`.** Every section, element,
+  collection and shared item is listed in its barrel (`sections.ts`,
+  `elements.ts`, `collections.ts`, `shared.ts`) and `smoodly/config.ts`
+  is the one registry. A component that is not registered does not exist
+  for the admin.
+- **A new collection is a new migration.** Write its view with
+  `collectionSQL` from `smoodly` into a new file under
+  `supabase/migrations/`, then apply it: `supabase db push` (hosted) or
+  `supabase db reset` (local). The admin cannot list a collection whose
+  view is missing.
+- **Seed through the stores.** `scripts/seed.ts` is starter content,
+  written through the page and entry stores, never raw SQL. It is
+  idempotent; run it with `npm run seed`.
+- **Never import the admin into the site.** Nothing under `app/(site)`,
+  `app/[locale]` or `components/` may import `@/smoodly/admin` or
+  `smoodly/admin/next`; the admin's chunk must not reach visitors.
+- **Two root layouts.** The site's layout lives in its route group or
+  locale segment and is never the admin's parent; `app/(smoodly)/admin`
+  is a second root layout. Do not add an `app/layout.tsx`.
+- **Toolsets and elements.** A richtext field names a toolset
+  (`smoodly/toolsets.ts`); a toolset embeds elements by value; the config
+  must register those elements too. Files the toolset imports use
+  relative paths, not `@/`.
+- **Section styles are data attributes.** `<smoodly.Section>` renders the
+  root element and emits the config's section styles as `data-*`
+  attributes; `app/globals.css` styles them. Marks
+  (`smoodly.marks(schema)`) tie rendered elements to fields so the
+  editor can select and edit them in place.
+- **Multilingual sites.** Content locales are Smoodly's; URL locales are
+  next-intl's. The locale set is `i18n/routing.ts`. UI strings of the
+  site's own go through next-intl's messages in `messages/<locale>.json`.
+- **Fixed versus open pages.** A page shape with a `slug` is fixed: one
+  record, created for you, never deleted. Without one it is open: editors
+  create as many as they like.
+
+## Commands
+
+    npm run dev          # http://localhost:3000, /admin is the editor
+    npm run build        # next build
+    npm run seed         # starter content, idempotent
+    npm run typecheck    # tsc --noEmit

package/templates/lorem/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/{next → lorem}/README.md

@@ -1,15 +1,16 @@
 # Smoodly site
 
 Created by `create-smoodly-app`. Content lives in Supabase; the admin is
-mounted at `/admin` from the `smoodly` package.
+mounted at `/admin` from the `smoodly` package. AGENTS.md holds the rules
+for an agent (or a person) building the site.
 
     npm run dev          # http://localhost:3000 — /admin is the editor
 
 ## Where things are
 
-- `app/page.tsx` — the home page: one line calling renderSmoodlyPath([]).
-- `app/[...path]/page.tsx` — every other page and every collection entry, at any depth.
-- `app/layout.tsx` — the site's root layout: fonts, `app/globals.css`, the header and footer from shared content.
+- `app/(site)/page.tsx` — the home page: one line calling renderSmoodlyPath([]).
+- `app/(site)/[...path]/page.tsx` — every other page and every collection entry, at any depth.
+- `app/(site)/layout.tsx` — the site's root layout: fonts, `app/globals.css`, the header and footer from shared content; the admin has its own under `app/(smoodly)/admin/`.
 - `components/pages/` — the page shapes and the entry page: `Home` (locked hero, freeform body), `Articles` (a fixed page at the collection's path — its index — with a code-fetched grid), `Page` (open; About lives here), `Article` (the entry page).
 - `components/sections/` — the building blocks editors compose with, and the header, footer and quote behind the shared items. Add one, list it in `smoodly/sections.ts`.
 - `components/strings.ts`, `messages/` — the site's own UI strings and the request locale, one seam.

package/templates/lorem/_gitignore

@@ -0,0 +1,5 @@
+node_modules/
+.next/
+.env.local
+next-env.d.ts
+*.tsbuildinfo