create-smoodly-app 0.0.25 → 0.0.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-smoodly-app",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "description": "Create a Smoodly site: a fresh Next.js app with the admin mounted, a Supabase schema, an env file and a first editor.",
   "license": "MIT",
   "repository": {

package/templates/blank/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.25"
+    "smoodly": "0.0.27"
   },
   "devDependencies": {
     "@next/env": "^16.3.4",

package/templates/blank/smoodly/admin.tsx

@@ -1,6 +1,6 @@
 import { createSmoodlyAdmin } from "smoodly/admin/next";
 import { config } from "./config";
 import { smoodlyOp } from "./ops";
-import { publicAuth } from "./server";
+import { publicAuth, publicContent } from "./server";
 
-export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth });
+export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth, content: publicContent });

package/templates/blank/smoodly/server.ts

@@ -9,7 +9,7 @@
 // admin route enters it from config.ts — so nothing here may read the
 // config at module scope.
 import {
-  createSmoodlyClient, createSmoodlySite, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type SmoodlySite,
+  createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
 import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
@@ -81,6 +81,11 @@ export function publicAuth(): AuthConfig {
   return { url: env.authUrl, key: env.authKey };
 }
 
+/** What the browser needs to join the editing-presence channel — public values only (spec 2026-09-26 concurrency §5). */
+export function publicContent(): ContentConfig {
+  return publicContentConfig(smoodlyEnv());
+}
+
 /** Locale-relative CMS path → site URL: the one seam for the renderer
  * (metadata alternates, the `page` prop's links) and the admin (canvas,
  * View live). The identity for a single-language site; with next-intl it

package/templates/blank/supabase/migrations/20260926130000_smoodly_v2.sql

@@ -0,0 +1,26 @@
+-- Smoodly core schema, version 2 (docs/superpowers/specs/2026-09-26-concurrency-guard-presence-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 1: the draft pointers become foreign keys (the
+-- token rides every locale row read) and the editing-presence channel
+-- gets its policy on realtime.messages.
+
+set client_min_messages = warning;
+
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '2')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/blank/supabase/migrations/20260926140000_smoodly_v3.sql

@@ -0,0 +1,38 @@
+-- Smoodly core schema, version 3 (docs/superpowers/specs/2026-09-26-security-pass-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 2: the presence channel admits a signed-in
+-- member of the topic's space (a definer lookup in members by the session
+-- token's user), the five unpinned functions get a search_path, and the
+-- three mutation RPCs are no longer executable by anon or public.
+
+set client_min_messages = warning;
+
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select public."smoodly_presence_member"()));
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select public."smoodly_presence_member"()));
+
+alter function "smoodly_current_space"() set search_path = '';
+alter function "smoodly_key_kind"() set search_path = '';
+alter function "smoodly_set_space"() set search_path = '';
+alter function "smoodly_reorder"(text, uuid[]) set search_path = public;
+alter function "smoodly_reorder_pages"(uuid[]) set search_path = public;
+alter function "smoodly_rewrite_paths"(jsonb, jsonb) set search_path = public;
+
+revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;
+revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;
+revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '3')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/blank/supabase/migrations/{20260926120100_smoodly_views.sql → 20260926140100_smoodly_views.sql}

@@ -1,5 +1,5 @@
 -- Smoodly: read views and order indexes for this app's collections, written by `npx smoodly migrate`
--- (2026-09-26T12:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
+-- (2026-09-26T14:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
 -- Never edit a written file: change the collection and run migrate again.
 
 -- smoodly:collection posts sha256:2e648b887b8e7146

package/templates/blank-intl/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.25",
+    "smoodly": "0.0.27",
     "next-intl": "^4.14.2"
   },
   "devDependencies": {

package/templates/blank-intl/smoodly/admin.tsx

@@ -1,6 +1,6 @@
 import { createSmoodlyAdmin } from "smoodly/admin/next";
 import { config } from "./config";
 import { smoodlyOp } from "./ops";
-import { publicAuth } from "./server";
+import { publicAuth, publicContent } from "./server";
 
-export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth });
+export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth, content: publicContent });

package/templates/blank-intl/smoodly/server.ts

@@ -9,7 +9,7 @@
 // admin route enters it from config.ts — so nothing here may read the
 // config at module scope.
 import {
-  createSmoodlyClient, createSmoodlySite, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type SmoodlySite,
+  createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
 import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
@@ -82,6 +82,11 @@ export function publicAuth(): AuthConfig {
   return { url: env.authUrl, key: env.authKey };
 }
 
+/** What the browser needs to join the editing-presence channel — public values only (spec 2026-09-26 concurrency §5). */
+export function publicContent(): ContentConfig {
+  return publicContentConfig(smoodlyEnv());
+}
+
 /** Locale-relative CMS path → site URL: the one seam for the renderer
  * (metadata alternates, the `page` prop's links) and the admin (canvas,
  * View live). The identity for a single-language site; with next-intl it

package/templates/blank-intl/supabase/migrations/20260926130000_smoodly_v2.sql

@@ -0,0 +1,26 @@
+-- Smoodly core schema, version 2 (docs/superpowers/specs/2026-09-26-concurrency-guard-presence-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 1: the draft pointers become foreign keys (the
+-- token rides every locale row read) and the editing-presence channel
+-- gets its policy on realtime.messages.
+
+set client_min_messages = warning;
+
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '2')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/blank-intl/supabase/migrations/20260926140000_smoodly_v3.sql

@@ -0,0 +1,38 @@
+-- Smoodly core schema, version 3 (docs/superpowers/specs/2026-09-26-security-pass-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 2: the presence channel admits a signed-in
+-- member of the topic's space (a definer lookup in members by the session
+-- token's user), the five unpinned functions get a search_path, and the
+-- three mutation RPCs are no longer executable by anon or public.
+
+set client_min_messages = warning;
+
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select public."smoodly_presence_member"()));
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select public."smoodly_presence_member"()));
+
+alter function "smoodly_current_space"() set search_path = '';
+alter function "smoodly_key_kind"() set search_path = '';
+alter function "smoodly_set_space"() set search_path = '';
+alter function "smoodly_reorder"(text, uuid[]) set search_path = public;
+alter function "smoodly_reorder_pages"(uuid[]) set search_path = public;
+alter function "smoodly_rewrite_paths"(jsonb, jsonb) set search_path = public;
+
+revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;
+revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;
+revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '3')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/blank-intl/supabase/migrations/{20260926120100_smoodly_views.sql → 20260926140100_smoodly_views.sql}

@@ -1,5 +1,5 @@
 -- Smoodly: read views and order indexes for this app's collections, written by `npx smoodly migrate`
--- (2026-09-26T12:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
+-- (2026-09-26T14:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
 -- Never edit a written file: change the collection and run migrate again.
 
 -- smoodly:collection posts sha256:2e648b887b8e7146

package/templates/lorem/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.25"
+    "smoodly": "0.0.27"
   },
   "devDependencies": {
     "@next/env": "^16.3.4",

package/templates/lorem/smoodly/admin.tsx

@@ -1,6 +1,6 @@
 import { createSmoodlyAdmin } from "smoodly/admin/next";
 import { config } from "./config";
 import { smoodlyOp } from "./ops";
-import { publicAuth } from "./server";
+import { publicAuth, publicContent } from "./server";
 
-export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth });
+export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth, content: publicContent });

package/templates/lorem/smoodly/server.ts

@@ -9,7 +9,7 @@
 // admin route enters it from config.ts — so nothing here may read the
 // config at module scope.
 import {
-  createSmoodlyClient, createSmoodlySite, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type SmoodlySite,
+  createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
 import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
@@ -81,6 +81,11 @@ export function publicAuth(): AuthConfig {
   return { url: env.authUrl, key: env.authKey };
 }
 
+/** What the browser needs to join the editing-presence channel — public values only (spec 2026-09-26 concurrency §5). */
+export function publicContent(): ContentConfig {
+  return publicContentConfig(smoodlyEnv());
+}
+
 /** Locale-relative CMS path → site URL: the one seam for the renderer
  * (metadata alternates, the `page` prop's links) and the admin (canvas,
  * View live). The identity for a single-language site; with next-intl it

package/templates/lorem/supabase/migrations/20260926130000_smoodly_v2.sql

@@ -0,0 +1,26 @@
+-- Smoodly core schema, version 2 (docs/superpowers/specs/2026-09-26-concurrency-guard-presence-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 1: the draft pointers become foreign keys (the
+-- token rides every locale row read) and the editing-presence channel
+-- gets its policy on realtime.messages.
+
+set client_min_messages = warning;
+
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '2')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/lorem/supabase/migrations/20260926140000_smoodly_v3.sql

@@ -0,0 +1,38 @@
+-- Smoodly core schema, version 3 (docs/superpowers/specs/2026-09-26-security-pass-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 2: the presence channel admits a signed-in
+-- member of the topic's space (a definer lookup in members by the session
+-- token's user), the five unpinned functions get a search_path, and the
+-- three mutation RPCs are no longer executable by anon or public.
+
+set client_min_messages = warning;
+
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select public."smoodly_presence_member"()));
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select public."smoodly_presence_member"()));
+
+alter function "smoodly_current_space"() set search_path = '';
+alter function "smoodly_key_kind"() set search_path = '';
+alter function "smoodly_set_space"() set search_path = '';
+alter function "smoodly_reorder"(text, uuid[]) set search_path = public;
+alter function "smoodly_reorder_pages"(uuid[]) set search_path = public;
+alter function "smoodly_rewrite_paths"(jsonb, jsonb) set search_path = public;
+
+revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;
+revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;
+revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '3')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/lorem/supabase/migrations/{20260926120100_smoodly_views.sql → 20260926140100_smoodly_views.sql}

@@ -1,5 +1,5 @@
 -- Smoodly: read views and order indexes for this app's collections, written by `npx smoodly migrate`
--- (2026-09-26T12:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
+-- (2026-09-26T14:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
 -- Never edit a written file: change the collection and run migrate again.
 
 -- smoodly:collection people sha256:929798ebb4fa2bb6

package/templates/lorem-intl/package.json

@@ -14,7 +14,7 @@
     "next": "^16.3.4",
     "react": "^19",
     "react-dom": "^19",
-    "smoodly": "0.0.25",
+    "smoodly": "0.0.27",
     "next-intl": "^4.14.2"
   },
   "devDependencies": {

package/templates/lorem-intl/smoodly/admin.tsx

@@ -1,6 +1,6 @@
 import { createSmoodlyAdmin } from "smoodly/admin/next";
 import { config } from "./config";
 import { smoodlyOp } from "./ops";
-import { publicAuth } from "./server";
+import { publicAuth, publicContent } from "./server";
 
-export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth });
+export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth, content: publicContent });

package/templates/lorem-intl/smoodly/server.ts

@@ -9,7 +9,7 @@
 // admin route enters it from config.ts — so nothing here may read the
 // config at module scope.
 import {
-  createSmoodlyClient, createSmoodlySite, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type SmoodlySite,
+  createSmoodlyClient, createSmoodlySite, publicContentConfig, smoodlyEnv, SupabaseAssetStore, SupabaseEntryStore, SupabaseMemberStore, SupabasePageStore, SupabasePathIndex, type ContentConfig, type SmoodlySite,
 } from "smoodly";
 import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
 import { createPageRenderer, createSmoodlyQueries, type PageRegistration } from "smoodly/next";
@@ -82,6 +82,11 @@ export function publicAuth(): AuthConfig {
   return { url: env.authUrl, key: env.authKey };
 }
 
+/** What the browser needs to join the editing-presence channel — public values only (spec 2026-09-26 concurrency §5). */
+export function publicContent(): ContentConfig {
+  return publicContentConfig(smoodlyEnv());
+}
+
 /** Locale-relative CMS path → site URL: the one seam for the renderer
  * (metadata alternates, the `page` prop's links) and the admin (canvas,
  * View live). The identity for a single-language site; with next-intl it

package/templates/lorem-intl/supabase/migrations/20260926130000_smoodly_v2.sql

@@ -0,0 +1,26 @@
+-- Smoodly core schema, version 2 (docs/superpowers/specs/2026-09-26-concurrency-guard-presence-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 1: the draft pointers become foreign keys (the
+-- token rides every locale row read) and the editing-presence channel
+-- gets its policy on realtime.messages.
+
+set client_min_messages = warning;
+
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '2')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/lorem-intl/supabase/migrations/20260926140000_smoodly_v3.sql

@@ -0,0 +1,38 @@
+-- Smoodly core schema, version 3 (docs/superpowers/specs/2026-09-26-security-pass-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 2: the presence channel admits a signed-in
+-- member of the topic's space (a definer lookup in members by the session
+-- token's user), the five unpinned functions get a search_path, and the
+-- three mutation RPCs are no longer executable by anon or public.
+
+set client_min_messages = warning;
+
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select public."smoodly_presence_member"()));
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select public."smoodly_presence_member"()));
+
+alter function "smoodly_current_space"() set search_path = '';
+alter function "smoodly_key_kind"() set search_path = '';
+alter function "smoodly_set_space"() set search_path = '';
+alter function "smoodly_reorder"(text, uuid[]) set search_path = public;
+alter function "smoodly_reorder_pages"(uuid[]) set search_path = public;
+alter function "smoodly_rewrite_paths"(jsonb, jsonb) set search_path = public;
+
+revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;
+revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;
+revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '3')
+  on conflict ("key") do update set "value" = excluded."value";

package/templates/lorem-intl/supabase/migrations/{20260926120100_smoodly_views.sql → 20260926140100_smoodly_views.sql}

@@ -1,5 +1,5 @@
 -- Smoodly: read views and order indexes for this app's collections, written by `npx smoodly migrate`
--- (2026-09-26T12:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
+-- (2026-09-26T14:01:00.000Z). One block per collection; the marker's hash is the block's SQL, compared on the next run.
 -- Never edit a written file: change the collection and run migrate again.
 
 -- smoodly:collection people sha256:929798ebb4fa2bb6