create-smoodly-app 0.0.4 → 0.0.6

package/templates/next-intl/proxy.ts

@@ -0,0 +1,11 @@
+import createMiddleware from "next-intl/middleware";
+import { routing } from "./i18n/routing";
+
+// next-intl's locale routing. /admin is excluded: the admin sits outside
+// app/[locale] and has no locale prefix.
+export default createMiddleware(routing);
+
+export const config = {
+  // Everything except /admin, /api, Next internals and files with an extension.
+  matcher: "/((?!admin|api|_next|_vercel|.*\\..*).*)",
+};

package/templates/{next/lib → next-intl}/smoodly/admin.tsx

@@ -1,6 +1,6 @@
 import { createSmoodlyAdmin } from "smoodly/admin/next";
-import { config } from "../../smoodly.config";
-import { publicAuth } from "../smoodly";
+import { config } from "./config";
 import { smoodlyOp } from "./ops";
+import { publicAuth } from "./server";
 
 export const { AdminPage, AdminLayout } = createSmoodlyAdmin({ config, op: smoodlyOp, auth: publicAuth });

package/templates/{next → next-intl/smoodly}/collections.ts

@@ -14,6 +14,7 @@ export const articles = smoodly.collection({
   name: "articles",
   title: "Articles",
   titleField: "title",
+  path: "posts",
   fields: {
     title: f.text(),
     slug: f.slug({ from: "title" }),

package/templates/next-intl/smoodly/config.ts

@@ -0,0 +1,31 @@
+import { defineConfig, f } from "smoodly";
+import { routing } from "@/i18n/routing";
+import { collections } from "./collections";
+import { sections } from "./sections";
+import { HomePage } from "@/components/pages/Home";
+import { StandardPage } from "@/components/pages/Page";
+import { ArticlePage } from "@/components/pages/Article";
+
+export { collections, sections };
+
+// The registry and the plain settings, one file. Runtime-free: nothing
+// here imports a route file or Next, so a script, the CLI's template
+// build and (later) the MCP server can load it outside the app. The
+// locale set comes from i18n/routing.ts (plain config, no Next inside) —
+// the proxy runs in the edge runtime and could not import this file the
+// other way round.
+export const config = defineConfig({
+  registry: {
+    sections,
+    collections,
+    pages: [HomePage, StandardPage, ArticlePage],
+  },
+  locales: { default: routing.defaultLocale, supported: [...routing.locales] },
+  // Smoodly's own default, spelled out: the record the site root serves.
+  homePageSlug: "home",
+  // Nesting on: an editor can put pages three deep.
+  pages: { tree: { depth: 3 } },
+  styles: {
+    sections: { spacing: f.select(["sm", "md", "lg"]).default("md") },
+  },
+});

package/templates/{next/lib → next-intl}/smoodly/ops.ts

@@ -3,9 +3,9 @@
 // gated by the editors table. ('use server' modules may only export
 // async functions — hence the shape.)
 import { createAdminOpHandler, type AdminOpCall } from "smoodly/admin/next";
-import { config } from "../../smoodly.config";
-import { adminAuth, stores } from "../smoodly";
+import { config } from "./config";
+import { adminAuth, href, stores } from "./server";
 
 export async function smoodlyOp(call: AdminOpCall) {
-  return createAdminOpHandler({ config, ...stores(), auth: adminAuth() })(call);
+  return createAdminOpHandler({ config, ...stores(), auth: adminAuth(), href })(call);
 }

package/templates/next-intl/smoodly/sections.ts

@@ -0,0 +1,8 @@
+// The site's section registrations, in one list. config.ts puts it
+// in the registry and re-exports it, so the config, the stores (which walk
+// trees against these schemas) and the renderer all share one array.
+import { Hero } from "@/components/sections/Hero";
+import { ArticleList } from "@/components/sections/ArticleList";
+import { CtaBanner } from "@/components/sections/CtaBanner";
+
+export const sections = [Hero, ArticleList, CtaBanner];

package/templates/next-intl/smoodly/server.ts

@@ -0,0 +1,73 @@
+// Server-only glue: the client, both stores, the site layer and the
+// renderer, constructed lazily so `next build` doesn't need env vars at
+// import time. The env shape is the package's (SMOODLY_*); whether the
+// secret is a service-role key or a cloud write key is invisible here.
+import {
+  createSmoodlyClient, createSmoodlySite, smoodlyEnv, SupabaseEntryStore, SupabasePageStore, SupabasePathIndex,
+} from "smoodly";
+import { supabaseAdminAuth, type AdminAuth, type AuthConfig } from "smoodly/admin/next";
+import { createPageRenderer, type PageRegistration } from "smoodly/next";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { getPathname } from "@/i18n/navigation";
+import { collections, config, sections } from "./config";
+
+let cached: { db: SupabaseClient; pages: SupabasePageStore; entries: SupabaseEntryStore; auth: AdminAuth } | null = null;
+
+function bound() {
+  if (cached) return cached;
+  const env = smoodlyEnv();
+  const db = createSmoodlyClient(env);
+  // ONE path index for both stores: pages and entries share the URL space.
+  const paths = new SupabasePathIndex(db);
+  const locales = config.locales;
+  const entries = new SupabaseEntryStore(db, collections, { paths, locales });
+  const pages = new SupabasePageStore(db, {
+    sections, entries, paths, locales,
+    homePageSlug: config.homePageSlug,
+    tree: config.pages?.tree,
+  });
+  const auth = supabaseAdminAuth({ authUrl: env.authUrl, authKey: env.authKey, db });
+  cached = { db, pages, entries, auth };
+  return cached;
+}
+
+export function stores() {
+  const { pages, entries } = bound();
+  return { pages, entries };
+}
+
+/** The server-side client (seed script, one-off admin tasks). */
+export const client = () => bound().db;
+
+/** The admin gate: session verified against the auth project, editors row read with the write key. */
+export const adminAuth = () => bound().auth;
+
+/** What the browser needs to sign in — public values only. */
+export function publicAuth(): AuthConfig {
+  const env = smoodlyEnv();
+  return { url: env.authUrl, key: env.authKey };
+}
+
+/** Locale-relative CMS path → site URL: the one seam for the renderer
+ * (metadata alternates, the `page` prop's links) and the admin (canvas,
+ * View live). The identity for a single-language site; with next-intl it
+ * becomes getPathname, which adds the locale prefix. */
+export const href = (path: string, locale: string) => getPathname({ locale, href: path });
+
+/** The site layer: (locale, path) → page or entry, and the content API
+ * (site.getPagesTree for menus, site.getEntries for lists). */
+export const site = createSmoodlySite({
+  stores,
+  collections,
+  sections,
+  locales: config.locales,
+  homePageSlug: config.homePageSlug,
+});
+
+/** The two route files call these. */
+export const { renderSmoodlyPath, smoodlyMetadata, renderSmoodlyPage, smoodlyPageMetadata } = createPageRenderer({
+  site,
+  sections,
+  pages: (config.registry.pages ?? []) as PageRegistration[],
+  href,
+});

package/templates/next-intl/supabase/migrations/00000000000000_smoodly.sql

@@ -0,0 +1,427 @@
+set client_min_messages = warning;
+
+-- The space a request acts in: the key's claim in Smoodly Cloud, the
+-- default space in self-host (service role, anon key). Policies, the
+-- insert trigger and the reorder RPC all read this ONE function.
+create or replace function "smoodly_current_space"() returns uuid
+language sql stable as $$
+  select coalesce((auth.jwt() ->> 'space_id')::uuid, '00000000-0000-0000-0000-000000000000');
+$$;
+
+create table if not exists "pages" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "parent_id" uuid references "pages" ("id") on delete restrict,
+  "slug" text not null,
+  "title" text not null,
+  "i18n" jsonb,
+  "template" text,
+  "status" text not null default 'draft',
+  "sort" numeric,
+  "locales" text[],
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The tree is the URL (spec 2026-09-05 §1): a node stores its own segment
+-- and its parent. Siblings are unique per segment; NULLS NOT DISTINCT so
+-- two root nodes cannot share one either. template null = folder.
+create unique index if not exists "pages_sibling_slug_key"
+  on "pages" ("space_id", "parent_id", "slug") nulls not distinct;
+
+create index if not exists "pages_parent_idx"
+  on "pages" ("space_id", "parent_id", "sort");
+
+-- Sibling reorder for pages: same shape as smoodly_reorder for entries.
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+  update "pages" pg set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where pg."id" = u.id
+    and pg."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "page_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "tree" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create table if not exists "saved_sections" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "title" text not null,
+  "fragment" jsonb not null,
+  "created_at" timestamptz not null default now()
+);
+
+create table if not exists "global_sections" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "type" text not null,
+  "content" jsonb not null,
+  "updated_at" timestamptz not null default now()
+);
+
+create table if not exists "entries" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "collection" text not null,
+  "parent_id" uuid references "entries" ("id") on delete restrict,
+  "fields" jsonb not null default '{}'::jsonb,
+  "i18n" jsonb,
+  "status" text not null default 'draft',
+  "sort" numeric,
+  "locales" text[],
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- Entry slugs are unique among SIBLINGS, like pages: one rule for every
+-- node in the tree, and the URL is the tree. NULLS NOT DISTINCT so two
+-- ROOT entries (parent_id null) cannot share a slug either. The partial
+-- predicate keeps absent, null, empty or non-string slugs out of the
+-- index entirely: with NULLS NOT DISTINCT a null slug would otherwise
+-- collide with the next null slug, and a collection with no slug field
+-- at all could hold only one entry per parent. jsonb_typeof(...) =
+-- 'string' is required because ->> renders ANY JSON scalar as text —
+-- a number, boolean or null slug would otherwise print as non-empty
+-- text and claim the index; only a non-empty string slug claims a URL,
+-- absent, null, empty or non-string slugs never conflict — the same
+-- rule as slugOf in paths.ts. A flat collection (every entry a root)
+-- therefore behaves exactly as per-collection uniqueness did.
+create unique index if not exists "entries_sibling_slug_key"
+  on "entries" ("space_id", "collection", "parent_id", ("fields"->>'slug')) nulls not distinct
+  where (jsonb_typeof("fields"->'slug') = 'string' and "fields"->>'slug' <> '');
+
+create index if not exists "entries_collection_status_idx"
+  on "entries" ("space_id", "collection", "status");
+
+create index if not exists "entries_collection_sort_idx"
+  on "entries" ("space_id", "collection", "sort");
+
+create index if not exists "entries_parent_idx"
+  on "entries" ("space_id", "collection", "parent_id");
+
+-- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
+-- statement. Deliberately does not touch updated_at — a drag must not
+-- make the whole collection look freshly edited. Scoped to the current
+-- space by the same function the policies use.
+create or replace function "smoodly_reorder"(
+  p_collection text,
+  p_ids uuid[]
+) returns void language sql as $$
+  update "entries" e set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where e."id" = u.id
+    and e."collection" = p_collection
+    and e."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "refs" (
+  "source_kind" text not null,
+  "source_id" uuid not null,
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "source_field" text not null,
+  "target_collection" text not null,
+  "target_id" uuid not null,
+  primary key ("source_kind", "source_id", "source_field", "target_id")
+);
+
+-- The URL index (spec 2026-09-05 §4): the refs counterpart for paths.
+-- Derived — the stores rewrite a target's rows on every create, rename,
+-- move and delete — so one primary-key hit resolves any URL in any locale
+-- and no page or entry can share a URL with another in any locale.
+-- Rows exist for drafts too (the editor needs them); the read policy
+-- admits a row only when its target is published.
+create table if not exists "paths" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "locale" text not null,
+  "path" text not null,
+  "kind" text not null check ("kind" in ('page', 'entry')),
+  "target_id" uuid not null,
+  primary key ("space_id", "locale", "path")
+);
+
+create index if not exists "paths_target_idx"
+  on "paths" ("space_id", "kind", "target_id");
+
+-- Replace the targets' rows with the given rows in ONE call: a SQL
+-- function runs in the caller's transaction, so a primary-key collision
+-- rolls the whole rewrite back. Inserted rows get their space from the
+-- a_set_space trigger (the claim, or the default space).
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+  delete from "paths" p
+  using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
+  where p."kind" = t.kind and p."target_id" = t.id
+    and p."space_id" = "smoodly_current_space"();
+  insert into "paths" ("locale", "path", "kind", "target_id")
+  select r.locale, r.path, r.kind, r.id
+  from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid);
+$$;
+
+-- RLS on every core table. The service role bypasses it (self-host
+-- adapters untouched). The policy set that follows (space layer) admits
+-- a key to its own space: everything for a write key, published rows for
+-- a read key or the anon key (default space). Drafts stay unreachable
+-- to anything but a write key. The generated per-collection views
+-- (collectionSQL) run with security_invoker = true, so they are subject
+-- to this same smoodly_read policy rather than their owner's privileges.
+alter table "pages" enable row level security;
+alter table "page_versions" enable row level security;
+alter table "saved_sections" enable row level security;
+alter table "global_sections" enable row level security;
+alter table "entries" enable row level security;
+alter table "refs" enable row level security;
+alter table "paths" enable row level security;
+
+-- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
+-- for everyone with ONE definition. Self-host fills them by hand or
+-- leaves them empty; smoodly.io writes rows with the service role.
+-- There is never cloud-only SQL on a content database.
+create table if not exists "editors" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "user_id" uuid not null,
+  "role" text not null default 'editor',
+  primary key ("space_id", "user_id")
+);
+
+create table if not exists "space_keys" (
+  "id" uuid primary key,
+  "space_id" uuid not null,
+  "kind" text not null check ("kind" in ('read', 'write')),
+  "revoked_at" timestamptz
+);
+
+create table if not exists "space_caps" (
+  "space_id" uuid primary key,
+  "row_cap" integer not null
+);
+
+alter table "editors" enable row level security;
+alter table "space_keys" enable row level security;
+alter table "space_caps" enable row level security;
+
+-- ── Claim readers. The two lookups run as definer so they can read the
+-- service-role-only tables from inside a policy; search_path is pinned.
+create or replace function "smoodly_key_kind"() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'kind';
+$$;
+
+create or replace function "smoodly_space_key_revoked"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select coalesce(
+    (select k."revoked_at" is not null from "space_keys" k
+      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
+    false);
+$$;
+
+create or replace function "smoodly_space_row_cap"() returns integer
+language sql stable security definer set search_path = public as $$
+  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+$$;
+
+-- ── Triggers. A key's claim wins over whatever the insert said, so an
+-- adapter never has to know its space and cannot write into another.
+-- No claim (service role, anon) leaves the given or default value —
+-- that is how smoodly.io writes cloud-state rows for a chosen space.
+create or replace function "smoodly_set_space"() returns trigger
+language plpgsql as $$
+begin
+  if auth.jwt() ->> 'space_id' is not null then
+    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
+  end if;
+  return new;
+end;
+$$;
+
+-- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- a_ (smoodly_set_space) runs first, so new.space_id already equals the
+-- current space for a keyed insert; smoodly_space_row_cap() reads the
+-- current space itself, so this never needs the row's space_id as an
+-- argument (which would let one space's insert probe another's cap).
+-- A service-role insert that names another space explicitly is a
+-- different case: there is no JWT claim, so smoodly_current_space()
+-- still resolves to the default space, and the cap read is the default
+-- space's (none) — the service role is never capped by another space's row.
+-- search_path is pinned empty, so every reference below is schema-qualified.
+create or replace function "smoodly_enforce_row_cap"() returns trigger
+language plpgsql set search_path = '' as $$
+declare
+  cap integer;
+  n bigint;
+begin
+  cap := public."smoodly_space_row_cap"();
+  if cap is null then
+    return new;
+  end if;
+  -- Advisory only (free-tier abuse guard), not a hard invariant: two
+  -- concurrent inserts can both observe n = cap - 1 and both pass.
+  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
+    into n using new."space_id";
+  if n >= cap then
+    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
+      using errcode = 'check_violation';
+  end if;
+  return new;
+end;
+$$;
+
+create index if not exists "page_versions_space_idx" on "page_versions" ("space_id");
+
+create index if not exists "saved_sections_space_idx" on "saved_sections" ("space_id");
+
+create index if not exists "global_sections_space_idx" on "global_sections" ("space_id");
+
+create index if not exists "refs_space_idx" on "refs" ("space_id");
+
+drop trigger if exists "smoodly_a_set_space" on "pages";
+create trigger "smoodly_a_set_space" before insert on "pages"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_versions";
+create trigger "smoodly_a_set_space" before insert on "page_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "saved_sections";
+create trigger "smoodly_a_set_space" before insert on "saved_sections"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "global_sections";
+create trigger "smoodly_a_set_space" before insert on "global_sections"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entries";
+create trigger "smoodly_a_set_space" before insert on "entries"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "refs";
+create trigger "smoodly_a_set_space" before insert on "refs"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "paths";
+create trigger "smoodly_a_set_space" before insert on "paths"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "editors";
+create trigger "smoodly_a_set_space" before insert on "editors"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_b_row_cap" on "pages";
+create trigger "smoodly_b_row_cap" before insert on "pages"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_versions";
+create trigger "smoodly_b_row_cap" before insert on "page_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "saved_sections";
+create trigger "smoodly_b_row_cap" before insert on "saved_sections"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "global_sections";
+create trigger "smoodly_b_row_cap" before insert on "global_sections"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entries";
+create trigger "smoodly_b_row_cap" before insert on "entries"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "refs";
+create trigger "smoodly_b_row_cap" before insert on "refs"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "paths";
+create trigger "smoodly_b_row_cap" before insert on "paths"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop policy if exists "smoodly_write" on "pages";
+create policy "smoodly_write" on "pages" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "page_versions";
+create policy "smoodly_write" on "page_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "pages" p where p."published_version_id" = "page_versions"."id"));
+
+drop policy if exists "smoodly_write" on "saved_sections";
+create policy "smoodly_write" on "saved_sections" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "global_sections";
+create policy "smoodly_write" on "global_sections" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "global_sections";
+create policy "smoodly_read" on "global_sections" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()));
+
+drop policy if exists "smoodly_write" on "entries";
+create policy "smoodly_write" on "entries" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+create policy "smoodly_write" on "paths" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (("kind" = 'page' and exists (select 1 from "pages" p where p."id" = "paths"."target_id" and p."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entries" e where e."id" = "paths"."target_id" and e."status" = 'published'))));
+
+drop policy if exists "smoodly_write" on "editors";
+create policy "smoodly_write" on "editors" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+create or replace view "people" with (security_invoker = true) as
+select
+  "id",
+  "sort",
+  "locales",
+  "created_at",
+  "updated_at",
+  "fields"->>'name' as "name",
+  "fields"->>'role' as "role"
+from "entries"
+where "collection" = 'people' and "status" = 'published';
+
+create or replace view "articles" with (security_invoker = true) as
+select
+  "id",
+  "sort",
+  "locales",
+  "created_at",
+  "updated_at",
+  "fields"->>'title' as "title",
+  "fields"->>'slug' as "slug",
+  "fields"->>'excerpt' as "excerpt",
+  "fields"->>'author' as "author"
+from "entries"
+where "collection" = 'articles' and "status" = 'published';

package/templates/next-intl/tsconfig.json

@@ -0,0 +1,41 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    },
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}