smoodly 0.0.1

package/dist/resolve.d.ts

@@ -0,0 +1,22 @@
+import type { Descriptor } from "./fields.ts";
+import type { CollectionSchema } from "./collections.ts";
+import type { PageTree } from "./render.tsx";
+export type EntryFetcher = (collection: string, ids: string[]) => Promise<Record<string, Record<string, unknown>>>;
+type SchemaLike = {
+    name: string;
+    fields: Record<string, Descriptor>;
+};
+type ResolveOptions = {
+    sections: ({
+        name: string;
+        fields: Record<string, Descriptor>;
+    } | {
+        schema: SchemaLike;
+    })[];
+    collections: CollectionSchema<any>[];
+    fetch: EntryFetcher;
+    /** Optional safety valve on chain length; unlimited by default. */
+    maxDepth?: number;
+};
+export declare function resolveTree(tree: PageTree, options: ResolveOptions): Promise<PageTree>;
+export {};

package/dist/resolve.js

@@ -0,0 +1,128 @@
+// The batched ref-resolution pass (DESIGN.md §3): one walk collects every
+// ref in the tree, fetches per collection in single batched calls, and
+// hands components hydrated entries. The ref site alone decides depth:
+// bare refs hydrate one entry (refs stay ids), `.resolve("key")` follows
+// the named refs one level, and bare `.resolve()` follows the whole chain.
+// Cycles are cut per path — a ref back to an entry already on its own
+// chain gets a shallow copy (refs as ids), so traversal terminates by
+// construction and the output stays JSON-serializable.
+function targetOf(d) {
+    const t = d.target?.();
+    if (!t?.name)
+        throw new Error("smoodly: ref descriptor has no resolvable target.");
+    return t.name;
+}
+function modeOf(d) {
+    const r = d.resolve;
+    if (r === "full")
+        return "full";
+    if (r && typeof r === "object")
+        return r;
+    return "shallow";
+}
+export async function resolveTree(tree, options) {
+    const maxDepth = options.maxDepth ?? Infinity;
+    const sectionSchemas = new Map(options.sections.map((s) => {
+        const schema = "schema" in s ? s.schema : s;
+        return [schema.name, schema];
+    }));
+    const collectionSchemas = new Map(options.collections.map((c) => [c.name, c]));
+    const resolved = structuredClone(tree);
+    // every entry is fetched once; cycle cuts reuse cached ancestors
+    const cache = new Map();
+    // seed tasks from every node's ref-typed fields
+    let tasks = [];
+    for (const nodes of Object.values(resolved.zones ?? {})) {
+        for (const node of nodes) {
+            const schema = sectionSchemas.get(node.type);
+            if (!schema)
+                continue;
+            collectTasks(node.fields, schema.fields, tasks);
+        }
+    }
+    for (let round = 0; round < maxDepth && tasks.length > 0; round++) {
+        // batch: one fetch per collection with unique uncached ids
+        const wanted = new Map();
+        for (const task of tasks) {
+            for (const id of Array.isArray(task.id) ? task.id : [task.id]) {
+                if (cache.get(task.collection)?.has(id))
+                    continue;
+                const set = wanted.get(task.collection) ?? new Set();
+                set.add(id);
+                wanted.set(task.collection, set);
+            }
+        }
+        await Promise.all([...wanted.entries()].map(async ([collection, ids]) => {
+            const fetched = await options.fetch(collection, [...ids]);
+            const table = cache.get(collection) ?? new Map();
+            for (const [id, entry] of Object.entries(fetched))
+                table.set(id, entry);
+            cache.set(collection, table);
+        }));
+        // apply results and queue follow-ups per the task's mode
+        const next = [];
+        for (const task of tasks) {
+            const hydrate = (id) => {
+                const raw = cache.get(task.collection)?.get(id);
+                if (!raw)
+                    return null;
+                const entry = structuredClone(raw);
+                const pathKey = `${task.collection}:${id}`;
+                // cycle: this entry is its own ancestor — shallow copy, no recursion
+                if (task.ancestors.includes(pathKey))
+                    return entry;
+                if (task.mode === "shallow")
+                    return entry;
+                const targetSchema = collectionSchemas.get(task.collection);
+                if (!targetSchema)
+                    return entry;
+                const ancestors = [...task.ancestors, pathKey];
+                for (const [key, d] of Object.entries(targetSchema.fields)) {
+                    if (d.type !== "ref" && d.type !== "refList")
+                        continue;
+                    let mode;
+                    if (task.mode === "full") {
+                        mode = "full";
+                    }
+                    else {
+                        const on = task.mode[key];
+                        if (!on)
+                            continue;
+                        mode = typeof on === "object" ? on : "shallow";
+                    }
+                    const value = entry[key];
+                    if (value == null)
+                        continue;
+                    next.push({
+                        holder: entry,
+                        key,
+                        collection: targetOf(d),
+                        id: value,
+                        isList: d.type === "refList",
+                        mode,
+                        ancestors,
+                    });
+                }
+                return entry;
+            };
+            task.holder[task.key] = task.isList
+                ? task.id.map(hydrate)
+                : hydrate(task.id);
+        }
+        tasks = next;
+    }
+    return resolved;
+}
+function collectTasks(values, descriptors, out) {
+    for (const [key, d] of Object.entries(descriptors)) {
+        const value = values[key];
+        if (value == null)
+            continue;
+        if (d.type === "ref" && typeof value === "string") {
+            out.push({ holder: values, key, collection: targetOf(d), id: value, isList: false, mode: modeOf(d), ancestors: [] });
+        }
+        else if (d.type === "refList" && Array.isArray(value)) {
+            out.push({ holder: values, key, collection: targetOf(d), id: value, isList: true, mode: modeOf(d), ancestors: [] });
+        }
+    }
+}

package/dist/revalidate.d.ts

@@ -0,0 +1,8 @@
+import type { EntryStore } from "./entry-store.ts";
+import type { PageStore } from "./store.ts";
+export declare function affectedPageSlugs(stores: {
+    pages: PageStore;
+    entries: EntryStore;
+}, entryId: string, options?: {
+    maxDepth?: number;
+}): Promise<string[]>;

package/dist/revalidate.js

@@ -0,0 +1,34 @@
+// The revalidation fan-out (DESIGN.md §3): an entry changed — which
+// published pages must re-render? Walks the refs index in REVERSE
+// (entry ← entry ← page), breadth-first with a visited set so cycles
+// terminate; `maxDepth` is an optional safety valve like resolveTree's.
+// Framework-free on purpose: returns slugs, and the Next.js glue maps
+// them to `revalidateTag("page:" + slug)`.
+export async function affectedPageSlugs(stores, entryId, options = {}) {
+    const maxDepth = options.maxDepth ?? Infinity;
+    const seen = new Set([entryId]);
+    const pageIds = new Set();
+    let frontier = [entryId];
+    for (let depth = 0; depth < maxDepth && frontier.length > 0; depth++) {
+        const next = [];
+        for (const id of frontier) {
+            for (const source of await stores.entries.incoming(id)) {
+                if (source.sourceKind === "page") {
+                    pageIds.add(source.sourceId);
+                }
+                else if (source.sourceKind === "entry" && !seen.has(source.sourceId)) {
+                    seen.add(source.sourceId);
+                    next.push(source.sourceId);
+                }
+            }
+        }
+        frontier = next;
+    }
+    const slugs = [];
+    for (const id of pageIds) {
+        const page = await stores.pages.getPageById(id);
+        if (page?.publishedVersionId)
+            slugs.push(page.slug);
+    }
+    return slugs;
+}

package/dist/schema.d.ts

@@ -0,0 +1,57 @@
+import type { Descriptor, FieldBuilder, ValueOf } from "./fields.ts";
+import { pageSchema } from "./page.ts";
+export type BuilderMap = Record<string, FieldBuilder<any, any>>;
+export type SectionSchema<F extends BuilderMap = BuilderMap, S extends BuilderMap = BuilderMap> = {
+    kind: "section";
+    name: string;
+    title: string;
+    icon?: string;
+    description?: string;
+    fields: Record<string, Descriptor>;
+    styles: Record<string, Descriptor>;
+    meta: Record<string, Descriptor>;
+    sample?: Record<string, unknown>;
+    styleDefaults?: false | {
+        omit: string[];
+    };
+    /** phantom: builder types for Props inference */
+    readonly __f?: F;
+    readonly __s?: S;
+};
+export type ElementSchema<F extends BuilderMap = BuilderMap, S extends BuilderMap = BuilderMap> = Omit<SectionSchema<F, S>, "kind"> & {
+    kind: "element";
+    contexts: ("richtext" | "column")[];
+};
+type OptionalKeys<M extends BuilderMap> = {
+    [K in keyof M]: M[K] extends {
+        __flags?: infer Fl;
+    } ? (Fl extends {
+        optional: true;
+    } ? K : never) : never;
+}[keyof M];
+export type NamespaceValues<M extends BuilderMap> = {
+    [K in Exclude<keyof M, OptionalKeys<M>>]: ValueOf<M[K]>;
+} & {
+    [K in OptionalKeys<M>]?: ValueOf<M[K]>;
+};
+type SectionInput<F extends BuilderMap, S extends BuilderMap, M extends BuilderMap> = {
+    name: string;
+    title: string;
+    icon?: string;
+    description?: string;
+    fields?: F;
+    styles?: S;
+    meta?: M;
+    sample?: Partial<NamespaceValues<F> & NamespaceValues<S>>;
+    styleDefaults?: false | {
+        omit: string[];
+    };
+};
+export declare const schema: {
+    page: typeof pageSchema;
+    section<F extends BuilderMap = {}, S extends BuilderMap = {}, M extends BuilderMap = {}>(input: SectionInput<F, S, M>): SectionSchema<F, S>;
+    element<F extends BuilderMap = {}, S extends BuilderMap = {}, M extends BuilderMap = {}>(input: SectionInput<F, S, M> & {
+        contexts: ("richtext" | "column")[];
+    }): ElementSchema<F, S>;
+};
+export {};

package/dist/schema.js

@@ -0,0 +1,40 @@
+import { pageSchema } from "./page.js";
+function toDescriptors(map) {
+    return Object.fromEntries(Object.entries(map ?? {}).map(([k, b]) => [k, b.descriptor]));
+}
+function assertNotLocalized(ns, map) {
+    for (const [key, d] of Object.entries(map)) {
+        if (d.localized) {
+            throw new Error(`smoodly: "${key}" in ${ns} uses .localized(), but localization is fields-only — ${ns} are never translated.`);
+        }
+    }
+}
+function baseSchema(input) {
+    if (!input?.name)
+        throw new Error("smoodly: a schema requires a name.");
+    const fields = toDescriptors(input.fields);
+    const styles = toDescriptors(input.styles);
+    const meta = toDescriptors(input.meta);
+    assertNotLocalized("styles", styles);
+    assertNotLocalized("meta", meta);
+    return {
+        name: input.name,
+        title: input.title,
+        icon: input.icon,
+        description: input.description,
+        fields,
+        styles,
+        meta,
+        sample: input.sample,
+        styleDefaults: input.styleDefaults,
+    };
+}
+export const schema = {
+    page: pageSchema,
+    section(input) {
+        return { kind: "section", ...baseSchema(input) };
+    },
+    element(input) {
+        return { kind: "element", contexts: input.contexts, ...baseSchema(input) };
+    },
+};

package/dist/section-wrapper.d.ts

@@ -0,0 +1,11 @@
+import type { CSSProperties, ReactNode } from "react";
+export declare function Section({ as, styles, className, style, children, }: {
+    as?: keyof React.JSX.IntrinsicElements;
+    styles: Record<string, unknown>;
+    className?: string;
+    style?: CSSProperties;
+    children?: ReactNode;
+}): import("react").ReactElement<{
+    className: string | undefined;
+    style: CSSProperties | undefined;
+}, string | import("react").JSXElementConstructor<any>>;

package/dist/section-wrapper.js

@@ -0,0 +1,19 @@
+import { createElement } from "react";
+// The root wrapper every section renders through. Owns the mechanical DOM
+// work on the real root element (no extra div): element choice via `as`,
+// string-valued styles emitted as kebab-cased data attributes. Built-in
+// meta (anchor, visibility) and editor chrome attach here when the
+// renderer and admin land. Bounded magic: everything else stays the dev's
+// job via normal className/style props.
+const kebab = (s) => s.replace(/[A-Z]/g, (c) => "-" + c.toLowerCase());
+export function Section({ as = "section", styles, className, style, children, }) {
+    const { __smoodlyNode, ...rest } = (styles ?? {});
+    const dataAttrs = {};
+    if (typeof __smoodlyNode === "string")
+        dataAttrs["data-smoodly-node"] = __smoodlyNode;
+    for (const [key, value] of Object.entries(rest)) {
+        if (typeof value === "string")
+            dataAttrs[`data-${kebab(key)}`] = value;
+    }
+    return createElement(as, { className, style, ...dataAttrs }, children);
+}

package/dist/sql-space.d.ts

@@ -0,0 +1,6 @@
+export declare const DEFAULT_SPACE = "'00000000-0000-0000-0000-000000000000'";
+export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0000-0000-0000-000000000000'";
+export declare const CONTENT_TABLES: readonly ["pages", "page_versions", "saved_sections", "global_sections", "entries", "refs"];
+export type ContentTable = (typeof CONTENT_TABLES)[number];
+export declare function currentSpaceSQL(): string;
+export declare function spaceLayerSQL(): string;

package/dist/sql-space.js

@@ -0,0 +1,172 @@
+// The space layer of the stable schema (spec 2026-09-04 §2–§3). A space
+// is one cloud environment; a self-host install is one space with the
+// default id. Everything that needs "which space is this request in"
+// reads smoodly_current_space() — the adapters never mention spaces.
+export const DEFAULT_SPACE = `'00000000-0000-0000-0000-000000000000'`;
+export const SPACE_COL = `"space_id" uuid not null default ${DEFAULT_SPACE}`;
+export const CONTENT_TABLES = [
+    "pages",
+    "page_versions",
+    "saved_sections",
+    "global_sections",
+    "entries",
+    "refs",
+];
+export function currentSpaceSQL() {
+    return `
+-- The space a request acts in: the key's claim in Smoodly Cloud, the
+-- default space in self-host (service role, anon key). Policies, the
+-- insert trigger and the reorder RPC all read this ONE function.
+create or replace function "smoodly_current_space"() returns uuid
+language sql stable as $$
+  select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
+$$;`.trim();
+}
+/** Which rows a read key (or the anon key, which has no claim) may see.
+ *  null = write keys only — refs and the section library are editor
+ *  tooling; editors is admission data; nothing a browser needs. The
+ *  empty string means "read policy, no extra predicate" (global_sections
+ *  is fully readable once it's in-space) — distinct from null. */
+const PUBLISHED_READ = {
+    pages: `"status" = 'published'`,
+    entries: `"status" = 'published'`,
+    page_versions: `exists (select 1 from "pages" p where p."published_version_id" = "page_versions"."id")`,
+    global_sections: ``,
+    saved_sections: null,
+    refs: null,
+    editors: null,
+};
+/** Tables whose existing indexes do not lead with space_id. */
+const NEEDS_SPACE_INDEX = ["page_versions", "saved_sections", "global_sections", "refs"];
+export function spaceLayerSQL() {
+    const statements = [];
+    statements.push(`
+-- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
+-- for everyone with ONE definition. Self-host fills them by hand or
+-- leaves them empty; smoodly.io writes rows with the service role.
+-- There is never cloud-only SQL on a content database.
+create table if not exists "editors" (
+  ${SPACE_COL},
+  "user_id" uuid not null,
+  "role" text not null default 'editor',
+  primary key ("space_id", "user_id")
+);
+
+create table if not exists "space_keys" (
+  "id" uuid primary key,
+  "space_id" uuid not null,
+  "kind" text not null check ("kind" in ('read', 'write')),
+  "revoked_at" timestamptz
+);
+
+create table if not exists "space_caps" (
+  "space_id" uuid primary key,
+  "row_cap" integer not null
+);
+
+alter table "editors" enable row level security;
+alter table "space_keys" enable row level security;
+alter table "space_caps" enable row level security;
+
+-- ── Claim readers. The two lookups run as definer so they can read the
+-- service-role-only tables from inside a policy; search_path is pinned.
+create or replace function "smoodly_key_kind"() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'kind';
+$$;
+
+create or replace function "smoodly_space_key_revoked"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select coalesce(
+    (select k."revoked_at" is not null from "space_keys" k
+      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
+    false);
+$$;
+
+create or replace function "smoodly_space_row_cap"() returns integer
+language sql stable security definer set search_path = public as $$
+  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+$$;
+
+-- ── Triggers. A key's claim wins over whatever the insert said, so an
+-- adapter never has to know its space and cannot write into another.
+-- No claim (service role, anon) leaves the given or default value —
+-- that is how smoodly.io writes cloud-state rows for a chosen space.
+create or replace function "smoodly_set_space"() returns trigger
+language plpgsql as $$
+begin
+  if auth.jwt() ->> 'space_id' is not null then
+    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
+  end if;
+  return new;
+end;
+$$;
+
+-- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- a_ (smoodly_set_space) runs first, so new.space_id already equals the
+-- current space for a keyed insert; smoodly_space_row_cap() reads the
+-- current space itself, so this never needs the row's space_id as an
+-- argument (which would let one space's insert probe another's cap).
+-- A service-role insert that names another space explicitly is a
+-- different case: there is no JWT claim, so smoodly_current_space()
+-- still resolves to the default space, and the cap read is the default
+-- space's (none) — the service role is never capped by another space's row.
+-- search_path is pinned empty, so every reference below is schema-qualified.
+create or replace function "smoodly_enforce_row_cap"() returns trigger
+language plpgsql set search_path = '' as $$
+declare
+  cap integer;
+  n bigint;
+begin
+  cap := public."smoodly_space_row_cap"();
+  if cap is null then
+    return new;
+  end if;
+  -- Advisory only (free-tier abuse guard), not a hard invariant: two
+  -- concurrent inserts can both observe n = cap - 1 and both pass.
+  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
+    into n using new."space_id";
+  if n >= cap then
+    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
+      using errcode = 'check_violation';
+  end if;
+  return new;
+end;
+$$;`.trim());
+    for (const table of NEEDS_SPACE_INDEX) {
+        statements.push(`create index if not exists "${table}_space_idx" on "${table}" ("space_id");`);
+    }
+    // Trigger names sort a_ before b_: same-event triggers fire alphabetically.
+    for (const table of [...CONTENT_TABLES, "editors"]) {
+        statements.push(`drop trigger if exists "smoodly_a_set_space" on "${table}";\n` +
+            `create trigger "smoodly_a_set_space" before insert on "${table}"\n` +
+            `  for each row execute function "smoodly_set_space"();`);
+    }
+    for (const table of CONTENT_TABLES) {
+        statements.push(`drop trigger if exists "smoodly_b_row_cap" on "${table}";\n` +
+            `create trigger "smoodly_b_row_cap" before insert on "${table}"\n` +
+            `  for each row execute function "smoodly_enforce_row_cap"();`);
+    }
+    // Policies (permissive, so read OR write admits). The service role
+    // bypasses them all — self-host adapters are untouched. Each function
+    // call sits in its own scalar subquery so the planner hoists it into
+    // an InitPlan, evaluated once per statement rather than once per row
+    // — needed for smoodly_space_key_revoked, a security definer function
+    // Postgres never inlines; applied to all three calls for the same win.
+    const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
+    const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
+    for (const table of [...CONTENT_TABLES, "editors"]) {
+        statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
+            `create policy "smoodly_write" on "${table}" for all\n` +
+            `  using (${write})\n` +
+            `  with check (${write});`);
+        const published = PUBLISHED_READ[table];
+        if (published !== null) {
+            const predicate = `${own}${published ? ` and ${published}` : ""}`;
+            statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
+                `create policy "smoodly_read" on "${table}" for select\n` +
+                `  using (${predicate});`);
+        }
+    }
+    return statements.join("\n\n");
+}

package/dist/sql.d.ts

@@ -0,0 +1,3 @@
+import type { CollectionSchema } from "./collections.ts";
+export declare function collectionSQL(collection: CollectionSchema<any>): string;
+export declare function coreTablesSQL(): string;

package/dist/sql.js

@@ -0,0 +1,162 @@
+// Schema → SQL generation (Postgres/Supabase) for the stable schema
+// (DESIGN.md §3): all collection content lives in the one `entries`
+// table, applied once and never migrated. Per collection we emit only
+// disposable guardrails — a published-only read view, created with
+// security_invoker so it runs under the caller's own RLS policies
+// rather than the view owner's privileges (PostgREST-native reads,
+// SQL-queryable eject story) — and partial expression indexes (slug
+// uniqueness, declared orderBy fields). Views project the default
+// locale; the `i18n` overlay is the resolver/API's business.
+import { currentSpaceSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
+const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
+const q = (s) => `"${s}"`;
+// Casts are fine in views (unlike index expressions, which must be
+// immutable — orderBy indexes stay on the text value; ISO dates sort
+// correctly as text).
+function fieldExpr(key, d) {
+    switch (d.type) {
+        case "text":
+        case "link":
+        case "slug":
+        case "select":
+        case "ref": // stored as the target entry's id string
+            return `"fields"->>'${key}'`;
+        case "number":
+            return `("fields"->>'${key}')::numeric`;
+        case "date":
+            return `("fields"->>'${key}')::timestamptz`;
+        default:
+            return `"fields"->'${key}'`; // image, video, file, object, richtext, dataAttributes, refList
+    }
+}
+export function collectionSQL(collection) {
+    const name = collection.name;
+    const columns = ['"id"', '"sort"', '"locales"', '"created_at"', '"updated_at"'];
+    for (const [key, d] of Object.entries(collection.fields)) {
+        columns.push(`${fieldExpr(key, d)} as ${q(snake(key))}`);
+    }
+    const statements = [
+        [
+            `create or replace view ${q(name)} with (security_invoker = true) as`,
+            `select`,
+            columns.map((c) => "  " + c).join(",\n"),
+            `from "entries"`,
+            `where "collection" = '${name}' and "status" = 'published';`,
+        ].join("\n"),
+    ];
+    // slug uniqueness is the generic core index (space_id, collection, slug);
+    // only declared orderBy fields need per-collection expression indexes
+    for (const key of Object.keys(collection.admin?.orderBy ?? {})) {
+        statements.push(`create index if not exists ${q(`entries_${name}_${snake(key)}_idx`)}\n` +
+            `  on "entries" (("fields"->>'${key}')) where "collection" = '${name}';`);
+    }
+    return statements.join("\n\n");
+}
+export function coreTablesSQL() {
+    return [
+        currentSpaceSQL(),
+        `
+create table if not exists "pages" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "slug" text not null,
+  "template" text not null,
+  "status" text not null default 'draft',
+  "sort" numeric,
+  "locales" text[],
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now(),
+  unique ("space_id", "slug")
+);
+
+create table if not exists "page_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "tree" jsonb not null,
+  "created_by" text,
+  "created_at" timestamptz not null default now()
+);
+
+create table if not exists "saved_sections" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "title" text not null,
+  "fragment" jsonb not null,
+  "created_at" timestamptz not null default now()
+);
+
+create table if not exists "global_sections" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "type" text not null,
+  "content" jsonb not null,
+  "updated_at" timestamptz not null default now()
+);
+
+create table if not exists "entries" (
+  "id" uuid primary key default gen_random_uuid(),
+  ${SPACE_COL},
+  "collection" text not null,
+  "fields" jsonb not null default '{}'::jsonb,
+  "i18n" jsonb,
+  "status" text not null default 'draft',
+  "sort" numeric,
+  "locales" text[],
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+create unique index if not exists "entries_slug_key"
+  on "entries" ("space_id", "collection", ("fields"->>'slug'));
+
+create index if not exists "entries_collection_status_idx"
+  on "entries" ("space_id", "collection", "status");
+
+create index if not exists "entries_collection_sort_idx"
+  on "entries" ("space_id", "collection", "sort");
+
+-- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
+-- statement. Deliberately does not touch updated_at — a drag must not
+-- make the whole collection look freshly edited. Scoped to the current
+-- space by the same function the policies use.
+create or replace function "smoodly_reorder"(
+  p_collection text,
+  p_ids uuid[]
+) returns void language sql as $$
+  update "entries" e set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where e."id" = u.id
+    and e."collection" = p_collection
+    and e."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "refs" (
+  "source_kind" text not null,
+  "source_id" uuid not null,
+  ${SPACE_COL},
+  "source_field" text not null,
+  "target_collection" text not null,
+  "target_id" uuid not null,
+  primary key ("source_kind", "source_id", "source_field", "target_id")
+);
+
+-- RLS on every core table. The service role bypasses it (self-host
+-- adapters untouched). The policy set that follows (space layer) admits
+-- a key to its own space: everything for a write key, published rows for
+-- a read key or the anon key (default space). Drafts stay unreachable
+-- to anything but a write key. The generated per-collection views
+-- (collectionSQL) run with security_invoker = true, so they are subject
+-- to this same smoodly_read policy rather than their owner's privileges.
+alter table "pages" enable row level security;
+alter table "page_versions" enable row level security;
+alter table "saved_sections" enable row level security;
+alter table "global_sections" enable row level security;
+alter table "entries" enable row level security;
+alter table "refs" enable row level security;
+`.trim(),
+        spaceLayerSQL(),
+    ].join("\n\n");
+}