smoodly 0.0.2 → 0.0.4

package/README.md

@@ -168,11 +168,11 @@ locale switcher — examples/site is single-locale so it stays hidden).
 
 Both packages move together. From the repo root:
 
-    npm version 0.0.2 -w smoodly -w create-smoodly-app --no-git-tag-version
+    npm version 0.0.4 -w smoodly -w create-smoodly-app --no-git-tag-version
     npm run build
     npm publish -w smoodly --access public
     npm publish -w create-smoodly-app --access public
-    git commit -am "release: 0.0.2" && git tag v0.0.2 && git push --tags origin main
+    git commit -am "release: 0.0.4" && git tag v0.0.4 && git push --tags origin main
 
 `prepublishOnly` rebuilds each package; the CLI's template is regenerated from
 `examples/site` in that build, so the template always matches the example
@@ -191,7 +191,7 @@ site at the tagged commit.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
 - Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
 - `isEditor` reads `editors` with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
-- The `sb_secret_` branch of `clientOptions` is unit-tested for shape only; the local stack uses legacy JWT keys, so a new-format secret key has not been exercised live against PostgREST and the GoTrue admin API.
+- The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/lib/smoodly/index.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.
 - `exports` has no `"./package.json"` entry, so tooling that reads a dependency's `package.json` through the exports map cannot. One line to add when something needs it.

package/dist/sql.js

@@ -54,6 +54,10 @@ export function collectionSQL(collection) {
 }
 export function coreTablesSQL() {
     return [
+        // The trigger/policy blocks below drop-before-create so the migration is
+        // re-appliable; on a fresh database every drop would otherwise NOTICE
+        // "does not exist, skipping" in the installer's output.
+        `set client_min_messages = warning;`,
         currentSpaceSQL(),
         `
 create table if not exists "pages" (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {