smoodly 0.0.24 → 0.0.26

package/dist/index.d.ts

@@ -27,6 +27,9 @@ export type { Crop, Hotspot, AssetKind, ImageValue, VideoValue, FileValue, Asset
 export { z } from "./zones.ts";
 export { defineConfig } from "./config.ts";
 export { collectionSQL, coreTablesSQL } from "./sql.ts";
+export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.ts";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.ts";
+export type { DraftToken, DraftPointerRow } from "./draft-token.ts";
 export { MemoryPageStore } from "./store.ts";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.ts";
 export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, BeginUploadInput, CreateAssetInput } from "./asset-store.ts";
@@ -150,10 +153,10 @@ export declare const smoodly: {
     Section: typeof Section;
     marks: typeof marks;
 };
-export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
+export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
 export type { MarkNode, MarkPath, Marks, Scope } from "./marks.ts";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.ts";
-export type { SmoodlyEnv } from "./env.ts";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.ts";
+export type { SmoodlyEnv, ContentConfig } from "./env.ts";
 export { clientOptions, createSmoodlyClient } from "./client.ts";
 export { createSmoodlySite, pageContextOf } from "./site.ts";
 export type { SiteOptions, SitePage, SitePageSchema, SiteEntry, SiteHit, SmoodlySite, LoadOptions, PageTreeItem, SiteEntryItem, EntryTreeItem, EntryQuery, } from "./site.ts";

package/dist/index.js

@@ -21,6 +21,8 @@ export { ASSET_COLLECTION, DEFAULT_MEDIA, MEDIA_TYPES, FULL_CROP, CENTER_HOTSPOT
 export { z } from "./zones.js";
 export { defineConfig } from "./config.js";
 export { collectionSQL, coreTablesSQL } from "./sql.js";
+export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.js";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.js";
 export { MemoryPageStore } from "./store.js";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.js";
 export { imageDimensions } from "./image-dimensions.js";
@@ -61,7 +63,7 @@ export const smoodly = {
     Section,
     marks,
 };
-export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.js";
+export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.js";
 export { clientOptions, createSmoodlyClient } from "./client.js";
 export { createSmoodlySite, pageContextOf } from "./site.js";

package/dist/marks.d.ts

@@ -4,6 +4,9 @@ export declare const NODE_ATTR = "data-smd-node";
 /** An empty zone's placeholder box, from `<Zone>` in editor mode. */
 export declare const ZONE_ATTR = "data-smd-zone";
 export declare const EMPTY_ATTR = "data-smd-empty";
+/** A section that renders no text and no media, stamped by the bridge in
+ *  editor mode so the canvas can give it a height to see and select. */
+export declare const BLANK_ATTR = "data-smd-blank";
 /** The element that renders a field's value verbatim. */
 export declare const FIELD_ATTR = "data-smd-field";
 /** A list item's or object field's root: scopes the field names inside it. */

package/dist/marks.js

@@ -3,6 +3,9 @@ export const NODE_ATTR = "data-smd-node";
 /** An empty zone's placeholder box, from `<Zone>` in editor mode. */
 export const ZONE_ATTR = "data-smd-zone";
 export const EMPTY_ATTR = "data-smd-empty";
+/** A section that renders no text and no media, stamped by the bridge in
+ *  editor mode so the canvas can give it a height to see and select. */
+export const BLANK_ATTR = "data-smd-blank";
 /** The element that renders a field's value verbatim. */
 export const FIELD_ATTR = "data-smd-field";
 /** A list item's or object field's root: scopes the field names inside it. */

package/dist/migrations.d.ts

@@ -0,0 +1,37 @@
+export type MigrationFile = {
+    name: string;
+    text: string;
+};
+export type CollectionSQL = {
+    name: string;
+    sql: string;
+};
+export declare const MARKER_PREFIX = "-- smoodly:collection ";
+/** The first 16 hex chars of sha256 over the exact emitted SQL. */
+export declare const collectionHash: (sql: string) => string;
+export declare const collectionMarker: (c: CollectionSQL) => string;
+/** name → hash, the LAST marker per collection across the files in name order. */
+export declare function parseMarkers(files: MigrationFile[]): Map<string, string>;
+/** UTC yyyyMMddHHmmss — the Supabase CLI's file-name prefix. */
+export declare const stamp: (at: Date) => string;
+/** A views file must sort after every core file it may depend on and
+ *  after any earlier views file it supersedes: the later of `now` and the
+ *  newest own stamp plus a minute. */
+export declare function viewsStamp(names: string[], now: Date): Date;
+/** One file with a block per new or changed collection; null when none changed. */
+export declare function viewsFile(collections: CollectionSQL[], existing: Map<string, string>, at: Date): MigrationFile | null;
+export type CorePending = {
+    copy: MigrationFile[];
+    modified: string[];
+};
+/** Package files the app lacks (copy) and same-named files whose text differs (modified — never overwritten). */
+export declare function pendingCoreFiles(packageFiles: MigrationFile[], appFiles: MigrationFile[]): CorePending;
+export type MigratePlan = CorePending & {
+    views: MigrationFile | null;
+};
+export declare function planMigrate(input: {
+    packageFiles: MigrationFile[];
+    appFiles: MigrationFile[];
+    collections: CollectionSQL[];
+}, now: Date): MigratePlan;
+export declare const planIsEmpty: (plan: MigratePlan) => boolean;

package/dist/migrations.js

@@ -0,0 +1,73 @@
+// packages/smoodly/src/migrations.ts
+// What `npx smoodly migrate` decides, as pure functions over file lists
+// (spec 2026-09-26 §2–§3): which package files the app lacks, which
+// collections need a fresh view block, and the one views file to write.
+// Node-only (crypto): exposed at `smoodly/migrations`, never from the
+// root index, which the client bundle reaches through the config.
+import { createHash } from "node:crypto";
+export const MARKER_PREFIX = "-- smoodly:collection ";
+const MARKER_RE = /^-- smoodly:collection (\S+) sha256:([0-9a-f]+)\s*$/gm;
+const OWN_FILE_RE = /^(\d{14})_smoodly_(v\d+|views)\.sql$/;
+/** The first 16 hex chars of sha256 over the exact emitted SQL. */
+export const collectionHash = (sql) => createHash("sha256").update(sql).digest("hex").slice(0, 16);
+export const collectionMarker = (c) => `${MARKER_PREFIX}${c.name} sha256:${collectionHash(c.sql)}`;
+/** name → hash, the LAST marker per collection across the files in name order. */
+export function parseMarkers(files) {
+    const out = new Map();
+    for (const file of [...files].sort((a, b) => a.name.localeCompare(b.name))) {
+        for (const m of file.text.matchAll(MARKER_RE))
+            out.set(m[1], m[2]);
+    }
+    return out;
+}
+/** UTC yyyyMMddHHmmss — the Supabase CLI's file-name prefix. */
+export const stamp = (at) => at.toISOString().replace(/\D/g, "").slice(0, 14);
+const stampDate = (s) => new Date(Date.UTC(+s.slice(0, 4), +s.slice(4, 6) - 1, +s.slice(6, 8), +s.slice(8, 10), +s.slice(10, 12), +s.slice(12, 14)));
+/** A views file must sort after every core file it may depend on and
+ *  after any earlier views file it supersedes: the later of `now` and the
+ *  newest own stamp plus a minute. */
+export function viewsStamp(names, now) {
+    let at = now;
+    for (const name of names) {
+        const m = OWN_FILE_RE.exec(name);
+        if (!m)
+            continue;
+        const after = new Date(stampDate(m[1]).getTime() + 60000);
+        if (after > at)
+            at = after;
+    }
+    return at;
+}
+/** One file with a block per new or changed collection; null when none changed. */
+export function viewsFile(collections, existing, at) {
+    const changed = collections.filter((c) => existing.get(c.name) !== collectionHash(c.sql));
+    if (changed.length === 0)
+        return null;
+    const text = "-- Smoodly: read views and order indexes for this app's collections, written by `npx smoodly migrate`\n" +
+        `-- (${at.toISOString()}). One block per collection; the marker's hash is the block's SQL, compared on the next run.\n` +
+        "-- Never edit a written file: change the collection and run migrate again.\n\n" +
+        changed.map((c) => `${collectionMarker(c)}\n${c.sql.trim()}`).join("\n\n") +
+        "\n";
+    return { name: `${stamp(at)}_smoodly_views.sql`, text };
+}
+/** Package files the app lacks (copy) and same-named files whose text differs (modified — never overwritten). */
+export function pendingCoreFiles(packageFiles, appFiles) {
+    const app = new Map(appFiles.map((f) => [f.name, f.text]));
+    const copy = [];
+    const modified = [];
+    for (const file of [...packageFiles].sort((a, b) => a.name.localeCompare(b.name))) {
+        const have = app.get(file.name);
+        if (have === undefined)
+            copy.push(file);
+        else if (have !== file.text)
+            modified.push(file.name);
+    }
+    return { copy, modified };
+}
+export function planMigrate(input, now) {
+    const core = pendingCoreFiles(input.packageFiles, input.appFiles);
+    const names = [...input.packageFiles, ...input.appFiles].map((f) => f.name);
+    const views = viewsFile(input.collections, parseMarkers(input.appFiles), viewsStamp(names, now));
+    return { ...core, views };
+}
+export const planIsEmpty = (plan) => plan.copy.length === 0 && plan.modified.length === 0 && plan.views === null;

package/dist/schema-version.d.ts

@@ -0,0 +1,17 @@
+/** The minimum schema version the package needs. Moves ONLY in a release
+ *  that adds a table, column, function or policy the package reads; a
+ *  unit test holds it equal to the highest file in `migrations/`. */
+export declare const SCHEMA_VERSION = 2;
+export declare const SCHEMA_VERSION_KEY = "schema_version";
+export declare const CORE_FILE_RE: RegExp;
+export declare const VIEWS_FILE_RE: RegExp;
+/** The version a core file leaves behind, from its name; null for anything else. */
+export declare function coreFileVersion(name: string): number | null;
+/** The last statement of every core file. */
+export declare function schemaVersionSQL(version: number): string;
+/** Behind blocks the admin and warns on the site (§5). Null = no
+ *  `smoodly_meta` table, a database older than version 1. Ahead is the
+ *  normal state of a cloud app between our migration and its package
+ *  bump, and is fine. */
+export declare const schemaBehind: (database: number | null, required?: number) => boolean;
+export declare function schemaBehindMessage(database: number | null, required?: number): string;

package/dist/schema-version.js

@@ -0,0 +1,32 @@
+// packages/smoodly/src/schema-version.ts
+// The schema version this package needs (spec 2026-09-26 §1) and the two
+// things every side agrees on: the `smoodly_meta` row that records a
+// database's version, and the names of the files the package ships. Pure
+// and framework-free — the SQL emitters, the CLI, the stores, the admin
+// op and the shell all read it from here.
+/** The minimum schema version the package needs. Moves ONLY in a release
+ *  that adds a table, column, function or policy the package reads; a
+ *  unit test holds it equal to the highest file in `migrations/`. */
+export const SCHEMA_VERSION = 2;
+export const SCHEMA_VERSION_KEY = "schema_version";
+export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
+export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;
+/** The version a core file leaves behind, from its name; null for anything else. */
+export function coreFileVersion(name) {
+    const m = CORE_FILE_RE.exec(name);
+    return m ? Number(m[2]) : null;
+}
+/** The last statement of every core file. */
+export function schemaVersionSQL(version) {
+    return (`insert into "smoodly_meta" ("key", "value") values ('${SCHEMA_VERSION_KEY}', '${version}')\n` +
+        `  on conflict ("key") do update set "value" = excluded."value";`);
+}
+/** Behind blocks the admin and warns on the site (§5). Null = no
+ *  `smoodly_meta` table, a database older than version 1. Ahead is the
+ *  normal state of a cloud app between our migration and its package
+ *  bump, and is fine. */
+export const schemaBehind = (database, required = SCHEMA_VERSION) => database === null || database < required;
+export function schemaBehindMessage(database, required = SCHEMA_VERSION) {
+    return (`smoodly: the database schema is at version ${database ?? "none"}; this Smoodly needs version ${required}. ` +
+        "Run `npx smoodly migrate`, then `supabase db push` (hosted) or `supabase db reset` (local).");
+}

package/dist/sql-space.js

@@ -193,6 +193,23 @@ $$;`.trim());
     statements.push(`drop policy if exists "smoodly_read" on "spaces";\n` +
         `create policy "smoodly_read" on "spaces" for select\n` +
         `  using (${write});`);
+    // The package reads its schema version with the write key (the
+    // service role bypasses anyway); nothing else sees the table. No
+    // space_id: the schema is one per database (spec 2026-09-26 §1).
+    statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
+        `create policy "smoodly_read" on "smoodly_meta" for select\n` +
+        `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
+    // The editing-presence channel (spec 2026-09-26 concurrency §6): one
+    // private Realtime topic per space, `space:<id>`. A caller receives on
+    // and sends to its own space's topic only — the anon key resolves to the
+    // default space, a cloud read key to its claim. Identical everywhere.
+    const topic = `(select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text`;
+    statements.push(`drop policy if exists "smoodly_presence_read" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_read" on "realtime"."messages" for select\n` +
+        `  using (${topic});`);
+    statements.push(`drop policy if exists "smoodly_presence_write" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_write" on "realtime"."messages" for insert\n` +
+        `  with check (${topic});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }

package/dist/sql.js

@@ -193,6 +193,17 @@ create table if not exists "entry_versions" (
 create index if not exists "entry_versions_entry_locale_idx"
   on "entry_versions" ("entry_id", "locale", "saved_at");
 
+-- ── Draft pointers as foreign keys (schema v2, spec 2026-09-26 concurrency §1):
+-- PostgREST embeds the draft version's saved_at through them, so every
+-- locale row read carries the token. Set null on delete: discard moves
+-- the pointer before it deletes the abandoned row, so nothing dangles.
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
 -- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
 -- statement. Deliberately does not touch updated_at — a drag must not
 -- make the whole collection look freshly edited. Scoped to the current
@@ -286,6 +297,15 @@ $$;
 -- to anything but a write key. The generated per-collection views
 -- (collectionSQL) run with security_invoker = true, so they are subject
 -- to this same smoodly_read policy rather than their owner's privileges.
+-- smoodly_meta: which version of this schema the database holds (spec
+-- 2026-09-26 §1). One row per database, not per space; every core
+-- migration file upserts the version row as its last statement, and the
+-- package compares it with SCHEMA_VERSION (behind blocks the admin).
+create table if not exists "smoodly_meta" (
+  "key" text primary key,
+  "value" text not null
+);
+
 alter table "pages" enable row level security;
 alter table "page_locales" enable row level security;
 alter table "page_versions" enable row level security;
@@ -295,6 +315,7 @@ alter table "entry_versions" enable row level security;
 alter table "refs" enable row level security;
 alter table "paths" enable row level security;
 alter table "assets" enable row level security;
+alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
     ].join("\n\n");

package/dist/store.d.ts

@@ -4,6 +4,7 @@ import { type RefEdge, type SectionLike } from "./refs.ts";
 import type { Toolset } from "./toolset.ts";
 import type { MemoryRefIndex } from "./ref-index.ts";
 import { type PathIndex } from "./path-index.ts";
+import { type DraftToken } from "./draft-token.ts";
 import { type LocaleSet, type PagePathOptions, type PathTarget } from "./paths.ts";
 export type PageLocale = {
     /** The node's OWN segment in this locale; the URL is derived (paths.ts). */
@@ -11,6 +12,8 @@ export type PageLocale = {
     title: string;
     status: "draft" | "published";
     draftVersionId: string | null;
+    /** The draft version's saved time as the store's own text — the token's second half (spec 2026-09-26 concurrency §1). Null with no pointer. */
+    draftSavedAt: string | null;
     publishedVersionId: string | null;
     updatedAt: number;
     /** The editor's email behind the last write that touched this row; null for the seed and scripts (spec 2026-09-13 history §2). */
@@ -54,6 +57,8 @@ export interface PageStore {
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    /** The database's schema version from `smoodly_meta`; null when the table is missing (older than v1). Memory: always current (spec 2026-09-26 §5). */
+    schemaVersion(): Promise<number | null>;
     /** locale → path, for the locales the page exists in. */
     pathsOf(id: string): Promise<Record<string, string>>;
     /** Refused when the page already has the locale or its parent lacks it (the parent rule). */
@@ -79,18 +84,18 @@ export interface PageStore {
     }): Promise<PageRecord>;
     /** A folder becomes a page: an empty draft version per present locale. */
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** The draft goes back to what is live: the locale's draft pointer set to its
      *  published pointer and the abandoned draft row deleted (spec 2026-09-13 history §1).
      *  Refused when nothing is published in the locale (spec 2026-09-13 publish flow §4). */
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** Takes ONE locale off the site: status draft, both pointers kept so a later
      *  publish republishes the current draft (spec §5). */
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
     /** The version's tree becomes the draft through the draft rule (spec 2026-09-13 history §6); the
      *  published version restores as a discard. Refused when the version is not this page's in this locale. */
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** One stored version by id, whoever it belongs to — callers check `pageId` and `locale`. */
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
@@ -194,6 +199,7 @@ export declare class MemoryPageStore implements PageStore {
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    schemaVersion(): Promise<number>;
     pathsOf(id: string): Promise<Record<string, string>>;
     addLocale(id: string, locale: string, options: AddLocaleOptions, by?: string): Promise<PageRecord>;
     removeLocale(id: string, locale: string): Promise<PageRecord>;
@@ -207,11 +213,11 @@ export declare class MemoryPageStore implements PageStore {
         index?: number;
     }): Promise<PageRecord>;
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
     fieldsOf(versionIds: string[]): Promise<Record<string, Record<string, unknown>>>;

package/dist/store.js

@@ -13,6 +13,8 @@ import { ASSET_COLLECTION } from "./media.js";
 import { collectTreeRefs } from "./refs.js";
 import { customToolset, withCustomSchema } from "./custom/index.js";
 import { MemoryPathIndex } from "./path-index.js";
+import { assertFresh } from "./draft-token.js";
+import { SCHEMA_VERSION } from "./schema-version.js";
 import { assertDepth, assertSegment, assertSupportedLocale, chainOf, isHomeNode, pagePathRows, unsupportedLocale, } from "./paths.js";
 export const DEFAULT_LOCALES = { default: "en", supported: ["en"] };
 /** The section list every adapter walks refs with: the registered ones plus the custom section's schema (spec 2026-09-14 §6). */
@@ -90,6 +92,11 @@ export async function assertPublishable(label, tree, sections, entries, locale)
 }
 let counter = 0;
 const uid = () => `id-${++counter}-${Date.now().toString(36)}`;
+/** A version's saved time: wall-clock, but strictly increasing, so two saves in one
+ *  millisecond still move the draft token (spec 2026-09-26 concurrency §1) the way
+ *  Postgres's microsecond `now()` does. */
+let lastSavedAt = 0;
+const savedClock = () => (lastSavedAt = Math.max(Date.now(), lastSavedAt + 1));
 /** The row's audit pair: every write that touches a locale row sets both (spec 2026-09-13 history §2). */
 function touchRow(row, by) {
     row.updatedAt = Date.now();
@@ -178,7 +185,7 @@ export class MemoryPageStore {
         refs.rewrite({ sourceKind: "page", sourceId: page.id }, pageRefEdges(this.liveTrees(page), sections, elements));
     }
     newVersion(pageId, locale, tree) {
-        const version = { id: uid(), pageId, locale, tree: structuredClone(tree), savedAt: Date.now() };
+        const version = { id: uid(), pageId, locale, tree: structuredClone(tree), savedAt: savedClock() };
         this.versions.set(version.id, version);
         return version;
     }
@@ -190,12 +197,14 @@ export class MemoryPageStore {
         let version;
         if (current && row.draftVersionId !== row.publishedVersionId) {
             current.tree = structuredClone(tree);
-            current.savedAt = Date.now();
+            current.savedAt = savedClock();
+            row.draftSavedAt = String(current.savedAt);
             version = current;
         }
         else {
             version = this.newVersion(page.id, locale, tree);
             row.draftVersionId = version.id;
+            row.draftSavedAt = String(version.savedAt);
         }
         touchRow(row, by);
         return version;
@@ -234,6 +243,7 @@ export class MemoryPageStore {
                     title: input.title ?? input.slug,
                     status: "draft",
                     draftVersionId: version?.id ?? null,
+                    draftSavedAt: version ? String(version.savedAt) : null,
                     publishedVersionId: null,
                     updatedAt: Date.now(),
                     updatedBy: by ?? null,
@@ -266,6 +276,9 @@ export class MemoryPageStore {
     resolvePath(locale, path) {
         return this.paths.resolve(locale, path);
     }
+    schemaVersion() {
+        return Promise.resolve(SCHEMA_VERSION);
+    }
     pathsOf(id) {
         return this.paths.pathsOf({ kind: "page", id });
     }
@@ -291,6 +304,7 @@ export class MemoryPageStore {
             title: options.title ?? source.title,
             status: "draft",
             draftVersionId: version?.id ?? null,
+            draftSavedAt: version ? String(version.savedAt) : null,
             publishedVersionId: null,
             updatedAt: Date.now(),
             updatedBy: by ?? null,
@@ -411,24 +425,28 @@ export class MemoryPageStore {
             throw pageErrors.hasTemplate(id);
         page.template = template;
         for (const [locale, row] of Object.entries(page.locales)) {
-            row.draftVersionId = this.newVersion(id, locale, { zones: {} }).id;
+            const version = this.newVersion(id, locale, { zones: {} });
+            row.draftVersionId = version.id;
+            row.draftSavedAt = String(version.savedAt);
             touchRow(row, by);
         }
         return this.snapshot(page);
     }
-    async saveDraft(id, locale, tree, by) {
+    async saveDraft(id, locale, tree, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
+        assertFresh(localeRow(page, locale), expected);
         const version = this.writeDraftVersion(page, locale, tree, by);
         this.writeRefs(page);
         return { ...version, tree: structuredClone(version.tree) };
     }
-    async publish(id, locale, by) {
+    async publish(id, locale, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.draftVersionId)
             throw pageErrors.folder(id);
         const { sections, entries } = this.options;
@@ -441,13 +459,15 @@ export class MemoryPageStore {
         this.writeRefs(page);
         return this.snapshot(page);
     }
-    async discardDraft(id, locale, by) {
+    async discardDraft(id, locale, by, expected) {
         const page = this.must(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.publishedVersionId)
             throw pageErrors.nothingPublished(id, locale);
         const abandoned = row.draftVersionId;
         row.draftVersionId = row.publishedVersionId;
+        row.draftSavedAt = String(this.versions.get(row.publishedVersionId).savedAt);
         if (abandoned && abandoned !== row.publishedVersionId)
             this.versions.delete(abandoned); // never shown as a stray draft
         touchRow(row, by);
@@ -462,7 +482,7 @@ export class MemoryPageStore {
         this.writeRefs(page);
         return this.snapshot(page);
     }
-    async restore(id, locale, versionId, by) {
+    async restore(id, locale, versionId, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
@@ -470,8 +490,10 @@ export class MemoryPageStore {
         const version = this.versions.get(versionId);
         if (!version || version.pageId !== id || version.locale !== locale)
             throw pageErrors.foreignVersion(id, locale, versionId);
+        // The memory store is single-threaded: the read-side check IS the atomic check.
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(id, locale, by);
+            return this.discardDraft(id, locale, by, expected);
         this.writeDraftVersion(page, locale, version.tree, by);
         this.writeRefs(page);
         return this.snapshot(page);

package/dist/supabase-entry-store.d.ts

@@ -1,6 +1,7 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CollectionSchema } from "./collections.ts";
 import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryUsage, EntryVersion, ListOptions } from "./entry-store.ts";
+import { type DraftToken } from "./draft-token.ts";
 export declare class SupabaseEntryStore implements EntryStore {
     private db;
     private paths;
@@ -39,9 +40,18 @@ export declare class SupabaseEntryStore implements EntryStore {
     private insertLocale;
     /** A touch writes the audit pair — `updated_at` and `updated_by` (spec 2026-09-13 history §2). */
     private updateLocale;
+    /** The row's stale error, built from a fresh read: what a reload would get, and who wrote last. */
+    private stale;
+    /** `updateLocale` with the pointer as a filter (spec 2026-09-26 concurrency §3): the row is
+     *  written only while `draft_version_id` still equals `guard` (null = still no pointer).
+     *  `undefined` guard = unconditional. Resolves false when no row matched. */
+    private guardedUpdateLocale;
     /** The row goes first (it is what makes the entry exist in the locale), then its versions. */
     private deleteLocale;
-    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion. */
+    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion —
+     *  guarded (spec 2026-09-26 concurrency §3) when the caller verified `row` against the token:
+     *  the rewrite filters on saved_at, the first draft on the pointer. Returns the version row it
+     *  created, or null when it rewrote in place, so a failed later step can undo it. */
     private recordVersion;
     /** See MemoryEntryStore.ensureLiveSnapshot: the snapshot of what is live, both pointers on it. */
     private ensureLiveSnapshot;
@@ -51,13 +61,13 @@ export declare class SupabaseEntryStore implements EntryStore {
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     addLocale(collection: string, id: string, locale: string, options: AddEntryLocaleOptions, by?: string): Promise<EntryRecord>;
     removeLocale(collection: string, id: string, locale: string): Promise<EntryRecord>;
     listVersions(collection: string, id: string, locale: string): Promise<EntryVersion[]>;
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     move(collection: string, id: string, to: {
         parentId: string | null;