smoodly 0.0.24 → 0.0.26

package/dist/supabase-entry-store.js

@@ -10,19 +10,21 @@ import { collectionDepth, collectionOrder } from "./collections.js";
 import { ARRAY_FIELD_TYPES, DEFAULT_ENTRY_LOCALES, entryErrors, entryFieldsIn, entryLocaleRow, entryRefEdges, entryTitleIn, isGlobalSchema, schemaOf, splitFields, } from "./entry-store.js";
 import { globalEntryId } from "./global-id.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
+import { assertFresh, draftToken, StaleDraftError } from "./draft-token.js";
 import { assertDepth, assertSupportedLocale, entryPathRows, slugOf } from "./paths.js";
 // entries.id is a Postgres uuid column: filtering on a non-UUID string
 // throws invalid_text_representation. A non-UUID id can't exist in the
 // table, so treat it the same as a missing one.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const UNIQUE_VIOLATION = "23505";
-const SELECT = "*, entry_locales(*)";
+const SELECT = "*, entry_locales(*, draft:entry_versions!entry_locales_draft_version_fkey(saved_at))";
 function toLocale(row) {
     return {
         slug: row.slug,
         status: row.status,
         fields: row.fields,
         draftVersionId: row.draft_version_id,
+        draftSavedAt: row.draft?.saved_at ?? null,
         publishedVersionId: row.published_version_id,
         updatedAt: Date.parse(row.updated_at),
         updatedBy: row.updated_by,
@@ -251,6 +253,26 @@ export class SupabaseEntryStore {
         if (res.error)
             this.fail(res.error.message);
     }
+    /** The row's stale error, built from a fresh read: what a reload would get, and who wrote last. */
+    async stale(collection, id, locale) {
+        const row = entryLocaleRow(await this.must(collection, id), locale);
+        return new StaleDraftError(draftToken(row), row.updatedBy, row.updatedAt);
+    }
+    /** `updateLocale` with the pointer as a filter (spec 2026-09-26 concurrency §3): the row is
+     *  written only while `draft_version_id` still equals `guard` (null = still no pointer).
+     *  `undefined` guard = unconditional. Resolves false when no row matched. */
+    async guardedUpdateLocale(entryId, locale, patch, options) {
+        const payload = (options.touch ?? true)
+            ? { ...patch, updated_at: new Date().toISOString(), updated_by: options.by ?? null }
+            : { ...patch };
+        let query = this.db.from("entry_locales").update(payload).eq("entry_id", entryId).eq("locale", locale);
+        if (options.guard !== undefined)
+            query = options.guard === null ? query.is("draft_version_id", null) : query.eq("draft_version_id", options.guard);
+        const res = await query.select("entry_id").maybeSingle();
+        if (res.error)
+            this.fail(res.error.message);
+        return res.data !== null;
+    }
     /** The row goes first (it is what makes the entry exist in the locale), then its versions. */
     async deleteLocale(entryId, locale) {
         const row = await this.db.from("entry_locales").delete().eq("entry_id", entryId).eq("locale", locale);
@@ -260,20 +282,43 @@ export class SupabaseEntryStore {
         if (versions.error)
             this.fail(versions.error.message);
     }
-    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion. */
-    async recordVersion(entry, locale) {
+    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion —
+     *  guarded (spec 2026-09-26 concurrency §3) when the caller verified `row` against the token:
+     *  the rewrite filters on saved_at, the first draft on the pointer. Returns the version row it
+     *  created, or null when it rewrote in place, so a failed later step can undo it. */
+    async recordVersion(entry, locale, guarded) {
         const row = entry.locales[locale];
         const fields = entryFieldsIn(entry, locale);
         if (row.draftVersionId && row.draftVersionId !== row.publishedVersionId) {
-            const res = await this.db.from("entry_versions").update({ fields, saved_at: new Date().toISOString() }).eq("id", row.draftVersionId);
+            let query = this.db.from("entry_versions").update({ fields, saved_at: new Date().toISOString() }).eq("id", row.draftVersionId);
+            if (guarded)
+                query = query.eq("saved_at", row.draftSavedAt ?? "");
+            const res = await query.select("id").maybeSingle();
             if (res.error)
                 this.fail(res.error.message);
-            return;
+            if (res.data === null)
+                throw await this.stale(entry.collection, entry.id, locale);
+            return { created: null };
         }
         const res = await this.db.from("entry_versions").insert({ entry_id: entry.id, locale, fields }).select("id").single();
         if (res.error)
             this.fail(res.error.message);
-        await this.updateLocale(entry.id, locale, { draft_version_id: res.data.id }, { touch: false });
+        const id = res.data.id;
+        let matched;
+        if (guarded)
+            matched = await this.guardedUpdateLocale(entry.id, locale, { draft_version_id: id }, { guard: row.draftVersionId, touch: false });
+        else {
+            await this.updateLocale(entry.id, locale, { draft_version_id: id }, { touch: false });
+            matched = true;
+        }
+        if (!matched) {
+            // The other writer took the pointer first: this row must never show in history.
+            const gone = await this.db.from("entry_versions").delete().eq("id", id);
+            if (gone.error)
+                this.fail(gone.error.message);
+            throw await this.stale(entry.collection, entry.id, locale);
+        }
+        return { created: id };
     }
     /** See MemoryEntryStore.ensureLiveSnapshot: the snapshot of what is live, both pointers on it. */
     async ensureLiveSnapshot(entry, locale) {
@@ -324,7 +369,7 @@ export class SupabaseEntryStore {
         try {
             await this.insertLocale(id, options.locale, { slug, fields: localized }, by);
             let record = await this.must(collection, id);
-            await this.recordVersion(record, options.locale);
+            await this.recordVersion(record, options.locale, false);
             record = await this.must(collection, id);
             await this.writePaths(record);
             await this.writeRefs(record);
@@ -417,15 +462,20 @@ export class SupabaseEntryStore {
         }
         return out;
     }
-    async update(collection, id, locale, fields, by) {
+    async update(collection, id, locale, fields, by, expected) {
         const schema = this.schema(collection);
         const before = await this.must(collection, id);
         const row = entryLocaleRow(before, locale);
-        await this.ensureLiveSnapshot(before, locale);
+        assertFresh(row, expected);
+        await this.ensureLiveSnapshot(before, locale); // mutates `row`'s pointers for a legacy row
         const { shared, localized, slug } = splitFields(fields, schema);
         if (isGlobalSchema(schema) && slug !== null)
             throw entryErrors.noSlug(collection);
         await this.assertSiblingSlug(collection, before.parentId, locale, slug, id);
+        // The snapshot of what the row is about to hold, written under the guard BEFORE the live
+        // columns change (spec 2026-09-26 concurrency §3): a stale save leaves nothing behind.
+        const next = { ...before, fields: shared, locales: { ...before.locales, [locale]: { ...row, fields: localized, slug } } };
+        const { created } = await this.recordVersion(next, locale, expected !== undefined);
         await this.updateNode(id, { fields: shared });
         await this.updateLocale(id, locale, { slug, fields: localized }, { by });
         const record = await this.must(collection, id);
@@ -434,27 +484,36 @@ export class SupabaseEntryStore {
         }
         catch (e) {
             await this.updateNode(id, { fields: before.fields, updated_at: new Date(before.updatedAt).toISOString() }, { touch: false });
-            await this.updateLocale(id, locale, { slug: row.slug, fields: row.fields, updated_at: new Date(row.updatedAt).toISOString(), updated_by: row.updatedBy }, { touch: false });
+            await this.updateLocale(id, locale, { slug: row.slug, fields: row.fields, updated_at: new Date(row.updatedAt).toISOString(), updated_by: row.updatedBy, ...(created ? { draft_version_id: row.draftVersionId } : {}) }, { touch: false });
+            if (created)
+                await this.db.from("entry_versions").delete().eq("id", created);
+            else {
+                // The in-place rewrite moved saved_at too: put the token back as it was read.
+                const undo = { fields: entryFieldsIn(before, locale), ...(row.draftSavedAt ? { saved_at: row.draftSavedAt } : {}) };
+                await this.db.from("entry_versions").update(undo).eq("id", row.draftVersionId);
+            }
             throw e;
         }
-        await this.recordVersion(record, locale);
         const final = await this.must(collection, id);
         await this.writeRefs(final);
         return final;
     }
-    async setStatus(collection, id, locale, status, by) {
+    async setStatus(collection, id, locale, status, by, expected) {
         let record = await this.must(collection, id);
         let row = entryLocaleRow(record, locale);
         if (status === "published") {
+            assertFresh(row, expected);
             if (!row.draftVersionId) {
-                await this.recordVersion(record, locale);
+                await this.recordVersion(record, locale, false);
                 record = await this.must(collection, id);
                 row = entryLocaleRow(record, locale);
             }
-            await this.updateLocale(id, locale, { status, published_version_id: row.draftVersionId }, { by });
+            const matched = await this.guardedUpdateLocale(id, locale, { status, published_version_id: row.draftVersionId }, { by, guard: expected !== undefined ? row.draftVersionId : undefined });
+            if (!matched)
+                throw await this.stale(collection, id, locale);
         }
         else {
-            // Unpublish keeps the pointer for a later republish (spec §2).
+            // Unpublish keeps the pointer for a later republish (spec §2) and is not guarded.
             await this.updateLocale(id, locale, { status }, { by });
         }
         await this.updateNode(id, {});
@@ -462,16 +521,20 @@ export class SupabaseEntryStore {
         await this.writeRefs(final);
         return final;
     }
-    async discardDraft(collection, id, locale, by) {
+    async discardDraft(collection, id, locale, by, expected) {
         const schema = this.schema(collection);
         const record = await this.must(collection, id);
         const row = entryLocaleRow(record, locale);
+        assertFresh(row, expected);
         const snapshot = row.publishedVersionId ? (await this.versionFields([row.publishedVersionId])).get(row.publishedVersionId) : undefined;
         if (!snapshot)
             throw entryErrors.nothingPublished(collection, id, locale);
         const { shared, localized } = splitFields(snapshot, schema);
+        // The pointer moves under the guard before the fields (spec 2026-09-26 concurrency §3).
+        const matched = await this.guardedUpdateLocale(id, locale, { fields: localized, draft_version_id: row.publishedVersionId }, { by, guard: expected !== undefined ? row.draftVersionId : undefined });
+        if (!matched)
+            throw await this.stale(collection, id, locale);
         await this.updateNode(id, { fields: shared });
-        await this.updateLocale(id, locale, { fields: localized, draft_version_id: row.publishedVersionId }, { by });
         if (row.draftVersionId && row.draftVersionId !== row.publishedVersionId) {
             // The pointer moved first, so a failure here leaves a stray row, never a dangling pointer.
             const gone = await this.db.from("entry_versions").delete().eq("id", row.draftVersionId);
@@ -498,7 +561,7 @@ export class SupabaseEntryStore {
         let added;
         try {
             added = await this.must(collection, id);
-            await this.recordVersion(added, locale);
+            await this.recordVersion(added, locale, false);
             added = await this.must(collection, id);
             await this.writePaths(added);
         }
@@ -547,20 +610,22 @@ export class SupabaseEntryStore {
             this.fail(res.error.message);
         return res.data.map(toVersion);
     }
-    async restore(collection, id, locale, versionId, by) {
+    async restore(collection, id, locale, versionId, by, expected) {
         const schema = this.schema(collection);
         const entry = await this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
         const version = await this.getVersion(collection, versionId);
         if (!version || version.entryId !== id || version.locale !== locale)
             throw entryErrors.foreignVersion(collection, id, locale, versionId);
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(collection, id, locale, by);
+            return this.discardDraft(collection, id, locale, by, expected);
         const { shared, localized } = splitFields(version.fields, schema);
+        // The snapshot first, under the guard, as in update.
+        const next = { ...entry, fields: shared, locales: { ...entry.locales, [locale]: { ...row, fields: localized } } };
+        await this.recordVersion(next, locale, expected !== undefined);
         await this.updateNode(id, { fields: shared });
         await this.updateLocale(id, locale, { fields: localized }, { by }); // the slug is the row's own and never versioned
-        const record = await this.must(collection, id);
-        await this.recordVersion(record, locale);
         const final = await this.must(collection, id);
         await this.writeRefs(final);
         return final;

package/dist/supabase-store.d.ts

@@ -1,6 +1,7 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { type AddLocaleOptions, type CreatePageInput, type PageRecord, type PageStore, type PageStoreOptions, type PageVersion } from "./store.ts";
 import type { PageTree } from "./render.tsx";
+import { type DraftToken } from "./draft-token.ts";
 import { type PathTarget } from "./paths.ts";
 export declare class SupabasePageStore implements PageStore {
     private db;
@@ -29,6 +30,12 @@ export declare class SupabasePageStore implements PageStore {
     private updateNode;
     /** A touch writes the audit pair — `updated_at` and `updated_by` (spec 2026-09-13 history §2). */
     private updateLocale;
+    /** The row's stale error, built from a fresh read: what a reload would get, and who wrote last. */
+    private stale;
+    /** `updateLocale` with the pointer as a filter (spec 2026-09-26 concurrency §3): the row is
+     *  written only while `draft_version_id` still equals `guard` (null = still no pointer).
+     *  `undefined` guard = unconditional. Resolves false when no row matched. */
+    private guardedUpdateLocale;
     private insertLocale;
     /** The locale's row and versions — the removeLocale and rollback shape.
      *  The row goes first: it is what makes the page exist in that locale,
@@ -36,7 +43,10 @@ export declare class SupabasePageStore implements PageStore {
      *  pointing at an already-deleted version. */
     private deleteLocale;
     private insertVersion;
-    /** The draft rule (spec 2026-09-13 history §1), see MemoryPageStore.writeDraftVersion. */
+    /** The draft rule (spec 2026-09-13 history §1), see MemoryPageStore.writeDraftVersion —
+     *  and the guard (spec 2026-09-26 concurrency §3): the caller ran assertFresh on the row it
+     *  holds, so `row` IS the expected state; the write itself filters on it, closing the
+     *  read-then-write window. `guarded` false = a script, no filters. */
     private writeDraftVersion;
     private versionTree;
     /** Every locale's draft and published trees in ONE query. */
@@ -48,7 +58,10 @@ export declare class SupabasePageStore implements PageStore {
     createPage(input: CreatePageInput, by?: string): Promise<PageRecord>;
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
+    /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
+    private schemaChecked;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    schemaVersion(): Promise<number | null>;
     pathsOf(id: string): Promise<{}>;
     addLocale(id: string, locale: string, options: AddLocaleOptions, by?: string): Promise<PageRecord>;
     removeLocale(id: string, locale: string): Promise<PageRecord>;
@@ -62,11 +75,11 @@ export declare class SupabasePageStore implements PageStore {
         index?: number;
     }): Promise<PageRecord>;
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
     fieldsOf(versionIds: string[]): Promise<Record<string, Record<string, unknown>>>;

package/dist/supabase-store.js

@@ -8,8 +8,10 @@
 // rewritten through ONE RPC per write, so a collision rolls back.
 import { assertPublishable, assertSupportedLocale, localeRow, pageErrors, pageRefEdges, pathOptions, refSections, } from "./store.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
+import { SCHEMA_VERSION_KEY, schemaBehind, schemaBehindMessage } from "./schema-version.js";
+import { assertFresh, draftToken, StaleDraftError } from "./draft-token.js";
 import { assertDepth, assertSegment, isHomeNode, pagePathRows } from "./paths.js";
-const SELECT = "*, page_locales(*)";
+const SELECT = "*, page_locales(*, draft:page_versions!page_locales_draft_version_fkey(saved_at))";
 const UNIQUE_VIOLATION = "23505";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function toRecord(row) {
@@ -20,6 +22,7 @@ function toRecord(row) {
             title: l.title,
             status: l.status,
             draftVersionId: l.draft_version_id,
+            draftSavedAt: l.draft?.saved_at ?? null,
             publishedVersionId: l.published_version_id,
             updatedAt: Date.parse(l.updated_at),
             updatedBy: l.updated_by,
@@ -40,6 +43,8 @@ export class SupabasePageStore {
     constructor(db, options = {}) {
         this.db = db;
         this.options = options;
+        /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
+        this.schemaChecked = false;
         this.options = { ...options, sections: refSections(options) };
         this.paths = options.paths ?? new SupabasePathIndex(db);
         this.opts = pathOptions(options);
@@ -142,6 +147,24 @@ export class SupabasePageStore {
             this.fail(res.error.message);
         return this.must(id);
     }
+    /** The row's stale error, built from a fresh read: what a reload would get, and who wrote last. */
+    async stale(id, locale) {
+        const row = localeRow(await this.must(id), locale);
+        return new StaleDraftError(draftToken(row), row.updatedBy, row.updatedAt);
+    }
+    /** `updateLocale` with the pointer as a filter (spec 2026-09-26 concurrency §3): the row is
+     *  written only while `draft_version_id` still equals `guard` (null = still no pointer).
+     *  `undefined` guard = unconditional. Resolves false when no row matched. */
+    async guardedUpdateLocale(id, locale, patch, options) {
+        const payload = { ...patch, updated_at: new Date().toISOString(), updated_by: options.by ?? null };
+        let query = this.db.from("page_locales").update(payload).eq("page_id", id).eq("locale", locale);
+        if (options.guard !== undefined)
+            query = options.guard === null ? query.is("draft_version_id", null) : query.eq("draft_version_id", options.guard);
+        const res = await query.select("page_id").maybeSingle();
+        if (res.error)
+            this.fail(res.error.message);
+        return res.data !== null;
+    }
     async insertLocale(id, locale, values) {
         const res = await this.db.from("page_locales").insert({ page_id: id, locale, ...values });
         if (res.error) {
@@ -168,24 +191,34 @@ export class SupabasePageStore {
             this.fail(res.error.message);
         return res.data;
     }
-    /** The draft rule (spec 2026-09-13 history §1), see MemoryPageStore.writeDraftVersion. */
-    async writeDraftVersion(page, locale, tree, by) {
+    /** The draft rule (spec 2026-09-13 history §1), see MemoryPageStore.writeDraftVersion —
+     *  and the guard (spec 2026-09-26 concurrency §3): the caller ran assertFresh on the row it
+     *  holds, so `row` IS the expected state; the write itself filters on it, closing the
+     *  read-then-write window. `guarded` false = a script, no filters. */
+    async writeDraftVersion(page, locale, tree, by, guarded) {
         const row = localeRow(page, locale);
         if (row.draftVersionId && row.draftVersionId !== row.publishedVersionId) {
-            const res = await this.db
-                .from("page_versions")
-                .update({ tree, saved_at: new Date().toISOString() })
-                .eq("id", row.draftVersionId)
-                .select("*")
-                .single();
+            let query = this.db.from("page_versions").update({ tree, saved_at: new Date().toISOString() }).eq("id", row.draftVersionId);
+            if (guarded)
+                query = query.eq("saved_at", row.draftSavedAt ?? "");
+            const res = await query.select("*").maybeSingle();
             if (res.error)
                 this.fail(res.error.message);
+            if (res.data === null)
+                throw await this.stale(page.id, locale);
             const record = await this.updateLocale(page.id, locale, {}, { by });
             return { version: res.data, record };
         }
         const version = await this.insertVersion(page.id, locale, tree);
-        const record = await this.updateLocale(page.id, locale, { draft_version_id: version.id }, { by });
-        return { version, record };
+        const matched = await this.guardedUpdateLocale(page.id, locale, { draft_version_id: version.id }, { by, guard: guarded ? row.draftVersionId : undefined });
+        if (!matched) {
+            // The other writer took the pointer first: this row must never show in history.
+            const gone = await this.db.from("page_versions").delete().eq("id", version.id);
+            if (gone.error)
+                this.fail(gone.error.message);
+            throw await this.stale(page.id, locale);
+        }
+        return { version, record: await this.must(page.id) };
     }
     async versionTree(versionId) {
         if (!versionId)
@@ -300,8 +333,28 @@ export class SupabasePageStore {
         return res.data.map(toRecord);
     }
     resolvePath(locale, path) {
+        if (!this.schemaChecked) {
+            this.schemaChecked = true;
+            void this.schemaVersion()
+                .then((v) => {
+                if (schemaBehind(v))
+                    console.warn(schemaBehindMessage(v));
+            })
+                .catch(() => { });
+        }
         return this.paths.resolve(locale, path);
     }
+    async schemaVersion() {
+        const res = await this.db.from("smoodly_meta").select("value").eq("key", SCHEMA_VERSION_KEY).maybeSingle();
+        if (res.error) {
+            // PGRST205: not in PostgREST's schema cache; 42P01: undefined table.
+            if (res.error.code === "PGRST205" || res.error.code === "42P01")
+                return null;
+            this.fail(res.error.message);
+        }
+        const n = Number(res.data?.value);
+        return Number.isInteger(n) ? n : null;
+    }
     pathsOf(id) {
         return UUID_RE.test(id) ? this.paths.pathsOf({ kind: "page", id }) : Promise.resolve({});
     }
@@ -452,41 +505,50 @@ export class SupabasePageStore {
         }
         return this.updateNode(id, { template });
     }
-    async saveDraft(id, locale, tree, by) {
+    async saveDraft(id, locale, tree, by, expected) {
         const page = await this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
-        const { version, record } = await this.writeDraftVersion(page, locale, tree, by);
+        assertFresh(localeRow(page, locale), expected);
+        const { version, record } = await this.writeDraftVersion(page, locale, tree, by, expected !== undefined);
         await this.writeRefs(record);
         return toVersion(version);
     }
-    async publish(id, locale, by) {
+    async publish(id, locale, by, expected) {
         const page = await this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.draftVersionId)
             throw pageErrors.folder(id);
         const { sections, entries } = this.options;
         const draft = (await this.versionTree(row.draftVersionId)) ?? { zones: {} };
         if (sections && entries)
             await assertPublishable(row.slug, draft, sections, entries, locale);
-        const record = await this.updateLocale(id, locale, { published_version_id: row.draftVersionId, status: "published" }, { by });
+        const matched = await this.guardedUpdateLocale(id, locale, { published_version_id: row.draftVersionId, status: "published" }, { by, guard: expected !== undefined ? row.draftVersionId : undefined });
+        if (!matched)
+            throw await this.stale(id, locale);
+        const record = await this.must(id);
         await this.writeRefs(record);
         return record;
     }
-    async discardDraft(id, locale, by) {
+    async discardDraft(id, locale, by, expected) {
         const page = await this.must(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.publishedVersionId)
             throw pageErrors.nothingPublished(id, locale);
-        const record = await this.updateLocale(id, locale, { draft_version_id: row.publishedVersionId }, { by });
+        const matched = await this.guardedUpdateLocale(id, locale, { draft_version_id: row.publishedVersionId }, { by, guard: expected !== undefined ? row.draftVersionId : undefined });
+        if (!matched)
+            throw await this.stale(id, locale);
         if (row.draftVersionId && row.draftVersionId !== row.publishedVersionId) {
             // The pointer moved first, so a failure here leaves a stray row, never a dangling pointer.
             const gone = await this.db.from("page_versions").delete().eq("id", row.draftVersionId);
             if (gone.error)
                 this.fail(gone.error.message);
         }
+        const record = await this.must(id);
         await this.writeRefs(record);
         return record;
     }
@@ -497,7 +559,7 @@ export class SupabasePageStore {
         await this.writeRefs(record);
         return record;
     }
-    async restore(id, locale, versionId, by) {
+    async restore(id, locale, versionId, by, expected) {
         const page = await this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
@@ -505,9 +567,10 @@ export class SupabasePageStore {
         const version = await this.getVersion(versionId);
         if (!version || version.pageId !== id || version.locale !== locale)
             throw pageErrors.foreignVersion(id, locale, versionId);
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(id, locale, by);
-        const { record } = await this.writeDraftVersion(page, locale, version.tree, by);
+            return this.discardDraft(id, locale, by, expected);
+        const { record } = await this.writeDraftVersion(page, locale, version.tree, by, expected !== undefined);
         await this.writeRefs(record);
         return record;
     }

package/dist/time-zone.d.ts

@@ -0,0 +1,6 @@
+/** Whether this runtime's Intl knows the zone: canonical names, the
+ *  aliases its database still carries ("Europe/Kiev"), "UTC". An offset
+ *  like "+3" or a bare city is refused. */
+export declare function isValidZone(zone: string): boolean;
+/** The zone the runtime resolves for itself — the editor's browser in the admin; "UTC" when it has none. */
+export declare function browserZone(): string;

package/dist/time-zone.js

@@ -0,0 +1,27 @@
+// The site's time zone (spec 2026-09-25 date pickers §5): an IANA name,
+// never an offset, so daylight-saving rules come from the runtime's own
+// zone database. Core and pure: defineConfig validates with it, the
+// admin's picker falls back to the browser's zone through it.
+/** Whether this runtime's Intl knows the zone: canonical names, the
+ *  aliases its database still carries ("Europe/Kiev"), "UTC". An offset
+ *  like "+3" or a bare city is refused. */
+export function isValidZone(zone) {
+    if (zone === "")
+        return false;
+    try {
+        new Intl.DateTimeFormat("en", { timeZone: zone });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The zone the runtime resolves for itself — the editor's browser in the admin; "UTC" when it has none. */
+export function browserZone() {
+    try {
+        return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+    }
+    catch {
+        return "UTC";
+    }
+}