smoodly 0.0.24 → 0.0.26

package/migrations/20260926120000_smoodly_v1.sql

@@ -0,0 +1,535 @@
+-- Smoodly core schema, version 1 (docs/superpowers/specs/2026-09-26-schema-migrations-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+
+set client_min_messages = warning;
+
+-- The space a request acts in: the key's claim in Smoodly Cloud, the
+-- default space in self-host (service role, anon key). Policies, the
+-- insert trigger and the reorder RPC all read this ONE function.
+create or replace function "smoodly_current_space"() returns uuid
+language sql stable as $$
+  select coalesce((auth.jwt() ->> 'space_id')::uuid, '00000000-0000-0000-0000-000000000000');
+$$;
+
+create table if not exists "pages" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "parent_id" uuid references "pages" ("id") on delete restrict,
+  "template" text,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The tree is the URL (spec 2026-09-05 §1): a node stores its parent and
+-- its position; template null = folder. Everything a locale owns — the
+-- node's own segment, title, publish state and version pointers — lives
+-- in page_locales, one row per locale the page exists in (spec 2026-09-06
+-- §2). There is no sibling-slug index: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same operation.
+create index if not exists "pages_parent_idx"
+  on "pages" ("space_id", "parent_id", "sort");
+
+create table if not exists "page_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text not null,
+  "title" text not null,
+  "status" text not null default 'draft',
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  "updated_by" text,
+  primary key ("page_id", "locale")
+);
+
+-- Sibling reorder for pages: same shape as smoodly_reorder for entries.
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+  update "pages" pg set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where pg."id" = u.id
+    and pg."space_id" = "smoodly_current_space"();
+$$;
+
+-- A version belongs to ONE locale of one page: each locale has its own
+-- draft, its own publish and its own history. One row per publish plus
+-- the live draft (spec 2026-09-13 history §1): the unpublished draft row
+-- is rewritten in place and saved_at is when its content last changed.
+create table if not exists "page_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "page_id" uuid not null references "pages" ("id") on delete cascade,
+  "locale" text not null,
+  "tree" jsonb not null,
+  "saved_at" timestamptz not null default now()
+);
+
+create index if not exists "page_versions_page_locale_idx"
+  on "page_versions" ("page_id", "locale", "saved_at");
+
+create table if not exists "entries" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "collection" text not null,
+  "parent_id" uuid references "entries" ("id") on delete restrict,
+  "fields" jsonb not null default '{}'::jsonb,
+  "sort" numeric,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+-- The node holds identity, tree position and the SHARED fields — every
+-- field without .localized() (spec 2026-09-06 §7): a Person's photo is
+-- the same in every language. Everything a locale owns — its segment,
+-- publish state, the .localized() fields and the version pointers —
+-- lives in entry_locales, one row per locale the entry exists in. There
+-- is no sibling-slug index any more: URL uniqueness per locale is the
+-- primary key of "paths", which the stores write inside the same
+-- operation, and both adapters pre-check siblings per locale in code.
+create index if not exists "entries_collection_sort_idx"
+  on "entries" ("space_id", "collection", "sort");
+
+create index if not exists "entries_parent_idx"
+  on "entries" ("space_id", "collection", "parent_id");
+
+create table if not exists "entry_locales" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "slug" text,
+  "status" text not null default 'draft',
+  "fields" jsonb not null default '{}'::jsonb,
+  "draft_version_id" uuid,
+  "published_version_id" uuid,
+  "updated_at" timestamptz not null default now(),
+  "updated_by" text,
+  primary key ("entry_id", "locale")
+);
+
+create index if not exists "entry_locales_status_idx"
+  on "entry_locales" ("space_id", "locale", "status");
+
+-- A version belongs to ONE locale of one entry and stores the MERGED
+-- fields (shared + localized + slug) as they were at that save, so
+-- restoring an old Finnish version restores the shared fields too.
+-- Rows for every collection and every global item (spec 2026-09-14 §1).
+-- One row per publish plus the live draft (spec 2026-09-13 history §1).
+create table if not exists "entry_versions" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "entry_id" uuid not null references "entries" ("id") on delete cascade,
+  "locale" text not null,
+  "fields" jsonb not null,
+  "saved_at" timestamptz not null default now()
+);
+
+create index if not exists "entry_versions_entry_locale_idx"
+  on "entry_versions" ("entry_id", "locale", "saved_at");
+
+-- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
+-- statement. Deliberately does not touch updated_at — a drag must not
+-- make the whole collection look freshly edited. Scoped to the current
+-- space by the same function the policies use.
+create or replace function "smoodly_reorder"(
+  p_collection text,
+  p_ids uuid[]
+) returns void language sql as $$
+  update "entries" e set "sort" = u.ord
+  from unnest(p_ids) with ordinality as u(id, ord)
+  where e."id" = u.id
+    and e."collection" = p_collection
+    and e."space_id" = "smoodly_current_space"();
+$$;
+
+create table if not exists "refs" (
+  "source_kind" text not null,
+  "source_id" uuid not null,
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "source_field" text not null,
+  "target_collection" text not null,
+  "target_id" uuid not null,
+  primary key ("source_kind", "source_id", "source_field", "target_id")
+);
+
+-- The URL index (spec 2026-09-05 §4): the refs counterpart for paths.
+-- Derived — the stores rewrite a target's rows on every create, rename,
+-- move and delete — so one primary-key hit resolves any URL in any locale
+-- and no page or entry can share a URL with another in any locale.
+-- Rows exist for drafts too (the editor needs them); the read policy
+-- admits a row only when its target is published.
+create table if not exists "paths" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "locale" text not null,
+  "path" text not null,
+  "kind" text not null check ("kind" in ('page', 'entry')),
+  "target_id" uuid not null,
+  primary key ("space_id", "locale", "path")
+);
+
+create index if not exists "paths_target_idx"
+  on "paths" ("space_id", "kind", "target_id");
+
+-- Media (spec 2026-09-08): one row per upload, bytes in the "media"
+-- bucket at "path". Immediate — never draft-gated, never versioned —
+-- so there is no locale row and no version table. status 'pending' is
+-- a row whose signed upload has not been confirmed; list never shows it.
+create table if not exists "assets" (
+  "id" uuid primary key default gen_random_uuid(),
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "kind" text not null check ("kind" in ('image', 'video', 'file')),
+  "status" text not null default 'pending' check ("status" in ('pending', 'ready')),
+  "path" text not null,
+  "mime" text not null,
+  "size" bigint not null,
+  "width" integer,
+  "height" integer,
+  "duration" numeric,
+  "poster_id" uuid references "assets" ("id") on delete set null,
+  "filename" text not null,
+  "title" text,
+  "alt" text,
+  "caption" text,
+  "credit" text,
+  "created_by" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+
+create index if not exists "assets_space_created_idx"
+  on "assets" ("space_id", "status", "created_at" desc);
+
+-- Replace the targets' rows with the given rows in ONE call: a SQL
+-- function runs in the caller's transaction, so a primary-key collision
+-- rolls the whole rewrite back. Inserted rows get their space from the
+-- a_set_space trigger (the claim, or the default space).
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+  delete from "paths" p
+  using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
+  where p."kind" = t.kind and p."target_id" = t.id
+    and p."space_id" = "smoodly_current_space"();
+  insert into "paths" ("locale", "path", "kind", "target_id")
+  select r.locale, r.path, r.kind, r.id
+  from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid);
+$$;
+
+-- RLS on every core table. The service role bypasses it (self-host
+-- adapters untouched). The policy set that follows (space layer) admits
+-- a key to its own space: everything for a write key, published rows for
+-- a read key or the anon key (default space). Drafts stay unreachable
+-- to anything but a write key. The generated per-collection views
+-- (collectionSQL) run with security_invoker = true, so they are subject
+-- to this same smoodly_read policy rather than their owner's privileges.
+-- smoodly_meta: which version of this schema the database holds (spec
+-- 2026-09-26 §1). One row per database, not per space; every core
+-- migration file upserts the version row as its last statement, and the
+-- package compares it with SCHEMA_VERSION (behind blocks the admin).
+create table if not exists "smoodly_meta" (
+  "key" text primary key,
+  "value" text not null
+);
+
+alter table "pages" enable row level security;
+alter table "page_locales" enable row level security;
+alter table "page_versions" enable row level security;
+alter table "entries" enable row level security;
+alter table "entry_locales" enable row level security;
+alter table "entry_versions" enable row level security;
+alter table "refs" enable row level security;
+alter table "paths" enable row level security;
+alter table "assets" enable row level security;
+alter table "smoodly_meta" enable row level security;
+
+-- ── Cloud state (spec 2026-09-04 §1, names 2026-09-25): three ordinary
+-- tables, shipped for everyone with ONE definition. Self-host fills them
+-- by hand or leaves them empty; smoodly.io writes rows with the service
+-- role. There is never cloud-only SQL on a content database.
+-- members: who may open /admin for a space (spec 2026-09-25 §1–§2). The
+-- email is stored so the Members page needs no Auth lookup — the auth
+-- project is not the content project in the cloud.
+create table if not exists "members" (
+  "space_id" uuid not null default '00000000-0000-0000-0000-000000000000',
+  "user_id" uuid not null,
+  "email" text,
+  "role" text not null default 'editor',
+  primary key ("space_id", "user_id")
+);
+
+create table if not exists "space_keys" (
+  "id" uuid primary key,
+  "space_id" uuid not null,
+  "kind" text not null check ("kind" in ('read', 'write')),
+  "revoked_at" timestamptz
+);
+
+-- spaces: the control plane's row for a space (spec 2026-09-25 §3). No
+-- row = self-host: no cap, members managed in /admin. console_url set =
+-- smoodly.io manages the members and /admin links there.
+create table if not exists "spaces" (
+  "space_id" uuid primary key,
+  "row_cap" integer,
+  "console_url" text
+);
+
+alter table "members" enable row level security;
+alter table "space_keys" enable row level security;
+alter table "spaces" enable row level security;
+
+-- ── Claim readers. The two lookups run as definer so they can read the
+-- service-role-only tables from inside a policy; search_path is pinned.
+create or replace function "smoodly_key_kind"() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'kind';
+$$;
+
+create or replace function "smoodly_space_key_revoked"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select coalesce(
+    (select k."revoked_at" is not null from "space_keys" k
+      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
+    false);
+$$;
+
+create or replace function "smoodly_space_row_cap"() returns integer
+language sql stable security definer set search_path = public as $$
+  select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
+$$;
+
+-- ── Triggers. A key's claim wins over whatever the insert said, so an
+-- adapter never has to know its space and cannot write into another.
+-- No claim (service role, anon) leaves the given or default value —
+-- that is how smoodly.io writes cloud-state rows for a chosen space.
+create or replace function "smoodly_set_space"() returns trigger
+language plpgsql as $$
+begin
+  if auth.jwt() ->> 'space_id' is not null then
+    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
+  end if;
+  return new;
+end;
+$$;
+
+-- Per table, per space. No spaces row, or a null cap = no cap (self-host). Trigger
+-- a_ (smoodly_set_space) runs first, so new.space_id already equals the
+-- current space for a keyed insert; smoodly_space_row_cap() reads the
+-- current space itself, so this never needs the row's space_id as an
+-- argument (which would let one space's insert probe another's cap).
+-- A service-role insert that names another space explicitly is a
+-- different case: there is no JWT claim, so smoodly_current_space()
+-- still resolves to the default space, and the cap read is the default
+-- space's (none) — the service role is never capped by another space's row.
+-- search_path is pinned empty, so every reference below is schema-qualified.
+create or replace function "smoodly_enforce_row_cap"() returns trigger
+language plpgsql set search_path = '' as $$
+declare
+  cap integer;
+  n bigint;
+begin
+  cap := public."smoodly_space_row_cap"();
+  if cap is null then
+    return new;
+  end if;
+  -- Advisory only (free-tier abuse guard), not a hard invariant: two
+  -- concurrent inserts can both observe n = cap - 1 and both pass.
+  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
+    into n using new."space_id";
+  if n >= cap then
+    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
+      using errcode = 'check_violation';
+  end if;
+  return new;
+end;
+$$;
+
+create index if not exists "page_locales_space_idx" on "page_locales" ("space_id");
+
+create index if not exists "page_versions_space_idx" on "page_versions" ("space_id");
+
+create index if not exists "entry_locales_space_idx" on "entry_locales" ("space_id");
+
+create index if not exists "entry_versions_space_idx" on "entry_versions" ("space_id");
+
+create index if not exists "refs_space_idx" on "refs" ("space_id");
+
+drop trigger if exists "smoodly_a_set_space" on "pages";
+create trigger "smoodly_a_set_space" before insert on "pages"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_locales";
+create trigger "smoodly_a_set_space" before insert on "page_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "page_versions";
+create trigger "smoodly_a_set_space" before insert on "page_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entries";
+create trigger "smoodly_a_set_space" before insert on "entries"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_locales";
+create trigger "smoodly_a_set_space" before insert on "entry_locales"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "entry_versions";
+create trigger "smoodly_a_set_space" before insert on "entry_versions"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "refs";
+create trigger "smoodly_a_set_space" before insert on "refs"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "paths";
+create trigger "smoodly_a_set_space" before insert on "paths"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "assets";
+create trigger "smoodly_a_set_space" before insert on "assets"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_a_set_space" on "members";
+create trigger "smoodly_a_set_space" before insert on "members"
+  for each row execute function "smoodly_set_space"();
+
+drop trigger if exists "smoodly_b_row_cap" on "pages";
+create trigger "smoodly_b_row_cap" before insert on "pages"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_locales";
+create trigger "smoodly_b_row_cap" before insert on "page_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "page_versions";
+create trigger "smoodly_b_row_cap" before insert on "page_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entries";
+create trigger "smoodly_b_row_cap" before insert on "entries"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_locales";
+create trigger "smoodly_b_row_cap" before insert on "entry_locales"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "entry_versions";
+create trigger "smoodly_b_row_cap" before insert on "entry_versions"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "refs";
+create trigger "smoodly_b_row_cap" before insert on "refs"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "paths";
+create trigger "smoodly_b_row_cap" before insert on "paths"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop trigger if exists "smoodly_b_row_cap" on "assets";
+create trigger "smoodly_b_row_cap" before insert on "assets"
+  for each row execute function "smoodly_enforce_row_cap"();
+
+drop policy if exists "smoodly_write" on "pages";
+create policy "smoodly_write" on "pages" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "page_locales";
+create policy "smoodly_write" on "page_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "page_versions";
+create policy "smoodly_write" on "page_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id"));
+
+drop policy if exists "smoodly_write" on "entries";
+create policy "smoodly_write" on "entries" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published'));
+
+drop policy if exists "smoodly_write" on "entry_locales";
+create policy "smoodly_write" on "entry_locales" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'published');
+
+drop policy if exists "smoodly_write" on "entry_versions";
+create policy "smoodly_write" on "entry_versions" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id"));
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+create policy "smoodly_write" on "paths" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published'))));
+
+drop policy if exists "smoodly_write" on "assets";
+create policy "smoodly_write" on "assets" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and "status" = 'ready');
+
+drop policy if exists "smoodly_write" on "members";
+create policy "smoodly_write" on "members" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "spaces";
+create policy "smoodly_read" on "spaces" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "smoodly_meta";
+create policy "smoodly_read" on "smoodly_meta" for select
+  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));
+
+insert into storage.buckets ("id", "name", "public", "file_size_limit")
+  values ('media', 'media', true, 104857600)
+  on conflict ("id") do update set "public" = excluded."public", "file_size_limit" = excluded."file_size_limit";
+
+drop policy if exists "smoodly_media_read" on storage.objects;
+create policy "smoodly_media_read" on storage.objects for select
+  using ("bucket_id" = 'media');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+create policy "smoodly_media_write" on storage.objects for all
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text)
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '1')
+  on conflict ("key") do update set "value" = excluded."value";

package/migrations/20260926130000_smoodly_v2.sql

@@ -0,0 +1,26 @@
+-- Smoodly core schema, version 2 (docs/superpowers/specs/2026-09-26-concurrency-guard-presence-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 1: the draft pointers become foreign keys (the
+-- token rides every locale row read) and the editing-presence channel
+-- gets its policy on realtime.messages.
+
+set client_min_messages = warning;
+
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text);
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '2')
+  on conflict ("key") do update set "value" = excluded."value";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {
@@ -11,6 +11,9 @@
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "smoodly": "bin/smoodly.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -43,10 +46,16 @@
     "./bridge": {
       "types": "./dist/admin/next/bridge.d.ts",
       "default": "./dist/admin/next/bridge.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations.d.ts",
+      "default": "./dist/migrations.js"
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "migrations",
+    "bin"
   ],
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
@@ -88,6 +97,7 @@
     "@tiptap/react": "3.31.3",
     "@tiptap/starter-kit": "3.31.3",
     "@tiptap/suggestion": "3.31.3",
-    "lucide-react": "^1.41.0"
+    "lucide-react": "^1.41.0",
+    "tsx": "^4.23.15"
   }
 }