smoodly 0.0.25 → 0.0.26

package/dist/entry-store.d.ts

@@ -3,6 +3,7 @@ import type { GlobalSchema } from "./global.ts";
 import { type RefEdge, type SectionLike } from "./refs.ts";
 import { MemoryRefIndex } from "./ref-index.ts";
 import { type PathIndex } from "./path-index.ts";
+import { type DraftToken } from "./draft-token.ts";
 import { type LocaleSet, type PathTarget } from "./paths.ts";
 export type EntryLocale = {
     /** The entry's segment in this locale; null claims no URL. */
@@ -11,6 +12,8 @@ export type EntryLocale = {
     /** ONLY the .localized() fields, for this locale. */
     fields: Record<string, unknown>;
     draftVersionId: string | null;
+    /** The draft version's saved time as the store's own text (spec 2026-09-26 concurrency §1). Null with no pointer. */
+    draftSavedAt: string | null;
     publishedVersionId: string | null;
     updatedAt: number;
     /** The editor's email behind the last write that touched this row; null for the seed and scripts (spec 2026-09-13 history §2). */
@@ -104,14 +107,14 @@ export interface EntryStore {
     }): Promise<Record<string, Record<string, unknown>>>;
     /** Replaces the merged fields for `locale`: shared keys on the node
      * (every locale sees them), localized keys and the slug on the row. */
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** The live row goes back to what is published: the published snapshot's fields
      *  (shared and localized, split as on save — the slug is never versioned) written over
      *  the row, the draft pointer set to the published one, the abandoned draft row deleted
      *  (spec 2026-09-13 history §1). Refused when the locale has no published version (a
      *  non-versioned collection never has one). */
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** Copies `from`'s localized fields and slug as the new row (shared
      * fields need no copy); refused when the entry has the locale or its
      * parent lacks it. */
@@ -124,7 +127,7 @@ export interface EntryStore {
     /** The snapshot's shared and localized fields become the draft (the slug is never
      *  versioned) through the draft rule; the live version restores as a discard. Refused
      *  when the version is not this entry's in this locale (spec 2026-09-13 history §6). */
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** One stored version by id — callers check `entryId` and `locale`. */
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     /** Blocked while anything references the entry (the safe-delete guard),
@@ -268,13 +271,13 @@ export declare class MemoryEntryStore implements EntryStore {
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     addLocale(collection: string, id: string, locale: string, options: AddEntryLocaleOptions, by?: string): Promise<EntryRecord>;
     removeLocale(collection: string, id: string, locale: string): Promise<EntryRecord>;
     listVersions(collection: string, id: string, locale: string): Promise<EntryVersion[]>;
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     move(collection: string, id: string, to: {
         parentId: string | null;

package/dist/entry-store.js

@@ -13,6 +13,7 @@ import { collectionDepth, collectionOrder } from "./collections.js";
 import { collectEntryRefs } from "./refs.js";
 import { MemoryRefIndex } from "./ref-index.js";
 import { MemoryPathIndex } from "./path-index.js";
+import { assertFresh } from "./draft-token.js";
 import { globalEntryId } from "./global-id.js";
 import { DEFAULT_SPACE_ID } from "./sql-space.js";
 import { assertDepth, assertSupportedLocale, chainOf, entryPathRows, slugOf, unsupportedLocale, } from "./paths.js";
@@ -44,6 +45,11 @@ export function schemaOf(collections, name) {
 export const isGlobalSchema = (schema) => schema.kind === "global";
 let counter = 0;
 const uid = (prefix) => `${prefix}-${++counter}-${Date.now().toString(36)}`;
+/** A version's saved time: wall-clock, but strictly increasing, so two saves in one
+ *  millisecond still move the draft token (spec 2026-09-26 concurrency §1) the way
+ *  Postgres's microsecond `now()` does. */
+let lastSavedAt = 0;
+const savedClock = () => (lastSavedAt = Math.max(Date.now(), lastSavedAt + 1));
 export const DEFAULT_ENTRY_LOCALES = { default: "en", supported: ["en"] };
 export const entryErrors = {
     notFound: (collection, id) => new Error(`smoodly: no entry "${id}" in "${collection}".`),
@@ -216,14 +222,16 @@ export class MemoryEntryStore {
         const current = row.draftVersionId ? this.versions.get(row.draftVersionId) : undefined;
         if (current && row.draftVersionId !== row.publishedVersionId) {
             current.fields = fields;
-            current.savedAt = Date.now();
+            current.savedAt = savedClock();
+            row.draftSavedAt = String(current.savedAt);
             this.versionSeq.set(current.id, ++this.seq); // newest again
             return;
         }
-        const version = { id: uid("version"), entryId: entry.id, locale, fields, savedAt: Date.now() };
+        const version = { id: uid("version"), entryId: entry.id, locale, fields, savedAt: savedClock() };
         this.versions.set(version.id, version);
         this.versionSeq.set(version.id, ++this.seq);
         row.draftVersionId = version.id;
+        row.draftSavedAt = String(version.savedAt);
     }
     /** A published row from before every collection was versioned has no snapshot; give it
      *  one from what is live BEFORE a write changes the fields, so the site keeps serving it
@@ -232,11 +240,12 @@ export class MemoryEntryStore {
         const row = entry.locales[locale];
         if (row.status !== "published" || row.publishedVersionId !== null)
             return;
-        const version = { id: uid("version"), entryId: entry.id, locale, fields: entryFieldsIn(entry, locale), savedAt: Date.now() };
+        const version = { id: uid("version"), entryId: entry.id, locale, fields: entryFieldsIn(entry, locale), savedAt: savedClock() };
         this.versions.set(version.id, version);
         this.versionSeq.set(version.id, ++this.seq);
         row.draftVersionId = version.id;
         row.publishedVersionId = version.id;
+        row.draftSavedAt = String(version.savedAt);
     }
     dropVersions(entryId, locale) {
         for (const [id, v] of this.versions) {
@@ -323,7 +332,7 @@ export class MemoryEntryStore {
             collection, parentId, fields: shared,
             locales: {
                 [options.locale]: {
-                    slug, status: "draft", fields: localized, draftVersionId: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
+                    slug, status: "draft", fields: localized, draftVersionId: null, draftSavedAt: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
                 },
             },
             sort: null, createdAt: now, updatedAt: now,
@@ -387,10 +396,11 @@ export class MemoryEntryStore {
         }
         return out;
     }
-    async update(collection, id, locale, fields, by) {
+    async update(collection, id, locale, fields, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
+        assertFresh(row, expected);
         this.ensureLiveSnapshot(entry, locale);
         const { shared, localized, slug } = splitFields(fields, schema);
         if (isGlobalSchema(schema) && slug !== null)
@@ -413,10 +423,11 @@ export class MemoryEntryStore {
         this.writeRefs(entry);
         return this.snapshot(entry);
     }
-    async setStatus(collection, id, locale, status, by) {
+    async setStatus(collection, id, locale, status, by, expected) {
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
         if (status === "published") {
+            assertFresh(row, expected);
             // Publish points at the current draft; a row always has one after its first write, but never trust that from here.
             if (!row.draftVersionId)
                 this.recordVersion(entry, locale);
@@ -428,10 +439,11 @@ export class MemoryEntryStore {
         this.writeRefs(entry); // the published snapshot just became, or stopped being, a live set
         return this.snapshot(entry);
     }
-    async discardDraft(collection, id, locale, by) {
+    async discardDraft(collection, id, locale, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
+        assertFresh(row, expected);
         const snapshot = row.publishedVersionId ? this.versions.get(row.publishedVersionId) : undefined;
         if (!snapshot)
             throw entryErrors.nothingPublished(collection, id, locale);
@@ -440,6 +452,7 @@ export class MemoryEntryStore {
         row.fields = localized;
         const abandoned = row.draftVersionId;
         row.draftVersionId = row.publishedVersionId;
+        row.draftSavedAt = String(snapshot.savedAt);
         if (abandoned && abandoned !== row.publishedVersionId) {
             this.versions.delete(abandoned);
             this.versionSeq.delete(abandoned);
@@ -462,7 +475,7 @@ export class MemoryEntryStore {
         const now = Date.now();
         entry.locales[locale] = {
             slug: source.slug, status: "draft", fields: structuredClone(source.fields),
-            draftVersionId: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
+            draftVersionId: null, draftSavedAt: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
         };
         this.recordVersion(entry, locale);
         // Only this node's rows change: a child cannot have a locale its parent lacked.
@@ -510,15 +523,16 @@ export class MemoryEntryStore {
             .sort((a, b) => b.savedAt - a.savedAt || this.versionSeq.get(b.id) - this.versionSeq.get(a.id))
             .map((v) => structuredClone(v));
     }
-    async restore(collection, id, locale, versionId, by) {
+    async restore(collection, id, locale, versionId, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
         const version = this.versions.get(versionId);
         if (!version || version.entryId !== id || version.locale !== locale)
             throw entryErrors.foreignVersion(collection, id, locale, versionId);
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(collection, id, locale, by);
+            return this.discardDraft(collection, id, locale, by, expected);
         const { shared, localized } = splitFields(version.fields, schema);
         entry.fields = shared;
         row.fields = localized; // the slug is the row's own and never versioned

package/dist/env.d.ts

@@ -14,3 +14,12 @@ export declare function resolveSmoodlyEnv(env: Record<string, string | undefined
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export declare const smoodlyEnv: () => SmoodlyEnv;
+/** What the browser needs to join the content project's presence channel (spec 2026-09-26 concurrency §5): public values only. */
+export type ContentConfig = {
+    url: string;
+    key: string;
+    spaceId: string;
+};
+/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
+export declare function spaceIdOfKey(key: string): string;
+export declare function publicContentConfig(env: SmoodlyEnv): ContentConfig;

package/dist/env.js

@@ -1,6 +1,7 @@
 // The one config shape (spec 2026-09-04 §4/§6). Self-host sets three
 // names; the cloud sets five. The two defaults are what keep a single
 // code path: a default for an absent value is not a mode branch.
+import { DEFAULT_SPACE_ID } from "./sql-space.js";
 const REQUIRED = ["SMOODLY_URL", "SMOODLY_SECRET_KEY", "SMOODLY_PUBLISHABLE_KEY"];
 export function resolveSmoodlyEnv(env) {
     const missing = REQUIRED.filter((name) => !env[name]);
@@ -20,3 +21,21 @@ export function resolveSmoodlyEnv(env) {
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export const smoodlyEnv = () => resolveSmoodlyEnv(process.env);
+/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
+export function spaceIdOfKey(key) {
+    const parts = key.split(".");
+    if (parts.length !== 3)
+        return DEFAULT_SPACE_ID;
+    try {
+        // base64url → base64, padded; atob exists in Node 22 and every browser, so no Buffer here.
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(parts[1].length / 4) * 4, "=");
+        const claims = JSON.parse(atob(b64));
+        return typeof claims.space_id === "string" && claims.space_id ? claims.space_id : DEFAULT_SPACE_ID;
+    }
+    catch {
+        return DEFAULT_SPACE_ID;
+    }
+}
+export function publicContentConfig(env) {
+    return { url: env.url, key: env.publishableKey, spaceId: spaceIdOfKey(env.secretKey) };
+}

package/dist/index.d.ts

@@ -28,6 +28,8 @@ export { z } from "./zones.ts";
 export { defineConfig } from "./config.ts";
 export { collectionSQL, coreTablesSQL } from "./sql.ts";
 export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.ts";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.ts";
+export type { DraftToken, DraftPointerRow } from "./draft-token.ts";
 export { MemoryPageStore } from "./store.ts";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.ts";
 export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, BeginUploadInput, CreateAssetInput } from "./asset-store.ts";
@@ -153,8 +155,8 @@ export declare const smoodly: {
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
 export type { MarkNode, MarkPath, Marks, Scope } from "./marks.ts";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.ts";
-export type { SmoodlyEnv } from "./env.ts";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.ts";
+export type { SmoodlyEnv, ContentConfig } from "./env.ts";
 export { clientOptions, createSmoodlyClient } from "./client.ts";
 export { createSmoodlySite, pageContextOf } from "./site.ts";
 export type { SiteOptions, SitePage, SitePageSchema, SiteEntry, SiteHit, SmoodlySite, LoadOptions, PageTreeItem, SiteEntryItem, EntryTreeItem, EntryQuery, } from "./site.ts";

package/dist/index.js

@@ -22,6 +22,7 @@ export { z } from "./zones.js";
 export { defineConfig } from "./config.js";
 export { collectionSQL, coreTablesSQL } from "./sql.js";
 export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.js";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.js";
 export { MemoryPageStore } from "./store.js";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.js";
 export { imageDimensions } from "./image-dimensions.js";
@@ -63,6 +64,6 @@ export const smoodly = {
     marks,
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.js";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.js";
 export { clientOptions, createSmoodlyClient } from "./client.js";
 export { createSmoodlySite, pageContextOf } from "./site.js";

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 1;
+export declare const SCHEMA_VERSION = 2;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 1;
+export const SCHEMA_VERSION = 2;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/sql-space.js

@@ -199,6 +199,17 @@ $$;`.trim());
     statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
         `create policy "smoodly_read" on "smoodly_meta" for select\n` +
         `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
+    // The editing-presence channel (spec 2026-09-26 concurrency §6): one
+    // private Realtime topic per space, `space:<id>`. A caller receives on
+    // and sends to its own space's topic only — the anon key resolves to the
+    // default space, a cloud read key to its claim. Identical everywhere.
+    const topic = `(select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text`;
+    statements.push(`drop policy if exists "smoodly_presence_read" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_read" on "realtime"."messages" for select\n` +
+        `  using (${topic});`);
+    statements.push(`drop policy if exists "smoodly_presence_write" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_write" on "realtime"."messages" for insert\n` +
+        `  with check (${topic});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }

package/dist/sql.js

@@ -193,6 +193,17 @@ create table if not exists "entry_versions" (
 create index if not exists "entry_versions_entry_locale_idx"
   on "entry_versions" ("entry_id", "locale", "saved_at");
 
+-- ── Draft pointers as foreign keys (schema v2, spec 2026-09-26 concurrency §1):
+-- PostgREST embeds the draft version's saved_at through them, so every
+-- locale row read carries the token. Set null on delete: discard moves
+-- the pointer before it deletes the abandoned row, so nothing dangles.
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
 -- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
 -- statement. Deliberately does not touch updated_at — a drag must not
 -- make the whole collection look freshly edited. Scoped to the current

package/dist/store.d.ts

@@ -4,6 +4,7 @@ import { type RefEdge, type SectionLike } from "./refs.ts";
 import type { Toolset } from "./toolset.ts";
 import type { MemoryRefIndex } from "./ref-index.ts";
 import { type PathIndex } from "./path-index.ts";
+import { type DraftToken } from "./draft-token.ts";
 import { type LocaleSet, type PagePathOptions, type PathTarget } from "./paths.ts";
 export type PageLocale = {
     /** The node's OWN segment in this locale; the URL is derived (paths.ts). */
@@ -11,6 +12,8 @@ export type PageLocale = {
     title: string;
     status: "draft" | "published";
     draftVersionId: string | null;
+    /** The draft version's saved time as the store's own text — the token's second half (spec 2026-09-26 concurrency §1). Null with no pointer. */
+    draftSavedAt: string | null;
     publishedVersionId: string | null;
     updatedAt: number;
     /** The editor's email behind the last write that touched this row; null for the seed and scripts (spec 2026-09-13 history §2). */
@@ -81,18 +84,18 @@ export interface PageStore {
     }): Promise<PageRecord>;
     /** A folder becomes a page: an empty draft version per present locale. */
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** The draft goes back to what is live: the locale's draft pointer set to its
      *  published pointer and the abandoned draft row deleted (spec 2026-09-13 history §1).
      *  Refused when nothing is published in the locale (spec 2026-09-13 publish flow §4). */
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** Takes ONE locale off the site: status draft, both pointers kept so a later
      *  publish republishes the current draft (spec §5). */
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
     /** The version's tree becomes the draft through the draft rule (spec 2026-09-13 history §6); the
      *  published version restores as a discard. Refused when the version is not this page's in this locale. */
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** One stored version by id, whoever it belongs to — callers check `pageId` and `locale`. */
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
@@ -210,11 +213,11 @@ export declare class MemoryPageStore implements PageStore {
         index?: number;
     }): Promise<PageRecord>;
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
     fieldsOf(versionIds: string[]): Promise<Record<string, Record<string, unknown>>>;

package/dist/store.js

@@ -13,6 +13,7 @@ import { ASSET_COLLECTION } from "./media.js";
 import { collectTreeRefs } from "./refs.js";
 import { customToolset, withCustomSchema } from "./custom/index.js";
 import { MemoryPathIndex } from "./path-index.js";
+import { assertFresh } from "./draft-token.js";
 import { SCHEMA_VERSION } from "./schema-version.js";
 import { assertDepth, assertSegment, assertSupportedLocale, chainOf, isHomeNode, pagePathRows, unsupportedLocale, } from "./paths.js";
 export const DEFAULT_LOCALES = { default: "en", supported: ["en"] };
@@ -91,6 +92,11 @@ export async function assertPublishable(label, tree, sections, entries, locale)
 }
 let counter = 0;
 const uid = () => `id-${++counter}-${Date.now().toString(36)}`;
+/** A version's saved time: wall-clock, but strictly increasing, so two saves in one
+ *  millisecond still move the draft token (spec 2026-09-26 concurrency §1) the way
+ *  Postgres's microsecond `now()` does. */
+let lastSavedAt = 0;
+const savedClock = () => (lastSavedAt = Math.max(Date.now(), lastSavedAt + 1));
 /** The row's audit pair: every write that touches a locale row sets both (spec 2026-09-13 history §2). */
 function touchRow(row, by) {
     row.updatedAt = Date.now();
@@ -179,7 +185,7 @@ export class MemoryPageStore {
         refs.rewrite({ sourceKind: "page", sourceId: page.id }, pageRefEdges(this.liveTrees(page), sections, elements));
     }
     newVersion(pageId, locale, tree) {
-        const version = { id: uid(), pageId, locale, tree: structuredClone(tree), savedAt: Date.now() };
+        const version = { id: uid(), pageId, locale, tree: structuredClone(tree), savedAt: savedClock() };
         this.versions.set(version.id, version);
         return version;
     }
@@ -191,12 +197,14 @@ export class MemoryPageStore {
         let version;
         if (current && row.draftVersionId !== row.publishedVersionId) {
             current.tree = structuredClone(tree);
-            current.savedAt = Date.now();
+            current.savedAt = savedClock();
+            row.draftSavedAt = String(current.savedAt);
             version = current;
         }
         else {
             version = this.newVersion(page.id, locale, tree);
             row.draftVersionId = version.id;
+            row.draftSavedAt = String(version.savedAt);
         }
         touchRow(row, by);
         return version;
@@ -235,6 +243,7 @@ export class MemoryPageStore {
                     title: input.title ?? input.slug,
                     status: "draft",
                     draftVersionId: version?.id ?? null,
+                    draftSavedAt: version ? String(version.savedAt) : null,
                     publishedVersionId: null,
                     updatedAt: Date.now(),
                     updatedBy: by ?? null,
@@ -295,6 +304,7 @@ export class MemoryPageStore {
             title: options.title ?? source.title,
             status: "draft",
             draftVersionId: version?.id ?? null,
+            draftSavedAt: version ? String(version.savedAt) : null,
             publishedVersionId: null,
             updatedAt: Date.now(),
             updatedBy: by ?? null,
@@ -415,24 +425,28 @@ export class MemoryPageStore {
             throw pageErrors.hasTemplate(id);
         page.template = template;
         for (const [locale, row] of Object.entries(page.locales)) {
-            row.draftVersionId = this.newVersion(id, locale, { zones: {} }).id;
+            const version = this.newVersion(id, locale, { zones: {} });
+            row.draftVersionId = version.id;
+            row.draftSavedAt = String(version.savedAt);
             touchRow(row, by);
         }
         return this.snapshot(page);
     }
-    async saveDraft(id, locale, tree, by) {
+    async saveDraft(id, locale, tree, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
+        assertFresh(localeRow(page, locale), expected);
         const version = this.writeDraftVersion(page, locale, tree, by);
         this.writeRefs(page);
         return { ...version, tree: structuredClone(version.tree) };
     }
-    async publish(id, locale, by) {
+    async publish(id, locale, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.draftVersionId)
             throw pageErrors.folder(id);
         const { sections, entries } = this.options;
@@ -445,13 +459,15 @@ export class MemoryPageStore {
         this.writeRefs(page);
         return this.snapshot(page);
     }
-    async discardDraft(id, locale, by) {
+    async discardDraft(id, locale, by, expected) {
         const page = this.must(id);
         const row = localeRow(page, locale);
+        assertFresh(row, expected);
         if (!row.publishedVersionId)
             throw pageErrors.nothingPublished(id, locale);
         const abandoned = row.draftVersionId;
         row.draftVersionId = row.publishedVersionId;
+        row.draftSavedAt = String(this.versions.get(row.publishedVersionId).savedAt);
         if (abandoned && abandoned !== row.publishedVersionId)
             this.versions.delete(abandoned); // never shown as a stray draft
         touchRow(row, by);
@@ -466,7 +482,7 @@ export class MemoryPageStore {
         this.writeRefs(page);
         return this.snapshot(page);
     }
-    async restore(id, locale, versionId, by) {
+    async restore(id, locale, versionId, by, expected) {
         const page = this.must(id);
         if (page.template === null)
             throw pageErrors.folder(id);
@@ -474,8 +490,10 @@ export class MemoryPageStore {
         const version = this.versions.get(versionId);
         if (!version || version.pageId !== id || version.locale !== locale)
             throw pageErrors.foreignVersion(id, locale, versionId);
+        // The memory store is single-threaded: the read-side check IS the atomic check.
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(id, locale, by);
+            return this.discardDraft(id, locale, by, expected);
         this.writeDraftVersion(page, locale, version.tree, by);
         this.writeRefs(page);
         return this.snapshot(page);

package/dist/supabase-entry-store.d.ts

@@ -1,6 +1,7 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CollectionSchema } from "./collections.ts";
 import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryUsage, EntryVersion, ListOptions } from "./entry-store.ts";
+import { type DraftToken } from "./draft-token.ts";
 export declare class SupabaseEntryStore implements EntryStore {
     private db;
     private paths;
@@ -39,9 +40,18 @@ export declare class SupabaseEntryStore implements EntryStore {
     private insertLocale;
     /** A touch writes the audit pair — `updated_at` and `updated_by` (spec 2026-09-13 history §2). */
     private updateLocale;
+    /** The row's stale error, built from a fresh read: what a reload would get, and who wrote last. */
+    private stale;
+    /** `updateLocale` with the pointer as a filter (spec 2026-09-26 concurrency §3): the row is
+     *  written only while `draft_version_id` still equals `guard` (null = still no pointer).
+     *  `undefined` guard = unconditional. Resolves false when no row matched. */
+    private guardedUpdateLocale;
     /** The row goes first (it is what makes the entry exist in the locale), then its versions. */
     private deleteLocale;
-    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion. */
+    /** The draft rule for every collection (spec 2026-09-14 §1), see MemoryEntryStore.recordVersion —
+     *  guarded (spec 2026-09-26 concurrency §3) when the caller verified `row` against the token:
+     *  the rewrite filters on saved_at, the first draft on the pointer. Returns the version row it
+     *  created, or null when it rewrote in place, so a failed later step can undo it. */
     private recordVersion;
     /** See MemoryEntryStore.ensureLiveSnapshot: the snapshot of what is live, both pointers on it. */
     private ensureLiveSnapshot;
@@ -51,13 +61,13 @@ export declare class SupabaseEntryStore implements EntryStore {
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     addLocale(collection: string, id: string, locale: string, options: AddEntryLocaleOptions, by?: string): Promise<EntryRecord>;
     removeLocale(collection: string, id: string, locale: string): Promise<EntryRecord>;
     listVersions(collection: string, id: string, locale: string): Promise<EntryVersion[]>;
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     move(collection: string, id: string, to: {
         parentId: string | null;