smoodly 0.0.25 → 0.0.27

package/dist/draft-token.d.ts

@@ -0,0 +1,31 @@
+export type DraftToken = {
+    versionId: string;
+    savedAt: string;
+};
+/** What a locale row carries for the token (both stores' row types satisfy it). */
+export type DraftPointerRow = {
+    draftVersionId: string | null;
+    draftSavedAt: string | null;
+};
+/** The row's token, or null when it has no draft pointer (a folder, a page created without a tree). */
+export declare function draftToken(row: DraftPointerRow): DraftToken | null;
+export declare function sameToken(a: DraftToken | null, b: DraftToken | null): boolean;
+/** An untrusted value is a token when it has the two strings and nothing is missing. */
+export declare function isDraftToken(v: unknown): v is DraftToken;
+export declare class StaleDraftError extends Error {
+    /** The row's token now — what a reload would get. */
+    readonly current: DraftToken | null;
+    /** The audit pair of the row: who wrote last, when. */
+    readonly by: string | null;
+    readonly at: number;
+    constructor(
+    /** The row's token now — what a reload would get. */
+    current: DraftToken | null, 
+    /** The audit pair of the row: who wrote last, when. */
+    by: string | null, at: number);
+}
+/** The read-side check every guarded write runs first. `undefined` = no check. */
+export declare function assertFresh(row: DraftPointerRow & {
+    updatedBy: string | null;
+    updatedAt: number;
+}, expected: DraftToken | null | undefined): void;

package/dist/draft-token.js

@@ -0,0 +1,41 @@
+// The draft token (spec 2026-09-26 concurrency §1): the locale row's
+// draft pointer with that version's saved time. Every state change moves
+// it — a save rewrites saved_at, a discard points at the published
+// version, a restore creates a new draft. Pure and framework-free; both
+// stores throw StaleDraftError, the ops map it, the admin freezes on it.
+/** The row's token, or null when it has no draft pointer (a folder, a page created without a tree). */
+export function draftToken(row) {
+    return row.draftVersionId === null ? null : { versionId: row.draftVersionId, savedAt: row.draftSavedAt ?? "" };
+}
+export function sameToken(a, b) {
+    if (a === null || b === null)
+        return a === b;
+    return a.versionId === b.versionId && a.savedAt === b.savedAt;
+}
+/** An untrusted value is a token when it has the two strings and nothing is missing. */
+export function isDraftToken(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v)
+        && typeof v.versionId === "string"
+        && typeof v.savedAt === "string";
+}
+export class StaleDraftError extends Error {
+    constructor(
+    /** The row's token now — what a reload would get. */
+    current, 
+    /** The audit pair of the row: who wrote last, when. */
+    by, at) {
+        super("smoodly: the draft changed since it was loaded — reload before saving.");
+        this.current = current;
+        this.by = by;
+        this.at = at;
+        this.name = "StaleDraftError";
+    }
+}
+/** The read-side check every guarded write runs first. `undefined` = no check. */
+export function assertFresh(row, expected) {
+    if (expected === undefined)
+        return;
+    const current = draftToken(row);
+    if (!sameToken(current, expected))
+        throw new StaleDraftError(current, row.updatedBy, row.updatedAt);
+}

package/dist/entry-store.d.ts

@@ -3,6 +3,7 @@ import type { GlobalSchema } from "./global.ts";
 import { type RefEdge, type SectionLike } from "./refs.ts";
 import { MemoryRefIndex } from "./ref-index.ts";
 import { type PathIndex } from "./path-index.ts";
+import { type DraftToken } from "./draft-token.ts";
 import { type LocaleSet, type PathTarget } from "./paths.ts";
 export type EntryLocale = {
     /** The entry's segment in this locale; null claims no URL. */
@@ -11,6 +12,8 @@ export type EntryLocale = {
     /** ONLY the .localized() fields, for this locale. */
     fields: Record<string, unknown>;
     draftVersionId: string | null;
+    /** The draft version's saved time as the store's own text (spec 2026-09-26 concurrency §1). Null with no pointer. */
+    draftSavedAt: string | null;
     publishedVersionId: string | null;
     updatedAt: number;
     /** The editor's email behind the last write that touched this row; null for the seed and scripts (spec 2026-09-13 history §2). */
@@ -104,14 +107,14 @@ export interface EntryStore {
     }): Promise<Record<string, Record<string, unknown>>>;
     /** Replaces the merged fields for `locale`: shared keys on the node
      * (every locale sees them), localized keys and the slug on the row. */
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** The live row goes back to what is published: the published snapshot's fields
      *  (shared and localized, split as on save — the slug is never versioned) written over
      *  the row, the draft pointer set to the published one, the abandoned draft row deleted
      *  (spec 2026-09-13 history §1). Refused when the locale has no published version (a
      *  non-versioned collection never has one). */
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** Copies `from`'s localized fields and slug as the new row (shared
      * fields need no copy); refused when the entry has the locale or its
      * parent lacks it. */
@@ -124,7 +127,7 @@ export interface EntryStore {
     /** The snapshot's shared and localized fields become the draft (the slug is never
      *  versioned) through the draft rule; the live version restores as a discard. Refused
      *  when the version is not this entry's in this locale (spec 2026-09-13 history §6). */
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     /** One stored version by id — callers check `entryId` and `locale`. */
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     /** Blocked while anything references the entry (the safe-delete guard),
@@ -268,13 +271,13 @@ export declare class MemoryEntryStore implements EntryStore {
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
-    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string): Promise<EntryRecord>;
-    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string): Promise<EntryRecord>;
-    discardDraft(collection: string, id: string, locale: string, by?: string): Promise<EntryRecord>;
+    update(collection: string, id: string, locale: string, fields: Record<string, unknown>, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    setStatus(collection: string, id: string, locale: string, status: "draft" | "published", by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
+    discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     addLocale(collection: string, id: string, locale: string, options: AddEntryLocaleOptions, by?: string): Promise<EntryRecord>;
     removeLocale(collection: string, id: string, locale: string): Promise<EntryRecord>;
     listVersions(collection: string, id: string, locale: string): Promise<EntryVersion[]>;
-    restore(collection: string, id: string, locale: string, versionId: string, by?: string): Promise<EntryRecord>;
+    restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;
     move(collection: string, id: string, to: {
         parentId: string | null;

package/dist/entry-store.js

@@ -13,6 +13,7 @@ import { collectionDepth, collectionOrder } from "./collections.js";
 import { collectEntryRefs } from "./refs.js";
 import { MemoryRefIndex } from "./ref-index.js";
 import { MemoryPathIndex } from "./path-index.js";
+import { assertFresh } from "./draft-token.js";
 import { globalEntryId } from "./global-id.js";
 import { DEFAULT_SPACE_ID } from "./sql-space.js";
 import { assertDepth, assertSupportedLocale, chainOf, entryPathRows, slugOf, unsupportedLocale, } from "./paths.js";
@@ -44,6 +45,11 @@ export function schemaOf(collections, name) {
 export const isGlobalSchema = (schema) => schema.kind === "global";
 let counter = 0;
 const uid = (prefix) => `${prefix}-${++counter}-${Date.now().toString(36)}`;
+/** A version's saved time: wall-clock, but strictly increasing, so two saves in one
+ *  millisecond still move the draft token (spec 2026-09-26 concurrency §1) the way
+ *  Postgres's microsecond `now()` does. */
+let lastSavedAt = 0;
+const savedClock = () => (lastSavedAt = Math.max(Date.now(), lastSavedAt + 1));
 export const DEFAULT_ENTRY_LOCALES = { default: "en", supported: ["en"] };
 export const entryErrors = {
     notFound: (collection, id) => new Error(`smoodly: no entry "${id}" in "${collection}".`),
@@ -216,14 +222,16 @@ export class MemoryEntryStore {
         const current = row.draftVersionId ? this.versions.get(row.draftVersionId) : undefined;
         if (current && row.draftVersionId !== row.publishedVersionId) {
             current.fields = fields;
-            current.savedAt = Date.now();
+            current.savedAt = savedClock();
+            row.draftSavedAt = String(current.savedAt);
             this.versionSeq.set(current.id, ++this.seq); // newest again
             return;
         }
-        const version = { id: uid("version"), entryId: entry.id, locale, fields, savedAt: Date.now() };
+        const version = { id: uid("version"), entryId: entry.id, locale, fields, savedAt: savedClock() };
         this.versions.set(version.id, version);
         this.versionSeq.set(version.id, ++this.seq);
         row.draftVersionId = version.id;
+        row.draftSavedAt = String(version.savedAt);
     }
     /** A published row from before every collection was versioned has no snapshot; give it
      *  one from what is live BEFORE a write changes the fields, so the site keeps serving it
@@ -232,11 +240,12 @@ export class MemoryEntryStore {
         const row = entry.locales[locale];
         if (row.status !== "published" || row.publishedVersionId !== null)
             return;
-        const version = { id: uid("version"), entryId: entry.id, locale, fields: entryFieldsIn(entry, locale), savedAt: Date.now() };
+        const version = { id: uid("version"), entryId: entry.id, locale, fields: entryFieldsIn(entry, locale), savedAt: savedClock() };
         this.versions.set(version.id, version);
         this.versionSeq.set(version.id, ++this.seq);
         row.draftVersionId = version.id;
         row.publishedVersionId = version.id;
+        row.draftSavedAt = String(version.savedAt);
     }
     dropVersions(entryId, locale) {
         for (const [id, v] of this.versions) {
@@ -323,7 +332,7 @@ export class MemoryEntryStore {
             collection, parentId, fields: shared,
             locales: {
                 [options.locale]: {
-                    slug, status: "draft", fields: localized, draftVersionId: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
+                    slug, status: "draft", fields: localized, draftVersionId: null, draftSavedAt: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
                 },
             },
             sort: null, createdAt: now, updatedAt: now,
@@ -387,10 +396,11 @@ export class MemoryEntryStore {
         }
         return out;
     }
-    async update(collection, id, locale, fields, by) {
+    async update(collection, id, locale, fields, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
+        assertFresh(row, expected);
         this.ensureLiveSnapshot(entry, locale);
         const { shared, localized, slug } = splitFields(fields, schema);
         if (isGlobalSchema(schema) && slug !== null)
@@ -413,10 +423,11 @@ export class MemoryEntryStore {
         this.writeRefs(entry);
         return this.snapshot(entry);
     }
-    async setStatus(collection, id, locale, status, by) {
+    async setStatus(collection, id, locale, status, by, expected) {
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
         if (status === "published") {
+            assertFresh(row, expected);
             // Publish points at the current draft; a row always has one after its first write, but never trust that from here.
             if (!row.draftVersionId)
                 this.recordVersion(entry, locale);
@@ -428,10 +439,11 @@ export class MemoryEntryStore {
         this.writeRefs(entry); // the published snapshot just became, or stopped being, a live set
         return this.snapshot(entry);
     }
-    async discardDraft(collection, id, locale, by) {
+    async discardDraft(collection, id, locale, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
+        assertFresh(row, expected);
         const snapshot = row.publishedVersionId ? this.versions.get(row.publishedVersionId) : undefined;
         if (!snapshot)
             throw entryErrors.nothingPublished(collection, id, locale);
@@ -440,6 +452,7 @@ export class MemoryEntryStore {
         row.fields = localized;
         const abandoned = row.draftVersionId;
         row.draftVersionId = row.publishedVersionId;
+        row.draftSavedAt = String(snapshot.savedAt);
         if (abandoned && abandoned !== row.publishedVersionId) {
             this.versions.delete(abandoned);
             this.versionSeq.delete(abandoned);
@@ -462,7 +475,7 @@ export class MemoryEntryStore {
         const now = Date.now();
         entry.locales[locale] = {
             slug: source.slug, status: "draft", fields: structuredClone(source.fields),
-            draftVersionId: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
+            draftVersionId: null, draftSavedAt: null, publishedVersionId: null, updatedAt: now, updatedBy: by ?? null,
         };
         this.recordVersion(entry, locale);
         // Only this node's rows change: a child cannot have a locale its parent lacked.
@@ -510,15 +523,16 @@ export class MemoryEntryStore {
             .sort((a, b) => b.savedAt - a.savedAt || this.versionSeq.get(b.id) - this.versionSeq.get(a.id))
             .map((v) => structuredClone(v));
     }
-    async restore(collection, id, locale, versionId, by) {
+    async restore(collection, id, locale, versionId, by, expected) {
         const schema = this.schema(collection);
         const entry = this.must(collection, id);
         const row = entryLocaleRow(entry, locale);
         const version = this.versions.get(versionId);
         if (!version || version.entryId !== id || version.locale !== locale)
             throw entryErrors.foreignVersion(collection, id, locale, versionId);
+        assertFresh(row, expected);
         if (versionId === row.publishedVersionId)
-            return this.discardDraft(collection, id, locale, by);
+            return this.discardDraft(collection, id, locale, by, expected);
         const { shared, localized } = splitFields(version.fields, schema);
         entry.fields = shared;
         row.fields = localized; // the slug is the row's own and never versioned

package/dist/env.d.ts

@@ -14,3 +14,12 @@ export declare function resolveSmoodlyEnv(env: Record<string, string | undefined
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export declare const smoodlyEnv: () => SmoodlyEnv;
+/** What the browser needs to join the content project's presence channel (spec 2026-09-26 concurrency §5): public values only. */
+export type ContentConfig = {
+    url: string;
+    key: string;
+    spaceId: string;
+};
+/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
+export declare function spaceIdOfKey(key: string): string;
+export declare function publicContentConfig(env: SmoodlyEnv): ContentConfig;

package/dist/env.js

@@ -1,6 +1,7 @@
 // The one config shape (spec 2026-09-04 §4/§6). Self-host sets three
 // names; the cloud sets five. The two defaults are what keep a single
 // code path: a default for an absent value is not a mode branch.
+import { DEFAULT_SPACE_ID } from "./sql-space.js";
 const REQUIRED = ["SMOODLY_URL", "SMOODLY_SECRET_KEY", "SMOODLY_PUBLISHABLE_KEY"];
 export function resolveSmoodlyEnv(env) {
     const missing = REQUIRED.filter((name) => !env[name]);
@@ -20,3 +21,21 @@ export function resolveSmoodlyEnv(env) {
 /** `resolveSmoodlyEnv(process.env)` — call lazily, never at module load,
  *  so `next build` without env still succeeds. */
 export const smoodlyEnv = () => resolveSmoodlyEnv(process.env);
+/** The space a key acts in: its `space_id` claim when it is a JWT that carries one, else the default space. */
+export function spaceIdOfKey(key) {
+    const parts = key.split(".");
+    if (parts.length !== 3)
+        return DEFAULT_SPACE_ID;
+    try {
+        // base64url → base64, padded; atob exists in Node 22 and every browser, so no Buffer here.
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(parts[1].length / 4) * 4, "=");
+        const claims = JSON.parse(atob(b64));
+        return typeof claims.space_id === "string" && claims.space_id ? claims.space_id : DEFAULT_SPACE_ID;
+    }
+    catch {
+        return DEFAULT_SPACE_ID;
+    }
+}
+export function publicContentConfig(env) {
+    return { url: env.url, key: env.publishableKey, spaceId: spaceIdOfKey(env.secretKey) };
+}

package/dist/index.d.ts

@@ -28,6 +28,8 @@ export { z } from "./zones.ts";
 export { defineConfig } from "./config.ts";
 export { collectionSQL, coreTablesSQL } from "./sql.ts";
 export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.ts";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.ts";
+export type { DraftToken, DraftPointerRow } from "./draft-token.ts";
 export { MemoryPageStore } from "./store.ts";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.ts";
 export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, BeginUploadInput, CreateAssetInput } from "./asset-store.ts";
@@ -153,8 +155,8 @@ export declare const smoodly: {
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.ts";
 export type { MarkNode, MarkPath, Marks, Scope } from "./marks.ts";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.ts";
-export type { SmoodlyEnv } from "./env.ts";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.ts";
+export type { SmoodlyEnv, ContentConfig } from "./env.ts";
 export { clientOptions, createSmoodlyClient } from "./client.ts";
 export { createSmoodlySite, pageContextOf } from "./site.ts";
 export type { SiteOptions, SitePage, SitePageSchema, SiteEntry, SiteHit, SmoodlySite, LoadOptions, PageTreeItem, SiteEntryItem, EntryTreeItem, EntryQuery, } from "./site.ts";

package/dist/index.js

@@ -22,6 +22,7 @@ export { z } from "./zones.js";
 export { defineConfig } from "./config.js";
 export { collectionSQL, coreTablesSQL } from "./sql.js";
 export { SCHEMA_VERSION, SCHEMA_VERSION_KEY, schemaVersionSQL, coreFileVersion, schemaBehind, schemaBehindMessage } from "./schema-version.js";
+export { draftToken, sameToken, isDraftToken, assertFresh, StaleDraftError } from "./draft-token.js";
 export { MemoryPageStore } from "./store.js";
 export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDownload, PAGE_SIZE as ASSET_PAGE_SIZE } from "./asset-store.js";
 export { imageDimensions } from "./image-dimensions.js";
@@ -63,6 +64,6 @@ export const smoodly = {
     marks,
 };
 export { NODE_ATTR, ZONE_ATTR, EMPTY_ATTR, BLANK_ATTR, FIELD_ATTR, ITEM_ATTR, EDITOR_ATTR, resolveMarkPath } from "./marks.js";
-export { resolveSmoodlyEnv, smoodlyEnv } from "./env.js";
+export { resolveSmoodlyEnv, smoodlyEnv, publicContentConfig, spaceIdOfKey } from "./env.js";
 export { clientOptions, createSmoodlyClient } from "./client.js";
 export { createSmoodlySite, pageContextOf } from "./site.js";

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 1;
+export declare const SCHEMA_VERSION = 3;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 1;
+export const SCHEMA_VERSION = 3;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/sql-space.d.ts

@@ -15,3 +15,9 @@ export declare function spaceLayerSQL(): string;
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export declare function storageSQL(): string;
+/** The three mutation RPCs are the stores' verbs, never a browser's (spec
+ *  2026-09-26 security pass §2): executable by the service role and by
+ *  `authenticated` (the role a cloud write key carries), not by anon or
+ *  public. `smoodly_current_space` is NOT here — the stores read it through
+ *  rpc(). Last in the schema, after every definition exists. */
+export declare function grantsSQL(): string;

package/dist/sql-space.js

@@ -25,7 +25,7 @@ export function currentSpaceSQL() {
 -- default space in self-host (service role, anon key). Policies, the
 -- insert trigger and the reorder RPC all read this ONE function.
 create or replace function "smoodly_current_space"() returns uuid
-language sql stable as $$
+language sql stable set search_path = '' as $$
   select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
 $$;`.trim();
 }
@@ -90,7 +90,7 @@ alter table "spaces" enable row level security;
 -- ── Claim readers. The two lookups run as definer so they can read the
 -- service-role-only tables from inside a policy; search_path is pinned.
 create or replace function "smoodly_key_kind"() returns text
-language sql stable as $$
+language sql stable set search_path = '' as $$
   select auth.jwt() ->> 'kind';
 $$;
 
@@ -107,12 +107,25 @@ language sql stable security definer set search_path = public as $$
   select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
 $$;
 
+-- The presence gate (spec 2026-09-26 security pass §1): the caller is a
+-- member of the space the Realtime topic names. auth.uid() is the session
+-- token's subject — the anon key and a read key carry none, so a visitor
+-- is refused at join. Definer, because members has no read policy for
+-- anyone but a write key. No space claim is read: the same rule serves
+-- the cloud once the content project accepts smoodly.io's tokens (OQ 32).
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
 -- ── Triggers. A key's claim wins over whatever the insert said, so an
 -- adapter never has to know its space and cannot write into another.
 -- No claim (service role, anon) leaves the given or default value —
 -- that is how smoodly.io writes cloud-state rows for a chosen space.
 create or replace function "smoodly_set_space"() returns trigger
-language plpgsql as $$
+language plpgsql set search_path = '' as $$
 begin
   if auth.jwt() ->> 'space_id' is not null then
     new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
@@ -199,6 +212,19 @@ $$;`.trim());
     statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
         `create policy "smoodly_read" on "smoodly_meta" for select\n` +
         `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
+    // The editing-presence channel (spec 2026-09-26 concurrency §5; gated
+    // 2026-09-26 security pass §1): one private Realtime topic per space,
+    // `space:<id>`. A caller receives on and sends to a topic only when a
+    // members row of that space names their session's user — the browser
+    // authenticates the socket with the editor's session token, never with
+    // the public key alone. Identical in self-host and the cloud.
+    const member = `(select public."smoodly_presence_member"())`;
+    statements.push(`drop policy if exists "smoodly_presence_read" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_read" on "realtime"."messages" for select\n` +
+        `  using (${member});`);
+    statements.push(`drop policy if exists "smoodly_presence_write" on "realtime"."messages";\n` +
+        `create policy "smoodly_presence_write" on "realtime"."messages" for insert\n` +
+        `  with check (${member});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }
@@ -227,3 +253,15 @@ create policy "smoodly_media_write" on storage.objects for all
   using (${write})
   with check (${write});`.trim();
 }
+/** The three mutation RPCs are the stores' verbs, never a browser's (spec
+ *  2026-09-26 security pass §2): executable by the service role and by
+ *  `authenticated` (the role a cloud write key carries), not by anon or
+ *  public. `smoodly_current_space` is NOT here — the stores read it through
+ *  rpc(). Last in the schema, after every definition exists. */
+export function grantsSQL() {
+    return [
+        `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
+        `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
+        `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
+    ].join("\n");
+}

package/dist/sql.js

@@ -11,7 +11,7 @@
 // locale (spec 2026-09-06 §7); a versioned collection reads its
 // fields from the published snapshot.
 import { BUILT_IN_ORDER_FIELDS } from "./collections.js";
-import { currentSpaceSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
+import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
 const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 const q = (s) => `"${s}"`;
 // Casts are fine in views (unlike index expressions, which must be
@@ -111,7 +111,7 @@ create table if not exists "page_locales" (
 );
 
 -- Sibling reorder for pages: same shape as smoodly_reorder for entries.
-create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql set search_path = public as $$
   update "pages" pg set "sort" = u.ord
   from unnest(p_ids) with ordinality as u(id, ord)
   where pg."id" = u.id
@@ -193,6 +193,17 @@ create table if not exists "entry_versions" (
 create index if not exists "entry_versions_entry_locale_idx"
   on "entry_versions" ("entry_id", "locale", "saved_at");
 
+-- ── Draft pointers as foreign keys (schema v2, spec 2026-09-26 concurrency §1):
+-- PostgREST embeds the draft version's saved_at through them, so every
+-- locale row read carries the token. Set null on delete: discard moves
+-- the pointer before it deletes the abandoned row, so nothing dangles.
+alter table "page_locales" drop constraint if exists "page_locales_draft_version_fkey";
+alter table "page_locales" add constraint "page_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "page_versions" ("id") on delete set null;
+alter table "entry_locales" drop constraint if exists "entry_locales_draft_version_fkey";
+alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
+  foreign key ("draft_version_id") references "entry_versions" ("id") on delete set null;
+
 -- v1 reorder (DESIGN.md §3 Manual ordering): rewrite sort 1..N in ONE
 -- statement. Deliberately does not touch updated_at — a drag must not
 -- make the whole collection look freshly edited. Scoped to the current
@@ -200,7 +211,7 @@ create index if not exists "entry_versions_entry_locale_idx"
 create or replace function "smoodly_reorder"(
   p_collection text,
   p_ids uuid[]
-) returns void language sql as $$
+) returns void language sql set search_path = public as $$
   update "entries" e set "sort" = u.ord
   from unnest(p_ids) with ordinality as u(id, ord)
   where e."id" = u.id
@@ -269,7 +280,7 @@ create index if not exists "assets_space_created_idx"
 -- function runs in the caller's transaction, so a primary-key collision
 -- rolls the whole rewrite back. Inserted rows get their space from the
 -- a_set_space trigger (the claim, or the default space).
-create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql set search_path = public as $$
   delete from "paths" p
   using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
   where p."kind" = t.kind and p."target_id" = t.id
@@ -307,5 +318,6 @@ alter table "assets" enable row level security;
 alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
+        grantsSQL(),
     ].join("\n\n");
 }

package/dist/store.d.ts

@@ -4,6 +4,7 @@ import { type RefEdge, type SectionLike } from "./refs.ts";
 import type { Toolset } from "./toolset.ts";
 import type { MemoryRefIndex } from "./ref-index.ts";
 import { type PathIndex } from "./path-index.ts";
+import { type DraftToken } from "./draft-token.ts";
 import { type LocaleSet, type PagePathOptions, type PathTarget } from "./paths.ts";
 export type PageLocale = {
     /** The node's OWN segment in this locale; the URL is derived (paths.ts). */
@@ -11,6 +12,8 @@ export type PageLocale = {
     title: string;
     status: "draft" | "published";
     draftVersionId: string | null;
+    /** The draft version's saved time as the store's own text — the token's second half (spec 2026-09-26 concurrency §1). Null with no pointer. */
+    draftSavedAt: string | null;
     publishedVersionId: string | null;
     updatedAt: number;
     /** The editor's email behind the last write that touched this row; null for the seed and scripts (spec 2026-09-13 history §2). */
@@ -81,18 +84,18 @@ export interface PageStore {
     }): Promise<PageRecord>;
     /** A folder becomes a page: an empty draft version per present locale. */
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** The draft goes back to what is live: the locale's draft pointer set to its
      *  published pointer and the abandoned draft row deleted (spec 2026-09-13 history §1).
      *  Refused when nothing is published in the locale (spec 2026-09-13 publish flow §4). */
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** Takes ONE locale off the site: status draft, both pointers kept so a later
      *  publish republishes the current draft (spec §5). */
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
     /** The version's tree becomes the draft through the draft rule (spec 2026-09-13 history §6); the
      *  published version restores as a discard. Refused when the version is not this page's in this locale. */
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     /** One stored version by id, whoever it belongs to — callers check `pageId` and `locale`. */
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
@@ -210,11 +213,11 @@ export declare class MemoryPageStore implements PageStore {
         index?: number;
     }): Promise<PageRecord>;
     setTemplate(id: string, template: string, by?: string): Promise<PageRecord>;
-    saveDraft(id: string, locale: string, tree: PageTree, by?: string): Promise<PageVersion>;
-    publish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    discardDraft(id: string, locale: string, by?: string): Promise<PageRecord>;
+    saveDraft(id: string, locale: string, tree: PageTree, by?: string, expected?: DraftToken | null): Promise<PageVersion>;
+    publish(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
+    discardDraft(id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     unpublish(id: string, locale: string, by?: string): Promise<PageRecord>;
-    restore(id: string, locale: string, versionId: string, by?: string): Promise<PageRecord>;
+    restore(id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<PageRecord>;
     getVersion(versionId: string): Promise<PageVersion | null>;
     getDraftTree(id: string, locale: string): Promise<PageTree | null>;
     fieldsOf(versionIds: string[]): Promise<Record<string, Record<string, unknown>>>;