smoodly 0.0.33 → 0.0.35

package/dist/paths.js

@@ -1,7 +1,3 @@
-// The one place a URL is derived (spec 2026-09-05 §1, §4; spec
-// 2026-09-06 §3, §7). Pure and framework-free: both store adapters and
-// the tree query call these, so the `paths` index and every derived
-// `path` value agree by construction.
 export const SEGMENT_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 export const isSegment = (s) => SEGMENT_RE.test(s);
 export function assertSegment(s, what) {
@@ -47,13 +43,31 @@ export function perLocaleSegments(value, supported) {
  *  (spec 2026-09-06 §3). The boot collision check (config.ts), the
  *  materializer (admin/fixed-nodes.ts) and the fixed path derivation
  *  (localize.ts) all fill through here, or a collision passes boot and
- *  only surfaces at materialization. Collection mounts are NOT filled:
- *  a per-locale path claims exactly the locales it names. */
+ *  only surfaces at materialization. Collection paths fill the same way
+ *  (addresses.ts): their entries take the default path in a locale the
+ *  path omits (collectionSegment), so the address is claimed there too. */
 export function fixedPageSegments(slug, locales) {
     const raw = perLocaleSegments(slug, locales.supported);
     return Object.fromEntries(locales.supported.map((l) => [l, raw[l] || raw[locales.default]]));
 }
 export const joinPath = (segments) => (segments.length === 0 ? "/" : "/" + segments.join("/"));
+/** A request's segment or a typed address's, as stored: percent-decoded and NFC-composed, so
+ *  a pasted `%C3%A4`, a typed `ä` and a decomposed `a\u0308` are one address. Next hands the
+ *  catch-all its segments still encoded. A stray `%` that is no escape stays as it is, and so
+ *  does a segment holding an encoded slash: decoded, it would become two segments and make
+ *  `/a%2Fb` an alias of `/a/b`. Slugs are ASCII, so this changes nothing a slug path holds. */
+export function decodeSegment(segment) {
+    let out = segment;
+    try {
+        const decoded = decodeURIComponent(segment);
+        if (!decoded.includes("/"))
+            out = decoded;
+    }
+    catch {
+        // not an escape sequence: looked up as typed
+    }
+    return out.normalize("NFC");
+}
 export const splitPath = (path) => path.split("/").filter((s) => s.length > 0);
 /** The node's segment in one locale. An absent locale is an error, never
  *  a fallback: the stores' parent rule guarantees a present node has a
@@ -83,28 +97,56 @@ export function assertDepth(depth, max, what) {
 /** Home is judged by identity: the root node whose DEFAULT-locale slug is
  *  homePageSlug serves "/" in every locale it exists in. */
 export const isHomeNode = (node, opts) => node.parentId === null && node.locales[opts.locales.default]?.slug === opts.homePageSlug;
+/** A code-owned root's address parts in the locale from the config; null
+ *  when no registration claims it there any more (an orphan). */
+function addressParts(root, locale, opts) {
+    const address = opts.addresses?.[root.fixed]?.[locale];
+    return address === undefined ? null : address.split("/");
+}
 /** The node's path in one locale: `/` for the home node, else the
- *  locale's ancestor chain joined. THE derivation — pagePathRows,
+ *  locale's ancestor chain joined. A code-owned root's path is its
+ *  address (spec 2026-09-29). THE derivation — pagePathRows,
  *  buildPageTree and the site layer all call this. */
 export function pagePath(node, byId, locale, opts) {
-    return isHomeNode(node, opts) ? "/" : joinPath(chainOf(node, byId).map((n) => segmentFor(n, locale)));
+    if (isHomeNode(node, opts))
+        return "/";
+    const [root, ...rest] = chainOf(node, byId);
+    const own = segmentFor(root, locale); // an absent root is a broken invariant, code-owned or not
+    const head = root.fixed ? addressParts(root, locale, opts) : [own];
+    if (head === null)
+        throw new Error(`smoodly: page "${node.id}" has no address in locale "${locale}".`);
+    return joinPath([...head, ...rest.map((n) => segmentFor(n, locale))]);
 }
 /** The same path, or null when the node or an ancestor is absent from the
- *  locale — what the Pages list shows as a dimmed "not in fi" row. */
+ *  locale — what the Pages list shows as a dimmed "not in fi" row — or
+ *  when its code-owned root has no address there. */
 export function pagePathIn(node, byId, locale, opts) {
     if (!node.locales[locale])
         return null;
     if (isHomeNode(node, opts))
         return "/";
     const chain = chainOf(node, byId);
-    return chain.every((n) => n.locales[locale] !== undefined) ? joinPath(chain.map((n) => n.locales[locale].slug)) : null;
+    if (!chain.every((n) => n.locales[locale] !== undefined))
+        return null;
+    const [root, ...rest] = chain;
+    const head = root.fixed ? addressParts(root, locale, opts) : [root.locales[locale].slug];
+    return head === null ? null : joinPath([...head, ...rest.map((n) => n.locales[locale].slug)]);
 }
-/** One row per locale the target EXISTS in. */
+/** One row per locale the target EXISTS in (spec 2026-09-29 anchored paths §3): under a code-owned root, the root's
+ *  owner key and the chain below it (`''` for the root itself); in the editors' tree, no anchor and the full path. */
 export function pagePathRows(targets, byId, opts) {
     const rows = [];
     for (const target of targets) {
+        const chain = chainOf(target, byId);
+        const root = chain[0];
         for (const locale of Object.keys(target.locales)) {
-            rows.push({ kind: "page", id: target.id, locale, path: pagePath(target, byId, locale, opts) });
+            if (root.fixed) {
+                const below = chain.slice(1).map((n) => segmentFor(n, locale));
+                rows.push({ kind: "page", id: target.id, locale, anchor: root.fixed, path: below.length === 0 ? "" : joinPath(below) });
+            }
+            else {
+                rows.push({ kind: "page", id: target.id, locale, anchor: "", path: pagePath(target, byId, locale, opts) });
+            }
         }
     }
     return rows;
@@ -131,22 +173,18 @@ export const slugOf = (fields) => {
 export function entrySegment(entry, locale) {
     return entry.locales[locale]?.slug ?? null;
 }
-/** One row per locale the target EXISTS in, where the whole chain has a
- *  segment in that locale. The stores' parent rule guarantees an ancestor
- *  is present wherever a descendant is; an ancestor without a slug there
- *  simply yields no URL for the subtree in that locale. */
-export function entryPathRows(targets, byId, collection, set) {
+/** One row per locale the target EXISTS in, where the whole chain has a slug there, under the collection's anchor
+ *  (spec 2026-09-29 anchored paths §1): written whether or not the collection has a `path`, which the index reads. */
+export function entryPathRows(targets, byId, collection) {
+    // `collection:<name>` is addresses.ts's collectionKey, spelled here: addresses.ts imports this module.
     const rows = [];
     for (const target of targets) {
         const chain = chainOf(target, byId);
         for (const locale of Object.keys(target.locales)) {
-            const base = collectionSegment(collection.path, locale, set);
-            if (base === null)
-                continue;
             const segments = chain.map((e) => entrySegment(e, locale));
             if (segments.some((s) => s === null))
                 continue;
-            rows.push({ kind: "entry", id: target.id, locale, path: joinPath([base, ...segments]) });
+            rows.push({ kind: "entry", id: target.id, locale, anchor: `collection:${collection}`, path: joinPath(segments) });
         }
     }
     return rows;

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 4;
+export declare const SCHEMA_VERSION = 6;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 4;
+export const SCHEMA_VERSION = 6;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/site.d.ts

@@ -27,14 +27,18 @@ export type SiteOptions = {
     styles?: StyleValuesInput;
     /** The custom section's options (spec 2026-09-14 §6); the defaults when absent. */
     custom?: CustomConfigInput;
-    /** Page shapes (entry pages are ignored): the source of each template's page-field descriptors (spec 2026-09-10 page fields §3). */
-    pages?: ReadonlyArray<SitePageSchema>;
+    /** Page shapes (entry pages are ignored): the source of each template's page-field descriptors (spec 2026-09-10 page fields §3)
+     *  and of the fixed pages' addresses (spec 2026-09-29 nested paths §3) — `config.registry.pages`. Required: a site that
+     *  missed one would take its code-owned record for an orphan and drop its URLs at the first lookup. */
+    pages: ReadonlyArray<SitePageSchema>;
 };
-/** A page registration as the site needs it: the template's page fields. */
+/** A page registration as the site needs it: the template's page fields, and a fixed page's address. */
 export type SitePageSchema = {
     schema: {
         kind: string;
         name: string;
+        title?: string;
+        slug?: string | Record<string, string>;
         fields?: Record<string, Descriptor>;
     };
 };

package/dist/site.js

@@ -6,6 +6,8 @@ import { globalNodeId, SETTINGS_KEY, STYLES_KEY, CSS_KEY } from "./global.js";
 import { SMD_KEY } from "./section-wrapper.js";
 import { resolveStyleValues } from "./styles.js";
 import { resolveCustom } from "./custom/index.js";
+import { addressMap, codeAddresses } from "./addresses.js";
+import { fullPath, servedAnchor } from "./anchors.js";
 import { withDefaults } from "./field-defaults.js";
 /** The `page` prop for a loaded page. `href` is the app's seam from a
  *  locale-relative path to a site URL; the default keeps CMS paths as URLs. */
@@ -29,7 +31,11 @@ export function createSmoodlySite(options) {
     const styles = resolveStyleValues(options.styles);
     const custom = resolveCustom(options.custom);
     const elements = elementSchemas(options.elements);
-    const pathOpts = { locales, homePageSlug };
+    // Code-owned addresses from the site's own registry (spec 2026-09-29 nested paths §3): a code-owned root's path.
+    const addresses = addressMap(codeAddresses({ locales, pages: options.pages, collections: options.collections }));
+    const pathOpts = { locales, homePageSlug, addresses };
+    /** The same addresses as the path index sees them: an entry's stored part joined to its collection's (spec 2026-09-29 anchored paths §2). */
+    const anchors = { addresses, homePageSlug, defaultLocale: locales.default };
     const mounted = options.collections.filter((c) => c.path !== undefined);
     /** The resolver's fetcher, bound to a locale: the merged fields of that
      *  locale — published ones (a versioned collection's snapshot) on the
@@ -184,8 +190,11 @@ export function createSmoodlySite(options) {
         return wanted
             .filter((record) => fieldsById[record.id] !== undefined)
             .map((record) => {
-            const rows = entryPathRows([record], byId, schema, locales);
-            const pathIn = (l) => rows.find((r) => r.locale === l)?.path ?? null;
+            const rows = entryPathRows([record], byId, schema.name);
+            const pathIn = (l) => {
+                const row = rows.find((r) => r.locale === l);
+                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
+            };
             return {
                 entry: { ...record, fields: fieldsById[record.id] },
                 path: pathIn(locale),
@@ -243,18 +252,20 @@ export function createSmoodlySite(options) {
             const shown = all.filter((n) => visible(n, locale, draft));
             const index = new Map(shown.map((n) => [n.id, n]));
             const fields = await linkFields(shown, locale, draft);
-            const toItem = (node) => ({
-                id: node.record.id,
-                title: node.record.locales[locale].title,
-                // Every node the walk reaches is present with a present chain, so
-                // buildPageTree's nullable path is never null here; pagePath is
-                // the same derivation and keeps the type honest.
-                path: node.path ?? pagePath(node.record, (x) => index.get(x), locale, pathOpts),
-                hasPage: hasPage(node.record, locale, draft),
-                fields: fields.get(node.record.id) ?? {},
-                children: node.children.map(toItem),
-            });
-            return buildPageTree(shown, locale, pathOpts).map(toItem);
+            // Every node the walk reaches is present with a present chain. Left
+            // out, with its subtree: a record no longer in code (no path, spec
+            // 2026-09-29 nested paths §5), and a page where another code address
+            // wins, which visitors never reach (anchored paths §4).
+            const hidden = (node) => node.path === null || servedAnchor(anchors, locale, node.path) !== (chainOf(node.record, (x) => index.get(x))[0].fixed ?? "");
+            const toItems = (nodes) => nodes.flatMap((node) => hidden(node) ? [] : [{
+                    id: node.record.id,
+                    title: node.record.locales[locale].title,
+                    path: node.path,
+                    hasPage: hasPage(node.record, locale, draft),
+                    fields: fields.get(node.record.id) ?? {},
+                    children: toItems(node.children),
+                }]);
+            return toItems(buildPageTree(shown, locale, pathOpts));
         },
         async getPage(pathOrId, o) {
             const locale = localeOf(o);

package/dist/space-transfer.d.ts

@@ -46,6 +46,8 @@ export declare function insertPlan(rows: TableRows): {
 export declare function brokenReferences(rows: TableRows): string[];
 /** The import's target check (spec §9.1): per table, how many of the target's row keys this export does not hold. All zero = empty, or an earlier run. */
 export declare function foreignRows(target: Record<ContentTable, string[]>, exported: TableRows): Record<ContentTable, number>;
+/** The export's rows the target does not hold yet: zero on a re-run of a finished import. */
+export declare function missingRows(target: Record<ContentTable, string[]>, exported: TableRows): number;
 export declare const countRows: (rows: TableRows) => Record<ContentTable, number>;
 export declare function formatBytes(n: number): string;
 /** "14 pages (41 versions), 32 entries (118 versions), 51 assets (38.2 MB), 9 redirects" (spec §8.5). */

package/dist/space-transfer.js

@@ -23,7 +23,7 @@ export const ROW_KEY = {
     entry_locales: ["entry_id", "locale"],
     entry_versions: ["id"],
     refs: ["source_kind", "source_id", "source_field", "target_id"],
-    paths: ["locale", "path"],
+    paths: ["locale", "anchor", "path"],
     assets: ["id"],
 };
 /** The primary key as Postgres declares it — what "on conflict do nothing" names. */
@@ -116,6 +116,13 @@ export function foreignRows(target, exported) {
         return [table, target[table].filter((key) => !own.has(key)).length];
     }));
 }
+/** The export's rows the target does not hold yet: zero on a re-run of a finished import. */
+export function missingRows(target, exported) {
+    return CONTENT_TABLES.reduce((n, table) => {
+        const held = new Set(target[table]);
+        return n + exported[table].filter((row) => !held.has(rowKey(table, row))).length;
+    }, 0);
+}
 export const countRows = (rows) => Object.fromEntries(CONTENT_TABLES.map((t) => [t, rows[t].length]));
 const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 const listJoin = (items) => (items.length <= 1 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`);

package/dist/sql-space.d.ts

@@ -7,6 +7,17 @@ export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0
 export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths", "assets"];
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 export declare function currentSpaceSQL(): string;
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export declare function writePoliciesSQL(table: string, write: string, prefix: string): string;
+/** The content tables' and members' policies. A table with a public read
+ *  has ONE select policy — its own space, not revoked, and a write key or
+ *  the published condition — and split write policies. A table without
+ *  one (refs, members) keeps its `for all` write policy, which is also its
+ *  only select. */
+export declare function contentPoliciesSQL(): string;
 export declare function spaceLayerSQL(): string;
 /** The media bucket and its object policies (spec 2026-09-08 media §3,
  *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
@@ -15,6 +26,9 @@ export declare function spaceLayerSQL(): string;
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export declare function storageSQL(): string;
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export declare function mediaPoliciesSQL(): string;
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
  *  `authenticated` (the role a cloud write key carries), not by anon or

package/dist/sql-space.js

@@ -49,6 +49,43 @@ const PUBLISHED_READ = {
 const NEEDS_SPACE_INDEX = [
     "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
 ];
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export function writePoliciesSQL(table, write, prefix) {
+    return [
+        `drop policy if exists "${prefix}_write" on ${table};`,
+        `drop policy if exists "${prefix}_insert" on ${table};\ncreate policy "${prefix}_insert" on ${table} for insert\n  with check (${write});`,
+        `drop policy if exists "${prefix}_update" on ${table};\ncreate policy "${prefix}_update" on ${table} for update\n  using (${write})\n  with check (${write});`,
+        `drop policy if exists "${prefix}_delete" on ${table};\ncreate policy "${prefix}_delete" on ${table} for delete\n  using (${write});`,
+    ].join("\n\n");
+}
+const OWN = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
+const WRITE = `${OWN} and (select "smoodly_key_kind"()) = 'write'`;
+/** The content tables' and members' policies. A table with a public read
+ *  has ONE select policy — its own space, not revoked, and a write key or
+ *  the published condition — and split write policies. A table without
+ *  one (refs, members) keeps its `for all` write policy, which is also its
+ *  only select. */
+export function contentPoliciesSQL() {
+    const statements = [];
+    for (const table of [...CONTENT_TABLES, "members"]) {
+        const published = PUBLISHED_READ[table];
+        if (published === null) {
+            statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
+                `create policy "smoodly_write" on "${table}" for all\n` +
+                `  using (${WRITE})\n` +
+                `  with check (${WRITE});`);
+            continue;
+        }
+        statements.push(writePoliciesSQL(`"${table}"`, WRITE, "smoodly"));
+        statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
+            `create policy "smoodly_read" on "${table}" for select\n` +
+            `  using (${OWN} and ((select "smoodly_key_kind"()) = 'write' or ${published}));`);
+    }
+    return statements.join("\n\n");
+}
 export function spaceLayerSQL() {
     const statements = [];
     statements.push(`
@@ -185,21 +222,9 @@ $$;`.trim());
     // an InitPlan, evaluated once per statement rather than once per row
     // — needed for smoodly_space_key_revoked, a security definer function
     // Postgres never inlines; applied to all three calls for the same win.
-    const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
-    const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
-    for (const table of [...CONTENT_TABLES, "members"]) {
-        statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
-            `create policy "smoodly_write" on "${table}" for all\n` +
-            `  using (${write})\n` +
-            `  with check (${write});`);
-        const published = PUBLISHED_READ[table];
-        if (published !== null) {
-            const predicate = `${own}${published ? ` and ${published}` : ""}`;
-            statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
-                `create policy "smoodly_read" on "${table}" for select\n` +
-                `  using (${predicate});`);
-        }
-    }
+    const own = OWN;
+    const write = WRITE;
+    statements.push(contentPoliciesSQL());
     // A write key reads its own space's row — the console URL the Members
     // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
     // space_keys but the two definer functions and the service role.
@@ -235,10 +260,6 @@ $$;`.trim());
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export function storageSQL() {
-    const write = `"bucket_id" = 'media'` +
-        ` and (select public."smoodly_key_kind"()) = 'write'` +
-        ` and not (select public."smoodly_space_key_revoked"())` +
-        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
     return `
 insert into storage.buckets ("id", "name", "public", "file_size_limit")
   values ('media', 'media', true, 104857600)
@@ -248,10 +269,16 @@ drop policy if exists "smoodly_media_read" on storage.objects;
 create policy "smoodly_media_read" on storage.objects for select
   using ("bucket_id" = 'media');
 
-drop policy if exists "smoodly_media_write" on storage.objects;
-create policy "smoodly_media_write" on storage.objects for all
-  using (${write})
-  with check (${write});`.trim();
+${mediaPoliciesSQL()}`.trim();
+}
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export function mediaPoliciesSQL() {
+    const write = `"bucket_id" = 'media'` +
+        ` and (select public."smoodly_key_kind"()) = 'write'` +
+        ` and not (select public."smoodly_space_key_revoked"())` +
+        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
+    return writePoliciesSQL("storage.objects", write, "smoodly_media");
 }
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
@@ -263,5 +290,6 @@ export function grantsSQL() {
         `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
+        `revoke execute on function "smoodly_space_row_cap"() from public, anon;`,
     ].join("\n");
 }

package/dist/sql.d.ts

@@ -1,3 +1,8 @@
 import { type CollectionSchema } from "./collections.ts";
 export declare function collectionSQL(collection: CollectionSchema<any>): string;
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export declare function foreignKeyIndexesSQL(): string;
 export declare function coreTablesSQL(): string;

package/dist/sql.js

@@ -69,6 +69,21 @@ export function collectionSQL(collection) {
     }
     return statements.join("\n\n");
 }
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export function foreignKeyIndexesSQL() {
+    return [
+        `create index if not exists "page_locales_draft_version_idx" on "page_locales" ("draft_version_id");`,
+        `create index if not exists "entry_locales_draft_version_idx" on "entry_locales" ("draft_version_id");`,
+        `create index if not exists "page_locales_published_version_idx" on "page_locales" ("published_version_id");`,
+        `create index if not exists "entry_locales_published_version_idx" on "entry_locales" ("published_version_id");`,
+        `create index if not exists "pages_parent_id_idx" on "pages" ("parent_id");`,
+        `create index if not exists "entries_parent_id_idx" on "entries" ("parent_id");`,
+        `create index if not exists "assets_poster_idx" on "assets" ("poster_id");`,
+    ].join("\n");
+}
 export function coreTablesSQL() {
     return [
         // The trigger/policy blocks below drop-before-create so the migration is
@@ -83,6 +98,7 @@ create table if not exists "pages" (
   "parent_id" uuid references "pages" ("id") on delete restrict,
   "template" text,
   "sort" numeric,
+  "fixed" text,
   "created_at" timestamptz not null default now(),
   "updated_at" timestamptz not null default now()
 );
@@ -96,6 +112,12 @@ create table if not exists "pages" (
 create index if not exists "pages_parent_idx"
   on "pages" ("space_id", "parent_id", "sort");
 
+-- The registration that owns a code-owned record (spec 2026-09-29 nested
+-- paths §3): "collection:<name>" or "page:<name>"; null = an editor's
+-- page. Its path is its address from the config, not its slug chain.
+create unique index if not exists "pages_fixed_idx"
+  on "pages" ("space_id", "fixed") where "fixed" is not null;
+
 create table if not exists "page_locales" (
   ${SPACE_COL},
   "page_id" uuid not null references "pages" ("id") on delete cascade,
@@ -238,14 +260,18 @@ create table if not exists "refs" (
 -- A row with "redirect" set is an old address of its target (spec
 -- 2026-09-26 redirects §2): the same primary key, so a redirect can never
 -- sit where a live URL is and a live row taking the address replaces it.
+-- "anchor" names the code address a row hangs under (spec 2026-09-29
+-- anchored paths): "path" is only the part editors made, and the address
+-- itself lives in the config; '' is the editors' own tree.
 create table if not exists "paths" (
   ${SPACE_COL},
   "locale" text not null,
+  "anchor" text not null default '',
   "path" text not null,
   "kind" text not null check ("kind" in ('page', 'entry')),
   "target_id" uuid not null,
   "redirect" boolean not null default false,
-  primary key ("space_id", "locale", "path")
+  primary key ("space_id", "locale", "anchor", "path")
 );
 
 create index if not exists "paths_target_idx"
@@ -285,29 +311,45 @@ create index if not exists "assets_space_created_idx"
 -- rolls the whole rewrite back. Inserted rows get their space from the
 -- a_set_space trigger (the claim, or the default space).
 -- A target may name redirect_locales: its old live rows there stay as redirects.
+-- A row carries "keys": every (anchor, path) that yields its full URL, from
+-- the config's addresses (spec 2026-09-29 anchored paths §2). A redirect at
+-- any of them goes (live wins, a redirect by hand has no anchor), and an old
+-- row at one is the same address moving between anchors, never a redirect.
 create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql set search_path = public as $$
   delete from "paths" p
-  using jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid)
-  where p."redirect" and p."locale" = r.locale and p."path" = r.path
+  using jsonb_to_recordset(p_rows) as r(locale text, anchor text, path text, kind text, id uuid, keys jsonb)
+  where p."redirect" and p."locale" = r.locale
+    and exists (select 1 from jsonb_to_recordset(r.keys) as k(anchor text, path text) where k.anchor = p."anchor" and k.path = p."path")
     and p."space_id" = "smoodly_current_space"();
   update "paths" p set "redirect" = true
   from jsonb_to_recordset(p_targets) as t(kind text, id uuid, redirect_locales text[])
   where not p."redirect" and p."kind" = t.kind and p."target_id" = t.id
     and p."locale" = any (coalesce(t.redirect_locales, '{}'::text[]))
-    and not exists (select 1 from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid)
-                    where r.locale = p."locale" and r.path = p."path")
+    and not exists (select 1 from jsonb_to_recordset(p_rows) as r(locale text, anchor text, path text, kind text, id uuid, keys jsonb)
+                    cross join lateral jsonb_to_recordset(r.keys) as k(anchor text, path text)
+                    where r.locale = p."locale" and k.anchor = p."anchor" and k.path = p."path")
     and p."space_id" = "smoodly_current_space"();
   delete from "paths" p
   using jsonb_to_recordset(p_targets) as t(kind text, id uuid, redirect_locales text[])
   where p."kind" = t.kind and p."target_id" = t.id
-    and (not p."redirect" or not exists (select 1 from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid)
+    and (not p."redirect" or not exists (select 1 from jsonb_to_recordset(p_rows) as r(locale text, anchor text, path text, kind text, id uuid)
                                           where r.kind = p."kind" and r.id = p."target_id" and r.locale = p."locale"))
     and p."space_id" = "smoodly_current_space"();
-  insert into "paths" ("locale", "path", "kind", "target_id")
-  select r.locale, r.path, r.kind, r.id
-  from jsonb_to_recordset(p_rows) as r(locale text, path text, kind text, id uuid);
+  insert into "paths" ("locale", "anchor", "path", "kind", "target_id")
+  select r.locale, r.anchor, r.path, r.kind, r.id
+  from jsonb_to_recordset(p_rows) as r(locale text, anchor text, path text, kind text, id uuid);
 $$;
 
+-- One call reads every candidate (anchor, path) of a request (spec
+-- 2026-09-29 anchored paths §2); the caller picks by precedence. Invoker
+-- rights: the paths read policy applies, as to a plain select.
+create or replace function "smoodly_resolve_path"(p_locale text, p_keys jsonb) returns setof "paths" language sql stable set search_path = public as $$
+  select p.* from "paths" p
+  join jsonb_to_recordset(p_keys) as k(anchor text, path text) on p."anchor" = k.anchor and p."path" = k.path
+  where p."locale" = p_locale;
+$$;`.trim(),
+        foreignKeyIndexesSQL(),
+        `
 -- RLS on every core table. The service role bypasses it (self-host
 -- adapters untouched). The policy set that follows (space layer) admits
 -- a key to its own space: everything for a write key, published rows for

package/dist/store.d.ts

@@ -1,5 +1,7 @@
 import type { PageTree } from "./render.tsx";
 import type { EntryStore } from "./entry-store.ts";
+import type { Addresses } from "./addresses.ts";
+import type { Anchors } from "./anchors.ts";
 import { type RefEdge, type SectionLike } from "./refs.ts";
 import type { Toolset } from "./toolset.ts";
 import type { MemoryRefIndex } from "./ref-index.ts";
@@ -25,6 +27,8 @@ export type PageRecord = {
     /** null = folder: a node with a title and a position but no page behind it. */
     template: string | null;
     sort: number | null;
+    /** The owner key when code owns the record (spec 2026-09-29 nested paths §3); absent/null = an editor's page. */
+    fixed?: string | null;
     /** One entry per locale the page exists in. */
     locales: Record<string, PageLocale>;
 };
@@ -35,6 +39,8 @@ export type CreatePageInput = {
     template: string | null;
     title?: string;
     parentId?: string | null;
+    /** The owner key; only the materializer and seeds pass it. The record must be a root. */
+    fixed?: string;
 };
 /** `from` names the locale whose draft tree, title and slug are copied;
  *  `slug` and `title` override the copies (the materializer's per-locale
@@ -146,12 +152,16 @@ export type PageStoreOptions = {
     tree?: {
         depth: number;
     };
+    /** Code-owned addresses by owner key (config.addresses): a code-owned record's path. */
+    addresses?: Addresses;
 };
 export declare const DEFAULT_LOCALES: LocaleSet;
 /** The section list every adapter walks refs with: the registered ones plus the custom section's schema (spec 2026-09-14 §6). */
 /** Group an index's redirect rows by locale, paths sorted. */
 export declare function groupRedirects(rows: PathRow[]): Record<string, string[]>;
 export declare function refSections(options: PageStoreOptions): SectionLike[] | undefined;
+/** The anchors a store's own index reads when none is shared (spec 2026-09-29 anchored paths §2). */
+export declare function storeAnchors(options: PageStoreOptions): Anchors;
 /** The options every adapter resolves the same way. */
 export declare function pathOptions(options: PageStoreOptions): PagePathOptions & {
     depth: number;
@@ -174,6 +184,8 @@ export declare const pageErrors: {
     localeInUse: (locale: string, titles: string[]) => Error;
     moveLocales: (locale: string) => Error;
     foreignVersion: (id: string, locale: string, versionId: string) => Error;
+    fixedTaken: (key: string) => Error;
+    fixedAtRoot: () => Error;
 };
 export { assertSupportedLocale } from "./paths.ts";
 /** The page's row for a locale — the "does not exist in locale" guard every per-locale write runs. */
@@ -206,7 +218,9 @@ export declare class MemoryPageStore implements PageStore {
     private hasChildren;
     private siblings;
     /** Sibling slugs are unique per parent PER LOCALE — a friendlier error
-     *  than the path index's, which stays the real invariant. */
+     *  than the path index's, which stays the real invariant. Code-owned
+     *  roots are left out: their path is their address, and the path index
+     *  guards it (spec 2026-09-29 nested paths §3). */
     private assertSlugFree;
     private subtree;
     private writePaths;