smoodly 0.0.34 → 0.0.35

package/dist/sql.js

@@ -69,6 +69,21 @@ export function collectionSQL(collection) {
     }
     return statements.join("\n\n");
 }
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export function foreignKeyIndexesSQL() {
+    return [
+        `create index if not exists "page_locales_draft_version_idx" on "page_locales" ("draft_version_id");`,
+        `create index if not exists "entry_locales_draft_version_idx" on "entry_locales" ("draft_version_id");`,
+        `create index if not exists "page_locales_published_version_idx" on "page_locales" ("published_version_id");`,
+        `create index if not exists "entry_locales_published_version_idx" on "entry_locales" ("published_version_id");`,
+        `create index if not exists "pages_parent_id_idx" on "pages" ("parent_id");`,
+        `create index if not exists "entries_parent_id_idx" on "entries" ("parent_id");`,
+        `create index if not exists "assets_poster_idx" on "assets" ("poster_id");`,
+    ].join("\n");
+}
 export function coreTablesSQL() {
     return [
         // The trigger/policy blocks below drop-before-create so the migration is
@@ -332,8 +347,9 @@ create or replace function "smoodly_resolve_path"(p_locale text, p_keys jsonb) r
   select p.* from "paths" p
   join jsonb_to_recordset(p_keys) as k(anchor text, path text) on p."anchor" = k.anchor and p."path" = k.path
   where p."locale" = p_locale;
-$$;
-
+$$;`.trim(),
+        foreignKeyIndexesSQL(),
+        `
 -- RLS on every core table. The service role bypasses it (self-host
 -- adapters untouched). The policy set that follows (space layer) admits
 -- a key to its own space: everything for a write key, published rows for

package/migrations/20260929135523_smoodly_v6.sql

@@ -0,0 +1,200 @@
+-- Smoodly core schema, version 6 (docs/superpowers/specs/2026-09-29-pre-install-fixes-design.md §3).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 5: one permissive policy per table and action (the
+-- write key reads through smoodly_read; smoodly_write splits into insert,
+-- update and delete where a public read exists; the media pair the same),
+-- indexes on the foreign keys without one, and no anon call of the row cap.
+-- Access is unchanged.
+
+set client_min_messages = warning;
+
+create index if not exists "page_locales_draft_version_idx" on "page_locales" ("draft_version_id");
+create index if not exists "entry_locales_draft_version_idx" on "entry_locales" ("draft_version_id");
+create index if not exists "page_locales_published_version_idx" on "page_locales" ("published_version_id");
+create index if not exists "entry_locales_published_version_idx" on "entry_locales" ("published_version_id");
+create index if not exists "pages_parent_id_idx" on "pages" ("parent_id");
+create index if not exists "entries_parent_id_idx" on "entries" ("parent_id");
+create index if not exists "assets_poster_idx" on "assets" ("poster_id");
+
+drop policy if exists "smoodly_write" on "pages";
+
+drop policy if exists "smoodly_insert" on "pages";
+create policy "smoodly_insert" on "pages" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "pages";
+create policy "smoodly_update" on "pages" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "pages";
+create policy "smoodly_delete" on "pages" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published')));
+
+drop policy if exists "smoodly_write" on "page_locales";
+
+drop policy if exists "smoodly_insert" on "page_locales";
+create policy "smoodly_insert" on "page_locales" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "page_locales";
+create policy "smoodly_update" on "page_locales" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "page_locales";
+create policy "smoodly_delete" on "page_locales" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'published'));
+
+drop policy if exists "smoodly_write" on "page_versions";
+
+drop policy if exists "smoodly_insert" on "page_versions";
+create policy "smoodly_insert" on "page_versions" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "page_versions";
+create policy "smoodly_update" on "page_versions" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "page_versions";
+create policy "smoodly_delete" on "page_versions" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id")));
+
+drop policy if exists "smoodly_write" on "entries";
+
+drop policy if exists "smoodly_insert" on "entries";
+create policy "smoodly_insert" on "entries" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entries";
+create policy "smoodly_update" on "entries" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entries";
+create policy "smoodly_delete" on "entries" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published')));
+
+drop policy if exists "smoodly_write" on "entry_locales";
+
+drop policy if exists "smoodly_insert" on "entry_locales";
+create policy "smoodly_insert" on "entry_locales" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entry_locales";
+create policy "smoodly_update" on "entry_locales" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entry_locales";
+create policy "smoodly_delete" on "entry_locales" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'published'));
+
+drop policy if exists "smoodly_write" on "entry_versions";
+
+drop policy if exists "smoodly_insert" on "entry_versions";
+create policy "smoodly_insert" on "entry_versions" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entry_versions";
+create policy "smoodly_update" on "entry_versions" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entry_versions";
+create policy "smoodly_delete" on "entry_versions" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")));
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+
+drop policy if exists "smoodly_insert" on "paths";
+create policy "smoodly_insert" on "paths" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "paths";
+create policy "smoodly_update" on "paths" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "paths";
+create policy "smoodly_delete" on "paths" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or (("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))));
+
+drop policy if exists "smoodly_write" on "assets";
+
+drop policy if exists "smoodly_insert" on "assets";
+create policy "smoodly_insert" on "assets" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "assets";
+create policy "smoodly_update" on "assets" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "assets";
+create policy "smoodly_delete" on "assets" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'ready'));
+
+drop policy if exists "smoodly_write" on "members";
+create policy "smoodly_write" on "members" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+
+drop policy if exists "smoodly_media_insert" on storage.objects;
+create policy "smoodly_media_insert" on storage.objects for insert
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_media_update" on storage.objects;
+create policy "smoodly_media_update" on storage.objects for update
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text)
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_media_delete" on storage.objects;
+create policy "smoodly_media_delete" on storage.objects for delete
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+revoke execute on function "smoodly_space_row_cap"() from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '6')
+  on conflict ("key") do update set "value" = excluded."value";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.34",
+  "version": "0.0.35",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {
@@ -43,10 +43,6 @@
       "types": "./dist/admin/next/index.d.ts",
       "default": "./dist/admin/next/index.js"
     },
-    "./bridge": {
-      "types": "./dist/admin/next/bridge.d.ts",
-      "default": "./dist/admin/next/bridge.js"
-    },
     "./migrations": {
       "types": "./dist/migrations.d.ts",
       "default": "./dist/migrations.js"