smoodly 0.0.34 → 0.0.36

package/dist/seo.d.ts

@@ -0,0 +1,18 @@
+import type { Descriptor } from "./fields.ts";
+import type { Seo } from "./read-shapes.ts";
+/** The reserved key an entry's SEO values live under; a collection may not declare a field of this name. */
+export declare const SEO_KEY = "$seo";
+/** `seo: true` falls back on the title only; the object names the fields the description and the image fall back on. */
+export type CollectionSeo = true | {
+    description?: string;
+    image?: string;
+};
+export declare const SEO_DESCRIPTOR: Descriptor;
+export declare function validateCollectionSeo(name: string, seo: CollectionSeo, fields: Record<string, Descriptor>): void;
+/** An entry's effective SEO: the editor's `$seo` values where set, the fallbacks the collection names otherwise. */
+export declare function entrySeo(fields: Record<string, unknown>, schema: {
+    titleField?: string;
+    seo?: CollectionSeo;
+}): Seo;
+/** A page's effective SEO from its stored meta; the title falls back to the page title. */
+export declare function pageSeo(meta: Record<string, unknown> | undefined, title: string): Seo;

package/dist/seo.js

@@ -0,0 +1,53 @@
+/** The reserved key an entry's SEO values live under; a collection may not declare a field of this name. */
+export const SEO_KEY = "$seo";
+export const SEO_DESCRIPTOR = {
+    type: "object",
+    optional: true,
+    localized: true,
+    fields: {
+        title: { type: "text", optional: true },
+        description: { type: "text", optional: true },
+        ogImage: { type: "image", optional: true },
+        noindex: { type: "boolean", optional: true },
+    },
+};
+export function validateCollectionSeo(name, seo, fields) {
+    if (seo === true)
+        return;
+    for (const [role, key] of Object.entries(seo)) {
+        if (key === undefined)
+            continue;
+        const d = fields[key];
+        if (!d)
+            throw new Error(`smoodly: collection "${name}" seo.${role} names "${key}", which is not a field.`);
+        if (role === "description" && d.type !== "text")
+            throw new Error(`smoodly: collection "${name}" seo.description "${key}" must be a text field, not ${d.type}.`);
+        if (role === "image" && d.type !== "image")
+            throw new Error(`smoodly: collection "${name}" seo.image "${key}" must be an image field, not ${d.type}.`);
+    }
+}
+const str = (v) => (typeof v === "string" && v !== "" ? v : undefined);
+const image = (v) => v !== null && typeof v === "object" && typeof v.url === "string" ? v : undefined;
+const compact = (s) => Object.fromEntries(Object.entries(s).filter(([, v]) => v !== undefined));
+/** An entry's effective SEO: the editor's `$seo` values where set, the fallbacks the collection names otherwise. */
+export function entrySeo(fields, schema) {
+    const raw = fields[SEO_KEY];
+    const own = raw !== null && typeof raw === "object" ? raw : {};
+    const map = schema.seo === true || schema.seo === undefined ? {} : schema.seo;
+    return compact({
+        title: str(own.title) ?? (schema.titleField ? str(fields[schema.titleField]) : undefined),
+        description: str(own.description) ?? (map.description ? str(fields[map.description]) : undefined),
+        image: image(own.ogImage) ?? (map.image ? image(fields[map.image]) : undefined),
+        noindex: own.noindex === true ? true : undefined,
+    });
+}
+/** A page's effective SEO from its stored meta; the title falls back to the page title. */
+export function pageSeo(meta, title) {
+    const m = meta ?? {};
+    return compact({
+        title: str(m.title) ?? str(title),
+        description: str(m.description),
+        image: image(m.ogImage),
+        noindex: m.noindex === true ? true : undefined,
+    });
+}

package/dist/site.d.ts

@@ -10,6 +10,7 @@ import { type StyleValues, type StyleValuesInput } from "./styles.ts";
 import { type CustomConfigInput, type ResolvedCustom } from "./custom/index.ts";
 import type { PageRecord, PageStore } from "./store.ts";
 import type { PathHit } from "./path-index.ts";
+import { type EntryItem, type PageItem, type Seo } from "./read-shapes.ts";
 export type SiteOptions = {
     stores: () => {
         pages: PageStore;
@@ -40,6 +41,7 @@ export type SitePageSchema = {
         title?: string;
         slug?: string | Record<string, string>;
         fields?: Record<string, Descriptor>;
+        seo?: true;
     };
 };
 export type SitePage = {
@@ -58,6 +60,8 @@ export type SitePage = {
     /** One key per supported locale: the page's `{ slug, path }` there, or null where it is
      *  absent or, outside draft mode, unpublished (spec 2026-09-15 §1). */
     locales: Record<string, PageAlternate | null>;
+    /** The effective SEO values, for a template with `seo: true` (spec 2026-09-29 content API contract §7). */
+    seo?: Seo;
 };
 export type SiteEntry = {
     kind: "entry";
@@ -70,6 +74,8 @@ export type SiteEntry = {
     entry: EntryRecord;
     path: string;
     locales: Record<string, LocaleAlternate | null>;
+    /** The effective SEO values, for a collection with `seo` (§7). */
+    seo?: Seo;
 };
 export type SiteHit = SitePage | SiteEntry;
 export type PageTreeItem = {
@@ -80,13 +86,7 @@ export type PageTreeItem = {
     fields: Record<string, unknown>;
     children: PageTreeItem[];
 };
-export type SiteEntryItem = {
-    entry: EntryRecord;
-    path: string | null;
-    locale: string;
-    locales: Record<string, LocaleAlternate | null>;
-};
-export type EntryTreeItem = SiteEntryItem & {
+export type EntryTreeItem = EntryItem & {
     children: EntryTreeItem[];
 };
 /** `where`, `limit`, `parent` and `order` run in the store (spec 2026-09-11 §3); `draft` reads live rows inside the editor preview. */
@@ -97,6 +97,8 @@ export type EntryQuery = {
     where?: Where;
     limit?: number;
     draft?: boolean;
+    /** Only these entries (`getEntry` by id). */
+    ids?: string[];
 };
 /** `version`: a stored page version to render instead of the draft — History (spec 2026-09-13 §4), draft mode only. */
 export type LoadOptions = {
@@ -124,26 +126,23 @@ export interface SmoodlySite {
     getPage(pathOrId: string, options?: {
         locale?: string;
         draft?: boolean;
-    }): Promise<SitePage | null>;
-    getEntries(collection: string, options?: EntryQuery): Promise<SiteEntryItem[]>;
+    }): Promise<PageItem | null>;
+    getEntries(collection: string, options?: EntryQuery): Promise<EntryItem[]>;
     getEntry(collection: string, idOrPath: string, options?: {
         locale?: string;
         draft?: boolean;
-    }): Promise<SiteEntryItem | null>;
+    }): Promise<EntryItem | null>;
     getEntriesTree(collection: string, options?: {
         locale?: string;
         draft?: boolean;
     }): Promise<EntryTreeItem[]>;
-    /** A global item's content in a locale (spec 2026-09-07 §4): an object
-     *  item's merged fields, or a visual item's section props (fields plus
-     *  `settings`), refs hydrated; null when the item has no row there or is
-     *  unpublished (outside draft mode). */
+    /** A global item's content in a locale (spec 2026-09-07 §4): `{ locale, fields }`,
+     *  plus `settings` and `styles` for a visual item, refs hydrated; null when the
+     *  item has no row there or is unpublished (outside draft mode). */
     getGlobal<V>(item: GlobalSchema<V>, options?: {
         locale?: string;
         draft?: boolean;
     }): Promise<V | null>;
 }
-/** The `page` prop for a loaded page. `href` is the app's seam from a
- *  locale-relative path to a site URL; the default keeps CMS paths as URLs. */
 export declare function pageContextOf(hit: SitePage, href?: (path: string, locale: string) => string): PageContext;
 export declare function createSmoodlySite(options: SiteOptions): SmoodlySite;

package/dist/site.js

@@ -1,6 +1,6 @@
-import { ARRAY_FIELD_TYPES, entryFieldsIn, localizedKeys, schemaOf } from "./entry-store.js";
+import { ARRAY_FIELD_TYPES, entryFieldsIn, schemaOf } from "./entry-store.js";
 import { buildPageTree, chainOf, entryAlternates, entryPathRows, entrySegment, pageAlternates, pagePath, } from "./paths.js";
-import { resolveFields, resolveMedia, resolveMediaSets, resolveTree } from "./resolve.js";
+import { resolveFields, resolveFieldSets, resolveMedia, resolveTree } from "./resolve.js";
 import { elementSchemas } from "./richtext-walk.js";
 import { globalNodeId, SETTINGS_KEY, STYLES_KEY, CSS_KEY } from "./global.js";
 import { SMD_KEY } from "./section-wrapper.js";
@@ -9,8 +9,12 @@ import { resolveCustom } from "./custom/index.js";
 import { addressMap, codeAddresses } from "./addresses.js";
 import { fullPath, servedAnchor } from "./anchors.js";
 import { withDefaults } from "./field-defaults.js";
+import { toEntryItem, toPageItem } from "./read-shapes.js";
+import { entrySeo, pageSeo, SEO_KEY } from "./seo.js";
 /** The `page` prop for a loaded page. `href` is the app's seam from a
  *  locale-relative path to a site URL; the default keeps CMS paths as URLs. */
+/** Field types whose stored value is an object: not filterable (memory and SQL would disagree). */
+const OBJECT_FIELD_TYPES = new Set(["image", "video", "file", "richtext", "object"]);
 export function pageContextOf(hit, href = (p) => p) {
     const withUrl = (l) => ({ ...l, url: href(l.path, hit.locale) });
     return {
@@ -41,6 +45,8 @@ export function createSmoodlySite(options) {
      *  locale — published ones (a versioned collection's snapshot) on the
      *  public path, the live rows in draft mode. */
     const fetcher = (draft, locale) => (collection, ids) => options.stores().entries.getMany(collection, ids, locale, draft ? undefined : { status: "published" });
+    /** The resolver's path lookup, bound to a locale: each EntryRef's address (spec 2026-09-29 content API contract §2). */
+    const pathLookup = (locale) => (collection, ids) => options.stores().entries.pathsIn(collection, ids, locale);
     /** The media fetcher (spec 2026-09-08 §9) — absent when the site runs without an asset store. */
     const assetFetcher = () => {
         const assets = options.stores().assets;
@@ -123,7 +129,7 @@ export function createSmoodlySite(options) {
             collections: options.collections,
             globals: options.globals,
             elements: options.elements,
-            fetch: fetcher(draft, locale),
+            fetch: fetcher(draft, locale), paths: pathLookup(locale),
             assets: assetFetcher(),
             page: { fields: pageFields(record.template) },
             custom,
@@ -139,6 +145,7 @@ export function createSmoodlySite(options) {
         // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present
         // one. Derived from the tree already listed — no index lookup (spec 2026-09-15 §2).
         const alternates = pageAlternates(record, byId, pathOpts, (l) => draft || record.locales[l]?.status === "published");
+        const withSeo = (options.pages ?? []).some((x) => x.schema.kind === "page" && x.schema.name === record.template && x.schema.seo === true);
         return {
             kind: "page",
             locale,
@@ -151,6 +158,7 @@ export function createSmoodlySite(options) {
             ancestors,
             children,
             locales: alternates,
+            ...(withSeo ? { seo: pageSeo(tree.meta, row.title) } : {}),
         };
     }
     async function loadEntry(id, locale, path, draft) {
@@ -170,51 +178,38 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(schema.name, [id], locale, { status: "published" }))[id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), assets: assetFetcher() });
+            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
             // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present one.
             // One record is in memory (a nested entry's parents are not), so the `paths` index
             // supplies the paths — the same single lookup as before (spec 2026-09-15 §2).
             const known = await entries.pathsOf(schema.name, id);
             const alternates = entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", (l) => known[l] ?? null);
-            return { kind: "entry", locale, collection: schema.name, entry: { ...record, fields }, path, locales: alternates };
+            return {
+                kind: "entry", locale, collection: schema.name, entry: { ...record, fields }, path, locales: alternates,
+                ...(schema.seo ? { seo: entrySeo(fields, schema) } : {}),
+            };
         }
         return null;
     }
     const localeOf = (o) => o?.locale ?? locales.default;
-    /** One locale's published fields and path for entries of one collection;
-     *  `all` is the whole collection (a draft ancestor still contributes
-     *  its segment). `fieldsById` is the published read for the locale. */
-    function entryItems(schema, wanted, all, locale, draft, fieldsById) {
-        const index = new Map(all.map((e) => [e.id, e]));
-        const byId = (x) => index.get(x);
-        return wanted
-            .filter((record) => fieldsById[record.id] !== undefined)
-            .map((record) => {
-            const rows = entryPathRows([record], byId, schema.name);
-            const pathIn = (l) => {
-                const row = rows.find((r) => r.locale === l);
-                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
-            };
-            return {
-                entry: { ...record, fields: fieldsById[record.id] },
-                path: pathIn(locale),
-                locale,
-                locales: entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", pathIn),
-            };
-        });
-    }
-    async function getEntries(collection, o = {}) {
+    async function readEntries(collection, o = {}) {
         const schema = schemaOf(options.collections, collection);
         const locale = localeOf(o);
         const draft = o.draft ?? false;
         const { entries } = options.stores();
         // A filter that silently matched nothing would be worse than an error (spec 2026-09-11 §3).
         for (const key of Object.keys(o.where ?? {})) {
-            if (key === "slug" || localizedKeys(schema).includes(key)) {
-                throw new Error(`smoodly: getEntries("${collection}"): "${key}" is localized — where filters shared fields only (spec 2026-09-11 §3).`);
+            if (key === "slug") {
+                throw new Error(`smoodly: getEntries("${collection}"): "slug" is not filterable — where filters fields; find an entry by its path instead.`);
             }
+            if (key === SEO_KEY)
+                throw new Error(`smoodly: getEntries("${collection}"): "${SEO_KEY}" is reserved — the SEO panel's values are not filterable.`);
             if (!(key in schema.fields))
                 throw new Error(`smoodly: getEntries("${collection}"): "${key}" is not a field of the collection.`);
+            // The memory adapter's `===` never matches an object while SQL's `@>` matches a subset, so the two would disagree.
+            if (OBJECT_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
+                throw new Error(`smoodly: getEntries("${collection}"): "${key}" holds an object — filter on a scalar field instead.`);
+            }
             // Any-of reads the text form of the whole field (PostgREST's `->>`), which for
             // an array is its JSON — `["a"]` never matches "a" — so refuse rather than match nothing.
             if (Array.isArray(o.where[key]) && ARRAY_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
@@ -224,26 +219,35 @@ export function createSmoodlySite(options) {
         if (o.limit !== undefined && (!Number.isInteger(o.limit) || o.limit < 0)) {
             throw new Error(`smoodly: getEntries("${collection}"): limit must be a non-negative integer.`);
         }
-        // The store filters, orders and limits (spec 2026-09-11 §3): the locale
-        // gate — presence in draft mode, published otherwise — is part of the
-        // query, so `limit` counts rows that are really there.
-        const inLocale = await entries.list(collection, {
-            order: o.order, where: o.where, limit: o.limit,
+        // The store filters, orders and limits over the snapshot shown (spec 2026-09-29 content API contract §5): the
+        // locale gate — presence in draft mode, published otherwise — is part of the query, so `limit` counts rows that are really there.
+        const rows = await entries.query(collection, {
+            locale, draft, where: o.where, order: o.order, limit: o.limit, ids: o.ids,
             ...(o.parent !== undefined ? { parent: o.parent } : {}),
-            ...(draft ? { locale } : { status: "published", locale }),
         });
         // Paths need every ancestor: a tree collection reads the whole collection for that, a flat one does not.
-        const all = schema.tree ? await entries.list(collection) : inLocale;
-        const fieldsById = draft
-            ? Object.fromEntries(inLocale.map((e) => [e.id, entryFieldsIn(e, locale)]))
-            : await entries.getMany(collection, inLocale.map((e) => e.id), locale, { status: "published" });
-        // Refs stay ids on the content API; media resolves (one asset round for
-        // the whole list), because a list page's cards need their image URLs.
-        const fetchAssets = assetFetcher();
-        if (fetchAssets)
-            await resolveMediaSets(Object.values(fieldsById).map((values) => ({ values, descriptors: schema.fields })), fetchAssets, elements);
-        return entryItems(schema, inLocale, all, locale, draft, fieldsById);
+        const all = schema.tree ? await entries.list(collection) : rows.map((r) => r.record);
+        // References and media resolve for the whole list in one pass (§2, §6).
+        const sets = rows.map((r) => ({ values: structuredClone(r.fields), descriptors: schema.fields }));
+        await resolveFieldSets(sets, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
+        const index = new Map(all.map((e) => [e.id, e]));
+        const byId = (x) => index.get(x);
+        return rows.map(({ record }, i) => {
+            const paths = entryPathRows([record], byId, schema.name);
+            const pathIn = (l) => {
+                const row = paths.find((r) => r.locale === l);
+                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
+            };
+            const item = toEntryItem(record, sets[i].values, {
+                path: pathIn(locale),
+                locale,
+                locales: entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", pathIn),
+                ...(schema.seo ? { seo: entrySeo(sets[i].values, schema) } : {}),
+            });
+            return { record, item };
+        });
     }
+    const getEntries = async (collection, o = {}) => (await readEntries(collection, o)).map((r) => r.item);
     const api = {
         async getPagesTree(o) {
             const locale = localeOf(o);
@@ -273,28 +277,29 @@ export function createSmoodlySite(options) {
             if (!path)
                 return null;
             const hit = await site.resolve(locale, path, { draft: o?.draft ?? false });
-            return hit?.kind === "page" ? hit : null;
+            return hit?.kind === "page" ? toPageItem(hit) : null;
         },
         getEntries,
         async getEntry(collection, idOrPath, o) {
             schemaOf(options.collections, collection); // an unknown collection is a wiring error on every branch
             const locale = localeOf(o);
+            const draft = o?.draft ?? false;
             if (idOrPath.startsWith("/")) {
-                const hit = await site.resolve(locale, idOrPath, { draft: o?.draft ?? false });
-                return hit?.kind === "entry" && hit.collection === collection ? { entry: hit.entry, path: hit.path, locale: hit.locale, locales: hit.locales } : null;
+                const hit = await site.resolve(locale, idOrPath, { draft });
+                return hit?.kind === "entry" && hit.collection === collection ? toEntryItem(hit.entry, hit.entry.fields, hit) : null;
             }
-            const items = await getEntries(collection, { locale, draft: o?.draft ?? false });
-            const byId = items.find((i) => i.entry.id === idOrPath);
+            const [byId] = await readEntries(collection, { locale, draft, ids: [idOrPath] });
             if (byId)
-                return byId;
+                return byId.item;
             // A bare slug names a ROOT entry only (sibling-scoped slugs, spec §4):
             // match the localized slug directly (paths.ts owns slug derivation),
             // regardless of whether the collection even has a `path`.
-            return items.find((i) => i.entry.parentId === null && entrySegment(i.entry, locale) === idOrPath) ?? null;
+            const all = await readEntries(collection, { locale, draft });
+            return all.find((r) => r.record.parentId === null && entrySegment(r.record, locale) === idOrPath)?.item ?? null;
         },
         async getEntriesTree(collection, o) {
-            const items = await getEntries(collection, { locale: localeOf(o), draft: o?.draft ?? false });
-            const build = (parentId) => items.filter((i) => i.entry.parentId === parentId).map((i) => ({ ...i, children: build(i.entry.id) }));
+            const rows = await readEntries(collection, { locale: localeOf(o), draft: o?.draft ?? false });
+            const build = (parentId) => rows.filter((r) => r.record.parentId === parentId).map((r) => ({ ...r.item, children: build(r.record.id) }));
             return build(null);
         },
         async getGlobal(item, o) {
@@ -312,9 +317,9 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(item.name, [record.id], locale, { status: "published" }))[record.id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, item.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), assets: assetFetcher() });
+            const fields = await resolveFields(raw, item.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
             if (!item.section)
-                return fields;
+                return { locale, fields };
             const { [SETTINGS_KEY]: settings, [STYLES_KEY]: steps, [CSS_KEY]: css, ...rest } = fields;
             const fetch = assetFetcher();
             const own = settings !== null && typeof settings === "object" ? settings : {};
@@ -324,7 +329,8 @@ export function createSmoodlySite(options) {
             // the wrapper strips it and emits data-smd-node, so the canvas selects the item and the css reaches it.
             const stepsObject = steps !== null && typeof steps === "object" ? steps : {};
             return {
-                ...rest,
+                locale,
+                fields: rest,
                 settings: own,
                 styles: { ...stepsObject, [SMD_KEY]: { node: globalNodeId(item.name), css: typeof css === "string" ? css : undefined, values: styles } },
             };

package/dist/sql-space.d.ts

@@ -7,6 +7,18 @@ export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0
 export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths", "assets"];
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 export declare function currentSpaceSQL(): string;
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export declare function writePoliciesSQL(table: string, write: string, prefix: string): string;
+/** The content tables' and members' policies. Each content table has ONE
+ *  select policy — its own space, not revoked, and a write key (spec
+ *  2026-09-29 content API contract §8): no key but a write key reads
+ *  content; the publishable key serves sign-in and presence. Split write
+ *  policies beside it. `refs` and `members` keep their `for all` write
+ *  policy, which is also their only select. */
+export declare function contentPoliciesSQL(): string;
 export declare function spaceLayerSQL(): string;
 /** The media bucket and its object policies (spec 2026-09-08 media §3,
  *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
@@ -15,6 +27,9 @@ export declare function spaceLayerSQL(): string;
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export declare function storageSQL(): string;
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export declare function mediaPoliciesSQL(): string;
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
  *  `authenticated` (the role a cloud write key carries), not by anon or

package/dist/sql-space.js

@@ -29,26 +29,47 @@ language sql stable set search_path = '' as $$
   select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
 $$;`.trim();
 }
-/** Which rows a read key (or the anon key, which has no claim) may see.
- *  null = write keys only — refs is editor tooling; members is admission
- *  data; nothing a browser needs. Global content (spec 2026-09-07) rides
- *  the three entry predicates: it is stored as entries. */
-const PUBLISHED_READ = {
-    pages: `exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published')`,
-    page_locales: `"status" = 'published'`,
-    page_versions: `exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id")`,
-    entries: `exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published')`,
-    entry_locales: `"status" = 'published'`,
-    entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
-    refs: null,
-    members: null,
-    assets: `"status" = 'ready'`,
-    paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
-};
 /** Tables whose existing indexes do not lead with space_id. */
 const NEEDS_SPACE_INDEX = [
     "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
 ];
+/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
+ *  the write key's insert, update and delete, each alone for its action; its
+ *  reads go through the table's one SELECT policy. `table` is as SQL names
+ *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
+export function writePoliciesSQL(table, write, prefix) {
+    return [
+        `drop policy if exists "${prefix}_write" on ${table};`,
+        `drop policy if exists "${prefix}_insert" on ${table};\ncreate policy "${prefix}_insert" on ${table} for insert\n  with check (${write});`,
+        `drop policy if exists "${prefix}_update" on ${table};\ncreate policy "${prefix}_update" on ${table} for update\n  using (${write})\n  with check (${write});`,
+        `drop policy if exists "${prefix}_delete" on ${table};\ncreate policy "${prefix}_delete" on ${table} for delete\n  using (${write});`,
+    ].join("\n\n");
+}
+const OWN = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
+const WRITE = `${OWN} and (select "smoodly_key_kind"()) = 'write'`;
+/** The content tables' and members' policies. Each content table has ONE
+ *  select policy — its own space, not revoked, and a write key (spec
+ *  2026-09-29 content API contract §8): no key but a write key reads
+ *  content; the publishable key serves sign-in and presence. Split write
+ *  policies beside it. `refs` and `members` keep their `for all` write
+ *  policy, which is also their only select. */
+export function contentPoliciesSQL() {
+    const statements = [];
+    for (const table of [...CONTENT_TABLES, "members"]) {
+        if (table === "refs" || table === "members") {
+            statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
+                `create policy "smoodly_write" on "${table}" for all\n` +
+                `  using (${WRITE})\n` +
+                `  with check (${WRITE});`);
+            continue;
+        }
+        statements.push(writePoliciesSQL(`"${table}"`, WRITE, "smoodly"));
+        statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
+            `create policy "smoodly_read" on "${table}" for select\n` +
+            `  using (${WRITE});`);
+    }
+    return statements.join("\n\n");
+}
 export function spaceLayerSQL() {
     const statements = [];
     statements.push(`
@@ -185,21 +206,9 @@ $$;`.trim());
     // an InitPlan, evaluated once per statement rather than once per row
     // — needed for smoodly_space_key_revoked, a security definer function
     // Postgres never inlines; applied to all three calls for the same win.
-    const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
-    const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
-    for (const table of [...CONTENT_TABLES, "members"]) {
-        statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
-            `create policy "smoodly_write" on "${table}" for all\n` +
-            `  using (${write})\n` +
-            `  with check (${write});`);
-        const published = PUBLISHED_READ[table];
-        if (published !== null) {
-            const predicate = `${own}${published ? ` and ${published}` : ""}`;
-            statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
-                `create policy "smoodly_read" on "${table}" for select\n` +
-                `  using (${predicate});`);
-        }
-    }
+    const own = OWN;
+    const write = WRITE;
+    statements.push(contentPoliciesSQL());
     // A write key reads its own space's row — the console URL the Members
     // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
     // space_keys but the two definer functions and the service role.
@@ -235,10 +244,6 @@ $$;`.trim());
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export function storageSQL() {
-    const write = `"bucket_id" = 'media'` +
-        ` and (select public."smoodly_key_kind"()) = 'write'` +
-        ` and not (select public."smoodly_space_key_revoked"())` +
-        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
     return `
 insert into storage.buckets ("id", "name", "public", "file_size_limit")
   values ('media', 'media', true, 104857600)
@@ -248,10 +253,16 @@ drop policy if exists "smoodly_media_read" on storage.objects;
 create policy "smoodly_media_read" on storage.objects for select
   using ("bucket_id" = 'media');
 
-drop policy if exists "smoodly_media_write" on storage.objects;
-create policy "smoodly_media_write" on storage.objects for all
-  using (${write})
-  with check (${write});`.trim();
+${mediaPoliciesSQL()}`.trim();
+}
+/** The media bucket's write policies: insert, update, delete for a write
+ *  key under its own space's prefix; reads are the public select above. */
+export function mediaPoliciesSQL() {
+    const write = `"bucket_id" = 'media'` +
+        ` and (select public."smoodly_key_kind"()) = 'write'` +
+        ` and not (select public."smoodly_space_key_revoked"())` +
+        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
+    return writePoliciesSQL("storage.objects", write, "smoodly_media");
 }
 /** The three mutation RPCs are the stores' verbs, never a browser's (spec
  *  2026-09-26 security pass §2): executable by the service role and by
@@ -259,9 +270,13 @@ create policy "smoodly_media_write" on storage.objects for all
  *  public. `smoodly_current_space` is NOT here — the stores read it through
  *  rpc(). Last in the schema, after every definition exists. */
 export function grantsSQL() {
+    // smoodly_list_entries is callable by every role on purpose: invoker
+    // rights and the read policies decide what a key sees (spec 2026-09-29
+    // content API contract §5), so there is nothing to revoke.
     return [
         `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
+        `revoke execute on function "smoodly_space_row_cap"() from public, anon;`,
     ].join("\n");
 }

package/dist/sql.d.ts

@@ -1,3 +1,13 @@
-import { type CollectionSchema } from "./collections.ts";
+import type { CollectionSchema } from "./collections.ts";
 export declare function collectionSQL(collection: CollectionSchema<any>): string;
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export declare function foreignKeyIndexesSQL(): string;
+/** The shown snapshot of one collection's entries in a locale, filtered,
+ *  ordered and limited in one query (spec 2026-09-29 content API contract
+ *  §5). Invoker rights, so RLS decides what a key sees. Defined after the
+ *  space layer, whose `smoodly_key_kind` it calls. */
+export declare function listEntriesSQL(): string;
 export declare function coreTablesSQL(): string;