smoodly 0.0.34 → 0.0.36

package/dist/sql.js

@@ -1,23 +1,18 @@
 // Schema → SQL generation (Postgres/Supabase) for the stable schema
 // (DESIGN.md §3): all collection content lives in the one `entries`
 // table, applied once and never migrated. Per collection we emit only
-// disposable guardrails — a published-only read view, created with
+// a disposable guardrail — a published-only read view, created with
 // security_invoker so it runs under the caller's own RLS policies
-// rather than the view owner's privileges (PostgREST-native reads,
-// SQL-queryable eject story) — and a partial expression index for a
-// declared order field, on the jsonb VALUE (sibling slug uniqueness
-// is the `paths` primary key plus the stores' per-locale pre-check,
-// not an index). A view joins the locale rows, one row per published
+// rather than the view owner's privileges (SQL-queryable eject story;
+// sibling slug uniqueness is the `paths` primary key plus the stores'
+// per-locale pre-check, not an index). A view joins the locale rows, one row per published
 // locale (spec 2026-09-06 §7); a versioned collection reads its
 // fields from the published snapshot.
-import { BUILT_IN_ORDER_FIELDS } from "./collections.js";
+import { SEO_KEY } from "./seo.js";
 import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
 const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 const q = (s) => `"${s}"`;
-// Casts are fine in views (unlike index expressions, which must be
-// immutable — the order field's index stays on the raw jsonb
-// expression: jsonb ordering compares numbers numerically and strings,
-// ISO dates included, alphabetically, matching the memory comparator).
+// Casts are fine in views.
 function fieldExpr(key, d, source) {
     switch (d.type) {
         case "text":
@@ -45,6 +40,8 @@ export function collectionSQL(collection) {
     for (const [key, d] of Object.entries(collection.fields)) {
         if (key === "slug")
             continue; // the segment is the row's column, never a field
+        if (key === SEO_KEY)
+            continue; // the panel's values are Smoodly-internal, not a view column
         columns.push(`${fieldExpr(key, d, source)} as ${q(snake(key))}`);
     }
     const statements = [
@@ -58,17 +55,71 @@ export function collectionSQL(collection) {
             `where e."collection" = '${name}' and l."status" = 'published';`,
         ].join("\n"),
     ];
-    // Only a declared order field needs a per-collection expression index —
-    // on the node's shared fields (an order field can be neither localized
-    // nor `slug`, which collection() refuses), the jsonb value (`->`) the
-    // adapter orders by, so the index serves the sort.
-    const order = collection.order;
-    if (order !== undefined && order !== "manual" && !BUILT_IN_ORDER_FIELDS.includes(order.by)) {
-        statements.push(`create index if not exists ${q(`entries_${name}_${snake(order.by)}_idx`)}\n` +
-            `  on "entries" (("fields"->'${order.by}')) where "collection" = '${name}';`);
-    }
+    // Ordering reads the shown snapshot (smoodly_list_entries), so no index on the live row serves it (spec 2026-09-29 content API contract §5).
     return statements.join("\n\n");
 }
+/** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
+ *  fixes §3): a restrict or set-null check scans the referencing table
+ *  without one, and the versions' read policies probe published_version_id
+ *  on every public read. The composite indexes that exist lead with space_id. */
+export function foreignKeyIndexesSQL() {
+    return [
+        `create index if not exists "page_locales_draft_version_idx" on "page_locales" ("draft_version_id");`,
+        `create index if not exists "entry_locales_draft_version_idx" on "entry_locales" ("draft_version_id");`,
+        `create index if not exists "page_locales_published_version_idx" on "page_locales" ("published_version_id");`,
+        `create index if not exists "entry_locales_published_version_idx" on "entry_locales" ("published_version_id");`,
+        `create index if not exists "pages_parent_id_idx" on "pages" ("parent_id");`,
+        `create index if not exists "entries_parent_id_idx" on "entries" ("parent_id");`,
+        `create index if not exists "assets_poster_idx" on "assets" ("poster_id");`,
+    ].join("\n");
+}
+/** The shown snapshot of one collection's entries in a locale, filtered,
+ *  ordered and limited in one query (spec 2026-09-29 content API contract
+ *  §5). Invoker rights, so RLS decides what a key sees. Defined after the
+ *  space layer, whose `smoodly_key_kind` it calls. */
+export function listEntriesSQL() {
+    return `
+-- The shown snapshot of one collection's entries in a locale, filtered,
+-- ordered and limited in one query (spec 2026-09-29 content API contract
+-- §5): the published snapshot, or the live merge in preview. Invoker
+-- rights, so RLS decides what a key sees; a preview read needs the
+-- service role or a write key, anything else reads published.
+create or replace function "smoodly_list_entries"(
+  p_collection text, p_locale text, p_draft boolean, p_where jsonb, p_order jsonb,
+  p_limit integer, p_parent uuid, p_has_parent boolean, p_ids uuid[]
+) returns table ("id" uuid, "fields" jsonb) language sql stable set search_path = public as $$
+  with mode as (
+    select p_draft and (current_user = 'service_role' or "smoodly_key_kind"() = 'write') as draft
+  ), shown as (
+    select e."id", e."sort", e."created_at", l."updated_at",
+      case when (select draft from mode) then e."fields" || l."fields" || jsonb_build_object('slug', l."slug")
+           else coalesce(v."fields", e."fields" || l."fields" || jsonb_build_object('slug', l."slug")) end as "fields"
+    from "entries" e
+    join "entry_locales" l on l."entry_id" = e."id" and l."locale" = p_locale
+    left join "entry_versions" v on v."id" = l."published_version_id"
+    where e."collection" = p_collection
+      and ((select draft from mode) or l."status" = 'published')
+      and (not p_has_parent or e."parent_id" is not distinct from p_parent)
+      and (p_ids is null or e."id" = any(p_ids))
+  )
+  select s."id", s."fields" from shown s
+  where not exists (
+    select 1 from jsonb_each(coalesce(p_where, '{}'::jsonb)) w
+    where not (case when w.value ? 'in'
+                    then (s."fields" ->> w.key) = any (select jsonb_array_elements_text(w.value -> 'in'))
+                    else s."fields" @> jsonb_build_object(w.key, w.value -> 'contains') end))
+  order by
+    case when p_order ->> 'by' = 'manual' then s."sort" end asc nulls last,
+    case when p_order ->> 'direction' = 'asc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end asc nulls last,
+    case when p_order ->> 'direction' = 'desc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end desc nulls last,
+    s."created_at" asc, s."id" asc
+  limit p_limit;
+$$;`.trim();
+}
 export function coreTablesSQL() {
     return [
         // The trigger/policy blocks below drop-before-create so the migration is
@@ -332,13 +383,14 @@ create or replace function "smoodly_resolve_path"(p_locale text, p_keys jsonb) r
   select p.* from "paths" p
   join jsonb_to_recordset(p_keys) as k(anchor text, path text) on p."anchor" = k.anchor and p."path" = k.path
   where p."locale" = p_locale;
-$$;
-
+$$;`.trim(),
+        foreignKeyIndexesSQL(),
+        `
 -- RLS on every core table. The service role bypasses it (self-host
 -- adapters untouched). The policy set that follows (space layer) admits
--- a key to its own space: everything for a write key, published rows for
--- a read key or the anon key (default space). Drafts stay unreachable
--- to anything but a write key. The generated per-collection views
+-- a write key to its own space and no other key to any content (spec
+-- 2026-09-29 content API contract §8): the publishable key serves
+-- sign-in and presence, and the generated per-collection views
 -- (collectionSQL) run with security_invoker = true, so they are subject
 -- to this same smoodly_read policy rather than their owner's privileges.
 -- smoodly_meta: which version of this schema the database holds (spec
@@ -362,6 +414,7 @@ alter table "assets" enable row level security;
 alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
+        listEntriesSQL(),
         grantsSQL(),
     ].join("\n\n");
 }

package/dist/supabase-entry-store.d.ts

@@ -1,6 +1,6 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CollectionSchema } from "./collections.ts";
-import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryScan, EntryUsage, EntryVersion, ListOptions } from "./entry-store.ts";
+import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryScan, EntryUsage, EntryVersion, ListOptions, SnapshotQuery, SnapshotRow } from "./entry-store.ts";
 import { type DraftToken } from "./draft-token.ts";
 export declare class SupabaseEntryStore implements EntryStore {
     private db;
@@ -57,6 +57,7 @@ export declare class SupabaseEntryStore implements EntryStore {
     create(collection: string, fields: Record<string, unknown>, options: CreateEntryOptions, by?: string): Promise<EntryRecord>;
     get(collection: string, id: string): Promise<EntryRecord | null>;
     list(collection: string, options?: ListOptions): Promise<EntryRecord[]>;
+    query(collection: string, q: SnapshotQuery): Promise<SnapshotRow[]>;
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
@@ -79,6 +80,7 @@ export declare class SupabaseEntryStore implements EntryStore {
     }): Promise<EntryRecord>;
     delete(collection: string, id: string): Promise<void>;
     resolvePath(locale: string, path: string): Promise<import("./path-index.ts").PathHit | null>;
+    pathsIn(collection: string, ids: string[], locale: string): Promise<Record<string, string>>;
     pathsOf(collection: string, id: string): Promise<Record<string, string>>;
     redirectsOf(collection: string, id: string): Promise<Record<string, string[]>>;
     reorder(collection: string, orderedIds: string[]): Promise<void>;

package/dist/supabase-entry-store.js

@@ -433,6 +433,41 @@ export class SupabaseEntryStore {
             this.fail(res.error.message);
         return res.data.map(({ gate: _gate, ...row }) => toRecord(row));
     }
+    async query(collection, q) {
+        const schema = this.schema(collection);
+        const where = {};
+        for (const [key, want] of Object.entries(q.where ?? {})) {
+            const inArray = ARRAY_FIELD_TYPES.has(schema.fields[key]?.type ?? "");
+            where[key] = Array.isArray(want) ? { in: want.map(String) } : { contains: inArray ? [want] : want };
+        }
+        const order = q.order ?? collectionOrder(schema);
+        const res = await this.db.rpc("smoodly_list_entries", {
+            p_collection: collection,
+            p_locale: q.locale,
+            p_draft: q.draft,
+            p_where: where,
+            p_order: order === "manual" ? { by: "manual" } : order,
+            p_limit: q.limit ?? null,
+            p_parent: q.parent ?? null,
+            p_has_parent: q.parent !== undefined,
+            p_ids: q.ids ? q.ids.filter((id) => UUID_RE.test(id)) : null,
+        });
+        if (res.error)
+            this.fail(res.error.message);
+        const shown = res.data;
+        if (shown.length === 0)
+            return [];
+        // In chunks: one in() over hundreds of ids would overflow the request URL.
+        const byId = new Map();
+        for (let i = 0; i < shown.length; i += 100) {
+            const recs = await this.db.from("entries").select(SELECT).in("id", shown.slice(i, i + 100).map((r) => r.id));
+            if (recs.error)
+                this.fail(recs.error.message);
+            for (const r of recs.data)
+                byId.set(r.id, toRecord(r));
+        }
+        return shown.flatMap((r) => (byId.has(r.id) ? [{ record: byId.get(r.id), fields: r.fields }] : []));
+    }
     async getMany(collection, ids, locale, options) {
         this.schema(collection);
         const uuidIds = ids.filter((id) => UUID_RE.test(id));
@@ -728,6 +763,10 @@ export class SupabaseEntryStore {
     resolvePath(locale, path) {
         return this.paths.resolve(locale, path);
     }
+    pathsIn(collection, ids, locale) {
+        this.schema(collection);
+        return this.paths.livePathsIn("entry", ids, locale);
+    }
     async pathsOf(collection, id) {
         return (await this.fetch(collection, id)) ? this.paths.pathsOf({ kind: "entry", id }) : {};
     }

package/dist/supabase-path-index.d.ts

@@ -19,6 +19,7 @@ export declare class SupabasePathIndex implements PathIndex {
     /** A locale's rows, sorted by URL in JS: the stored path is not the URL. */
     private rowsIn;
     pathsOf(target: PathTarget): Promise<Record<string, string>>;
+    livePathsIn(kind: "page" | "entry", ids: string[], locale: string): Promise<Record<string, string>>;
     redirectsOf(target: PathTarget): Promise<PathRow[]>;
     listLive(locale: string): Promise<PathRow[]>;
     listRedirects(locale: string): Promise<PathRow[]>;

package/dist/supabase-path-index.js

@@ -1,6 +1,7 @@
 import { candidates, fullPath, pickHit, sameUrlKeys } from "./anchors.js";
 import { pathLiveError, pathTakenError } from "./path-index.js";
 const UNIQUE_VIOLATION = "23505";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const COLS = "locale, anchor, path, kind, target_id, redirect";
 export class SupabasePathIndex {
     /** Held by reference: the config's addresses (spec 2026-09-29 anchored paths §2). */
@@ -84,6 +85,21 @@ export class SupabasePathIndex {
             out[r.locale] = r.path;
         return out;
     }
+    async livePathsIn(kind, ids, locale) {
+        const uuids = ids.filter((id) => UUID_RE.test(id));
+        if (uuids.length === 0)
+            return {};
+        const out = {};
+        // In chunks: one in() over hundreds of ids would overflow the request URL.
+        for (let i = 0; i < uuids.length; i += 100) {
+            const res = await this.db.from("paths").select(COLS).eq("kind", kind).eq("locale", locale).eq("redirect", false).in("target_id", uuids.slice(i, i + 100));
+            if (res.error)
+                this.fail(res.error.message);
+            for (const r of this.shown(res.data))
+                out[r.id] = r.path;
+        }
+        return out;
+    }
     redirectsOf(target) {
         return this.rowsOf(target, true);
     }

package/migrations/20260929135523_smoodly_v6.sql

@@ -0,0 +1,200 @@
+-- Smoodly core schema, version 6 (docs/superpowers/specs/2026-09-29-pre-install-fixes-design.md §3).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 5: one permissive policy per table and action (the
+-- write key reads through smoodly_read; smoodly_write splits into insert,
+-- update and delete where a public read exists; the media pair the same),
+-- indexes on the foreign keys without one, and no anon call of the row cap.
+-- Access is unchanged.
+
+set client_min_messages = warning;
+
+create index if not exists "page_locales_draft_version_idx" on "page_locales" ("draft_version_id");
+create index if not exists "entry_locales_draft_version_idx" on "entry_locales" ("draft_version_id");
+create index if not exists "page_locales_published_version_idx" on "page_locales" ("published_version_id");
+create index if not exists "entry_locales_published_version_idx" on "entry_locales" ("published_version_id");
+create index if not exists "pages_parent_id_idx" on "pages" ("parent_id");
+create index if not exists "entries_parent_id_idx" on "entries" ("parent_id");
+create index if not exists "assets_poster_idx" on "assets" ("poster_id");
+
+drop policy if exists "smoodly_write" on "pages";
+
+drop policy if exists "smoodly_insert" on "pages";
+create policy "smoodly_insert" on "pages" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "pages";
+create policy "smoodly_update" on "pages" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "pages";
+create policy "smoodly_delete" on "pages" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published')));
+
+drop policy if exists "smoodly_write" on "page_locales";
+
+drop policy if exists "smoodly_insert" on "page_locales";
+create policy "smoodly_insert" on "page_locales" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "page_locales";
+create policy "smoodly_update" on "page_locales" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "page_locales";
+create policy "smoodly_delete" on "page_locales" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'published'));
+
+drop policy if exists "smoodly_write" on "page_versions";
+
+drop policy if exists "smoodly_insert" on "page_versions";
+create policy "smoodly_insert" on "page_versions" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "page_versions";
+create policy "smoodly_update" on "page_versions" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "page_versions";
+create policy "smoodly_delete" on "page_versions" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id")));
+
+drop policy if exists "smoodly_write" on "entries";
+
+drop policy if exists "smoodly_insert" on "entries";
+create policy "smoodly_insert" on "entries" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entries";
+create policy "smoodly_update" on "entries" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entries";
+create policy "smoodly_delete" on "entries" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published')));
+
+drop policy if exists "smoodly_write" on "entry_locales";
+
+drop policy if exists "smoodly_insert" on "entry_locales";
+create policy "smoodly_insert" on "entry_locales" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entry_locales";
+create policy "smoodly_update" on "entry_locales" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entry_locales";
+create policy "smoodly_delete" on "entry_locales" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'published'));
+
+drop policy if exists "smoodly_write" on "entry_versions";
+
+drop policy if exists "smoodly_insert" on "entry_versions";
+create policy "smoodly_insert" on "entry_versions" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "entry_versions";
+create policy "smoodly_update" on "entry_versions" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "entry_versions";
+create policy "smoodly_delete" on "entry_versions" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")));
+
+drop policy if exists "smoodly_write" on "refs";
+create policy "smoodly_write" on "refs" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_write" on "paths";
+
+drop policy if exists "smoodly_insert" on "paths";
+create policy "smoodly_insert" on "paths" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "paths";
+create policy "smoodly_update" on "paths" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "paths";
+create policy "smoodly_delete" on "paths" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or (("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))));
+
+drop policy if exists "smoodly_write" on "assets";
+
+drop policy if exists "smoodly_insert" on "assets";
+create policy "smoodly_insert" on "assets" for insert
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_update" on "assets";
+create policy "smoodly_update" on "assets" for update
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_delete" on "assets";
+create policy "smoodly_delete" on "assets" for delete
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and ((select "smoodly_key_kind"()) = 'write' or "status" = 'ready'));
+
+drop policy if exists "smoodly_write" on "members";
+create policy "smoodly_write" on "members" for all
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write')
+  with check ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_media_write" on storage.objects;
+
+drop policy if exists "smoodly_media_insert" on storage.objects;
+create policy "smoodly_media_insert" on storage.objects for insert
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_media_update" on storage.objects;
+create policy "smoodly_media_update" on storage.objects for update
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text)
+  with check ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+drop policy if exists "smoodly_media_delete" on storage.objects;
+create policy "smoodly_media_delete" on storage.objects for delete
+  using ("bucket_id" = 'media' and (select public."smoodly_key_kind"()) = 'write' and not (select public."smoodly_space_key_revoked"()) and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text);
+
+revoke execute on function "smoodly_space_row_cap"() from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '6')
+  on conflict ("key") do update set "value" = excluded."value";

package/migrations/20260930040956_smoodly_v7.sql

@@ -0,0 +1,84 @@
+-- Smoodly core schema, version 7 (docs/superpowers/specs/2026-09-29-content-api-contract-design.md §5).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 6: smoodly_list_entries, which filters, orders and
+-- limits a collection over the snapshot the reader is shown, and the read
+-- policies of every content table admit a write key only (§8).
+
+-- The shown snapshot of one collection's entries in a locale, filtered,
+-- ordered and limited in one query (spec 2026-09-29 content API contract
+-- §5): the published snapshot, or the live merge in preview. Invoker
+-- rights, so RLS decides what a key sees; a preview read needs the
+-- service role or a write key, anything else reads published.
+create or replace function "smoodly_list_entries"(
+  p_collection text, p_locale text, p_draft boolean, p_where jsonb, p_order jsonb,
+  p_limit integer, p_parent uuid, p_has_parent boolean, p_ids uuid[]
+) returns table ("id" uuid, "fields" jsonb) language sql stable set search_path = public as $$
+  with mode as (
+    select p_draft and (current_user = 'service_role' or "smoodly_key_kind"() = 'write') as draft
+  ), shown as (
+    select e."id", e."sort", e."created_at", l."updated_at",
+      case when (select draft from mode) then e."fields" || l."fields" || jsonb_build_object('slug', l."slug")
+           else coalesce(v."fields", e."fields" || l."fields" || jsonb_build_object('slug', l."slug")) end as "fields"
+    from "entries" e
+    join "entry_locales" l on l."entry_id" = e."id" and l."locale" = p_locale
+    left join "entry_versions" v on v."id" = l."published_version_id"
+    where e."collection" = p_collection
+      and ((select draft from mode) or l."status" = 'published')
+      and (not p_has_parent or e."parent_id" is not distinct from p_parent)
+      and (p_ids is null or e."id" = any(p_ids))
+  )
+  select s."id", s."fields" from shown s
+  where not exists (
+    select 1 from jsonb_each(coalesce(p_where, '{}'::jsonb)) w
+    where not (case when w.value ? 'in'
+                    then (s."fields" ->> w.key) = any (select jsonb_array_elements_text(w.value -> 'in'))
+                    else s."fields" @> jsonb_build_object(w.key, w.value -> 'contains') end))
+  order by
+    case when p_order ->> 'by' = 'manual' then s."sort" end asc nulls last,
+    case when p_order ->> 'direction' = 'asc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end asc nulls last,
+    case when p_order ->> 'direction' = 'desc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end desc nulls last,
+    s."created_at" asc, s."id" asc
+  limit p_limit;
+$$;
+
+-- No public content reads (spec 2026-09-29 content API contract §8): the
+-- publishable key and a read key read nothing; a write key reads its own space.
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '7')
+  on conflict ("key") do update set "value" = excluded."value";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.34",
+  "version": "0.0.36",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {
@@ -43,10 +43,6 @@
       "types": "./dist/admin/next/index.d.ts",
       "default": "./dist/admin/next/index.js"
     },
-    "./bridge": {
-      "types": "./dist/admin/next/bridge.d.ts",
-      "default": "./dist/admin/next/bridge.js"
-    },
     "./migrations": {
       "types": "./dist/migrations.d.ts",
       "default": "./dist/migrations.js"