smoodly 0.0.35 → 0.0.36

package/dist/site.js

@@ -1,6 +1,6 @@
-import { ARRAY_FIELD_TYPES, entryFieldsIn, localizedKeys, schemaOf } from "./entry-store.js";
+import { ARRAY_FIELD_TYPES, entryFieldsIn, schemaOf } from "./entry-store.js";
 import { buildPageTree, chainOf, entryAlternates, entryPathRows, entrySegment, pageAlternates, pagePath, } from "./paths.js";
-import { resolveFields, resolveMedia, resolveMediaSets, resolveTree } from "./resolve.js";
+import { resolveFields, resolveFieldSets, resolveMedia, resolveTree } from "./resolve.js";
 import { elementSchemas } from "./richtext-walk.js";
 import { globalNodeId, SETTINGS_KEY, STYLES_KEY, CSS_KEY } from "./global.js";
 import { SMD_KEY } from "./section-wrapper.js";
@@ -9,8 +9,12 @@ import { resolveCustom } from "./custom/index.js";
 import { addressMap, codeAddresses } from "./addresses.js";
 import { fullPath, servedAnchor } from "./anchors.js";
 import { withDefaults } from "./field-defaults.js";
+import { toEntryItem, toPageItem } from "./read-shapes.js";
+import { entrySeo, pageSeo, SEO_KEY } from "./seo.js";
 /** The `page` prop for a loaded page. `href` is the app's seam from a
  *  locale-relative path to a site URL; the default keeps CMS paths as URLs. */
+/** Field types whose stored value is an object: not filterable (memory and SQL would disagree). */
+const OBJECT_FIELD_TYPES = new Set(["image", "video", "file", "richtext", "object"]);
 export function pageContextOf(hit, href = (p) => p) {
     const withUrl = (l) => ({ ...l, url: href(l.path, hit.locale) });
     return {
@@ -41,6 +45,8 @@ export function createSmoodlySite(options) {
      *  locale — published ones (a versioned collection's snapshot) on the
      *  public path, the live rows in draft mode. */
     const fetcher = (draft, locale) => (collection, ids) => options.stores().entries.getMany(collection, ids, locale, draft ? undefined : { status: "published" });
+    /** The resolver's path lookup, bound to a locale: each EntryRef's address (spec 2026-09-29 content API contract §2). */
+    const pathLookup = (locale) => (collection, ids) => options.stores().entries.pathsIn(collection, ids, locale);
     /** The media fetcher (spec 2026-09-08 §9) — absent when the site runs without an asset store. */
     const assetFetcher = () => {
         const assets = options.stores().assets;
@@ -123,7 +129,7 @@ export function createSmoodlySite(options) {
             collections: options.collections,
             globals: options.globals,
             elements: options.elements,
-            fetch: fetcher(draft, locale),
+            fetch: fetcher(draft, locale), paths: pathLookup(locale),
             assets: assetFetcher(),
             page: { fields: pageFields(record.template) },
             custom,
@@ -139,6 +145,7 @@ export function createSmoodlySite(options) {
         // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present
         // one. Derived from the tree already listed — no index lookup (spec 2026-09-15 §2).
         const alternates = pageAlternates(record, byId, pathOpts, (l) => draft || record.locales[l]?.status === "published");
+        const withSeo = (options.pages ?? []).some((x) => x.schema.kind === "page" && x.schema.name === record.template && x.schema.seo === true);
         return {
             kind: "page",
             locale,
@@ -151,6 +158,7 @@ export function createSmoodlySite(options) {
             ancestors,
             children,
             locales: alternates,
+            ...(withSeo ? { seo: pageSeo(tree.meta, row.title) } : {}),
         };
     }
     async function loadEntry(id, locale, path, draft) {
@@ -170,51 +178,38 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(schema.name, [id], locale, { status: "published" }))[id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), assets: assetFetcher() });
+            const fields = await resolveFields(raw, schema.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
             // Alternates advertise PUBLISHED locales only; the editor (draft) sees every present one.
             // One record is in memory (a nested entry's parents are not), so the `paths` index
             // supplies the paths — the same single lookup as before (spec 2026-09-15 §2).
             const known = await entries.pathsOf(schema.name, id);
             const alternates = entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", (l) => known[l] ?? null);
-            return { kind: "entry", locale, collection: schema.name, entry: { ...record, fields }, path, locales: alternates };
+            return {
+                kind: "entry", locale, collection: schema.name, entry: { ...record, fields }, path, locales: alternates,
+                ...(schema.seo ? { seo: entrySeo(fields, schema) } : {}),
+            };
         }
         return null;
     }
     const localeOf = (o) => o?.locale ?? locales.default;
-    /** One locale's published fields and path for entries of one collection;
-     *  `all` is the whole collection (a draft ancestor still contributes
-     *  its segment). `fieldsById` is the published read for the locale. */
-    function entryItems(schema, wanted, all, locale, draft, fieldsById) {
-        const index = new Map(all.map((e) => [e.id, e]));
-        const byId = (x) => index.get(x);
-        return wanted
-            .filter((record) => fieldsById[record.id] !== undefined)
-            .map((record) => {
-            const rows = entryPathRows([record], byId, schema.name);
-            const pathIn = (l) => {
-                const row = rows.find((r) => r.locale === l);
-                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
-            };
-            return {
-                entry: { ...record, fields: fieldsById[record.id] },
-                path: pathIn(locale),
-                locale,
-                locales: entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", pathIn),
-            };
-        });
-    }
-    async function getEntries(collection, o = {}) {
+    async function readEntries(collection, o = {}) {
         const schema = schemaOf(options.collections, collection);
         const locale = localeOf(o);
         const draft = o.draft ?? false;
         const { entries } = options.stores();
         // A filter that silently matched nothing would be worse than an error (spec 2026-09-11 §3).
         for (const key of Object.keys(o.where ?? {})) {
-            if (key === "slug" || localizedKeys(schema).includes(key)) {
-                throw new Error(`smoodly: getEntries("${collection}"): "${key}" is localized — where filters shared fields only (spec 2026-09-11 §3).`);
+            if (key === "slug") {
+                throw new Error(`smoodly: getEntries("${collection}"): "slug" is not filterable — where filters fields; find an entry by its path instead.`);
             }
+            if (key === SEO_KEY)
+                throw new Error(`smoodly: getEntries("${collection}"): "${SEO_KEY}" is reserved — the SEO panel's values are not filterable.`);
             if (!(key in schema.fields))
                 throw new Error(`smoodly: getEntries("${collection}"): "${key}" is not a field of the collection.`);
+            // The memory adapter's `===` never matches an object while SQL's `@>` matches a subset, so the two would disagree.
+            if (OBJECT_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
+                throw new Error(`smoodly: getEntries("${collection}"): "${key}" holds an object — filter on a scalar field instead.`);
+            }
             // Any-of reads the text form of the whole field (PostgREST's `->>`), which for
             // an array is its JSON — `["a"]` never matches "a" — so refuse rather than match nothing.
             if (Array.isArray(o.where[key]) && ARRAY_FIELD_TYPES.has(schema.fields[key].type ?? "")) {
@@ -224,26 +219,35 @@ export function createSmoodlySite(options) {
         if (o.limit !== undefined && (!Number.isInteger(o.limit) || o.limit < 0)) {
             throw new Error(`smoodly: getEntries("${collection}"): limit must be a non-negative integer.`);
         }
-        // The store filters, orders and limits (spec 2026-09-11 §3): the locale
-        // gate — presence in draft mode, published otherwise — is part of the
-        // query, so `limit` counts rows that are really there.
-        const inLocale = await entries.list(collection, {
-            order: o.order, where: o.where, limit: o.limit,
+        // The store filters, orders and limits over the snapshot shown (spec 2026-09-29 content API contract §5): the
+        // locale gate — presence in draft mode, published otherwise — is part of the query, so `limit` counts rows that are really there.
+        const rows = await entries.query(collection, {
+            locale, draft, where: o.where, order: o.order, limit: o.limit, ids: o.ids,
             ...(o.parent !== undefined ? { parent: o.parent } : {}),
-            ...(draft ? { locale } : { status: "published", locale }),
         });
         // Paths need every ancestor: a tree collection reads the whole collection for that, a flat one does not.
-        const all = schema.tree ? await entries.list(collection) : inLocale;
-        const fieldsById = draft
-            ? Object.fromEntries(inLocale.map((e) => [e.id, entryFieldsIn(e, locale)]))
-            : await entries.getMany(collection, inLocale.map((e) => e.id), locale, { status: "published" });
-        // Refs stay ids on the content API; media resolves (one asset round for
-        // the whole list), because a list page's cards need their image URLs.
-        const fetchAssets = assetFetcher();
-        if (fetchAssets)
-            await resolveMediaSets(Object.values(fieldsById).map((values) => ({ values, descriptors: schema.fields })), fetchAssets, elements);
-        return entryItems(schema, inLocale, all, locale, draft, fieldsById);
+        const all = schema.tree ? await entries.list(collection) : rows.map((r) => r.record);
+        // References and media resolve for the whole list in one pass (§2, §6).
+        const sets = rows.map((r) => ({ values: structuredClone(r.fields), descriptors: schema.fields }));
+        await resolveFieldSets(sets, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
+        const index = new Map(all.map((e) => [e.id, e]));
+        const byId = (x) => index.get(x);
+        return rows.map(({ record }, i) => {
+            const paths = entryPathRows([record], byId, schema.name);
+            const pathIn = (l) => {
+                const row = paths.find((r) => r.locale === l);
+                return row ? fullPath(anchors, row.anchor ?? "", row.path, l) : null;
+            };
+            const item = toEntryItem(record, sets[i].values, {
+                path: pathIn(locale),
+                locale,
+                locales: entryAlternates(record, locales, (l) => draft || record.locales[l]?.status === "published", pathIn),
+                ...(schema.seo ? { seo: entrySeo(sets[i].values, schema) } : {}),
+            });
+            return { record, item };
+        });
     }
+    const getEntries = async (collection, o = {}) => (await readEntries(collection, o)).map((r) => r.item);
     const api = {
         async getPagesTree(o) {
             const locale = localeOf(o);
@@ -273,28 +277,29 @@ export function createSmoodlySite(options) {
             if (!path)
                 return null;
             const hit = await site.resolve(locale, path, { draft: o?.draft ?? false });
-            return hit?.kind === "page" ? hit : null;
+            return hit?.kind === "page" ? toPageItem(hit) : null;
         },
         getEntries,
         async getEntry(collection, idOrPath, o) {
             schemaOf(options.collections, collection); // an unknown collection is a wiring error on every branch
             const locale = localeOf(o);
+            const draft = o?.draft ?? false;
             if (idOrPath.startsWith("/")) {
-                const hit = await site.resolve(locale, idOrPath, { draft: o?.draft ?? false });
-                return hit?.kind === "entry" && hit.collection === collection ? { entry: hit.entry, path: hit.path, locale: hit.locale, locales: hit.locales } : null;
+                const hit = await site.resolve(locale, idOrPath, { draft });
+                return hit?.kind === "entry" && hit.collection === collection ? toEntryItem(hit.entry, hit.entry.fields, hit) : null;
             }
-            const items = await getEntries(collection, { locale, draft: o?.draft ?? false });
-            const byId = items.find((i) => i.entry.id === idOrPath);
+            const [byId] = await readEntries(collection, { locale, draft, ids: [idOrPath] });
             if (byId)
-                return byId;
+                return byId.item;
             // A bare slug names a ROOT entry only (sibling-scoped slugs, spec §4):
             // match the localized slug directly (paths.ts owns slug derivation),
             // regardless of whether the collection even has a `path`.
-            return items.find((i) => i.entry.parentId === null && entrySegment(i.entry, locale) === idOrPath) ?? null;
+            const all = await readEntries(collection, { locale, draft });
+            return all.find((r) => r.record.parentId === null && entrySegment(r.record, locale) === idOrPath)?.item ?? null;
         },
         async getEntriesTree(collection, o) {
-            const items = await getEntries(collection, { locale: localeOf(o), draft: o?.draft ?? false });
-            const build = (parentId) => items.filter((i) => i.entry.parentId === parentId).map((i) => ({ ...i, children: build(i.entry.id) }));
+            const rows = await readEntries(collection, { locale: localeOf(o), draft: o?.draft ?? false });
+            const build = (parentId) => rows.filter((r) => r.record.parentId === parentId).map((r) => ({ ...r.item, children: build(r.record.id) }));
             return build(null);
         },
         async getGlobal(item, o) {
@@ -312,9 +317,9 @@ export function createSmoodlySite(options) {
                 : (await entries.getMany(item.name, [record.id], locale, { status: "published" }))[record.id];
             if (!raw)
                 return null;
-            const fields = await resolveFields(raw, item.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), assets: assetFetcher() });
+            const fields = await resolveFields(raw, item.fields, { collections: options.collections, elements: options.elements, fetch: fetcher(draft, locale), paths: pathLookup(locale), assets: assetFetcher() });
             if (!item.section)
-                return fields;
+                return { locale, fields };
             const { [SETTINGS_KEY]: settings, [STYLES_KEY]: steps, [CSS_KEY]: css, ...rest } = fields;
             const fetch = assetFetcher();
             const own = settings !== null && typeof settings === "object" ? settings : {};
@@ -324,7 +329,8 @@ export function createSmoodlySite(options) {
             // the wrapper strips it and emits data-smd-node, so the canvas selects the item and the css reaches it.
             const stepsObject = steps !== null && typeof steps === "object" ? steps : {};
             return {
-                ...rest,
+                locale,
+                fields: rest,
                 settings: own,
                 styles: { ...stepsObject, [SMD_KEY]: { node: globalNodeId(item.name), css: typeof css === "string" ? css : undefined, values: styles } },
             };

package/dist/sql-space.d.ts

@@ -12,11 +12,12 @@ export declare function currentSpaceSQL(): string;
  *  reads go through the table's one SELECT policy. `table` is as SQL names
  *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
 export declare function writePoliciesSQL(table: string, write: string, prefix: string): string;
-/** The content tables' and members' policies. A table with a public read
- *  has ONE select policy — its own space, not revoked, and a write key or
- *  the published condition — and split write policies. A table without
- *  one (refs, members) keeps its `for all` write policy, which is also its
- *  only select. */
+/** The content tables' and members' policies. Each content table has ONE
+ *  select policy — its own space, not revoked, and a write key (spec
+ *  2026-09-29 content API contract §8): no key but a write key reads
+ *  content; the publishable key serves sign-in and presence. Split write
+ *  policies beside it. `refs` and `members` keep their `for all` write
+ *  policy, which is also their only select. */
 export declare function contentPoliciesSQL(): string;
 export declare function spaceLayerSQL(): string;
 /** The media bucket and its object policies (spec 2026-09-08 media §3,

package/dist/sql-space.js

@@ -29,22 +29,6 @@ language sql stable set search_path = '' as $$
   select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
 $$;`.trim();
 }
-/** Which rows a read key (or the anon key, which has no claim) may see.
- *  null = write keys only — refs is editor tooling; members is admission
- *  data; nothing a browser needs. Global content (spec 2026-09-07) rides
- *  the three entry predicates: it is stored as entries. */
-const PUBLISHED_READ = {
-    pages: `exists (select 1 from "page_locales" l where l."page_id" = "pages"."id" and l."status" = 'published')`,
-    page_locales: `"status" = 'published'`,
-    page_versions: `exists (select 1 from "page_locales" l where l."published_version_id" = "page_versions"."id")`,
-    entries: `exists (select 1 from "entry_locales" l where l."entry_id" = "entries"."id" and l."status" = 'published')`,
-    entry_locales: `"status" = 'published'`,
-    entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
-    refs: null,
-    members: null,
-    assets: `"status" = 'ready'`,
-    paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
-};
 /** Tables whose existing indexes do not lead with space_id. */
 const NEEDS_SPACE_INDEX = [
     "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
@@ -63,16 +47,16 @@ export function writePoliciesSQL(table, write, prefix) {
 }
 const OWN = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
 const WRITE = `${OWN} and (select "smoodly_key_kind"()) = 'write'`;
-/** The content tables' and members' policies. A table with a public read
- *  has ONE select policy — its own space, not revoked, and a write key or
- *  the published condition — and split write policies. A table without
- *  one (refs, members) keeps its `for all` write policy, which is also its
- *  only select. */
+/** The content tables' and members' policies. Each content table has ONE
+ *  select policy — its own space, not revoked, and a write key (spec
+ *  2026-09-29 content API contract §8): no key but a write key reads
+ *  content; the publishable key serves sign-in and presence. Split write
+ *  policies beside it. `refs` and `members` keep their `for all` write
+ *  policy, which is also their only select. */
 export function contentPoliciesSQL() {
     const statements = [];
     for (const table of [...CONTENT_TABLES, "members"]) {
-        const published = PUBLISHED_READ[table];
-        if (published === null) {
+        if (table === "refs" || table === "members") {
             statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
                 `create policy "smoodly_write" on "${table}" for all\n` +
                 `  using (${WRITE})\n` +
@@ -82,7 +66,7 @@ export function contentPoliciesSQL() {
         statements.push(writePoliciesSQL(`"${table}"`, WRITE, "smoodly"));
         statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
             `create policy "smoodly_read" on "${table}" for select\n` +
-            `  using (${OWN} and ((select "smoodly_key_kind"()) = 'write' or ${published}));`);
+            `  using (${WRITE});`);
     }
     return statements.join("\n\n");
 }
@@ -286,6 +270,9 @@ export function mediaPoliciesSQL() {
  *  public. `smoodly_current_space` is NOT here — the stores read it through
  *  rpc(). Last in the schema, after every definition exists. */
 export function grantsSQL() {
+    // smoodly_list_entries is callable by every role on purpose: invoker
+    // rights and the read policies decide what a key sees (spec 2026-09-29
+    // content API contract §5), so there is nothing to revoke.
     return [
         `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
         `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,

package/dist/sql.d.ts

@@ -1,8 +1,13 @@
-import { type CollectionSchema } from "./collections.ts";
+import type { CollectionSchema } from "./collections.ts";
 export declare function collectionSQL(collection: CollectionSchema<any>): string;
 /** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
  *  fixes §3): a restrict or set-null check scans the referencing table
  *  without one, and the versions' read policies probe published_version_id
  *  on every public read. The composite indexes that exist lead with space_id. */
 export declare function foreignKeyIndexesSQL(): string;
+/** The shown snapshot of one collection's entries in a locale, filtered,
+ *  ordered and limited in one query (spec 2026-09-29 content API contract
+ *  §5). Invoker rights, so RLS decides what a key sees. Defined after the
+ *  space layer, whose `smoodly_key_kind` it calls. */
+export declare function listEntriesSQL(): string;
 export declare function coreTablesSQL(): string;

package/dist/sql.js

@@ -1,23 +1,18 @@
 // Schema → SQL generation (Postgres/Supabase) for the stable schema
 // (DESIGN.md §3): all collection content lives in the one `entries`
 // table, applied once and never migrated. Per collection we emit only
-// disposable guardrails — a published-only read view, created with
+// a disposable guardrail — a published-only read view, created with
 // security_invoker so it runs under the caller's own RLS policies
-// rather than the view owner's privileges (PostgREST-native reads,
-// SQL-queryable eject story) — and a partial expression index for a
-// declared order field, on the jsonb VALUE (sibling slug uniqueness
-// is the `paths` primary key plus the stores' per-locale pre-check,
-// not an index). A view joins the locale rows, one row per published
+// rather than the view owner's privileges (SQL-queryable eject story;
+// sibling slug uniqueness is the `paths` primary key plus the stores'
+// per-locale pre-check, not an index). A view joins the locale rows, one row per published
 // locale (spec 2026-09-06 §7); a versioned collection reads its
 // fields from the published snapshot.
-import { BUILT_IN_ORDER_FIELDS } from "./collections.js";
+import { SEO_KEY } from "./seo.js";
 import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
 const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 const q = (s) => `"${s}"`;
-// Casts are fine in views (unlike index expressions, which must be
-// immutable — the order field's index stays on the raw jsonb
-// expression: jsonb ordering compares numbers numerically and strings,
-// ISO dates included, alphabetically, matching the memory comparator).
+// Casts are fine in views.
 function fieldExpr(key, d, source) {
     switch (d.type) {
         case "text":
@@ -45,6 +40,8 @@ export function collectionSQL(collection) {
     for (const [key, d] of Object.entries(collection.fields)) {
         if (key === "slug")
             continue; // the segment is the row's column, never a field
+        if (key === SEO_KEY)
+            continue; // the panel's values are Smoodly-internal, not a view column
         columns.push(`${fieldExpr(key, d, source)} as ${q(snake(key))}`);
     }
     const statements = [
@@ -58,15 +55,7 @@ export function collectionSQL(collection) {
             `where e."collection" = '${name}' and l."status" = 'published';`,
         ].join("\n"),
     ];
-    // Only a declared order field needs a per-collection expression index —
-    // on the node's shared fields (an order field can be neither localized
-    // nor `slug`, which collection() refuses), the jsonb value (`->`) the
-    // adapter orders by, so the index serves the sort.
-    const order = collection.order;
-    if (order !== undefined && order !== "manual" && !BUILT_IN_ORDER_FIELDS.includes(order.by)) {
-        statements.push(`create index if not exists ${q(`entries_${name}_${snake(order.by)}_idx`)}\n` +
-            `  on "entries" (("fields"->'${order.by}')) where "collection" = '${name}';`);
-    }
+    // Ordering reads the shown snapshot (smoodly_list_entries), so no index on the live row serves it (spec 2026-09-29 content API contract §5).
     return statements.join("\n\n");
 }
 /** Foreign keys the planner needs an index for (spec 2026-09-29 pre-install
@@ -84,6 +73,53 @@ export function foreignKeyIndexesSQL() {
         `create index if not exists "assets_poster_idx" on "assets" ("poster_id");`,
     ].join("\n");
 }
+/** The shown snapshot of one collection's entries in a locale, filtered,
+ *  ordered and limited in one query (spec 2026-09-29 content API contract
+ *  §5). Invoker rights, so RLS decides what a key sees. Defined after the
+ *  space layer, whose `smoodly_key_kind` it calls. */
+export function listEntriesSQL() {
+    return `
+-- The shown snapshot of one collection's entries in a locale, filtered,
+-- ordered and limited in one query (spec 2026-09-29 content API contract
+-- §5): the published snapshot, or the live merge in preview. Invoker
+-- rights, so RLS decides what a key sees; a preview read needs the
+-- service role or a write key, anything else reads published.
+create or replace function "smoodly_list_entries"(
+  p_collection text, p_locale text, p_draft boolean, p_where jsonb, p_order jsonb,
+  p_limit integer, p_parent uuid, p_has_parent boolean, p_ids uuid[]
+) returns table ("id" uuid, "fields" jsonb) language sql stable set search_path = public as $$
+  with mode as (
+    select p_draft and (current_user = 'service_role' or "smoodly_key_kind"() = 'write') as draft
+  ), shown as (
+    select e."id", e."sort", e."created_at", l."updated_at",
+      case when (select draft from mode) then e."fields" || l."fields" || jsonb_build_object('slug', l."slug")
+           else coalesce(v."fields", e."fields" || l."fields" || jsonb_build_object('slug', l."slug")) end as "fields"
+    from "entries" e
+    join "entry_locales" l on l."entry_id" = e."id" and l."locale" = p_locale
+    left join "entry_versions" v on v."id" = l."published_version_id"
+    where e."collection" = p_collection
+      and ((select draft from mode) or l."status" = 'published')
+      and (not p_has_parent or e."parent_id" is not distinct from p_parent)
+      and (p_ids is null or e."id" = any(p_ids))
+  )
+  select s."id", s."fields" from shown s
+  where not exists (
+    select 1 from jsonb_each(coalesce(p_where, '{}'::jsonb)) w
+    where not (case when w.value ? 'in'
+                    then (s."fields" ->> w.key) = any (select jsonb_array_elements_text(w.value -> 'in'))
+                    else s."fields" @> jsonb_build_object(w.key, w.value -> 'contains') end))
+  order by
+    case when p_order ->> 'by' = 'manual' then s."sort" end asc nulls last,
+    case when p_order ->> 'direction' = 'asc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end asc nulls last,
+    case when p_order ->> 'direction' = 'desc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end desc nulls last,
+    s."created_at" asc, s."id" asc
+  limit p_limit;
+$$;`.trim();
+}
 export function coreTablesSQL() {
     return [
         // The trigger/policy blocks below drop-before-create so the migration is
@@ -352,9 +388,9 @@ $$;`.trim(),
         `
 -- RLS on every core table. The service role bypasses it (self-host
 -- adapters untouched). The policy set that follows (space layer) admits
--- a key to its own space: everything for a write key, published rows for
--- a read key or the anon key (default space). Drafts stay unreachable
--- to anything but a write key. The generated per-collection views
+-- a write key to its own space and no other key to any content (spec
+-- 2026-09-29 content API contract §8): the publishable key serves
+-- sign-in and presence, and the generated per-collection views
 -- (collectionSQL) run with security_invoker = true, so they are subject
 -- to this same smoodly_read policy rather than their owner's privileges.
 -- smoodly_meta: which version of this schema the database holds (spec
@@ -378,6 +414,7 @@ alter table "assets" enable row level security;
 alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
+        listEntriesSQL(),
         grantsSQL(),
     ].join("\n\n");
 }

package/dist/supabase-entry-store.d.ts

@@ -1,6 +1,6 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { CollectionSchema } from "./collections.ts";
-import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryScan, EntryUsage, EntryVersion, ListOptions } from "./entry-store.ts";
+import type { AddEntryLocaleOptions, CreateEntryOptions, EntryRecord, EntryStore, EntryStoreOptions, EntryScan, EntryUsage, EntryVersion, ListOptions, SnapshotQuery, SnapshotRow } from "./entry-store.ts";
 import { type DraftToken } from "./draft-token.ts";
 export declare class SupabaseEntryStore implements EntryStore {
     private db;
@@ -57,6 +57,7 @@ export declare class SupabaseEntryStore implements EntryStore {
     create(collection: string, fields: Record<string, unknown>, options: CreateEntryOptions, by?: string): Promise<EntryRecord>;
     get(collection: string, id: string): Promise<EntryRecord | null>;
     list(collection: string, options?: ListOptions): Promise<EntryRecord[]>;
+    query(collection: string, q: SnapshotQuery): Promise<SnapshotRow[]>;
     getMany(collection: string, ids: string[], locale: string, options?: {
         status?: "published";
     }): Promise<Record<string, Record<string, unknown>>>;
@@ -79,6 +80,7 @@ export declare class SupabaseEntryStore implements EntryStore {
     }): Promise<EntryRecord>;
     delete(collection: string, id: string): Promise<void>;
     resolvePath(locale: string, path: string): Promise<import("./path-index.ts").PathHit | null>;
+    pathsIn(collection: string, ids: string[], locale: string): Promise<Record<string, string>>;
     pathsOf(collection: string, id: string): Promise<Record<string, string>>;
     redirectsOf(collection: string, id: string): Promise<Record<string, string[]>>;
     reorder(collection: string, orderedIds: string[]): Promise<void>;

package/dist/supabase-entry-store.js

@@ -433,6 +433,41 @@ export class SupabaseEntryStore {
             this.fail(res.error.message);
         return res.data.map(({ gate: _gate, ...row }) => toRecord(row));
     }
+    async query(collection, q) {
+        const schema = this.schema(collection);
+        const where = {};
+        for (const [key, want] of Object.entries(q.where ?? {})) {
+            const inArray = ARRAY_FIELD_TYPES.has(schema.fields[key]?.type ?? "");
+            where[key] = Array.isArray(want) ? { in: want.map(String) } : { contains: inArray ? [want] : want };
+        }
+        const order = q.order ?? collectionOrder(schema);
+        const res = await this.db.rpc("smoodly_list_entries", {
+            p_collection: collection,
+            p_locale: q.locale,
+            p_draft: q.draft,
+            p_where: where,
+            p_order: order === "manual" ? { by: "manual" } : order,
+            p_limit: q.limit ?? null,
+            p_parent: q.parent ?? null,
+            p_has_parent: q.parent !== undefined,
+            p_ids: q.ids ? q.ids.filter((id) => UUID_RE.test(id)) : null,
+        });
+        if (res.error)
+            this.fail(res.error.message);
+        const shown = res.data;
+        if (shown.length === 0)
+            return [];
+        // In chunks: one in() over hundreds of ids would overflow the request URL.
+        const byId = new Map();
+        for (let i = 0; i < shown.length; i += 100) {
+            const recs = await this.db.from("entries").select(SELECT).in("id", shown.slice(i, i + 100).map((r) => r.id));
+            if (recs.error)
+                this.fail(recs.error.message);
+            for (const r of recs.data)
+                byId.set(r.id, toRecord(r));
+        }
+        return shown.flatMap((r) => (byId.has(r.id) ? [{ record: byId.get(r.id), fields: r.fields }] : []));
+    }
     async getMany(collection, ids, locale, options) {
         this.schema(collection);
         const uuidIds = ids.filter((id) => UUID_RE.test(id));
@@ -728,6 +763,10 @@ export class SupabaseEntryStore {
     resolvePath(locale, path) {
         return this.paths.resolve(locale, path);
     }
+    pathsIn(collection, ids, locale) {
+        this.schema(collection);
+        return this.paths.livePathsIn("entry", ids, locale);
+    }
     async pathsOf(collection, id) {
         return (await this.fetch(collection, id)) ? this.paths.pathsOf({ kind: "entry", id }) : {};
     }

package/dist/supabase-path-index.d.ts

@@ -19,6 +19,7 @@ export declare class SupabasePathIndex implements PathIndex {
     /** A locale's rows, sorted by URL in JS: the stored path is not the URL. */
     private rowsIn;
     pathsOf(target: PathTarget): Promise<Record<string, string>>;
+    livePathsIn(kind: "page" | "entry", ids: string[], locale: string): Promise<Record<string, string>>;
     redirectsOf(target: PathTarget): Promise<PathRow[]>;
     listLive(locale: string): Promise<PathRow[]>;
     listRedirects(locale: string): Promise<PathRow[]>;

package/dist/supabase-path-index.js

@@ -1,6 +1,7 @@
 import { candidates, fullPath, pickHit, sameUrlKeys } from "./anchors.js";
 import { pathLiveError, pathTakenError } from "./path-index.js";
 const UNIQUE_VIOLATION = "23505";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const COLS = "locale, anchor, path, kind, target_id, redirect";
 export class SupabasePathIndex {
     /** Held by reference: the config's addresses (spec 2026-09-29 anchored paths §2). */
@@ -84,6 +85,21 @@ export class SupabasePathIndex {
             out[r.locale] = r.path;
         return out;
     }
+    async livePathsIn(kind, ids, locale) {
+        const uuids = ids.filter((id) => UUID_RE.test(id));
+        if (uuids.length === 0)
+            return {};
+        const out = {};
+        // In chunks: one in() over hundreds of ids would overflow the request URL.
+        for (let i = 0; i < uuids.length; i += 100) {
+            const res = await this.db.from("paths").select(COLS).eq("kind", kind).eq("locale", locale).eq("redirect", false).in("target_id", uuids.slice(i, i + 100));
+            if (res.error)
+                this.fail(res.error.message);
+            for (const r of this.shown(res.data))
+                out[r.id] = r.path;
+        }
+        return out;
+    }
     redirectsOf(target) {
         return this.rowsOf(target, true);
     }