smoodly 0.0.51 → 0.0.53

package/dist/published.js

@@ -1,164 +0,0 @@
-// The delivery model's store (spec 2026-10-07 delivery model §1, §5): the
-// finished documents Publish writes, one row per page, entry or global per
-// locale, read in one lookup. Derived from the editing tables and
-// rebuildable; the memory adapter is two maps with the matcher in code, the
-// Supabase one (supabase-published-store.ts) reads published_pages,
-// published_entries, the published_routes view and smoodly_list_published.
-import { matchesWhere } from "./entry-store.js";
-const keyOf = (id, locale) => `${id}:${locale}`;
-const asc = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
-/** smoodly_list_published's ORDER BY: manual by sort, else the built-in time or
- *  the field, absent, null and empty last in both directions; ties by creation, then id. */
-function compareRows(order) {
-    return (a, b) => {
-        if (order === "manual") {
-            const d = (a.sort ?? Infinity) - (b.sort ?? Infinity);
-            if (d !== 0 && !Number.isNaN(d))
-                return d;
-        }
-        else if (order) {
-            const value = (r) => {
-                const v = order.by === "createdAt" ? r.createdAt : order.by === "updatedAt" ? r.updatedAt : r.fields[order.by];
-                return v === "" ? null : v;
-            };
-            const va = value(a), vb = value(b);
-            if (va == null && vb != null)
-                return 1;
-            if (vb == null && va != null)
-                return -1;
-            if (va != null && vb != null) {
-                const d = typeof va === "number" && typeof vb === "number" ? va - vb : String(va).localeCompare(String(vb));
-                if (d !== 0)
-                    return order.direction === "asc" ? d : -d;
-            }
-        }
-        return asc(a.createdAt, b.createdAt) || asc(a.id, b.id);
-    };
-}
-/** An address holds one row per table, as the SQL's unique (space, locale, path) index says: a row of another id
- *  left at an incoming address (a stale row a capped rename did not reach) goes before the write. */
-function vacate(map, rows) {
-    const incoming = new Map(rows.filter((r) => r.path !== null).map((r) => [`${r.locale}\u0000${r.path}`, r.id]));
-    for (const [k, row] of map) {
-        const holder = row.path === null ? undefined : incoming.get(`${row.locale}\u0000${row.path}`);
-        if (holder !== undefined && holder !== row.id)
-            map.delete(k);
-    }
-}
-export class MemoryPublishedStore {
-    constructor() {
-        this.pages = new Map();
-        this.entryRows = new Map();
-        this.recorded = null;
-        this.deploy = null;
-        this.removedAt = null;
-    }
-    async recordedModel() {
-        return this.recorded;
-    }
-    async recordModel(model) {
-        this.recorded = model;
-    }
-    async newestPublishedAt() {
-        const all = [...this.pages.values(), ...this.entryRows.values()].map((r) => r.publishedAt);
-        return all.length === 0 ? null : Math.max(...all);
-    }
-    async countPublishedAfter(since) {
-        return [...this.pages.values(), ...this.entryRows.values()].filter((r) => r.publishedAt > since).length;
-    }
-    async deployRequest() {
-        return this.deploy;
-    }
-    async requestDeploy(by, at = Date.now()) {
-        this.deploy = { at, by };
-    }
-    async countBehind(model) {
-        const rows = [...this.pages.values(), ...this.entryRows.values()];
-        return { behind: rows.filter((r) => r.model !== model).length, total: rows.length };
-    }
-    async putPages(rows, options) {
-        vacate(this.pages, rows);
-        for (const row of rows) {
-            const kept = options?.keep ? this.pages.get(keyOf(row.id, row.locale))?.publishedAt : undefined;
-            this.pages.set(keyOf(row.id, row.locale), structuredClone(kept === undefined ? row : { ...row, publishedAt: kept }));
-        }
-    }
-    async putEntries(rows, options) {
-        vacate(this.entryRows, rows);
-        for (const row of rows) {
-            const kept = options?.keep ? this.entryRows.get(keyOf(row.id, row.locale))?.publishedAt : undefined;
-            this.entryRows.set(keyOf(row.id, row.locale), structuredClone(kept === undefined ? row : { ...row, publishedAt: kept }));
-        }
-    }
-    async remove(keys) {
-        let deleted = 0;
-        for (const key of keys) {
-            const map = key.kind === "page" ? this.pages : this.entryRows;
-            for (const [k, row] of map)
-                if (row.id === key.id && (key.locale === undefined || row.locale === key.locale)) {
-                    map.delete(k);
-                    deleted += 1;
-                }
-        }
-        // Only a row that went is a change (a key with no row is not): the Deploy tile counts it (spec 2026-10-09 §5).
-        if (deleted > 0)
-            this.removedAt = Date.now();
-    }
-    async lastRemovalAt() {
-        return this.removedAt;
-    }
-    async byAddress(locale, path, globals) {
-        const found = () => {
-            for (const row of this.pages.values()) {
-                if (row.locale === locale && row.path === path && row.hasPage)
-                    return { kind: "page", row: structuredClone(row) };
-            }
-            for (const row of this.entryRows.values()) {
-                if (row.locale === locale && row.path === path)
-                    return { kind: "entry", row: structuredClone(row) };
-            }
-            return null;
-        };
-        const route = found();
-        if (!route || !globals)
-            return route;
-        const wanted = new Set(globals);
-        route.globals = structuredClone([...this.entryRows.values()].filter((r) => r.locale === locale && wanted.has(r.collection)));
-        return route;
-    }
-    async page(id, locale) {
-        const row = this.pages.get(keyOf(id, locale));
-        return row ? structuredClone(row) : null;
-    }
-    async entry(id, locale) {
-        const row = this.entryRows.get(keyOf(id, locale));
-        return row ? structuredClone(row) : null;
-    }
-    async entries(collection, q) {
-        const wanted = q.ids ? new Set(q.ids) : null;
-        const rows = [...this.entryRows.values()].filter((r) => r.collection === collection &&
-            r.locale === q.locale &&
-            (q.parent === undefined || r.parentId === q.parent) &&
-            (!wanted || wanted.has(r.id)) &&
-            (!q.where || matchesWhere(r.fields, q.where)));
-        rows.sort(compareRows(q.order));
-        return structuredClone(typeof q.limit === "number" ? rows.slice(0, q.limit) : rows);
-    }
-    async tree(locale) {
-        return [...this.pages.values()]
-            .filter((r) => r.locale === locale)
-            .sort((a, b) => {
-            const d = (a.sort ?? Infinity) - (b.sort ?? Infinity);
-            return (d !== 0 && !Number.isNaN(d) ? d : 0) || asc(a.publishedAt, b.publishedAt) || asc(a.id, b.id);
-        })
-            .map(({ id, parentId, sort, path, title, hasPage, linkFields, model, stale }) => structuredClone({ id, parentId, sort, path, title, hasPage, linkFields, model, stale }));
-    }
-    async markStale(keys) {
-        for (const key of keys) {
-            const map = key.kind === "page" ? this.pages : this.entryRows;
-            for (const row of map.values())
-                if (row.id === key.id && (key.locale === undefined || row.locale === key.locale))
-                    row.stale = true;
-        }
-    }
-}

package/dist/ref-index.d.ts

@@ -1,19 +0,0 @@
-import type { RefEdge } from "./refs.ts";
-export type RefSource = {
-    sourceKind: string;
-    sourceId: string;
-};
-export declare class MemoryRefIndex {
-    private rows;
-    /** Replace a source's outgoing edges wholesale (what every save does). */
-    rewrite(source: RefSource, edges: RefEdge[]): void;
-    remove({ sourceKind, sourceId }: RefSource): void;
-    /** The reverse question: who points at this target? */
-    to(targetCollection: string, targetId: string): {
-        sourceKind: string;
-        sourceId: string;
-        sourceField: string;
-    }[];
-    /** Reverse lookup by id alone (ids are globally unique) — the fan-out walk. */
-    incoming(targetId: string): RefSource[];
-}

package/dist/schema-read.d.ts

@@ -1,23 +0,0 @@
-import type { SupabaseClient } from "@supabase/supabase-js";
-export type SchemaRead = {
-    version: number;
-} | {
-    missing: "key" | "schema";
-};
-/** The policies show `smoodly_meta` to a write key only, so no visible row means the key is not a secret key (spec §5). */
-export declare function readSchemaVersion(db: SupabaseClient): Promise<SchemaRead>;
-/** How long a refused key is believed before it is read again. */
-export declare const KEY_RECHECK_MS = 30000;
-/** The site's schema check, once per process (spec 2026-09-26 §5). An old or missing schema warns
- *  and never blocks. A key that cannot see the version row reads every table as empty rather than
- *  refused, so lookups fail instead of serving empty pages and 404s (decided 2026-10-02) — but only
- *  for {@link KEY_RECHECK_MS}: a fixed key or a briefly missing row recovers without a restart. A
- *  failed read refuses nothing and is tried again; the lookup itself names that error. */
-export declare class SecretKeyCheck {
-    private readonly read;
-    private readonly now;
-    private pending;
-    private refusedAt;
-    constructor(read: () => Promise<SchemaRead>, now?: () => number);
-    refused(): Promise<boolean>;
-}

package/dist/schema-read.js

@@ -1,50 +0,0 @@
-import { SCHEMA_VERSION_KEY, schemaBehind, schemaBehindMessage } from "./schema-version.js";
-/** The policies show `smoodly_meta` to a write key only, so no visible row means the key is not a secret key (spec §5). */
-export async function readSchemaVersion(db) {
-    const res = await db.from("smoodly_meta").select("value").eq("key", SCHEMA_VERSION_KEY).maybeSingle();
-    if (res.error) {
-        // PGRST205: not in PostgREST's schema cache; 42P01: undefined table; 42501: no grant.
-        if (res.error.code === "PGRST205" || res.error.code === "42P01")
-            return { missing: "schema" };
-        if (res.error.code === "42501")
-            return { missing: "key" };
-        throw new Error(`smoodly: reading the schema version: ${res.error.message}`);
-    }
-    const n = Number(res.data?.value);
-    return res.data && Number.isInteger(n) ? { version: n } : { missing: "key" };
-}
-/** How long a refused key is believed before it is read again. */
-export const KEY_RECHECK_MS = 30000;
-/** The site's schema check, once per process (spec 2026-09-26 §5). An old or missing schema warns
- *  and never blocks. A key that cannot see the version row reads every table as empty rather than
- *  refused, so lookups fail instead of serving empty pages and 404s (decided 2026-10-02) — but only
- *  for {@link KEY_RECHECK_MS}: a fixed key or a briefly missing row recovers without a restart. A
- *  failed read refuses nothing and is tried again; the lookup itself names that error. */
-export class SecretKeyCheck {
-    constructor(read, now = Date.now) {
-        this.read = read;
-        this.now = now;
-        this.pending = null;
-        this.refusedAt = null;
-    }
-    refused() {
-        if (this.refusedAt !== null && this.now() - this.refusedAt >= KEY_RECHECK_MS)
-            this.pending = null;
-        this.pending ?? (this.pending = this.read().then((read) => {
-            if ("missing" in read && read.missing === "key") {
-                this.refusedAt = this.now();
-                return true;
-            }
-            this.refusedAt = null;
-            if ("missing" in read)
-                console.warn(schemaBehindMessage(null));
-            else if (schemaBehind(read.version))
-                console.warn(schemaBehindMessage(read.version));
-            return false;
-        }, () => {
-            this.pending = null;
-            return false;
-        }));
-        return this.pending;
-    }
-}

package/dist/schema-version.d.ts

@@ -1,19 +0,0 @@
-/** The minimum schema version the package needs. Moves ONLY in a release
- *  that adds a table, column, function or policy the package reads; a
- *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 11;
-export declare const SCHEMA_VERSION_KEY = "schema_version";
-export declare const CORE_FILE_RE: RegExp;
-export declare const VIEWS_FILE_RE: RegExp;
-/** The version a core file leaves behind, from its name; null for anything else. */
-export declare function coreFileVersion(name: string): number | null;
-/** The last statement of every core file. */
-export declare function schemaVersionSQL(version: number): string;
-/** Behind blocks the admin and warns on the site (§5). Null = no
- *  `smoodly_meta` table, a database older than version 1. Ahead is the
- *  normal state of a cloud app between our migration and its package
- *  bump, and is fine. */
-export declare const schemaBehind: (database: number | null, required?: number) => boolean;
-export declare function schemaBehindMessage(database: number | null, required?: number): string;
-/** The version row is hidden from anything but a secret key, so an invisible row means the wrong key, not an old schema. */
-export declare const secretKeyRefusedMessage = "smoodly: SMOODLY_SECRET_KEY cannot read the schema version \u2014 it is not the project's secret (service-role) key; the publishable key there is the usual mix-up.";

package/dist/schema-version.js

@@ -1,34 +0,0 @@
-// packages/smoodly/src/schema-version.ts
-// The schema version this package needs (spec 2026-09-26 §1) and the two
-// things every side agrees on: the `smoodly_meta` row that records a
-// database's version, and the names of the files the package ships. Pure
-// and framework-free — the SQL emitters, the CLI, the stores, the admin
-// op and the shell all read it from here.
-/** The minimum schema version the package needs. Moves ONLY in a release
- *  that adds a table, column, function or policy the package reads; a
- *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 11;
-export const SCHEMA_VERSION_KEY = "schema_version";
-export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
-export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;
-/** The version a core file leaves behind, from its name; null for anything else. */
-export function coreFileVersion(name) {
-    const m = CORE_FILE_RE.exec(name);
-    return m ? Number(m[2]) : null;
-}
-/** The last statement of every core file. */
-export function schemaVersionSQL(version) {
-    return (`insert into "smoodly_meta" ("key", "value") values ('${SCHEMA_VERSION_KEY}', '${version}')\n` +
-        `  on conflict ("key") do update set "value" = excluded."value";`);
-}
-/** Behind blocks the admin and warns on the site (§5). Null = no
- *  `smoodly_meta` table, a database older than version 1. Ahead is the
- *  normal state of a cloud app between our migration and its package
- *  bump, and is fine. */
-export const schemaBehind = (database, required = SCHEMA_VERSION) => database === null || database < required;
-export function schemaBehindMessage(database, required = SCHEMA_VERSION) {
-    return (`smoodly: the database schema is at version ${database ?? "none"}; this Smoodly needs version ${required}. ` +
-        "Run `npx smoodly migrate`, then apply it: `supabase db push` (hosted) or `supabase migration up` (local).");
-}
-/** The version row is hidden from anything but a secret key, so an invisible row means the wrong key, not an old schema. */
-export const secretKeyRefusedMessage = "smoodly: SMOODLY_SECRET_KEY cannot read the schema version — it is not the project's secret (service-role) key; the publishable key there is the usual mix-up.";

package/dist/sql-space.d.ts

@@ -1,44 +0,0 @@
-/** The one space a self-host install has; the space a request with no
- *  claim resolves to. The bare uuid — code needs the value (a shared
- *  item's id namespace), SQL needs it quoted. */
-export declare const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
-export declare const DEFAULT_SPACE = "'00000000-0000-0000-0000-000000000000'";
-export declare const SPACE_COL = "\"space_id\" uuid not null default '00000000-0000-0000-0000-000000000000'";
-export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_versions", "entries", "entry_locales", "entry_versions", "refs", "paths", "assets"];
-export type ContentTable = (typeof CONTENT_TABLES)[number];
-/** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
- *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived.
- *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current;
- *  `space_deploys` (schema v11) one row per space: the last Deploy press of static mode. */
-export declare const DELIVERY_TABLES: readonly ["published_pages", "published_entries", "published_models", "space_deploys"];
-export declare function currentSpaceSQL(): string;
-/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
- *  the write key's insert, update and delete, each alone for its action; its
- *  reads go through the table's one SELECT policy. `table` is as SQL names
- *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
-export declare function writePoliciesSQL(table: string, write: string, prefix: string): string;
-/** The content tables' and members' policies. Each content table has ONE
- *  select policy — its own space, not revoked, and a write key (spec
- *  2026-09-29 content API contract §8): no key but a write key reads
- *  content; the publishable key serves sign-in and presence. Split write
- *  policies beside it. `refs` and `members` keep their `for all` write
- *  policy, which is also their only select. */
-export declare function contentPoliciesSQL(): string;
-export declare function spaceLayerSQL(): string;
-/** The media bucket and its object policies (spec 2026-09-08 media §3,
- *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
- *  a write key under its own space's prefix only; the service role
- *  bypasses; signed uploads are minted server-side with that same key.
- *  Schema-qualified calls: storage policies do not run with public on
- *  the search path. Last in the migration, after the functions exist. */
-export declare function storageSQL(): string;
-/** The media bucket's write policies: insert, update, delete for a write
- *  key under its own space's prefix; reads are the public select above. */
-export declare function mediaPoliciesSQL(): string;
-/** The three mutation RPCs are the stores' verbs, never a browser's (spec
- *  2026-09-26 security pass §2): executable by the service role and by
- *  `authenticated` (the role a cloud write key carries), not by anon or
- *  public. `smoodly_current_space` is NOT here — the stores read it through
- *  rpc(). Last in the schema, after every definition exists. */
-export declare function grantsSQL(): string;

package/dist/sql-space.js

@@ -1,289 +0,0 @@
-// The space layer of the stable schema (spec 2026-09-04 §2–§3). A space
-// is one cloud environment; a self-host install is one space with the
-// default id. Everything that needs "which space is this request in"
-// reads smoodly_current_space() — the adapters never mention spaces.
-/** The one space a self-host install has; the space a request with no
- *  claim resolves to. The bare uuid — code needs the value (a shared
- *  item's id namespace), SQL needs it quoted. */
-export const DEFAULT_SPACE_ID = "00000000-0000-0000-0000-000000000000";
-export const DEFAULT_SPACE = `'${DEFAULT_SPACE_ID}'`;
-export const SPACE_COL = `"space_id" uuid not null default ${DEFAULT_SPACE}`;
-export const CONTENT_TABLES = [
-    "pages",
-    "page_locales",
-    "page_versions",
-    "entries",
-    "entry_locales",
-    "entry_versions",
-    "refs",
-    "paths",
-    "assets",
-];
-/** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
- *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived.
- *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current;
- *  `space_deploys` (schema v11) one row per space: the last Deploy press of static mode. */
-export const DELIVERY_TABLES = ["published_pages", "published_entries", "published_models", "space_deploys"];
-export function currentSpaceSQL() {
-    return `
--- The space a request acts in: the key's claim in Smoodly Cloud, the
--- default space in self-host (service role, anon key). Policies, the
--- insert trigger and the reorder RPC all read this ONE function.
-create or replace function "smoodly_current_space"() returns uuid
-language sql stable set search_path = '' as $$
-  select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
-$$;`.trim();
-}
-/** Tables whose existing indexes do not lead with space_id. */
-const NEEDS_SPACE_INDEX = [
-    "page_locales", "page_versions", "entry_locales", "entry_versions", "refs",
-];
-/** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
- *  the write key's insert, update and delete, each alone for its action; its
- *  reads go through the table's one SELECT policy. `table` is as SQL names
- *  it (`"pages"`, `storage.objects`). Drops the old `for all` policy first. */
-export function writePoliciesSQL(table, write, prefix) {
-    return [
-        `drop policy if exists "${prefix}_write" on ${table};`,
-        `drop policy if exists "${prefix}_insert" on ${table};\ncreate policy "${prefix}_insert" on ${table} for insert\n  with check (${write});`,
-        `drop policy if exists "${prefix}_update" on ${table};\ncreate policy "${prefix}_update" on ${table} for update\n  using (${write})\n  with check (${write});`,
-        `drop policy if exists "${prefix}_delete" on ${table};\ncreate policy "${prefix}_delete" on ${table} for delete\n  using (${write});`,
-    ].join("\n\n");
-}
-const OWN = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
-const WRITE = `${OWN} and (select "smoodly_key_kind"()) = 'write'`;
-/** The content tables' and members' policies. Each content table has ONE
- *  select policy — its own space, not revoked, and a write key (spec
- *  2026-09-29 content API contract §8): no key but a write key reads
- *  content; the publishable key serves sign-in and presence. Split write
- *  policies beside it. `refs` and `members` keep their `for all` write
- *  policy, which is also their only select. */
-export function contentPoliciesSQL() {
-    const statements = [];
-    for (const table of [...CONTENT_TABLES, ...DELIVERY_TABLES, "members"]) {
-        if (table === "refs" || table === "members") {
-            statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
-                `create policy "smoodly_write" on "${table}" for all\n` +
-                `  using (${WRITE})\n` +
-                `  with check (${WRITE});`);
-            continue;
-        }
-        statements.push(writePoliciesSQL(`"${table}"`, WRITE, "smoodly"));
-        statements.push(`drop policy if exists "smoodly_read" on "${table}";\n` +
-            `create policy "smoodly_read" on "${table}" for select\n` +
-            `  using (${WRITE});`);
-    }
-    return statements.join("\n\n");
-}
-export function spaceLayerSQL() {
-    const statements = [];
-    statements.push(`
--- ── Cloud state (spec 2026-09-04 §1, names 2026-09-25): three ordinary
--- tables, shipped for everyone with ONE definition. Self-host fills them
--- by hand or leaves them empty; smoodly.io writes rows with the service
--- role. There is never cloud-only SQL on a content database.
--- members: who may open /admin for a space (spec 2026-09-25 §1–§2). The
--- email is stored so the Members page needs no Auth lookup — the auth
--- project is not the content project in the cloud.
-create table if not exists "members" (
-  ${SPACE_COL},
-  "user_id" uuid not null,
-  "email" text,
-  "role" text not null default 'editor',
-  primary key ("space_id", "user_id")
-);
-
-create table if not exists "space_keys" (
-  "id" uuid primary key,
-  "space_id" uuid not null,
-  "kind" text not null check ("kind" in ('read', 'write')),
-  "revoked_at" timestamptz
-);
-
--- spaces: the control plane's row for a space (spec 2026-09-25 §3). No
--- row = self-host: no cap, members managed in /admin. console_url set =
--- smoodly.io manages the members and /admin links there.
-create table if not exists "spaces" (
-  "space_id" uuid primary key,
-  "row_cap" integer,
-  "console_url" text
-);
-
-alter table "members" enable row level security;
-alter table "space_keys" enable row level security;
-alter table "spaces" enable row level security;
-
--- ── Claim readers. The two lookups run as definer so they can read the
--- service-role-only tables from inside a policy; search_path is pinned.
-create or replace function "smoodly_key_kind"() returns text
-language sql stable set search_path = '' as $$
-  select auth.jwt() ->> 'kind';
-$$;
-
-create or replace function "smoodly_space_key_revoked"() returns boolean
-language sql stable security definer set search_path = public as $$
-  select coalesce(
-    (select k."revoked_at" is not null from "space_keys" k
-      where k."id" = (auth.jwt() ->> 'key_id')::uuid),
-    false);
-$$;
-
-create or replace function "smoodly_space_row_cap"() returns integer
-language sql stable security definer set search_path = public as $$
-  select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
-$$;
-
--- The presence gate (spec 2026-09-26 security pass §1): the caller is a
--- member of the space the Realtime topic names. auth.uid() is the session
--- token's subject — the anon key and a read key carry none, so a visitor
--- is refused at join. Definer, because members has no read policy for
--- anyone but a write key. No space claim is read: the same rule serves
--- the cloud once the content project accepts smoodly.io's tokens (OQ 32).
-create or replace function "smoodly_presence_member"() returns boolean
-language sql stable security definer set search_path = public as $$
-  select exists (select 1 from "members" m
-    where m."user_id" = auth.uid()
-      and realtime.topic() = 'space:' || m."space_id"::text);
-$$;
-
--- ── Triggers. A key's claim wins over whatever the insert said, so an
--- adapter never has to know its space and cannot write into another.
--- No claim (service role, anon) leaves the given or default value —
--- that is how smoodly.io writes cloud-state rows for a chosen space.
-create or replace function "smoodly_set_space"() returns trigger
-language plpgsql set search_path = '' as $$
-begin
-  if auth.jwt() ->> 'space_id' is not null then
-    new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
-  end if;
-  return new;
-end;
-$$;
-
--- Per table, per space. No spaces row, or a null cap = no cap (self-host). Trigger
--- a_ (smoodly_set_space) runs first, so new.space_id already equals the
--- current space for a keyed insert; smoodly_space_row_cap() reads the
--- current space itself, so this never needs the row's space_id as an
--- argument (which would let one space's insert probe another's cap).
--- A service-role insert that names another space explicitly is a
--- different case: there is no JWT claim, so smoodly_current_space()
--- still resolves to the default space, and the cap read is the default
--- space's (none) — the service role is never capped by another space's row.
--- search_path is pinned empty, so every reference below is schema-qualified.
-create or replace function "smoodly_enforce_row_cap"() returns trigger
-language plpgsql set search_path = '' as $$
-declare
-  cap integer;
-  n bigint;
-begin
-  cap := public."smoodly_space_row_cap"();
-  if cap is null then
-    return new;
-  end if;
-  -- Advisory only (free-tier abuse guard), not a hard invariant: two
-  -- concurrent inserts can both observe n = cap - 1 and both pass.
-  execute format('select count(*) from %I.%I where "space_id" = $1', tg_table_schema, tg_table_name)
-    into n using new."space_id";
-  if n >= cap then
-    raise exception 'smoodly: row cap (%) reached for this space in %', cap, tg_table_name
-      using errcode = 'check_violation';
-  end if;
-  return new;
-end;
-$$;`.trim());
-    for (const table of NEEDS_SPACE_INDEX) {
-        statements.push(`create index if not exists "${table}_space_idx" on "${table}" ("space_id");`);
-    }
-    // Trigger names sort a_ before b_: same-event triggers fire alphabetically.
-    for (const table of [...CONTENT_TABLES, ...DELIVERY_TABLES, "members"]) {
-        statements.push(`drop trigger if exists "smoodly_a_set_space" on "${table}";\n` +
-            `create trigger "smoodly_a_set_space" before insert on "${table}"\n` +
-            `  for each row execute function "smoodly_set_space"();`);
-    }
-    for (const table of CONTENT_TABLES) {
-        statements.push(`drop trigger if exists "smoodly_b_row_cap" on "${table}";\n` +
-            `create trigger "smoodly_b_row_cap" before insert on "${table}"\n` +
-            `  for each row execute function "smoodly_enforce_row_cap"();`);
-    }
-    // Policies (permissive, so read OR write admits). The service role
-    // bypasses them all — self-host adapters are untouched. Each function
-    // call sits in its own scalar subquery so the planner hoists it into
-    // an InitPlan, evaluated once per statement rather than once per row
-    // — needed for smoodly_space_key_revoked, a security definer function
-    // Postgres never inlines; applied to all three calls for the same win.
-    const own = OWN;
-    const write = WRITE;
-    statements.push(contentPoliciesSQL());
-    // A write key reads its own space's row — the console URL the Members
-    // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
-    // space_keys but the two definer functions and the service role.
-    statements.push(`drop policy if exists "smoodly_read" on "spaces";\n` +
-        `create policy "smoodly_read" on "spaces" for select\n` +
-        `  using (${write});`);
-    // The package reads its schema version with the write key (the
-    // service role bypasses anyway); nothing else sees the table. No
-    // space_id: the schema is one per database (spec 2026-09-26 §1).
-    statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
-        `create policy "smoodly_read" on "smoodly_meta" for select\n` +
-        `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
-    // The editing-presence channel (spec 2026-09-26 concurrency §5; gated
-    // 2026-09-26 security pass §1): one private Realtime topic per space,
-    // `space:<id>`. A caller receives on and sends to a topic only when a
-    // members row of that space names their session's user — the browser
-    // authenticates the socket with the editor's session token, never with
-    // the public key alone. Identical in self-host and the cloud.
-    const member = `(select public."smoodly_presence_member"())`;
-    statements.push(`drop policy if exists "smoodly_presence_read" on "realtime"."messages";\n` +
-        `create policy "smoodly_presence_read" on "realtime"."messages" for select\n` +
-        `  using (${member});`);
-    statements.push(`drop policy if exists "smoodly_presence_write" on "realtime"."messages";\n` +
-        `create policy "smoodly_presence_write" on "realtime"."messages" for insert\n` +
-        `  with check (${member});`);
-    statements.push(storageSQL());
-    return statements.join("\n\n");
-}
-/** The media bucket and its object policies (spec 2026-09-08 media §3,
- *  §12). Public read: the CDN and next/image fetch without tokens. Writes:
- *  a write key under its own space's prefix only; the service role
- *  bypasses; signed uploads are minted server-side with that same key.
- *  Schema-qualified calls: storage policies do not run with public on
- *  the search path. Last in the migration, after the functions exist. */
-export function storageSQL() {
-    return `
-insert into storage.buckets ("id", "name", "public", "file_size_limit")
-  values ('media', 'media', true, 104857600)
-  on conflict ("id") do update set "public" = excluded."public", "file_size_limit" = excluded."file_size_limit";
-
-drop policy if exists "smoodly_media_read" on storage.objects;
-create policy "smoodly_media_read" on storage.objects for select
-  using ("bucket_id" = 'media');
-
-${mediaPoliciesSQL()}`.trim();
-}
-/** The media bucket's write policies: insert, update, delete for a write
- *  key under its own space's prefix; reads are the public select above. */
-export function mediaPoliciesSQL() {
-    const write = `"bucket_id" = 'media'` +
-        ` and (select public."smoodly_key_kind"()) = 'write'` +
-        ` and not (select public."smoodly_space_key_revoked"())` +
-        ` and split_part("name", '/', 1) = (select public."smoodly_current_space"())::text`;
-    return writePoliciesSQL("storage.objects", write, "smoodly_media");
-}
-/** The three mutation RPCs are the stores' verbs, never a browser's (spec
- *  2026-09-26 security pass §2): executable by the service role and by
- *  `authenticated` (the role a cloud write key carries), not by anon or
- *  public. `smoodly_current_space` is NOT here — the stores read it through
- *  rpc(). Last in the schema, after every definition exists. */
-export function grantsSQL() {
-    // smoodly_list_entries and smoodly_list_published are callable by every
-    // role on purpose: invoker rights and the read policies decide what a key
-    // sees (spec 2026-09-29 content API contract §5), so there is nothing to
-    // revoke; the published_routes view is security_invoker for the same reason.
-    return [
-        `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
-        `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
-        `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
-        `revoke execute on function "smoodly_space_row_cap"() from public, anon;`,
-    ].join("\n");
-}