smoodly 0.0.22 → 0.0.24

package/README.md

@@ -239,7 +239,7 @@ Implemented:
 
 - The space layer (spec 2026-09-04 §3): `space_id` on every content
   table, `smoodly_current_space()`, the insert trigger, the row cap, the
-  three cloud-state tables (`editors`, `space_keys`, `space_caps`) and
+  three cloud-state tables (`members`, `space_keys`, `spaces`) and
   the policy set. Service role bypasses it; a write key is scoped to its
   space. Contract suites run in both modes; `test/isolation.supabase.test.ts`
   proves isolation. Generated per-collection views are `security_invoker`,
@@ -495,6 +495,14 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-25, docs session)
+
+- `f.slug({ from })` stores `from` on the descriptor, but nothing reads it:
+  the admin never derives a slug from the named field. Either wire it (fill
+  the slug from `from` while the slug is untouched, in the entry form) or
+  drop the option. The Fields guide documents the slug as a plain text box
+  with the URL prefix and does not mention `from`.
+
 ## Follow-ups (logged 2026-09-17, admin path spec)
 
 - A robots `Disallow` for the admin path from `next/meta`.
@@ -624,6 +632,33 @@ tool — reset and reseed a development database (`supabase db reset`,
   the control never offers it there, so nothing shows — the store could
   answer it as a no-op instead.
 
+## Follow-ups (logged 2026-09-25, settings + members spec)
+
+- Existing databases (every install so far is ours; DESIGN.md OQ #2):
+  `alter table "editors" rename to "members";`
+  `alter table "members" add column "email" text;`
+  `alter table "space_caps" rename to "spaces";`
+  `alter table "spaces" alter column "row_cap" drop not null;`
+  `alter table "spaces" add column "console_url" text;`
+  `update "members" set "role" = 'admin' where "role" = 'owner';`
+  then re-run the regenerated migration's `smoodly_space_row_cap` function
+  and the `smoodly_read` policy on `spaces` (both `create or replace` /
+  `drop … if exists`, so the whole migration file can be re-applied).
+  Policies and triggers follow a table rename. Rows written before the
+  column show their user id on the Members page until re-inserted (the
+  demo-editor upsert fills it on the next seed).
+- Members management shipped 2026-09-25 (spec
+  `docs/superpowers/specs/2026-09-25-members-management-design.md`); out
+  of its scope: a pending-invite status and "resend invite" on a row
+  (needs the Auth user's `last_sign_in_at`, which the cloud projection
+  does not carry); removing the Auth account together with the member
+  row; invites from the cloud's `/admin` (they are smoodly.io's); a
+  project whose Auth is OAuth-only (the invite mail asks for a password);
+  redirects on a published rename (the confirm says "there are none
+  yet"). The API Keys page's contents are DESIGN.md OQ #33.
+- The members list is not paged (tens of rows, not thousands).
+- The `api-keys` page id is a URL segment; the title reads "API Keys".
+
 ## Follow-ups (logged 2026-09-13, history spec)
 
 - Existing databases (every install so far is ours; DESIGN.md OQ #2):
@@ -1616,7 +1651,7 @@ the toolbar instead of pushing the content.
 - Light/dark toggle (nav foot): the choice is stored in `localStorage`
   (`smoodly-theme`) and written as `data-theme` on the admin wrapper, never on
   the host `<html>`. It is per browser, not per editor account — a server-side
-  preference would need a place to live (`editors`, or a cloud user profile).
+  preference would need a place to live (`members`, or a cloud user profile).
 - `lucide-react` is now a runtime dependency, for the toggle's two icons. The
   rest of the UI still uses the design system's unicode glyphs (↑ ↓ ⧉ × ··· ▾
   ← ⋮⋮); swapping them for Lucide is the next step whenever it is wanted.
@@ -1636,7 +1671,7 @@ the toolbar instead of pushing the content.
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
 - Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `isEditor` reads `editors` with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/auth.d.ts

@@ -1,13 +1,18 @@
+import { type MemberRole } from "../permissions.ts";
 import type { AdminOpCall, OpResult } from "./ops.ts";
-/** The verified editor: the Auth user id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
-export type AdminSession = {
+/** What the auth project vouches for: the Auth user id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
+export type VerifiedUser = {
     userId: string;
     email: string | null;
 };
+/** The verified member: the user plus the normalized role from `members`. */
+export type AdminSession = VerifiedUser & {
+    role: MemberRole;
+};
 export type AdminAuth = {
     /** The user behind a session token, or null when the auth project rejects it. */
-    verify(token: string): Promise<AdminSession | null>;
-    /** Does `editors` hold this user for the current space? */
-    isEditor(userId: string): Promise<boolean>;
+    verify(token: string): Promise<VerifiedUser | null>;
+    /** The stored role of this user in `members` for the current space, or null without a row. */
+    memberOf(userId: string): Promise<string | null>;
 };
 export declare function gateAdminOp(auth: AdminAuth, call: AdminOpCall, run: (call: AdminOpCall, session: AdminSession) => Promise<OpResult<unknown>>): Promise<OpResult<unknown>>;

package/dist/admin/auth.js

@@ -1,3 +1,9 @@
+// Admission to the admin (spec 2026-09-04 §5; roles 2026-09-25 members
+// management §2): a session token from the auth project, then a row in
+// `members` read with the write key, whose role rides on the session.
+// One gate around the ops seam — individual ops ask can(). Framework-
+// free; Supabase-backed implementation in supabase-auth.ts.
+import { normalizeRole } from "../permissions.js";
 const unauthorized = (message) => ({ ok: false, code: "unauthorized", message });
 export async function gateAdminOp(auth, call, run) {
     const token = typeof call === "object" && call !== null && typeof call.token === "string"
@@ -5,24 +11,19 @@ export async function gateAdminOp(auth, call, run) {
         : null;
     if (!token)
         return unauthorized("smoodly: sign in to use the admin.");
-    let session;
-    let editor;
+    let user;
+    let stored;
     try {
-        session = await auth.verify(token);
-        if (!session)
+        user = await auth.verify(token);
+        if (!user)
             return unauthorized("smoodly: your session has expired — sign in again.");
-        editor = await auth.isEditor(session.userId);
+        stored = await auth.memberOf(user.userId);
     }
     catch (e) {
         console.error("smoodly: auth check failed", e);
-        return {
-            ok: false,
-            code: "internal",
-            message: "smoodly: could not check your session.",
-        };
+        return { ok: false, code: "internal", message: "smoodly: could not check your session." };
     }
-    if (!editor) {
+    if (stored === null)
         return unauthorized("smoodly: this account is not an editor of this site.");
-    }
-    return run(call, session);
+    return run(call, { ...user, role: normalizeRole(stored) });
 }

package/dist/admin/client-ops.js

@@ -3,6 +3,7 @@ const GROUPS = {
     entries: ["list", "distinct", "get", "create", "save", "setStatus", "discardDraft", "delete", "move", "addLocale", "removeLocale", "listVersions", "getVersion", "restore"],
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
+    members: ["list", "me", "invite", "setRole", "remove"],
     preview: ["enable", "disable"],
 };
 export function makeClientOps(action, token) {

package/dist/admin/editor/PageSettings.js

@@ -10,6 +10,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useState } from "react";
 import { updatedLine } from "../ui/format.js";
 import { Field, InfoRow, SectionLabel } from "../ui/primitives.js";
+import { confirmLiveUrl } from "../shell/live-url.js";
 export function PageSettings({ record, locale, registry, path, fixed, onRename }) {
     const row = record.locales[locale];
     const [draft, setDraft] = useState({ title: row?.title ?? "", slug: row?.slug ?? "" });
@@ -30,6 +31,11 @@ export function PageSettings({ record, locale, registry, path, fixed, onRename }
             setError(`A ${key} is required — nothing falls back to another locale.`);
             return;
         }
+        // A published slug is a live URL: one confirm, Cancel restores the input (members management §5).
+        if (key === "slug" && !confirmLiveUrl({ status: row.status, from: row.slug, to: next })) {
+            setDraft((d) => ({ ...d, slug: row.slug }));
+            return;
+        }
         setError(await onRename({ [key]: next }));
     };
     const onKey = (key) => (e) => {

package/dist/admin/index.d.ts

@@ -1,4 +1,6 @@
-export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem } from "./ops.ts";
+export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
+export type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+export type { MemberRole } from "../permissions.ts";
 export { createAdminOps, runAdminOp, type AdminEffects } from "./ops-impl.ts";
 export { fixedNodeSpecs, fixedNodeOf, ensureFixedNodes, type FixedNode } from "./fixed-nodes.ts";
 export { ensureGlobalItems, initialGlobalFields } from "./global-items.ts";

package/dist/admin/next/index.d.ts

@@ -1,6 +1,8 @@
 export { createAdminOpHandler } from "./op-handler.ts";
 export { createSmoodlyAdmin } from "./create-admin.tsx";
-export type { AdminOpCall, AdminOpAction, AdminOps, OpResult } from "../ops.ts";
+export type { AdminOpCall, AdminOpAction, AdminOps, OpResult, MembersListResult } from "../ops.ts";
+export type { InviteInput, InviteResult, MemberRecord } from "../../member-store.ts";
+export type { MemberRole } from "../../permissions.ts";
 export type { AuthConfig } from "../shell/session.ts";
 export type { AdminAuth } from "../auth.ts";
 export { supabaseAdminAuth } from "../supabase-auth.ts";

package/dist/admin/next/op-handler.d.ts

@@ -2,6 +2,7 @@ import type { ResolvedConfig } from "../../config.ts";
 import type { EntryStore } from "../../entry-store.ts";
 import type { PageStore } from "../../store.ts";
 import type { AssetStore } from "../../asset-store.ts";
+import type { MemberStore } from "../../member-store.ts";
 import { type AdminAuth } from "../auth.ts";
 import type { AdminOpAction } from "../ops.ts";
 export declare function createAdminOpHandler(deps: {
@@ -12,4 +13,6 @@ export declare function createAdminOpHandler(deps: {
     href?: (path: string, locale: string) => string;
     /** The media library; without it the assets ops answer "no media store". */
     assets?: AssetStore;
+    /** The admission table; without it members.list answers "no member store". */
+    members?: MemberStore;
 }): AdminOpAction;

package/dist/admin/next/op-handler.js

@@ -13,6 +13,7 @@ export function createAdminOpHandler(deps) {
         entries: deps.entries,
         href: deps.href,
         assets: deps.assets,
+        members: deps.members,
         effects: {
             // updateTag, not revalidateTag(tag, profile): the profile form is
             // stale-while-revalidate, so the first request after publish still

package/dist/admin/ops-impl.d.ts

@@ -1,6 +1,7 @@
 import type { ResolvedConfig } from "../config.ts";
 import type { EntryStore } from "../entry-store.ts";
 import type { AssetStore } from "../asset-store.ts";
+import type { MemberStore } from "../member-store.ts";
 import type { PageStore } from "../store.ts";
 import type { AdminOpCall, AdminOps, OpResult } from "./ops.ts";
 import type { AdminSession } from "./auth.ts";
@@ -21,6 +22,8 @@ export declare function createAdminOps(deps: {
     href?: (path: string, locale: string) => string;
     /** The media library; absent = every assets op answers "no media store". */
     assets?: AssetStore;
+    /** The admission table (spec 2026-09-25 §4); absent = members.list answers "no member store". */
+    members?: MemberStore;
     /** The verified editor; their email is every write's `by`. Absent for the seed and tests (spec 2026-09-13 history §2). */
     actor?: AdminSession;
 }): AdminOps;

package/dist/admin/ops-impl.js

@@ -1,5 +1,6 @@
 import { entryFieldsIn, entryTitleIn } from "../entry-store.js";
 import { distinctTags } from "../tags.js";
+import { can, isMemberRole, normalizeRole } from "../permissions.js";
 import { ASSET_COLLECTION } from "../media.js";
 import { adminHref, adminSlugTaken, isAdminSlug } from "../admin-path.js";
 import { affectedTargets, collectionTag, entryTag, pageTag, pagesTreeTag, globalTag } from "../revalidate.js";
@@ -87,7 +88,7 @@ const classify = (e) => {
         return err("validation", message);
     if (message.includes("not a valid slug"))
         return err("validation", message);
-    if (message.includes("no page") || message.includes("no entry") || message.includes("no collection") || message.includes("no asset"))
+    if (message.includes("no page") || message.includes("no entry") || message.includes("no collection") || message.includes("no asset") || message.includes("no member"))
         return err("not_found", message);
     if (message.includes("not pending"))
         return err("conflict", message);
@@ -200,6 +201,27 @@ export function createAdminOps(deps) {
     const nameOf = (r) => r.locales[def]?.slug ?? Object.values(r.locales)[0]?.slug ?? r.id;
     const assets = deps.assets;
     const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
+    const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
+    const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    /** unauthorized unless the actor may manage members; no actor (scripts, the seed) may. */
+    const membersDenied = () => deps.actor && !can(deps.actor.role, "members.manage") ? err("unauthorized", "smoodly: only an admin can manage members.") : null;
+    /** blocked when the control plane manages this space's members (a row, never a mode check). */
+    const membersManaged = async () => (await deps.members.consoleUrl()) ? err("blocked", "smoodly: members are managed at smoodly.io.") : null;
+    /** The two guards on setRole and remove: never your own row, never the last admin (unless the change keeps them admin). */
+    const memberGuards = async (userId, staysAdmin) => {
+        if (deps.actor?.userId === userId)
+            return err("blocked", "smoodly: you cannot change your own membership.");
+        if (staysAdmin)
+            return null;
+        const rows = await deps.members.list();
+        const target = rows.find((m) => m.userId === userId);
+        if (!target)
+            return null; // the store answers not_found
+        const admins = rows.filter((m) => normalizeRole(m.role) === "admin");
+        if (normalizeRole(target.role) === "admin" && admins.length <= 1)
+            return err("blocked", "smoodly: this site needs at least one admin.");
+        return null;
+    };
     const mb = (bytes) => `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
     const isDim = (v) => v === undefined || (typeof v === "number" && Number.isFinite(v) && v >= 0);
     /** What an asset's usage row points at, labelled for the Media screen. */
@@ -849,6 +871,61 @@ export function createAdminOps(deps) {
                 return ok(out);
             }),
         },
+        members: {
+            list: () => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const denied = membersDenied();
+                if (denied)
+                    return denied;
+                const [members, consoleUrl] = await Promise.all([deps.members.list(), deps.members.consoleUrl()]);
+                return ok({ members, consoleUrl });
+            }),
+            me: () => guard(async () => ok({ role: deps.actor?.role ?? "admin" })),
+            invite: (input) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                const email = typeof input?.email === "string" ? input.email.trim() : "";
+                if (!EMAIL_RE.test(email))
+                    return err("validation", "smoodly: enter a valid email address.");
+                if (!isMemberRole(input.role))
+                    return err("validation", "smoodly: the role must be admin or editor.");
+                if (typeof input.redirectTo !== "string" || !input.redirectTo)
+                    return err("validation", "smoodly: the invite needs a return URL.");
+                const rows = await deps.members.list();
+                if (rows.some((m) => m.email?.toLowerCase() === email.toLowerCase()))
+                    return err("conflict", "smoodly: already a member.");
+                return ok(await deps.members.invite({ email, role: input.role, redirectTo: input.redirectTo }));
+            }),
+            setRole: (userId, role) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                if (!isMemberRole(role))
+                    return err("validation", "smoodly: the role must be admin or editor.");
+                const guardHit = await memberGuards(userId, role === "admin");
+                if (guardHit)
+                    return guardHit;
+                return ok(await deps.members.setRole(userId, role));
+            }),
+            remove: (userId) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                const guardHit = await memberGuards(userId, false);
+                if (guardHit)
+                    return guardHit;
+                await deps.members.remove(userId);
+                return ok(null);
+            }),
+        },
         preview: {
             enable: () => guard(async () => (await effects?.draft?.enable(), ok(null))),
             disable: () => guard(async () => (await effects?.draft?.disable(), ok(null))),

package/dist/admin/ops.d.ts

@@ -3,6 +3,8 @@ import type { PageTree } from "../render.tsx";
 import type { EntryRecord, EntryUsage } from "../entry-store.ts";
 import type { AssetRecord, AssetMeta } from "../media.ts";
 import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-store.ts";
+import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 export type OpError = {
     ok: false;
@@ -91,6 +93,11 @@ export type AssetUsageItem = {
     title: string;
     href: string | null;
 };
+/** The Members page's read (spec 2026-09-25 §4): the rows and, when the control plane manages them, where. */
+export type MembersListResult = {
+    members: MemberRecord[];
+    consoleUrl: string | null;
+};
 export type AdminOps = {
     pages: {
         /** Lists every node, materializing fixed pages and collection mounts (in every supported locale) first. */
@@ -189,6 +196,20 @@ export type AdminOps = {
         delete(id: string): Promise<OpResult<null>>;
         usage(id: string): Promise<OpResult<AssetUsageItem[]>>;
     };
+    members: {
+        /** The space's members; admins only. `consoleUrl` set means smoodly.io manages them and every write below is blocked. */
+        list(): Promise<OpResult<MembersListResult>>;
+        /** The caller's role; every member. The shell hides Settings from editors with it. */
+        me(): Promise<OpResult<{
+            role: MemberRole;
+        }>>;
+        /** Admins only, self-host only: invites (or adds an existing account), refuses a duplicate row (spec 2026-09-25 members management §3). */
+        invite(input: InviteInput): Promise<OpResult<InviteResult>>;
+        /** Admins only, self-host only; never your own row, never the last admin. */
+        setRole(userId: string, role: MemberRole): Promise<OpResult<MemberRecord>>;
+        /** Admins only, self-host only; the same two guards. The Auth account stays. */
+        remove(userId: string): Promise<OpResult<null>>;
+    };
     preview: {
         enable(): Promise<OpResult<null>>;
         disable(): Promise<OpResult<null>>;

package/dist/admin/shell/AdminApp.js

@@ -12,7 +12,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (shell/IconRail.tsx), then the main column whose views own their own
 // 48px top bar (the editor adds the third, its inspector). The shell is
 // viewport-height; every column scrolls inside itself.
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { makeClientOps } from "../client-ops.js";
 import { PagesList } from "./PagesList.js";
 import { EntriesList } from "./EntriesList.js";
@@ -21,13 +21,16 @@ import { GlobalList } from "./GlobalList.js";
 import { GlobalForm } from "./GlobalForm.js";
 import { EditorView } from "../editor/EditorView.js";
 import { LoginView } from "./LoginView.js";
+import { SetPasswordView } from "./SetPasswordView.js";
 import { useAdminSession } from "./session.js";
 import { IconRail } from "./IconRail.js";
 import { useRoute } from "./router.js";
 import { AdminPathProvider } from "./base.js";
 import { mountMismatch } from "../../admin-path.js";
+import { can } from "../../permissions.js";
 import { ErrorPane } from "./ErrorPane.js";
 import { MediaScreen } from "./MediaScreen.js";
+import { SettingsView } from "./SettingsView.js";
 import { AssetsProvider } from "../forms/assets-context.js";
 import { ElementsProvider } from "../forms/elements-context.js";
 export function AdminApp({ registry, op, auth }) {
@@ -37,6 +40,24 @@ export function AdminApp({ registry, op, auth }) {
     const [head = "pages", tail] = route.segments.length ? route.segments : ["pages"];
     const isCollection = registry.collections.some((c) => c.name === head);
     const email = session.state.status === "signed_in" ? session.state.session.user.email : undefined;
+    // The role rides on members.me (members management §2): Settings hides
+    // from an editor, and the area itself refuses. Unknown until it answers.
+    const signedIn = session.state.status === "signed_in";
+    const [role, setRole] = useState(null);
+    useEffect(() => {
+        if (!signedIn) {
+            setRole(null);
+            return;
+        }
+        let live = true;
+        ops.members.me()
+            .then((r) => { if (live)
+            setRole(r.ok ? r.data.role : "editor"); })
+            .catch(() => { if (live)
+            setRole("editor"); });
+        return () => { live = false; };
+    }, [signedIn, ops]);
+    const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }
@@ -46,6 +67,9 @@ export function AdminApp({ registry, op, auth }) {
     }
     if (session.state.status === "signed_out")
         return _jsx(LoginView, { client: session.client, providers: auth.providers });
+    // An invite or reset link signed the person in: Set password before the shell (members management §6).
+    if (session.arrival)
+        return _jsx(SetPasswordView, { client: session.client, mode: session.arrival, onDone: session.clearArrival });
     let main;
     if (head === "pages" && !tail)
         main = _jsx(PagesList, { ops: ops, registry: registry });
@@ -59,9 +83,11 @@ export function AdminApp({ registry, op, auth }) {
         main = _jsx(GlobalList, { ops: ops, registry: registry });
     else if (head === "globals" && tail)
         main = _jsx(GlobalForm, { ops: ops, registry: registry, name: decodeURIComponent(tail) });
+    else if (head === "settings")
+        main = _jsx(SettingsView, { ops: ops, tail: tail, role: role, userId: userId });
     else if (head === "media")
         main = _jsx(MediaScreen, {});
     else
         main = _jsx(ErrorPane, { message: "Not found." });
-    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(AssetsProvider, { ops: ops, media: registry.media, children: _jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }) }) }) }));
+    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(AssetsProvider, { ops: ops, media: registry.media, children: _jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }) }) }) }));
 }

package/dist/admin/shell/EntryForm.js

@@ -32,6 +32,7 @@ import { entrySourceLocale, entryTitle, localizedFieldKeys } from "./entries-lis
 import { useAdminHref } from "./base.js";
 import { localeFromUrl, writeLocaleToUrl } from "../editor/locale-url.js";
 import { navigate, useLeaveGuard } from "./router.js";
+import { LIVE_URL_MESSAGE, liveUrlChanges } from "./live-url.js";
 /** A stable empty map for the hooks that run before the "no such collection" return. */
 const NO_FIELDS = {};
 export function EntryForm({ ops, registry, collection, id }) {
@@ -59,10 +60,26 @@ export function EntryForm({ ops, registry, collection, id }) {
     const formRef = useRef(null);
     const fieldsRef = useRef(fields);
     fieldsRef.current = fields;
+    const recordRef = useRef(record);
+    recordRef.current = record;
+    /** The slug the editor already confirmed as a live-URL change, so the next autosave does not ask again. */
+    const confirmedSlug = useRef(null);
     // The page editor's controller: debounced, retrying, flushable (spec 2026-09-14 §3).
     const { saveState, mark, flush } = useDraftAutosave({
         read: () => fieldsRef.current,
         persist: async (value) => {
+            // A published entry's slug is a live URL: one confirm at the save, Cancel restores it (members management §5).
+            const row = recordRef.current?.locales[locale];
+            const stored = row?.slug ?? null;
+            const next = typeof value.slug === "string" ? value.slug : null;
+            if (next !== confirmedSlug.current && liveUrlChanges({ status: row?.status, from: stored, to: next })) {
+                if (window.confirm(LIVE_URL_MESSAGE))
+                    confirmedSlug.current = next;
+                else {
+                    value = { ...value, slug: stored };
+                    setFields((f) => ({ ...(f ?? {}), slug: stored }));
+                }
+            }
             const r = await ops.entries.save(collection, id, locale, value);
             if (r.ok)
                 setRecord(r.data);

package/dist/admin/shell/IconRail.d.ts

@@ -1,7 +1,9 @@
 import type { AdminRegistry } from "../serialize.ts";
-export declare function IconRail({ registry, active, email, onSignOut }: {
+export declare function IconRail({ registry, active, email, settings, onSignOut }: {
     registry: AdminRegistry;
     active: string;
     email?: string;
+    /** Whether the Settings tile shows — `can(role, "settings")` in the shell. */
+    settings?: boolean;
     onSignOut: () => void;
 }): import("react").JSX.Element;

package/dist/admin/shell/IconRail.js

@@ -9,8 +9,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Items are registry-derived, never separately configured: Pages, then
 // Collections — one rail item whose flyout lists every collection — then
 // Media, Globals (the global content items, when the registry has any;
-// the route is /globals), and Settings, shown but inert until it
-// exists. The user avatar is pinned to the bottom and opens the same
+// the route is /globals), and Settings (the Settings area, spec
+// 2026-09-25; the route is /settings; admins only, so the shell passes
+// `settings` false for an editor). The user avatar is pinned to the bottom and opens the same
 // flyout with the theme toggle and Sign out, which the old nav's footer
 // held.
 //
@@ -29,7 +30,7 @@ const ICON = { size: 18, strokeWidth: 2, "aria-hidden": true };
 function AppIcon() {
     return (_jsxs("svg", { className: "sm-rail__logo", viewBox: "0 0 89 86", fill: "none", xmlns: "http://www.w3.org/2000/svg", role: "img", "aria-label": "Smoodly", children: [_jsx("path", { fill: "#0038B1", d: "M0 51.5552C0 24.3141 25.0505 0 52.5493 0H52.7761C74.4707 0 89 14.6336 89 34.445C89 61.6862 64.4034 86 36.0066 86C14.0946 86 0 70.9165 0 51.5552Z" }), _jsx("path", { fill: "#FFFFFF", d: "M23.25 46.1188C23.25 33.0027 34.8806 21.2959 47.6479 21.2959H47.7532C57.8257 21.2959 64.5714 28.3417 64.5714 37.8805C64.5714 50.9966 53.1516 62.7033 39.9674 62.7033C29.7939 62.7033 23.25 55.4409 23.25 46.1188Z" })] }));
 }
-export function IconRail({ registry, active, email, onSignOut }) {
+export function IconRail({ registry, active, email, settings = true, onSignOut }) {
     const adminHref = useAdminHref();
     const root = useRef(null);
     const uid = useId();
@@ -72,11 +73,11 @@ export function IconRail({ registry, active, email, onSignOut }) {
             items[(i + (e.key === "ArrowDown" ? 1 : -1) + items.length) % items.length].focus();
         }
     };
-    const link = (key, label, icon, href) => (_jsx("li", { className: "sm-rail__item", children: href ? (_jsxs(RouteLink, { className: "sm-rail__btn", href: href, "aria-current": key === active ? "page" : undefined, onClick: close, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] })) : (_jsxs("a", { className: "sm-rail__btn", "aria-disabled": true, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] })) }));
+    const link = (key, label, icon, href) => (_jsx("li", { className: "sm-rail__item", children: _jsxs(RouteLink, { className: "sm-rail__btn", href: href, "aria-current": key === active ? "page" : undefined, onClick: close, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] }) }));
     const collections = registry.collections;
     const collectionActive = collections.some((c) => c.name === active);
     const collectionsOpen = open === "collections" || (hovered && open === null);
     const name = email?.split("@")[0] ?? "Editor";
     const initials = name.slice(0, 2).toUpperCase();
-    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), link("settings", "Settings", _jsx(Settings, { ...ICON }), null)] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
+    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), settings && link("settings", "Settings", _jsx(Settings, { ...ICON }), adminHref("/settings"))] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
 }

package/dist/admin/shell/InviteModal.d.ts

@@ -0,0 +1,6 @@
+import type { InviteInput } from "../../member-store.ts";
+export declare function InviteModal({ onClose, onInvite }: {
+    onClose(): void;
+    /** Resolves to an error message, or null when the invite landed (the caller closes). */
+    onInvite(input: Omit<InviteInput, "redirectTo">): Promise<string | null>;
+}): import("react").JSX.Element;

package/dist/admin/shell/InviteModal.js

@@ -0,0 +1,24 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/InviteModal.tsx
+// Invite a member (spec 2026-09-25 members management §4): an email, a
+// role, Send. The op's error shows inside; success closes it and the
+// page reports what happened.
+import { useState } from "react";
+import { MEMBER_ROLES } from "../../permissions.js";
+import { Modal } from "../ui/Modal.js";
+import { Banner, Button, Field, Segmented } from "../ui/primitives.js";
+import { roleLabel } from "./members-list.js";
+export function InviteModal({ onClose, onInvite }) {
+    const [email, setEmail] = useState("");
+    const [role, setRole] = useState("editor");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const submit = async (e) => {
+        e.preventDefault();
+        setBusy(true);
+        setError(await onInvite({ email: email.trim(), role }));
+        setBusy(false);
+    };
+    return (_jsx(Modal, { title: "Invite a member", width: 420, onClose: onClose, children: _jsxs("form", { onSubmit: submit, style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", required: true, autoFocus: true, value: email, onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Role", asDiv: true, children: _jsx(Segmented, { options: MEMBER_ROLES, value: role, onChange: setRole, label: roleLabel }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsxs("div", { style: { display: "flex", justifyContent: "flex-end", gap: 8 }, children: [_jsx(Button, { variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx("button", { type: "submit", className: "sm-btn sm-btn--primary", disabled: busy, children: busy ? "Sending…" : "Send invite" })] })] }) }));
+}

package/dist/admin/shell/ListView.d.ts

@@ -4,11 +4,13 @@ export type ListColumn = {
     label: string;
     width: string;
 };
-export declare function ListView({ title, titleTrailing, actions, columns, rows, empty, sortable }: {
+export declare function ListView({ title, titleTrailing, actions, notice, columns, rows, empty, sortable }: {
     title: string;
     /** Rides right after the title — the locale picker, in the place every form's switch has. */
     titleTrailing?: ReactNode;
     actions?: ReactNode;
+    /** Between the top bar and the list card — a Banner, as the Media screen places its error. */
+    notice?: ReactNode;
     columns: ListColumn[];
     rows: {
         key: string;

package/dist/admin/shell/ListView.js

@@ -3,10 +3,10 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Grip, TopBar, cx } from "../ui/primitives.js";
 import { navigate } from "./router.js";
-export function ListView({ title, titleTrailing, actions, columns, rows, empty, sortable }) {
+export function ListView({ title, titleTrailing, actions, notice, columns, rows, empty, sortable }) {
     const widths = sortable ? ["24px", ...columns.map((c) => c.width)] : columns.map((c) => c.width);
     const grid = { gridTemplateColumns: widths.join(" ") };
-    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsxs(_Fragment, { children: [_jsx("span", { className: "sm-title", children: title }), titleTrailing] }), right: actions }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [sortable && _jsx("span", { "aria-hidden": "true" }), columns.map((c) => _jsx("span", { children: c.label }, c.label))] }), _jsxs("div", { className: "sm-table__body", ref: sortable?.hook.containerRef, children: [rows.map((r, i) => {
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsxs(_Fragment, { children: [_jsx("span", { className: "sm-title", children: title }), titleTrailing] }), right: actions }), notice, _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [sortable && _jsx("span", { "aria-hidden": "true" }), columns.map((c) => _jsx("span", { children: c.label }, c.label))] }), _jsxs("div", { className: "sm-table__body", ref: sortable?.hook.containerRef, children: [rows.map((r, i) => {
                                     const clickable = Boolean(r.href || r.onClick);
                                     const href = r.href;
                                     const go = r.onClick ?? (href ? () => { navigate(href); } : undefined);