smoodly 0.0.22 → 0.0.24

package/dist/member-store.js

@@ -0,0 +1,60 @@
+export const memberErrors = {
+    notFound: (userId) => new Error(`smoodly: no member "${userId}".`),
+    noAccount: (email) => new Error(`smoodly: no Auth account for "${email}" although the invite said it exists.`),
+};
+/** Email first (case-insensitive), rows without one last, ties by user id. */
+export function sortMembers(rows) {
+    return [...rows].sort((a, b) => {
+        if (a.email === null && b.email === null)
+            return a.userId.localeCompare(b.userId);
+        if (a.email === null)
+            return 1;
+        if (b.email === null)
+            return -1;
+        return a.email.localeCompare(b.email, undefined, { sensitivity: "base" }) || a.userId.localeCompare(b.userId);
+    });
+}
+export class MemoryMemberStore {
+    constructor(rows = [], url = null, 
+    /** Auth accounts that exist without a member row: email → user id. */
+    accounts = {}) {
+        this.rows = rows;
+        this.url = url;
+        this.accounts = accounts;
+        /** Emails an invite was "sent" to, in order — what a test asserts. */
+        this.sent = [];
+    }
+    async list() {
+        return sortMembers(this.rows);
+    }
+    async consoleUrl() {
+        return this.url;
+    }
+    async invite(input) {
+        const key = input.email.toLowerCase();
+        let userId = this.accounts[key] ?? this.rows.find((r) => r.email?.toLowerCase() === key)?.userId;
+        let invited = false;
+        if (!userId) {
+            userId = crypto.randomUUID();
+            this.accounts[key] = userId;
+            this.sent.push(input.email);
+            invited = true;
+        }
+        const member = { userId, email: input.email, role: input.role };
+        this.rows = [...this.rows.filter((r) => r.userId !== userId), member];
+        return { member, invited };
+    }
+    async setRole(userId, role) {
+        const row = this.rows.find((r) => r.userId === userId);
+        if (!row)
+            throw memberErrors.notFound(userId);
+        const next = { ...row, role };
+        this.rows = this.rows.map((r) => (r.userId === userId ? next : r));
+        return next;
+    }
+    async remove(userId) {
+        if (!this.rows.some((r) => r.userId === userId))
+            throw memberErrors.notFound(userId);
+        this.rows = this.rows.filter((r) => r.userId !== userId);
+    }
+}

package/dist/permissions.d.ts

@@ -0,0 +1,7 @@
+export declare const MEMBER_ROLES: readonly ["admin", "editor"];
+export type MemberRole = (typeof MEMBER_ROLES)[number];
+export type Capability = "content.write" | "settings" | "members.manage";
+export declare function can(role: MemberRole, capability: Capability): boolean;
+export declare const isMemberRole: (v: unknown) => v is MemberRole;
+/** What the table holds → a role: `owner` (the pre-2026-09-25 word) is admin; anything unknown reads as editor, the safer side. */
+export declare function normalizeRole(stored: string): MemberRole;

package/dist/permissions.js

@@ -0,0 +1,19 @@
+// Roles and what each may do (spec 2026-09-25 members management §1–§2).
+// The ONE place a role string is read: the ops and the shell ask can(),
+// the gate normalizes what the table holds. A third role is one row in
+// GRANTS; a stored matrix, if ever wanted, replaces GRANTS behind can().
+export const MEMBER_ROLES = ["admin", "editor"];
+const GRANTS = {
+    admin: ["content.write", "settings", "members.manage"],
+    editor: ["content.write"],
+};
+export function can(role, capability) {
+    return GRANTS[role].includes(capability);
+}
+export const isMemberRole = (v) => typeof v === "string" && MEMBER_ROLES.includes(v);
+/** What the table holds → a role: `owner` (the pre-2026-09-25 word) is admin; anything unknown reads as editor, the safer side. */
+export function normalizeRole(stored) {
+    if (stored === "owner")
+        return "admin";
+    return isMemberRole(stored) ? stored : "editor";
+}

package/dist/sql-space.js

@@ -30,7 +30,7 @@ language sql stable as $$
 $$;`.trim();
 }
 /** Which rows a read key (or the anon key, which has no claim) may see.
- *  null = write keys only — refs is editor tooling; editors is admission
+ *  null = write keys only — refs is editor tooling; members is admission
  *  data; nothing a browser needs. Global content (spec 2026-09-07) rides
  *  the three entry predicates: it is stored as entries. */
 const PUBLISHED_READ = {
@@ -41,7 +41,7 @@ const PUBLISHED_READ = {
     entry_locales: `"status" = 'published'`,
     entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
     refs: null,
-    editors: null,
+    members: null,
     assets: `"status" = 'ready'`,
     paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
 };
@@ -52,13 +52,17 @@ const NEEDS_SPACE_INDEX = [
 export function spaceLayerSQL() {
     const statements = [];
     statements.push(`
--- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
--- for everyone with ONE definition. Self-host fills them by hand or
--- leaves them empty; smoodly.io writes rows with the service role.
--- There is never cloud-only SQL on a content database.
-create table if not exists "editors" (
+-- ── Cloud state (spec 2026-09-04 §1, names 2026-09-25): three ordinary
+-- tables, shipped for everyone with ONE definition. Self-host fills them
+-- by hand or leaves them empty; smoodly.io writes rows with the service
+-- role. There is never cloud-only SQL on a content database.
+-- members: who may open /admin for a space (spec 2026-09-25 §1–§2). The
+-- email is stored so the Members page needs no Auth lookup — the auth
+-- project is not the content project in the cloud.
+create table if not exists "members" (
   ${SPACE_COL},
   "user_id" uuid not null,
+  "email" text,
   "role" text not null default 'editor',
   primary key ("space_id", "user_id")
 );
@@ -70,14 +74,18 @@ create table if not exists "space_keys" (
   "revoked_at" timestamptz
 );
 
-create table if not exists "space_caps" (
+-- spaces: the control plane's row for a space (spec 2026-09-25 §3). No
+-- row = self-host: no cap, members managed in /admin. console_url set =
+-- smoodly.io manages the members and /admin links there.
+create table if not exists "spaces" (
   "space_id" uuid primary key,
-  "row_cap" integer not null
+  "row_cap" integer,
+  "console_url" text
 );
 
-alter table "editors" enable row level security;
+alter table "members" enable row level security;
 alter table "space_keys" enable row level security;
-alter table "space_caps" enable row level security;
+alter table "spaces" enable row level security;
 
 -- ── Claim readers. The two lookups run as definer so they can read the
 -- service-role-only tables from inside a policy; search_path is pinned.
@@ -96,7 +104,7 @@ $$;
 
 create or replace function "smoodly_space_row_cap"() returns integer
 language sql stable security definer set search_path = public as $$
-  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+  select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
 $$;
 
 -- ── Triggers. A key's claim wins over whatever the insert said, so an
@@ -113,7 +121,7 @@ begin
 end;
 $$;
 
--- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- Per table, per space. No spaces row, or a null cap = no cap (self-host). Trigger
 -- a_ (smoodly_set_space) runs first, so new.space_id already equals the
 -- current space for a keyed insert; smoodly_space_row_cap() reads the
 -- current space itself, so this never needs the row's space_id as an
@@ -148,7 +156,7 @@ $$;`.trim());
         statements.push(`create index if not exists "${table}_space_idx" on "${table}" ("space_id");`);
     }
     // Trigger names sort a_ before b_: same-event triggers fire alphabetically.
-    for (const table of [...CONTENT_TABLES, "editors"]) {
+    for (const table of [...CONTENT_TABLES, "members"]) {
         statements.push(`drop trigger if exists "smoodly_a_set_space" on "${table}";\n` +
             `create trigger "smoodly_a_set_space" before insert on "${table}"\n` +
             `  for each row execute function "smoodly_set_space"();`);
@@ -166,7 +174,7 @@ $$;`.trim());
     // Postgres never inlines; applied to all three calls for the same win.
     const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
     const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
-    for (const table of [...CONTENT_TABLES, "editors"]) {
+    for (const table of [...CONTENT_TABLES, "members"]) {
         statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
             `create policy "smoodly_write" on "${table}" for all\n` +
             `  using (${write})\n` +
@@ -179,6 +187,12 @@ $$;`.trim());
                 `  using (${predicate});`);
         }
     }
+    // A write key reads its own space's row — the console URL the Members
+    // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
+    // space_keys but the two definer functions and the service role.
+    statements.push(`drop policy if exists "smoodly_read" on "spaces";\n` +
+        `create policy "smoodly_read" on "spaces" for select\n` +
+        `  using (${write});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }

package/dist/supabase-member-store.d.ts

@@ -0,0 +1,15 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type InviteInput, type InviteResult, type MemberRecord, type MemberStore } from "./member-store.ts";
+import type { MemberRole } from "./permissions.ts";
+export declare class SupabaseMemberStore implements MemberStore {
+    private db;
+    constructor(db: SupabaseClient);
+    list(): Promise<MemberRecord[]>;
+    consoleUrl(): Promise<string | null>;
+    private toRecord;
+    /** The admin API has no lookup by email: page through the users (tens, not thousands). */
+    private userIdByEmail;
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    remove(userId: string): Promise<void>;
+}

package/dist/supabase-member-store.js

@@ -0,0 +1,78 @@
+import { memberErrors, sortMembers } from "./member-store.js";
+export class SupabaseMemberStore {
+    constructor(db) {
+        this.db = db;
+    }
+    async list() {
+        const res = await this.db.from("members").select("user_id, email, role");
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return sortMembers(res.data.map((r) => this.toRecord(r)));
+    }
+    async consoleUrl() {
+        const res = await this.db.from("spaces").select("console_url").limit(1).maybeSingle();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return res.data?.console_url ?? null;
+    }
+    toRecord(row) {
+        return { userId: row.user_id, email: row.email, role: row.role };
+    }
+    /** The admin API has no lookup by email: page through the users (tens, not thousands). */
+    async userIdByEmail(email) {
+        const wanted = email.toLowerCase();
+        for (let page = 1; page <= 50; page++) {
+            const res = await this.db.auth.admin.listUsers({ page, perPage: 200 });
+            if (res.error)
+                throw new Error(`smoodly: ${res.error.message}`);
+            const hit = res.data.users.find((u) => u.email?.toLowerCase() === wanted);
+            if (hit)
+                return hit.id;
+            if (res.data.users.length < 200)
+                break;
+        }
+        throw memberErrors.noAccount(email);
+    }
+    async invite(input) {
+        // Self-host: the content client is the auth project's service role, so
+        // the admin API is reachable. A cloud write key never gets here — the
+        // ops refuse behind the console URL first.
+        const sent = await this.db.auth.admin.inviteUserByEmail(input.email, { redirectTo: input.redirectTo });
+        let userId;
+        let invited;
+        if (!sent.error) {
+            userId = sent.data.user.id;
+            invited = true;
+        }
+        else if (sent.error.code === "email_exists" || /already (been )?registered/i.test(sent.error.message)) {
+            userId = await this.userIdByEmail(input.email);
+            invited = false;
+        }
+        else {
+            throw new Error(`smoodly: ${sent.error.message}`);
+        }
+        const res = await this.db
+            .from("members")
+            .upsert({ user_id: userId, email: input.email, role: input.role }, { onConflict: "space_id,user_id" })
+            .select("user_id, email, role")
+            .single();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return { member: this.toRecord(res.data), invited };
+    }
+    async setRole(userId, role) {
+        const res = await this.db.from("members").update({ role }).eq("user_id", userId).select("user_id, email, role").maybeSingle();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        if (!res.data)
+            throw memberErrors.notFound(userId);
+        return this.toRecord(res.data);
+    }
+    async remove(userId) {
+        const res = await this.db.from("members").delete().eq("user_id", userId).select("user_id");
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        if (!res.data || res.data.length === 0)
+            throw memberErrors.notFound(userId);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.22",
+  "version": "0.0.24",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {