smoodly 0.0.23 → 0.0.24

package/README.md

@@ -640,15 +640,22 @@ tool — reset and reseed a development database (`supabase db reset`,
   `alter table "space_caps" rename to "spaces";`
   `alter table "spaces" alter column "row_cap" drop not null;`
   `alter table "spaces" add column "console_url" text;`
+  `update "members" set "role" = 'admin' where "role" = 'owner';`
   then re-run the regenerated migration's `smoodly_space_row_cap` function
   and the `smoodly_read` policy on `spaces` (both `create or replace` /
   `drop … if exists`, so the whole migration file can be re-applied).
   Policies and triggers follow a table rename. Rows written before the
   column show their user id on the Members page until re-inserted (the
   demo-editor upsert fills it on the next seed).
-- The Members page is read-only; adding, re-roling and removing members
-  in self-host, the role vocabulary and its enforcement at the gate, and
-  the API Keys page's contents are DESIGN.md OQ #33.
+- Members management shipped 2026-09-25 (spec
+  `docs/superpowers/specs/2026-09-25-members-management-design.md`); out
+  of its scope: a pending-invite status and "resend invite" on a row
+  (needs the Auth user's `last_sign_in_at`, which the cloud projection
+  does not carry); removing the Auth account together with the member
+  row; invites from the cloud's `/admin` (they are smoodly.io's); a
+  project whose Auth is OAuth-only (the invite mail asks for a password);
+  redirects on a published rename (the confirm says "there are none
+  yet"). The API Keys page's contents are DESIGN.md OQ #33.
 - The members list is not paged (tens of rows, not thousands).
 - The `api-keys` page id is a URL segment; the title reads "API Keys".
 
@@ -1664,7 +1671,7 @@ the toolbar instead of pushing the content.
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
 - Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `isEditor` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/auth.d.ts

@@ -1,13 +1,18 @@
+import { type MemberRole } from "../permissions.ts";
 import type { AdminOpCall, OpResult } from "./ops.ts";
-/** The verified editor: the Auth user id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
-export type AdminSession = {
+/** What the auth project vouches for: the Auth user id and the email the locale rows record as `updated_by` (spec 2026-09-13 history §2). */
+export type VerifiedUser = {
     userId: string;
     email: string | null;
 };
+/** The verified member: the user plus the normalized role from `members`. */
+export type AdminSession = VerifiedUser & {
+    role: MemberRole;
+};
 export type AdminAuth = {
     /** The user behind a session token, or null when the auth project rejects it. */
-    verify(token: string): Promise<AdminSession | null>;
-    /** Does `editors` hold this user for the current space? */
-    isEditor(userId: string): Promise<boolean>;
+    verify(token: string): Promise<VerifiedUser | null>;
+    /** The stored role of this user in `members` for the current space, or null without a row. */
+    memberOf(userId: string): Promise<string | null>;
 };
 export declare function gateAdminOp(auth: AdminAuth, call: AdminOpCall, run: (call: AdminOpCall, session: AdminSession) => Promise<OpResult<unknown>>): Promise<OpResult<unknown>>;

package/dist/admin/auth.js

@@ -1,3 +1,9 @@
+// Admission to the admin (spec 2026-09-04 §5; roles 2026-09-25 members
+// management §2): a session token from the auth project, then a row in
+// `members` read with the write key, whose role rides on the session.
+// One gate around the ops seam — individual ops ask can(). Framework-
+// free; Supabase-backed implementation in supabase-auth.ts.
+import { normalizeRole } from "../permissions.js";
 const unauthorized = (message) => ({ ok: false, code: "unauthorized", message });
 export async function gateAdminOp(auth, call, run) {
     const token = typeof call === "object" && call !== null && typeof call.token === "string"
@@ -5,24 +11,19 @@ export async function gateAdminOp(auth, call, run) {
         : null;
     if (!token)
         return unauthorized("smoodly: sign in to use the admin.");
-    let session;
-    let editor;
+    let user;
+    let stored;
     try {
-        session = await auth.verify(token);
-        if (!session)
+        user = await auth.verify(token);
+        if (!user)
             return unauthorized("smoodly: your session has expired — sign in again.");
-        editor = await auth.isEditor(session.userId);
+        stored = await auth.memberOf(user.userId);
     }
     catch (e) {
         console.error("smoodly: auth check failed", e);
-        return {
-            ok: false,
-            code: "internal",
-            message: "smoodly: could not check your session.",
-        };
+        return { ok: false, code: "internal", message: "smoodly: could not check your session." };
     }
-    if (!editor) {
+    if (stored === null)
         return unauthorized("smoodly: this account is not an editor of this site.");
-    }
-    return run(call, session);
+    return run(call, { ...user, role: normalizeRole(stored) });
 }

package/dist/admin/client-ops.js

@@ -3,7 +3,7 @@ const GROUPS = {
     entries: ["list", "distinct", "get", "create", "save", "setStatus", "discardDraft", "delete", "move", "addLocale", "removeLocale", "listVersions", "getVersion", "restore"],
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
-    members: ["list"],
+    members: ["list", "me", "invite", "setRole", "remove"],
     preview: ["enable", "disable"],
 };
 export function makeClientOps(action, token) {

package/dist/admin/editor/PageSettings.js

@@ -10,6 +10,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useState } from "react";
 import { updatedLine } from "../ui/format.js";
 import { Field, InfoRow, SectionLabel } from "../ui/primitives.js";
+import { confirmLiveUrl } from "../shell/live-url.js";
 export function PageSettings({ record, locale, registry, path, fixed, onRename }) {
     const row = record.locales[locale];
     const [draft, setDraft] = useState({ title: row?.title ?? "", slug: row?.slug ?? "" });
@@ -30,6 +31,11 @@ export function PageSettings({ record, locale, registry, path, fixed, onRename }
             setError(`A ${key} is required — nothing falls back to another locale.`);
             return;
         }
+        // A published slug is a live URL: one confirm, Cancel restores the input (members management §5).
+        if (key === "slug" && !confirmLiveUrl({ status: row.status, from: row.slug, to: next })) {
+            setDraft((d) => ({ ...d, slug: row.slug }));
+            return;
+        }
         setError(await onRename({ [key]: next }));
     };
     const onKey = (key) => (e) => {

package/dist/admin/index.d.ts

@@ -1,4 +1,6 @@
 export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
+export type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+export type { MemberRole } from "../permissions.ts";
 export { createAdminOps, runAdminOp, type AdminEffects } from "./ops-impl.ts";
 export { fixedNodeSpecs, fixedNodeOf, ensureFixedNodes, type FixedNode } from "./fixed-nodes.ts";
 export { ensureGlobalItems, initialGlobalFields } from "./global-items.ts";

package/dist/admin/next/index.d.ts

@@ -1,6 +1,8 @@
 export { createAdminOpHandler } from "./op-handler.ts";
 export { createSmoodlyAdmin } from "./create-admin.tsx";
 export type { AdminOpCall, AdminOpAction, AdminOps, OpResult, MembersListResult } from "../ops.ts";
+export type { InviteInput, InviteResult, MemberRecord } from "../../member-store.ts";
+export type { MemberRole } from "../../permissions.ts";
 export type { AuthConfig } from "../shell/session.ts";
 export type { AdminAuth } from "../auth.ts";
 export { supabaseAdminAuth } from "../supabase-auth.ts";

package/dist/admin/ops-impl.js

@@ -1,5 +1,6 @@
 import { entryFieldsIn, entryTitleIn } from "../entry-store.js";
 import { distinctTags } from "../tags.js";
+import { can, isMemberRole, normalizeRole } from "../permissions.js";
 import { ASSET_COLLECTION } from "../media.js";
 import { adminHref, adminSlugTaken, isAdminSlug } from "../admin-path.js";
 import { affectedTargets, collectionTag, entryTag, pageTag, pagesTreeTag, globalTag } from "../revalidate.js";
@@ -87,7 +88,7 @@ const classify = (e) => {
         return err("validation", message);
     if (message.includes("not a valid slug"))
         return err("validation", message);
-    if (message.includes("no page") || message.includes("no entry") || message.includes("no collection") || message.includes("no asset"))
+    if (message.includes("no page") || message.includes("no entry") || message.includes("no collection") || message.includes("no asset") || message.includes("no member"))
         return err("not_found", message);
     if (message.includes("not pending"))
         return err("conflict", message);
@@ -201,6 +202,26 @@ export function createAdminOps(deps) {
     const assets = deps.assets;
     const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
     const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
+    const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    /** unauthorized unless the actor may manage members; no actor (scripts, the seed) may. */
+    const membersDenied = () => deps.actor && !can(deps.actor.role, "members.manage") ? err("unauthorized", "smoodly: only an admin can manage members.") : null;
+    /** blocked when the control plane manages this space's members (a row, never a mode check). */
+    const membersManaged = async () => (await deps.members.consoleUrl()) ? err("blocked", "smoodly: members are managed at smoodly.io.") : null;
+    /** The two guards on setRole and remove: never your own row, never the last admin (unless the change keeps them admin). */
+    const memberGuards = async (userId, staysAdmin) => {
+        if (deps.actor?.userId === userId)
+            return err("blocked", "smoodly: you cannot change your own membership.");
+        if (staysAdmin)
+            return null;
+        const rows = await deps.members.list();
+        const target = rows.find((m) => m.userId === userId);
+        if (!target)
+            return null; // the store answers not_found
+        const admins = rows.filter((m) => normalizeRole(m.role) === "admin");
+        if (normalizeRole(target.role) === "admin" && admins.length <= 1)
+            return err("blocked", "smoodly: this site needs at least one admin.");
+        return null;
+    };
     const mb = (bytes) => `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
     const isDim = (v) => v === undefined || (typeof v === "number" && Number.isFinite(v) && v >= 0);
     /** What an asset's usage row points at, labelled for the Media screen. */
@@ -854,9 +875,56 @@ export function createAdminOps(deps) {
             list: () => guard(async () => {
                 if (!deps.members)
                     return noMembers();
+                const denied = membersDenied();
+                if (denied)
+                    return denied;
                 const [members, consoleUrl] = await Promise.all([deps.members.list(), deps.members.consoleUrl()]);
                 return ok({ members, consoleUrl });
             }),
+            me: () => guard(async () => ok({ role: deps.actor?.role ?? "admin" })),
+            invite: (input) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                const email = typeof input?.email === "string" ? input.email.trim() : "";
+                if (!EMAIL_RE.test(email))
+                    return err("validation", "smoodly: enter a valid email address.");
+                if (!isMemberRole(input.role))
+                    return err("validation", "smoodly: the role must be admin or editor.");
+                if (typeof input.redirectTo !== "string" || !input.redirectTo)
+                    return err("validation", "smoodly: the invite needs a return URL.");
+                const rows = await deps.members.list();
+                if (rows.some((m) => m.email?.toLowerCase() === email.toLowerCase()))
+                    return err("conflict", "smoodly: already a member.");
+                return ok(await deps.members.invite({ email, role: input.role, redirectTo: input.redirectTo }));
+            }),
+            setRole: (userId, role) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                if (!isMemberRole(role))
+                    return err("validation", "smoodly: the role must be admin or editor.");
+                const guardHit = await memberGuards(userId, role === "admin");
+                if (guardHit)
+                    return guardHit;
+                return ok(await deps.members.setRole(userId, role));
+            }),
+            remove: (userId) => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const refused = membersDenied() ?? (await membersManaged());
+                if (refused)
+                    return refused;
+                const guardHit = await memberGuards(userId, false);
+                if (guardHit)
+                    return guardHit;
+                await deps.members.remove(userId);
+                return ok(null);
+            }),
         },
         preview: {
             enable: () => guard(async () => (await effects?.draft?.enable(), ok(null))),

package/dist/admin/ops.d.ts

@@ -3,7 +3,8 @@ import type { PageTree } from "../render.tsx";
 import type { EntryRecord, EntryUsage } from "../entry-store.ts";
 import type { AssetRecord, AssetMeta } from "../media.ts";
 import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-store.ts";
-import type { MemberRecord } from "../member-store.ts";
+import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
+import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 export type OpError = {
     ok: false;
@@ -196,8 +197,18 @@ export type AdminOps = {
         usage(id: string): Promise<OpResult<AssetUsageItem[]>>;
     };
     members: {
-        /** The space's members, read-only in this cut; `consoleUrl` set means smoodly.io manages them. */
+        /** The space's members; admins only. `consoleUrl` set means smoodly.io manages them and every write below is blocked. */
         list(): Promise<OpResult<MembersListResult>>;
+        /** The caller's role; every member. The shell hides Settings from editors with it. */
+        me(): Promise<OpResult<{
+            role: MemberRole;
+        }>>;
+        /** Admins only, self-host only: invites (or adds an existing account), refuses a duplicate row (spec 2026-09-25 members management §3). */
+        invite(input: InviteInput): Promise<OpResult<InviteResult>>;
+        /** Admins only, self-host only; never your own row, never the last admin. */
+        setRole(userId: string, role: MemberRole): Promise<OpResult<MemberRecord>>;
+        /** Admins only, self-host only; the same two guards. The Auth account stays. */
+        remove(userId: string): Promise<OpResult<null>>;
     };
     preview: {
         enable(): Promise<OpResult<null>>;

package/dist/admin/shell/AdminApp.js

@@ -12,7 +12,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (shell/IconRail.tsx), then the main column whose views own their own
 // 48px top bar (the editor adds the third, its inspector). The shell is
 // viewport-height; every column scrolls inside itself.
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { makeClientOps } from "../client-ops.js";
 import { PagesList } from "./PagesList.js";
 import { EntriesList } from "./EntriesList.js";
@@ -21,11 +21,13 @@ import { GlobalList } from "./GlobalList.js";
 import { GlobalForm } from "./GlobalForm.js";
 import { EditorView } from "../editor/EditorView.js";
 import { LoginView } from "./LoginView.js";
+import { SetPasswordView } from "./SetPasswordView.js";
 import { useAdminSession } from "./session.js";
 import { IconRail } from "./IconRail.js";
 import { useRoute } from "./router.js";
 import { AdminPathProvider } from "./base.js";
 import { mountMismatch } from "../../admin-path.js";
+import { can } from "../../permissions.js";
 import { ErrorPane } from "./ErrorPane.js";
 import { MediaScreen } from "./MediaScreen.js";
 import { SettingsView } from "./SettingsView.js";
@@ -38,6 +40,24 @@ export function AdminApp({ registry, op, auth }) {
     const [head = "pages", tail] = route.segments.length ? route.segments : ["pages"];
     const isCollection = registry.collections.some((c) => c.name === head);
     const email = session.state.status === "signed_in" ? session.state.session.user.email : undefined;
+    // The role rides on members.me (members management §2): Settings hides
+    // from an editor, and the area itself refuses. Unknown until it answers.
+    const signedIn = session.state.status === "signed_in";
+    const [role, setRole] = useState(null);
+    useEffect(() => {
+        if (!signedIn) {
+            setRole(null);
+            return;
+        }
+        let live = true;
+        ops.members.me()
+            .then((r) => { if (live)
+            setRole(r.ok ? r.data.role : "editor"); })
+            .catch(() => { if (live)
+            setRole("editor"); });
+        return () => { live = false; };
+    }, [signedIn, ops]);
+    const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }
@@ -47,6 +67,9 @@ export function AdminApp({ registry, op, auth }) {
     }
     if (session.state.status === "signed_out")
         return _jsx(LoginView, { client: session.client, providers: auth.providers });
+    // An invite or reset link signed the person in: Set password before the shell (members management §6).
+    if (session.arrival)
+        return _jsx(SetPasswordView, { client: session.client, mode: session.arrival, onDone: session.clearArrival });
     let main;
     if (head === "pages" && !tail)
         main = _jsx(PagesList, { ops: ops, registry: registry });
@@ -61,10 +84,10 @@ export function AdminApp({ registry, op, auth }) {
     else if (head === "globals" && tail)
         main = _jsx(GlobalForm, { ops: ops, registry: registry, name: decodeURIComponent(tail) });
     else if (head === "settings")
-        main = _jsx(SettingsView, { ops: ops, tail: tail });
+        main = _jsx(SettingsView, { ops: ops, tail: tail, role: role, userId: userId });
     else if (head === "media")
         main = _jsx(MediaScreen, {});
     else
         main = _jsx(ErrorPane, { message: "Not found." });
-    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(AssetsProvider, { ops: ops, media: registry.media, children: _jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }) }) }) }));
+    return (_jsx(AdminPathProvider, { value: registry.adminPath, children: _jsx(ElementsProvider, { elements: registry.elements, children: _jsx(AssetsProvider, { ops: ops, media: registry.media, children: _jsxs("div", { className: "sm-shell", children: [_jsx(IconRail, { registry: registry, active: head, email: email, settings: role !== null && can(role, "settings"), onSignOut: () => session.client.auth.signOut() }), _jsx("main", { className: "sm-main", children: main }, `${head}/${tail ?? ""}`)] }) }) }) }));
 }

package/dist/admin/shell/EntryForm.js

@@ -32,6 +32,7 @@ import { entrySourceLocale, entryTitle, localizedFieldKeys } from "./entries-lis
 import { useAdminHref } from "./base.js";
 import { localeFromUrl, writeLocaleToUrl } from "../editor/locale-url.js";
 import { navigate, useLeaveGuard } from "./router.js";
+import { LIVE_URL_MESSAGE, liveUrlChanges } from "./live-url.js";
 /** A stable empty map for the hooks that run before the "no such collection" return. */
 const NO_FIELDS = {};
 export function EntryForm({ ops, registry, collection, id }) {
@@ -59,10 +60,26 @@ export function EntryForm({ ops, registry, collection, id }) {
     const formRef = useRef(null);
     const fieldsRef = useRef(fields);
     fieldsRef.current = fields;
+    const recordRef = useRef(record);
+    recordRef.current = record;
+    /** The slug the editor already confirmed as a live-URL change, so the next autosave does not ask again. */
+    const confirmedSlug = useRef(null);
     // The page editor's controller: debounced, retrying, flushable (spec 2026-09-14 §3).
     const { saveState, mark, flush } = useDraftAutosave({
         read: () => fieldsRef.current,
         persist: async (value) => {
+            // A published entry's slug is a live URL: one confirm at the save, Cancel restores it (members management §5).
+            const row = recordRef.current?.locales[locale];
+            const stored = row?.slug ?? null;
+            const next = typeof value.slug === "string" ? value.slug : null;
+            if (next !== confirmedSlug.current && liveUrlChanges({ status: row?.status, from: stored, to: next })) {
+                if (window.confirm(LIVE_URL_MESSAGE))
+                    confirmedSlug.current = next;
+                else {
+                    value = { ...value, slug: stored };
+                    setFields((f) => ({ ...(f ?? {}), slug: stored }));
+                }
+            }
             const r = await ops.entries.save(collection, id, locale, value);
             if (r.ok)
                 setRecord(r.data);

package/dist/admin/shell/IconRail.d.ts

@@ -1,7 +1,9 @@
 import type { AdminRegistry } from "../serialize.ts";
-export declare function IconRail({ registry, active, email, onSignOut }: {
+export declare function IconRail({ registry, active, email, settings, onSignOut }: {
     registry: AdminRegistry;
     active: string;
     email?: string;
+    /** Whether the Settings tile shows — `can(role, "settings")` in the shell. */
+    settings?: boolean;
     onSignOut: () => void;
 }): import("react").JSX.Element;

package/dist/admin/shell/IconRail.js

@@ -10,7 +10,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Collections — one rail item whose flyout lists every collection — then
 // Media, Globals (the global content items, when the registry has any;
 // the route is /globals), and Settings (the Settings area, spec
-// 2026-09-25; the route is /settings). The user avatar is pinned to the bottom and opens the same
+// 2026-09-25; the route is /settings; admins only, so the shell passes
+// `settings` false for an editor). The user avatar is pinned to the bottom and opens the same
 // flyout with the theme toggle and Sign out, which the old nav's footer
 // held.
 //
@@ -29,7 +30,7 @@ const ICON = { size: 18, strokeWidth: 2, "aria-hidden": true };
 function AppIcon() {
     return (_jsxs("svg", { className: "sm-rail__logo", viewBox: "0 0 89 86", fill: "none", xmlns: "http://www.w3.org/2000/svg", role: "img", "aria-label": "Smoodly", children: [_jsx("path", { fill: "#0038B1", d: "M0 51.5552C0 24.3141 25.0505 0 52.5493 0H52.7761C74.4707 0 89 14.6336 89 34.445C89 61.6862 64.4034 86 36.0066 86C14.0946 86 0 70.9165 0 51.5552Z" }), _jsx("path", { fill: "#FFFFFF", d: "M23.25 46.1188C23.25 33.0027 34.8806 21.2959 47.6479 21.2959H47.7532C57.8257 21.2959 64.5714 28.3417 64.5714 37.8805C64.5714 50.9966 53.1516 62.7033 39.9674 62.7033C29.7939 62.7033 23.25 55.4409 23.25 46.1188Z" })] }));
 }
-export function IconRail({ registry, active, email, onSignOut }) {
+export function IconRail({ registry, active, email, settings = true, onSignOut }) {
     const adminHref = useAdminHref();
     const root = useRef(null);
     const uid = useId();
@@ -78,5 +79,5 @@ export function IconRail({ registry, active, email, onSignOut }) {
     const collectionsOpen = open === "collections" || (hovered && open === null);
     const name = email?.split("@")[0] ?? "Editor";
     const initials = name.slice(0, 2).toUpperCase();
-    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), link("settings", "Settings", _jsx(Settings, { ...ICON }), adminHref("/settings"))] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
+    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), settings && link("settings", "Settings", _jsx(Settings, { ...ICON }), adminHref("/settings"))] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
 }

package/dist/admin/shell/InviteModal.d.ts

@@ -0,0 +1,6 @@
+import type { InviteInput } from "../../member-store.ts";
+export declare function InviteModal({ onClose, onInvite }: {
+    onClose(): void;
+    /** Resolves to an error message, or null when the invite landed (the caller closes). */
+    onInvite(input: Omit<InviteInput, "redirectTo">): Promise<string | null>;
+}): import("react").JSX.Element;

package/dist/admin/shell/InviteModal.js

@@ -0,0 +1,24 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/InviteModal.tsx
+// Invite a member (spec 2026-09-25 members management §4): an email, a
+// role, Send. The op's error shows inside; success closes it and the
+// page reports what happened.
+import { useState } from "react";
+import { MEMBER_ROLES } from "../../permissions.js";
+import { Modal } from "../ui/Modal.js";
+import { Banner, Button, Field, Segmented } from "../ui/primitives.js";
+import { roleLabel } from "./members-list.js";
+export function InviteModal({ onClose, onInvite }) {
+    const [email, setEmail] = useState("");
+    const [role, setRole] = useState("editor");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const submit = async (e) => {
+        e.preventDefault();
+        setBusy(true);
+        setError(await onInvite({ email: email.trim(), role }));
+        setBusy(false);
+    };
+    return (_jsx(Modal, { title: "Invite a member", width: 420, onClose: onClose, children: _jsxs("form", { onSubmit: submit, style: { display: "flex", flexDirection: "column", gap: 14 }, children: [_jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", required: true, autoFocus: true, value: email, onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Role", asDiv: true, children: _jsx(Segmented, { options: MEMBER_ROLES, value: role, onChange: setRole, label: roleLabel }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsxs("div", { style: { display: "flex", justifyContent: "flex-end", gap: 8 }, children: [_jsx(Button, { variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx("button", { type: "submit", className: "sm-btn sm-btn--primary", disabled: busy, children: busy ? "Sending…" : "Send invite" })] })] }) }));
+}

package/dist/admin/shell/LoginView.js

@@ -4,10 +4,18 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Google/GitHub when the auth project has them. Errors come from
 // Supabase Auth verbatim. Being an editor is checked by the server on
 // the first op — a signed-in non-editor sees that message in the shell.
+// Forgot password (members management §6) mails a reset link; the reply
+// is the same whatever the email, so the form reveals no membership.
 import { useState } from "react";
 import { Banner, Button, Field, Logo } from "../ui/primitives.js";
 const LABELS = { google: "Continue with Google", github: "Continue with GitHub" };
+const CARD = {
+    width: 320, display: "flex", flexDirection: "column", gap: 14,
+    background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
+    border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
+};
 export function LoginView({ client, providers = [] }) {
+    const [mode, setMode] = useState("signin");
     const [email, setEmail] = useState("");
     const [password, setPassword] = useState("");
     const [error, setError] = useState(null);
@@ -28,6 +36,20 @@ export function LoginView({ client, providers = [] }) {
             setBusy(false);
         }
     };
+    const forgot = async (e) => {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            // The answer is not shown: the form must not reveal whether an email is registered.
+            await client.auth.resetPasswordForEmail(email, { redirectTo: window.location.origin + window.location.pathname });
+        }
+        catch { /* same */ }
+        finally {
+            setBusy(false);
+            setMode("sent");
+        }
+    };
     const oauth = async (provider) => {
         setBusy(true);
         setError(null);
@@ -43,9 +65,16 @@ export function LoginView({ client, providers = [] }) {
             setBusy(false);
         }
     };
-    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: _jsxs("form", { onSubmit: submit, style: {
-                width: 320, display: "flex", flexDirection: "column", gap: 14,
-                background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
-                border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
-            }, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", value: password, required: true, autoComplete: "current-password", onChange: (e) => setPassword(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Signing in…" : "Sign in" }), providers.map((p) => (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => oauth(p), children: LABELS[p] }, p)))] }) }));
+    const back = (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => { setError(null); setMode("signin"); }, children: "Back to sign in" }));
+    let card;
+    if (mode === "sent") {
+        card = (_jsxs("div", { style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx("span", { children: "Check your email for a link to choose a new password." }), back] }));
+    }
+    else if (mode === "forgot") {
+        card = (_jsxs("form", { onSubmit: forgot, style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", autoFocus: true, onChange: (e) => setEmail(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Sending…" : "Send reset link" }), back] }));
+    }
+    else {
+        card = (_jsxs("form", { onSubmit: submit, style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", value: password, required: true, autoComplete: "current-password", onChange: (e) => setPassword(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Signing in…" : "Sign in" }), providers.map((p) => (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => oauth(p), children: LABELS[p] }, p))), _jsx("button", { type: "button", className: "sm-link", disabled: busy, onClick: () => { setError(null); setMode("forgot"); }, style: { background: "transparent", border: 0, color: "var(--text-muted)", cursor: "pointer", font: "inherit", padding: 0 }, children: "Forgot password?" })] }));
+    }
+    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: card }));
 }

package/dist/admin/shell/MembersPage.d.ts

@@ -1,5 +1,6 @@
 import type { AdminOps, MembersListResult } from "../ops.ts";
-export declare function MembersPage({ ops, initial }: {
+export declare function MembersPage({ ops, userId, initial }: {
     ops: AdminOps;
+    userId: string;
     initial?: MembersListResult | null;
 }): import("react").JSX.Element;