smoodly 0.0.23 → 0.0.24

package/dist/admin/shell/MembersPage.js

@@ -1,36 +1,83 @@
 "use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // packages/smoodly/src/admin/shell/MembersPage.tsx
-// The Members page (spec 2026-09-25 §7): the admission table, read-only
-// in this cut — Email and Role, no actions, no row click. A console URL
-// from the op means smoodly.io manages the rows, and a banner under the
-// top bar says so.
+// The Members page (spec 2026-09-25 §7; management §4): the admission
+// table with Invite, an in-place role control and Remove — all off when
+// the control plane manages the space (the console URL banner stays).
+// Own row and the last admin render their controls disabled with the
+// guard's reason, so the rule is visible before it is hit.
 import { useEffect, useState } from "react";
-import { Banner, StatusBadge } from "../ui/primitives.js";
+import { MEMBER_ROLES } from "../../permissions.js";
+import { ActionMenu } from "../ui/ActionMenu.js";
+import { Banner, Button, Segmented, StatusBadge } from "../ui/primitives.js";
 import { ErrorPane } from "./ErrorPane.js";
+import { InviteModal } from "./InviteModal.js";
 import { ListView } from "./ListView.js";
-import { memberRows } from "./members-list.js";
-export function MembersPage({ ops, initial = null }) {
+import { GUARD_TITLE, memberRows, roleLabel } from "./members-list.js";
+export function MembersPage({ ops, userId, initial = null }) {
     const [data, setData] = useState(initial);
     const [error, setError] = useState(null);
-    useEffect(() => {
-        if (initial)
+    const [notice, setNotice] = useState(null);
+    const [inviting, setInviting] = useState(false);
+    const load = () => ops.members.list()
+        .then((r) => (r.ok ? setData(r.data) : setError(r.message)))
+        .catch(() => setError("Couldn't reach the server."));
+    useEffect(() => { if (!initial)
+        void load(); }, [ops, initial]); // eslint-disable-line react-hooks/exhaustive-deps
+    const invite = async (input) => {
+        // The admin's own origin and mount: /settings/… stripped, so the invite lands on the shell.
+        const redirectTo = window.location.origin + window.location.pathname.replace(/\/settings(\/.*)?$/, "");
+        const r = await ops.members.invite({ ...input, redirectTo });
+        if (!r.ok)
+            return r.message;
+        setInviting(false);
+        setNotice({
+            tone: "ok",
+            text: r.data.invited ? `Invite sent to ${input.email}.` : `${input.email} added — they can sign in with their existing account.`,
+        });
+        void load();
+        return null;
+    };
+    const setRole = async (row, role) => {
+        if (role === row.value)
             return;
-        ops.members.list()
-            .then((r) => (r.ok ? setData(r.data) : setError(r.message)))
-            .catch(() => setError("Couldn't reach the server."));
-    }, [ops, initial]);
+        const r = await ops.members.setRole(row.key, role);
+        if (!r.ok) {
+            setNotice({ tone: "error", text: r.message });
+            return;
+        }
+        setData((d) => d && { ...d, members: d.members.map((m) => (m.userId === row.key ? r.data : m)) });
+    };
+    const remove = async (row) => {
+        if (!window.confirm(`Remove ${row.email} from this site? They keep their account and lose access to the admin.`))
+            return;
+        const r = await ops.members.remove(row.key);
+        if (!r.ok) {
+            setNotice({ tone: "error", text: r.message });
+            return;
+        }
+        void load();
+    };
     if (error)
         return _jsx(ErrorPane, { message: error });
-    const rows = data ? memberRows(data.members) : [];
-    return (_jsx(ListView, { title: "Members", notice: data?.consoleUrl && (_jsxs(Banner, { tone: "ok", children: ["Members are managed at smoodly.io.", " ", _jsx("a", { href: data.consoleUrl, target: "_blank", rel: "noreferrer", children: "Open the console" })] })), columns: [
-            { label: "Email", width: "minmax(200px,1fr)" },
-            { label: "Role", width: "120px" },
-        ], rows: rows.map((r) => ({
-            key: r.key,
-            cells: [
-                r.fallback ? _jsx("span", { style: { color: "var(--text-muted)" }, children: r.email }) : r.email,
-                _jsx(StatusBadge, { status: r.role }),
-            ],
-        })), empty: "No members yet" }));
+    const managed = Boolean(data?.consoleUrl);
+    const rows = data ? memberRows(data.members, { me: userId }) : [];
+    const guardTitle = (r) => (r.own ? GUARD_TITLE.own : r.lastAdmin ? GUARD_TITLE.lastAdmin : undefined);
+    return (_jsxs(_Fragment, { children: [_jsx(ListView, { title: "Members", actions: !managed && data && _jsx(Button, { onClick: () => setInviting(true), children: "Invite" }), notice: _jsxs(_Fragment, { children: [data?.consoleUrl && (_jsxs(Banner, { tone: "ok", children: ["Members are managed at smoodly.io.", " ", _jsx("a", { href: data.consoleUrl, target: "_blank", rel: "noreferrer", children: "Open the console" })] })), notice && _jsx(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: notice.text })] }), columns: [
+                    { label: "Email", width: "minmax(200px,1fr)" },
+                    { label: "Role", width: managed ? "120px" : "180px" },
+                    ...(managed ? [] : [{ label: "", width: "48px" }]),
+                ], rows: rows.map((r) => ({
+                    key: r.key,
+                    cells: [
+                        r.fallback ? _jsx("span", { style: { color: "var(--text-muted)" }, children: r.email }) : r.email,
+                        managed
+                            ? _jsx(StatusBadge, { status: r.role })
+                            : _jsx(Segmented, { options: MEMBER_ROLES, value: r.value, onChange: (v) => void setRole(r, v), label: roleLabel, disabled: r.own || r.lastAdmin, option: () => (guardTitle(r) ? { title: guardTitle(r) } : undefined) }),
+                        ...(managed ? [] : [
+                            // ActionMenu has no title of its own when disabled: the span carries the guard's reason.
+                            _jsx("span", { title: guardTitle(r), children: _jsx(ActionMenu, { label: "Member actions", small: true, disabled: r.own || r.lastAdmin, items: [{ label: "Remove", danger: true, run: () => void remove(r) }] }) }),
+                        ]),
+                    ],
+                })), empty: "No members yet" }), inviting && _jsx(InviteModal, { onClose: () => setInviting(false), onInvite: invite })] }));
 }

package/dist/admin/shell/PagesList.js

@@ -17,6 +17,7 @@ import { useSortable } from "../ui/useSortable.js";
 import { useAdminHref } from "./base.js";
 import { navigate } from "./router.js";
 import { ErrorPane } from "./ErrorPane.js";
+import { confirmLiveUrl } from "./live-url.js";
 const LOCALE_KEY = "smoodly.pages.locale";
 /** The selected locale survives a reload within the session; a stored
  *  value that is no longer supported falls back to the default. */
@@ -74,6 +75,10 @@ export function PagesList({ ops, registry }) {
                 return;
             if (projection.parentId === row.parentId && projection.index === row.index)
                 return;
+            // A published page under a new parent is a new live URL (members management §5).
+            const current = row.record.locales[locale];
+            if (!confirmLiveUrl({ status: current?.status, from: row.parentId ?? "", to: projection.parentId ?? "" }))
+                return;
             const ok = await run(() => ops.pages.move(row.id, { parentId: projection.parentId, index: projection.index }));
             if (!ok)
                 throw new Error("move refused");
@@ -153,6 +158,8 @@ export function PagesList({ ops, registry }) {
         const slug = window.prompt("Slug (the URL segment):", current.slug);
         if (slug === null)
             return;
+        if (!confirmLiveUrl({ status: current.status, from: current.slug, to: slug }))
+            return;
         void run(() => ops.pages.rename(row.id, { locale, title, slug }));
     };
     const destroy = (row) => {

package/dist/admin/shell/SetPasswordView.d.ts

@@ -0,0 +1,7 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Arrival } from "./session.ts";
+export declare function SetPasswordView({ client, mode, onDone }: {
+    client: SupabaseClient;
+    mode: Arrival;
+    onDone(): void;
+}): import("react").JSX.Element;

package/dist/admin/shell/SetPasswordView.js

@@ -0,0 +1,41 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/SetPasswordView.tsx
+// The arrival screen (spec 2026-09-25 members management §6): an invite
+// link or a reset link signed the person in; now they choose a password.
+// An invite cannot skip it (the account has none yet); a recovery may.
+import { useState } from "react";
+import { Banner, Button, Field, Logo } from "../ui/primitives.js";
+export function SetPasswordView({ client, mode, onDone }) {
+    const [password, setPassword] = useState("");
+    const [again, setAgain] = useState("");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const submit = async (e) => {
+        e.preventDefault();
+        if (password !== again) {
+            setError("The two passwords differ.");
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await client.auth.updateUser({ password });
+            if (res.error)
+                setError(res.error.message);
+            else
+                onDone();
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : String(e));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: _jsxs("form", { onSubmit: submit, style: {
+                width: 320, display: "flex", flexDirection: "column", gap: 14,
+                background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
+                border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
+            }, children: [_jsx(Logo, { height: 20 }), _jsx("span", { className: "sm-title", children: mode === "invite" ? "Set your password" : "Choose a new password" }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", required: true, minLength: 8, autoComplete: "new-password", value: password, onChange: (e) => setPassword(e.target.value) }) }), _jsx(Field, { label: "Again", children: _jsx("input", { className: "sm-input", type: "password", required: true, autoComplete: "new-password", value: again, onChange: (e) => setAgain(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Saving…" : "Save" }), mode === "recovery" && _jsx(Button, { variant: "secondary", size: "lg", onClick: onDone, children: "Skip" })] }) }));
+}

package/dist/admin/shell/SettingsView.d.ts

@@ -1,5 +1,9 @@
+import { type MemberRole } from "../../permissions.ts";
 import type { AdminOps } from "../ops.ts";
-export declare function SettingsView({ ops, tail }: {
+export declare function SettingsView({ ops, tail, role, userId }: {
     ops: AdminOps;
     tail: string | undefined;
+    /** The caller's role from `members.me`; null while it loads. */
+    role: MemberRole | null;
+    userId: string;
 }): import("react").JSX.Element;

package/dist/admin/shell/SettingsView.js

@@ -4,8 +4,11 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // The Settings area (spec 2026-09-25 §5): a 200px secondary nav at the
 // left of the main column, then the page with its own top bar. The head
 // segment alone replaces itself with the default page, so Back skips the
-// empty URL. An unknown page is the shell's Not found pane.
+// empty URL. An unknown page is the shell's Not found pane. Admins only
+// (members management §2): an editor gets the error pane, and until the
+// role is known the area is loading.
 import { useEffect } from "react";
+import { can } from "../../permissions.js";
 import { TopBar } from "../ui/primitives.js";
 import { useAdminHref } from "./base.js";
 import { ErrorPane } from "./ErrorPane.js";
@@ -13,16 +16,34 @@ import { MembersPage } from "./MembersPage.js";
 import { RouteLink } from "./RouteLink.js";
 import { navigate } from "./router.js";
 import { DEFAULT_SETTINGS_PAGE, SETTINGS_PAGES, settingsPage, settingsTitle } from "./settings.js";
-export function SettingsView({ ops, tail }) {
+export function SettingsView({ ops, tail, role, userId }) {
     const adminHref = useAdminHref();
     const page = settingsPage(tail);
     useEffect(() => {
         if (tail === undefined)
             navigate(adminHref(`/settings/${DEFAULT_SETTINGS_PAGE}`), { replace: true });
     }, [tail, adminHref]);
+    if (role === null)
+        return _jsx("div", { className: "sm-empty", children: "Loading\u2026" });
+    if (!can(role, "settings"))
+        return _jsx(ErrorPane, { message: "Settings are for admins." });
     if (!page)
         return _jsx(ErrorPane, { message: "Not found." });
     return (_jsxs("div", { className: "sm-settings", children: [_jsx("nav", { className: "sm-settings__nav", "aria-label": "Settings", children: SETTINGS_PAGES.map((p) => (_jsx(RouteLink, { className: "sm-settings__link", href: adminHref(`/settings/${p.id}`), "aria-current": p.id === page ? "page" : undefined, children: p.title }, p.id))) }), _jsx("section", { className: "sm-settings__page", children: page === "members"
-                    ? _jsx(MembersPage, { ops: ops })
-                    : _jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: settingsTitle(page) }) }), _jsx("div", { className: "sm-listwrap" })] }) })] }));
+                    ? _jsx(MembersPage, { ops: ops, userId: userId })
+                    : page === "roles"
+                        ? _jsx(RolesPage, {})
+                        : _jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: settingsTitle(page) }) }), _jsx("div", { className: "sm-listwrap" })] }) })] }));
+}
+// The two roles, read-only (members management §1): what each may do.
+// A row per capability group, not per Capability — the table explains,
+// permissions.ts decides.
+const ROLE_ROWS = [
+    ["Edit, publish, unpublish and delete content; upload and delete media", true, true],
+    ["Open Settings and every page under it", true, false],
+    ["Invite, re-role and remove members", true, false],
+];
+function RolesPage() {
+    const grid = { gridTemplateColumns: "minmax(240px,1fr) 100px 100px" };
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Roles" }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [_jsx("span", { children: "What a role may do" }), _jsx("span", { children: "Admin" }), _jsx("span", { children: "Editor" })] }), _jsx("div", { className: "sm-table__body", children: ROLE_ROWS.map(([what, admin, editor]) => (_jsxs("div", { className: "sm-row", style: grid, children: [_jsx("span", { className: "sm-cell", children: what }), _jsx("span", { className: "sm-cell", children: admin ? "yes" : "no" }), _jsx("span", { className: "sm-cell", children: editor ? "yes" : "no" })] }, what))) })] }) })] }));
 }

package/dist/admin/shell/live-url.d.ts

@@ -0,0 +1,9 @@
+export declare const LIVE_URL_MESSAGE = "This changes the live URL. Old links stop working until a redirect exists (there are none yet). Continue?";
+/** `from` null = there was no URL part to change (a new row, a collection without a path). */
+export declare function liveUrlChanges(input: {
+    status: "draft" | "published" | undefined;
+    from: string | null;
+    to: string | null;
+}): boolean;
+/** True when the change may go ahead: not a live change, or confirmed. */
+export declare const confirmLiveUrl: (input: Parameters<typeof liveUrlChanges>[0]) => boolean;

package/dist/admin/shell/live-url.js

@@ -0,0 +1,10 @@
+// The one confirm on anything that changes a live URL (spec 2026-09-25
+// members management §5): a published page's or entry's slug, or a
+// published page's parent. Whoever the role — the mistake is the same.
+export const LIVE_URL_MESSAGE = "This changes the live URL. Old links stop working until a redirect exists (there are none yet). Continue?";
+/** `from` null = there was no URL part to change (a new row, a collection without a path). */
+export function liveUrlChanges(input) {
+    return input.status === "published" && input.from !== null && input.to !== input.from;
+}
+/** True when the change may go ahead: not a live change, or confirmed. */
+export const confirmLiveUrl = (input) => !liveUrlChanges(input) || window.confirm(LIVE_URL_MESSAGE);

package/dist/admin/shell/members-list.d.ts

@@ -1,9 +1,21 @@
 import type { MemberRecord } from "../../member-store.ts";
+import { type MemberRole } from "../../permissions.ts";
 export type MemberRow = {
     key: string;
     email: string;
     fallback: boolean;
+    /** Display label. */
     role: string;
+    /** The normalized role, what the control holds. */
+    value: MemberRole;
+    own: boolean;
+    lastAdmin: boolean;
 };
 export declare const roleLabel: (role: string) => string;
-export declare function memberRows(members: MemberRecord[]): MemberRow[];
+export declare function memberRows(members: MemberRecord[], opts: {
+    me: string;
+}): MemberRow[];
+export declare const GUARD_TITLE: {
+    readonly own: "You cannot change your own membership.";
+    readonly lastAdmin: "This site needs at least one admin.";
+};

package/dist/admin/shell/members-list.js

@@ -1,9 +1,21 @@
+import { normalizeRole } from "../../permissions.js";
 export const roleLabel = (role) => (role ? role[0].toUpperCase() + role.slice(1) : "");
-export function memberRows(members) {
-    return members.map((m) => ({
-        key: m.userId,
-        email: m.email ?? m.userId,
-        fallback: m.email === null,
-        role: roleLabel(m.role),
-    }));
+export function memberRows(members, opts) {
+    const admins = members.filter((m) => normalizeRole(m.role) === "admin").length;
+    return members.map((m) => {
+        const value = normalizeRole(m.role);
+        return {
+            key: m.userId,
+            email: m.email ?? m.userId,
+            fallback: m.email === null,
+            role: roleLabel(value),
+            value,
+            own: m.userId === opts.me,
+            lastAdmin: value === "admin" && admins <= 1,
+        };
+    });
 }
+export const GUARD_TITLE = {
+    own: "You cannot change your own membership.",
+    lastAdmin: "This site needs at least one admin.",
+};

package/dist/admin/shell/session.d.ts

@@ -4,6 +4,9 @@ export type AuthConfig = {
     key: string;
     providers?: ("google" | "github")[];
 };
+export type Arrival = "invite" | "recovery";
+/** What an auth email link says it is: GoTrue's implicit flow puts `type=` in the fragment; a query form is accepted too. */
+export declare function arrivalOf(hash: string, search: string): Arrival | null;
 export type SessionState = {
     status: "loading";
 } | {
@@ -16,4 +19,7 @@ export declare function useAdminSession(auth: AuthConfig): {
     client: SupabaseClient;
     state: SessionState;
     token: () => string | null;
+    /** The email link this visit arrived on, until the Set password screen is done. */
+    arrival: Arrival | null;
+    clearArrival: () => void;
 };

package/dist/admin/shell/session.js

@@ -3,10 +3,21 @@
 // project (smoodly.io's in the cloud, the customer's own in self-host —
 // the app passes the URL and publishable key). The token getter reads a
 // ref so the ops facade, created once, always sends the current token.
+// An auth email link (invite, reset) says what it is in the URL before
+// the client consumes the fragment; the shell shows Set password for it
+// (spec 2026-09-25 members management §6).
 import { useEffect, useRef, useState } from "react";
 import { createClient } from "@supabase/supabase-js";
+/** What an auth email link says it is: GoTrue's implicit flow puts `type=` in the fragment; a query form is accepted too. */
+export function arrivalOf(hash, search) {
+    const fromHash = new URLSearchParams(hash.replace(/^#/, "")).get("type");
+    const type = fromHash ?? new URLSearchParams(search).get("type");
+    return type === "invite" || type === "recovery" ? type : null;
+}
 export function useAdminSession(auth) {
     const browser = typeof window !== "undefined";
+    // Read BEFORE the client exists: it consumes and strips the fragment as soon as it is constructed.
+    const [arrival, setArrival] = useState(() => browser ? arrivalOf(window.location.hash, window.location.search) : null);
     const [client] = useState(() => createClient(auth.url, auth.key, {
         // Own storage key: a self-hoster's own supabase-js client in the same
         // browser must never share the admin's session slot (DESIGN.md §1).
@@ -29,11 +40,15 @@ export function useAdminSession(auth) {
                 return;
             apply(null);
         });
-        const { data } = client.auth.onAuthStateChange((_event, session) => apply(session));
+        const { data } = client.auth.onAuthStateChange((event, session) => {
+            if (event === "PASSWORD_RECOVERY")
+                setArrival("recovery");
+            apply(session);
+        });
         return () => {
             active = false;
             data.subscription.unsubscribe();
         };
     }, [client]);
-    return { client, state, token: () => current.current?.access_token ?? null };
+    return { client, state, token: () => current.current?.access_token ?? null, arrival, clearArrival: () => setArrival(null) };
 }

package/dist/admin/supabase-auth.js

@@ -1,8 +1,9 @@
 // The Supabase-backed AdminAuth: the session is verified against the
 // AUTH project (smoodly.io's in the cloud, the customer's own in self-
 // host — same code, different SMOODLY_AUTH_URL), the members row is read
-// from the CONTENT project with the write key. No space filter: the
-// policy set scopes the write key, and self-host has one space.
+// from the CONTENT project with the write key, its role onto the session.
+// No space filter: the policy set scopes the write key, and self-host
+// has one space.
 import { createClient } from "@supabase/supabase-js";
 export function supabaseAdminAuth(input) {
     const auth = createClient(input.authUrl, input.authKey, {
@@ -13,11 +14,11 @@ export function supabaseAdminAuth(input) {
             const res = await auth.auth.getUser(token);
             return res.data.user ? { userId: res.data.user.id, email: res.data.user.email ?? null } : null;
         },
-        async isEditor(userId) {
-            const res = await input.db.from("members").select("user_id").eq("user_id", userId).limit(1);
+        async memberOf(userId) {
+            const res = await input.db.from("members").select("role").eq("user_id", userId).limit(1);
             if (res.error)
                 throw new Error(`smoodly: ${res.error.message}`);
-            return res.data.length > 0;
+            return res.data.length > 0 ? String(res.data[0].role) : null;
         },
     };
 }

package/dist/index.d.ts

@@ -33,9 +33,11 @@ export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, Begi
 export { imageDimensions } from "./image-dimensions.ts";
 export { SupabasePageStore } from "./supabase-store.ts";
 export { SupabaseAssetStore } from "./supabase-asset-store.ts";
-export { MemoryMemberStore, sortMembers } from "./member-store.ts";
-export type { MemberStore, MemberRecord } from "./member-store.ts";
+export { MemoryMemberStore, sortMembers, memberErrors } from "./member-store.ts";
+export type { MemberStore, MemberRecord, InviteInput, InviteResult } from "./member-store.ts";
 export { SupabaseMemberStore } from "./supabase-member-store.ts";
+export { MEMBER_ROLES, can, normalizeRole, isMemberRole } from "./permissions.ts";
+export type { MemberRole, Capability } from "./permissions.ts";
 export { collectEntryRefs, collectTreeRefs } from "./refs.ts";
 export type { RefEdge, SectionLike } from "./refs.ts";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.ts";

package/dist/index.js

@@ -26,8 +26,9 @@ export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDo
 export { imageDimensions } from "./image-dimensions.js";
 export { SupabasePageStore } from "./supabase-store.js";
 export { SupabaseAssetStore } from "./supabase-asset-store.js";
-export { MemoryMemberStore, sortMembers } from "./member-store.js";
+export { MemoryMemberStore, sortMembers, memberErrors } from "./member-store.js";
 export { SupabaseMemberStore } from "./supabase-member-store.js";
+export { MEMBER_ROLES, can, normalizeRole, isMemberRole } from "./permissions.js";
 export { collectEntryRefs, collectTreeRefs } from "./refs.js";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.js";
 export { MemoryRefIndex } from "./ref-index.js";

package/dist/member-store.d.ts

@@ -1,20 +1,49 @@
+import type { MemberRole } from "./permissions.ts";
 export type MemberRecord = {
     userId: string;
     email: string | null;
     role: string;
 };
+export type InviteInput = {
+    email: string;
+    role: MemberRole;
+    redirectTo: string;
+};
+/** `invited` false = the email already had a confirmed account, so no mail was sent; the row was added. (A pending invitee is re-invited: same account, mail again, `invited` true.) */
+export type InviteResult = {
+    member: MemberRecord;
+    invited: boolean;
+};
 export interface MemberStore {
     /** Every member of the current space, by email then user id. */
     list(): Promise<MemberRecord[]>;
     /** The space's console URL when the control plane manages its members; null in self-host. */
     consoleUrl(): Promise<string | null>;
+    /** Creates or finds the Auth user for the email, mails the invite when it created one, upserts the row (spec 2026-09-25 members management §3). */
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    /** Deletes the member row only; the Auth account stays. */
+    remove(userId: string): Promise<void>;
 }
+export declare const memberErrors: {
+    notFound: (userId: string) => Error;
+    noAccount: (email: string) => Error;
+};
 /** Email first (case-insensitive), rows without one last, ties by user id. */
 export declare function sortMembers(rows: MemberRecord[]): MemberRecord[];
 export declare class MemoryMemberStore implements MemberStore {
     private rows;
     private url;
-    constructor(rows?: MemberRecord[], url?: string | null);
+    /** Auth accounts that exist without a member row: email → user id. */
+    private accounts;
+    /** Emails an invite was "sent" to, in order — what a test asserts. */
+    readonly sent: string[];
+    constructor(rows?: MemberRecord[], url?: string | null, 
+    /** Auth accounts that exist without a member row: email → user id. */
+    accounts?: Record<string, string>);
     list(): Promise<MemberRecord[]>;
     consoleUrl(): Promise<string | null>;
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    remove(userId: string): Promise<void>;
 }

package/dist/member-store.js

@@ -1,8 +1,7 @@
-// The members contract (spec 2026-09-25 §4) and its memory adapter. A
-// member is one row of the admission table: the Auth user id, the email
-// stored beside it, and a role from the package's vocabulary. Read-only
-// in this cut; the console URL says whether the control plane manages
-// the rows (a cloud space) — no row, no URL, self-host.
+export const memberErrors = {
+    notFound: (userId) => new Error(`smoodly: no member "${userId}".`),
+    noAccount: (email) => new Error(`smoodly: no Auth account for "${email}" although the invite said it exists.`),
+};
 /** Email first (case-insensitive), rows without one last, ties by user id. */
 export function sortMembers(rows) {
     return [...rows].sort((a, b) => {
@@ -16,9 +15,14 @@ export function sortMembers(rows) {
     });
 }
 export class MemoryMemberStore {
-    constructor(rows = [], url = null) {
+    constructor(rows = [], url = null, 
+    /** Auth accounts that exist without a member row: email → user id. */
+    accounts = {}) {
         this.rows = rows;
         this.url = url;
+        this.accounts = accounts;
+        /** Emails an invite was "sent" to, in order — what a test asserts. */
+        this.sent = [];
     }
     async list() {
         return sortMembers(this.rows);
@@ -26,4 +30,31 @@ export class MemoryMemberStore {
     async consoleUrl() {
         return this.url;
     }
+    async invite(input) {
+        const key = input.email.toLowerCase();
+        let userId = this.accounts[key] ?? this.rows.find((r) => r.email?.toLowerCase() === key)?.userId;
+        let invited = false;
+        if (!userId) {
+            userId = crypto.randomUUID();
+            this.accounts[key] = userId;
+            this.sent.push(input.email);
+            invited = true;
+        }
+        const member = { userId, email: input.email, role: input.role };
+        this.rows = [...this.rows.filter((r) => r.userId !== userId), member];
+        return { member, invited };
+    }
+    async setRole(userId, role) {
+        const row = this.rows.find((r) => r.userId === userId);
+        if (!row)
+            throw memberErrors.notFound(userId);
+        const next = { ...row, role };
+        this.rows = this.rows.map((r) => (r.userId === userId ? next : r));
+        return next;
+    }
+    async remove(userId) {
+        if (!this.rows.some((r) => r.userId === userId))
+            throw memberErrors.notFound(userId);
+        this.rows = this.rows.filter((r) => r.userId !== userId);
+    }
 }

package/dist/permissions.d.ts

@@ -0,0 +1,7 @@
+export declare const MEMBER_ROLES: readonly ["admin", "editor"];
+export type MemberRole = (typeof MEMBER_ROLES)[number];
+export type Capability = "content.write" | "settings" | "members.manage";
+export declare function can(role: MemberRole, capability: Capability): boolean;
+export declare const isMemberRole: (v: unknown) => v is MemberRole;
+/** What the table holds → a role: `owner` (the pre-2026-09-25 word) is admin; anything unknown reads as editor, the safer side. */
+export declare function normalizeRole(stored: string): MemberRole;

package/dist/permissions.js

@@ -0,0 +1,19 @@
+// Roles and what each may do (spec 2026-09-25 members management §1–§2).
+// The ONE place a role string is read: the ops and the shell ask can(),
+// the gate normalizes what the table holds. A third role is one row in
+// GRANTS; a stored matrix, if ever wanted, replaces GRANTS behind can().
+export const MEMBER_ROLES = ["admin", "editor"];
+const GRANTS = {
+    admin: ["content.write", "settings", "members.manage"],
+    editor: ["content.write"],
+};
+export function can(role, capability) {
+    return GRANTS[role].includes(capability);
+}
+export const isMemberRole = (v) => typeof v === "string" && MEMBER_ROLES.includes(v);
+/** What the table holds → a role: `owner` (the pre-2026-09-25 word) is admin; anything unknown reads as editor, the safer side. */
+export function normalizeRole(stored) {
+    if (stored === "owner")
+        return "admin";
+    return isMemberRole(stored) ? stored : "editor";
+}

package/dist/supabase-member-store.d.ts

@@ -1,8 +1,15 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-import { type MemberRecord, type MemberStore } from "./member-store.ts";
+import { type InviteInput, type InviteResult, type MemberRecord, type MemberStore } from "./member-store.ts";
+import type { MemberRole } from "./permissions.ts";
 export declare class SupabaseMemberStore implements MemberStore {
     private db;
     constructor(db: SupabaseClient);
     list(): Promise<MemberRecord[]>;
     consoleUrl(): Promise<string | null>;
+    private toRecord;
+    /** The admin API has no lookup by email: page through the users (tens, not thousands). */
+    private userIdByEmail;
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    remove(userId: string): Promise<void>;
 }