smoodly 0.0.23 → 0.0.25

package/dist/permissions.js

@@ -0,0 +1,19 @@
+// Roles and what each may do (spec 2026-09-25 members management §1–§2).
+// The ONE place a role string is read: the ops and the shell ask can(),
+// the gate normalizes what the table holds. A third role is one row in
+// GRANTS; a stored matrix, if ever wanted, replaces GRANTS behind can().
+export const MEMBER_ROLES = ["admin", "editor"];
+const GRANTS = {
+    admin: ["content.write", "settings", "members.manage"],
+    editor: ["content.write"],
+};
+export function can(role, capability) {
+    return GRANTS[role].includes(capability);
+}
+export const isMemberRole = (v) => typeof v === "string" && MEMBER_ROLES.includes(v);
+/** What the table holds → a role: `owner` (the pre-2026-09-25 word) is admin; anything unknown reads as editor, the safer side. */
+export function normalizeRole(stored) {
+    if (stored === "owner")
+        return "admin";
+    return isMemberRole(stored) ? stored : "editor";
+}

package/dist/schema-version.d.ts

@@ -0,0 +1,17 @@
+/** The minimum schema version the package needs. Moves ONLY in a release
+ *  that adds a table, column, function or policy the package reads; a
+ *  unit test holds it equal to the highest file in `migrations/`. */
+export declare const SCHEMA_VERSION = 1;
+export declare const SCHEMA_VERSION_KEY = "schema_version";
+export declare const CORE_FILE_RE: RegExp;
+export declare const VIEWS_FILE_RE: RegExp;
+/** The version a core file leaves behind, from its name; null for anything else. */
+export declare function coreFileVersion(name: string): number | null;
+/** The last statement of every core file. */
+export declare function schemaVersionSQL(version: number): string;
+/** Behind blocks the admin and warns on the site (§5). Null = no
+ *  `smoodly_meta` table, a database older than version 1. Ahead is the
+ *  normal state of a cloud app between our migration and its package
+ *  bump, and is fine. */
+export declare const schemaBehind: (database: number | null, required?: number) => boolean;
+export declare function schemaBehindMessage(database: number | null, required?: number): string;

package/dist/schema-version.js

@@ -0,0 +1,32 @@
+// packages/smoodly/src/schema-version.ts
+// The schema version this package needs (spec 2026-09-26 §1) and the two
+// things every side agrees on: the `smoodly_meta` row that records a
+// database's version, and the names of the files the package ships. Pure
+// and framework-free — the SQL emitters, the CLI, the stores, the admin
+// op and the shell all read it from here.
+/** The minimum schema version the package needs. Moves ONLY in a release
+ *  that adds a table, column, function or policy the package reads; a
+ *  unit test holds it equal to the highest file in `migrations/`. */
+export const SCHEMA_VERSION = 1;
+export const SCHEMA_VERSION_KEY = "schema_version";
+export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
+export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;
+/** The version a core file leaves behind, from its name; null for anything else. */
+export function coreFileVersion(name) {
+    const m = CORE_FILE_RE.exec(name);
+    return m ? Number(m[2]) : null;
+}
+/** The last statement of every core file. */
+export function schemaVersionSQL(version) {
+    return (`insert into "smoodly_meta" ("key", "value") values ('${SCHEMA_VERSION_KEY}', '${version}')\n` +
+        `  on conflict ("key") do update set "value" = excluded."value";`);
+}
+/** Behind blocks the admin and warns on the site (§5). Null = no
+ *  `smoodly_meta` table, a database older than version 1. Ahead is the
+ *  normal state of a cloud app between our migration and its package
+ *  bump, and is fine. */
+export const schemaBehind = (database, required = SCHEMA_VERSION) => database === null || database < required;
+export function schemaBehindMessage(database, required = SCHEMA_VERSION) {
+    return (`smoodly: the database schema is at version ${database ?? "none"}; this Smoodly needs version ${required}. ` +
+        "Run `npx smoodly migrate`, then `supabase db push` (hosted) or `supabase db reset` (local).");
+}

package/dist/sql-space.js

@@ -193,6 +193,12 @@ $$;`.trim());
     statements.push(`drop policy if exists "smoodly_read" on "spaces";\n` +
         `create policy "smoodly_read" on "spaces" for select\n` +
         `  using (${write});`);
+    // The package reads its schema version with the write key (the
+    // service role bypasses anyway); nothing else sees the table. No
+    // space_id: the schema is one per database (spec 2026-09-26 §1).
+    statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
+        `create policy "smoodly_read" on "smoodly_meta" for select\n` +
+        `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }

package/dist/sql.js

@@ -286,6 +286,15 @@ $$;
 -- to anything but a write key. The generated per-collection views
 -- (collectionSQL) run with security_invoker = true, so they are subject
 -- to this same smoodly_read policy rather than their owner's privileges.
+-- smoodly_meta: which version of this schema the database holds (spec
+-- 2026-09-26 §1). One row per database, not per space; every core
+-- migration file upserts the version row as its last statement, and the
+-- package compares it with SCHEMA_VERSION (behind blocks the admin).
+create table if not exists "smoodly_meta" (
+  "key" text primary key,
+  "value" text not null
+);
+
 alter table "pages" enable row level security;
 alter table "page_locales" enable row level security;
 alter table "page_versions" enable row level security;
@@ -295,6 +304,7 @@ alter table "entry_versions" enable row level security;
 alter table "refs" enable row level security;
 alter table "paths" enable row level security;
 alter table "assets" enable row level security;
+alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
     ].join("\n\n");

package/dist/store.d.ts

@@ -54,6 +54,8 @@ export interface PageStore {
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    /** The database's schema version from `smoodly_meta`; null when the table is missing (older than v1). Memory: always current (spec 2026-09-26 §5). */
+    schemaVersion(): Promise<number | null>;
     /** locale → path, for the locales the page exists in. */
     pathsOf(id: string): Promise<Record<string, string>>;
     /** Refused when the page already has the locale or its parent lacks it (the parent rule). */
@@ -194,6 +196,7 @@ export declare class MemoryPageStore implements PageStore {
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    schemaVersion(): Promise<number>;
     pathsOf(id: string): Promise<Record<string, string>>;
     addLocale(id: string, locale: string, options: AddLocaleOptions, by?: string): Promise<PageRecord>;
     removeLocale(id: string, locale: string): Promise<PageRecord>;

package/dist/store.js

@@ -13,6 +13,7 @@ import { ASSET_COLLECTION } from "./media.js";
 import { collectTreeRefs } from "./refs.js";
 import { customToolset, withCustomSchema } from "./custom/index.js";
 import { MemoryPathIndex } from "./path-index.js";
+import { SCHEMA_VERSION } from "./schema-version.js";
 import { assertDepth, assertSegment, assertSupportedLocale, chainOf, isHomeNode, pagePathRows, unsupportedLocale, } from "./paths.js";
 export const DEFAULT_LOCALES = { default: "en", supported: ["en"] };
 /** The section list every adapter walks refs with: the registered ones plus the custom section's schema (spec 2026-09-14 §6). */
@@ -266,6 +267,9 @@ export class MemoryPageStore {
     resolvePath(locale, path) {
         return this.paths.resolve(locale, path);
     }
+    schemaVersion() {
+        return Promise.resolve(SCHEMA_VERSION);
+    }
     pathsOf(id) {
         return this.paths.pathsOf({ kind: "page", id });
     }

package/dist/supabase-member-store.d.ts

@@ -1,8 +1,15 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-import { type MemberRecord, type MemberStore } from "./member-store.ts";
+import { type InviteInput, type InviteResult, type MemberRecord, type MemberStore } from "./member-store.ts";
+import type { MemberRole } from "./permissions.ts";
 export declare class SupabaseMemberStore implements MemberStore {
     private db;
     constructor(db: SupabaseClient);
     list(): Promise<MemberRecord[]>;
     consoleUrl(): Promise<string | null>;
+    private toRecord;
+    /** The admin API has no lookup by email: page through the users (tens, not thousands). */
+    private userIdByEmail;
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    remove(userId: string): Promise<void>;
 }

package/dist/supabase-member-store.js

@@ -1,4 +1,4 @@
-import { sortMembers } from "./member-store.js";
+import { memberErrors, sortMembers } from "./member-store.js";
 export class SupabaseMemberStore {
     constructor(db) {
         this.db = db;
@@ -7,7 +7,7 @@ export class SupabaseMemberStore {
         const res = await this.db.from("members").select("user_id, email, role");
         if (res.error)
             throw new Error(`smoodly: ${res.error.message}`);
-        return sortMembers(res.data.map((r) => ({ userId: r.user_id, email: r.email, role: r.role })));
+        return sortMembers(res.data.map((r) => this.toRecord(r)));
     }
     async consoleUrl() {
         const res = await this.db.from("spaces").select("console_url").limit(1).maybeSingle();
@@ -15,4 +15,64 @@ export class SupabaseMemberStore {
             throw new Error(`smoodly: ${res.error.message}`);
         return res.data?.console_url ?? null;
     }
+    toRecord(row) {
+        return { userId: row.user_id, email: row.email, role: row.role };
+    }
+    /** The admin API has no lookup by email: page through the users (tens, not thousands). */
+    async userIdByEmail(email) {
+        const wanted = email.toLowerCase();
+        for (let page = 1; page <= 50; page++) {
+            const res = await this.db.auth.admin.listUsers({ page, perPage: 200 });
+            if (res.error)
+                throw new Error(`smoodly: ${res.error.message}`);
+            const hit = res.data.users.find((u) => u.email?.toLowerCase() === wanted);
+            if (hit)
+                return hit.id;
+            if (res.data.users.length < 200)
+                break;
+        }
+        throw memberErrors.noAccount(email);
+    }
+    async invite(input) {
+        // Self-host: the content client is the auth project's service role, so
+        // the admin API is reachable. A cloud write key never gets here — the
+        // ops refuse behind the console URL first.
+        const sent = await this.db.auth.admin.inviteUserByEmail(input.email, { redirectTo: input.redirectTo });
+        let userId;
+        let invited;
+        if (!sent.error) {
+            userId = sent.data.user.id;
+            invited = true;
+        }
+        else if (sent.error.code === "email_exists" || /already (been )?registered/i.test(sent.error.message)) {
+            userId = await this.userIdByEmail(input.email);
+            invited = false;
+        }
+        else {
+            throw new Error(`smoodly: ${sent.error.message}`);
+        }
+        const res = await this.db
+            .from("members")
+            .upsert({ user_id: userId, email: input.email, role: input.role }, { onConflict: "space_id,user_id" })
+            .select("user_id, email, role")
+            .single();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return { member: this.toRecord(res.data), invited };
+    }
+    async setRole(userId, role) {
+        const res = await this.db.from("members").update({ role }).eq("user_id", userId).select("user_id, email, role").maybeSingle();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        if (!res.data)
+            throw memberErrors.notFound(userId);
+        return this.toRecord(res.data);
+    }
+    async remove(userId) {
+        const res = await this.db.from("members").delete().eq("user_id", userId).select("user_id");
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        if (!res.data || res.data.length === 0)
+            throw memberErrors.notFound(userId);
+    }
 }

package/dist/supabase-store.d.ts

@@ -48,7 +48,10 @@ export declare class SupabasePageStore implements PageStore {
     createPage(input: CreatePageInput, by?: string): Promise<PageRecord>;
     getPage(id: string): Promise<PageRecord | null>;
     listPages(): Promise<PageRecord[]>;
+    /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
+    private schemaChecked;
     resolvePath(locale: string, path: string): Promise<PathTarget | null>;
+    schemaVersion(): Promise<number | null>;
     pathsOf(id: string): Promise<{}>;
     addLocale(id: string, locale: string, options: AddLocaleOptions, by?: string): Promise<PageRecord>;
     removeLocale(id: string, locale: string): Promise<PageRecord>;

package/dist/supabase-store.js

@@ -8,6 +8,7 @@
 // rewritten through ONE RPC per write, so a collision rolls back.
 import { assertPublishable, assertSupportedLocale, localeRow, pageErrors, pageRefEdges, pathOptions, refSections, } from "./store.js";
 import { SupabasePathIndex } from "./supabase-path-index.js";
+import { SCHEMA_VERSION_KEY, schemaBehind, schemaBehindMessage } from "./schema-version.js";
 import { assertDepth, assertSegment, isHomeNode, pagePathRows } from "./paths.js";
 const SELECT = "*, page_locales(*)";
 const UNIQUE_VIOLATION = "23505";
@@ -40,6 +41,8 @@ export class SupabasePageStore {
     constructor(db, options = {}) {
         this.db = db;
         this.options = options;
+        /** The site's one warning per process (spec 2026-09-26 §5): fired by the first locate, never blocking. */
+        this.schemaChecked = false;
         this.options = { ...options, sections: refSections(options) };
         this.paths = options.paths ?? new SupabasePathIndex(db);
         this.opts = pathOptions(options);
@@ -300,8 +303,28 @@ export class SupabasePageStore {
         return res.data.map(toRecord);
     }
     resolvePath(locale, path) {
+        if (!this.schemaChecked) {
+            this.schemaChecked = true;
+            void this.schemaVersion()
+                .then((v) => {
+                if (schemaBehind(v))
+                    console.warn(schemaBehindMessage(v));
+            })
+                .catch(() => { });
+        }
         return this.paths.resolve(locale, path);
     }
+    async schemaVersion() {
+        const res = await this.db.from("smoodly_meta").select("value").eq("key", SCHEMA_VERSION_KEY).maybeSingle();
+        if (res.error) {
+            // PGRST205: not in PostgREST's schema cache; 42P01: undefined table.
+            if (res.error.code === "PGRST205" || res.error.code === "42P01")
+                return null;
+            this.fail(res.error.message);
+        }
+        const n = Number(res.data?.value);
+        return Number.isInteger(n) ? n : null;
+    }
     pathsOf(id) {
         return UUID_RE.test(id) ? this.paths.pathsOf({ kind: "page", id }) : Promise.resolve({});
     }

package/dist/time-zone.d.ts

@@ -0,0 +1,6 @@
+/** Whether this runtime's Intl knows the zone: canonical names, the
+ *  aliases its database still carries ("Europe/Kiev"), "UTC". An offset
+ *  like "+3" or a bare city is refused. */
+export declare function isValidZone(zone: string): boolean;
+/** The zone the runtime resolves for itself — the editor's browser in the admin; "UTC" when it has none. */
+export declare function browserZone(): string;

package/dist/time-zone.js

@@ -0,0 +1,27 @@
+// The site's time zone (spec 2026-09-25 date pickers §5): an IANA name,
+// never an offset, so daylight-saving rules come from the runtime's own
+// zone database. Core and pure: defineConfig validates with it, the
+// admin's picker falls back to the browser's zone through it.
+/** Whether this runtime's Intl knows the zone: canonical names, the
+ *  aliases its database still carries ("Europe/Kiev"), "UTC". An offset
+ *  like "+3" or a bare city is refused. */
+export function isValidZone(zone) {
+    if (zone === "")
+        return false;
+    try {
+        new Intl.DateTimeFormat("en", { timeZone: zone });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The zone the runtime resolves for itself — the editor's browser in the admin; "UTC" when it has none. */
+export function browserZone() {
+    try {
+        return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+    }
+    catch {
+        return "UTC";
+    }
+}