smoodly 0.0.26 → 0.0.27

package/README.md

@@ -477,6 +477,19 @@ Implemented:
   what (a lock in the lists, a line under the top bar) and announces
   saves so a clean view refreshes and a dirty one freezes early. Schema
   version 2 adds the draft-pointer foreign keys and the channel policies.
+- The security pass over the database boundary (spec 2026-09-26 security
+  pass): the presence channel admits a signed-in member of the topic's
+  space (`smoodly_presence_member()`, the socket carries the session
+  token through the client's `accessToken` callback, re-sent on refresh);
+  every function pins `search_path`; the three mutation RPCs are revoked
+  from `anon`/`public`. Schema version 3. The threat table, one test per
+  cell: content, `refs`/`members`, `spaces`/`smoodly_meta` and storage
+  columns — `test/isolation.supabase.test.ts` ("space isolation", "read
+  keys", "cloud state rows") and `test/rls.supabase.test.ts`; presence
+  and RPC columns — `isolation.supabase.test.ts` ("signed-in users and
+  the public keys"); admin ops — `test/admin-auth.test.ts`,
+  `test/admin-auth.supabase.test.ts`, `test/admin-ops.test.ts` ("members
+  ops").
 
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
@@ -504,6 +517,29 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-26, security pass)
+
+- The bridge posts with `"*"` on both sides. Safe today: the admin
+  accepts a message only when `e.source` is its own iframe's window, and
+  the canvas acts on two kinds, refresh and scroll. The target-origin
+  pass belongs to the content-surface sweep (spec §Out of scope).
+- The invite's `redirectTo` is a client-supplied string bounded by the
+  auth project's redirect allow-list; a same-origin check in the op is
+  one line when wanted.
+- Every op call with a junk token costs one `auth.getUser` against the
+  auth project; rate limiting is the session-model spec's (OQ 20).
+- The content-surface sweep: `f.link` values reach section components
+  unfiltered, uploads allow SVG and PDF on a public bucket (SVG served
+  with `?download=`), the custom CSS refusal list, richtext hrefs.
+- A refused private-channel join surfaces as `CHANNEL_ERROR` (about 80
+  ms on the local stack); the suite asserts "not SUBSCRIBED".
+- The isolation suite's `join` helper still uses a bare
+  `realtime.setAuth(key)`: its positive cases resolve on the first
+  SUBSCRIBED, before realtime-js re-asks the default `accessToken`
+  callback and the server closes the channel. Fine for proving the
+  policy; a client that must stay joined passes `accessToken` (what
+  `connectRealtime` does since 3ed8931).
+
 ## Follow-ups (logged 2026-09-26, concurrency spec)
 
 - A hard lock with takeover, if a real team asks: presence has the facts.
@@ -522,10 +558,6 @@ after both are on the registry. From the repo root:
   lock outlives a closed tab by that much.
 - The live suites wipe `members` and the content tables; a pane walk after
   them needs `npm run reseed` (or `scripts/demo-editor.ts`) first.
-- `e2e/helpers.ts`'s `expectSaved` passes at once when the indicator still
-  reads "Saved" from before the edit (the debounce is 800 ms), so a step that
-  needs the save landed can race it; `concurrency.spec.ts` waits for the
-  save's server response instead. Fold that into the helper for every spec.
 
 ## Follow-ups (logged 2026-09-26, browser suite)
 
@@ -1844,8 +1876,8 @@ the toolbar instead of pushing the content.
 - Once the policy-based published read exists, decide whether it becomes the canonical headless read path and the generated per-collection views turn optional (cloud has no views).
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
-- Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- **Verified and kept 2026-09-26 (security pass §3)** — Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
+- **Verified and kept 2026-09-26 (security pass §3)** — `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/editor/EditorView.js

@@ -829,7 +829,7 @@ export function EditorView({ ops, registry, id }) {
                                 trailing: registry.locales.supported.length > 1 && (_jsx(LocaleSwitcher, { registry: registry, present: record ? registry.locales.supported.filter((l) => record.locales[l]) : [locale], parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => { void doAddLocale(l); } })),
                             },
                             { label },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), ready && (_jsx(LinkButton, { icon: true, href: siteUrl, target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: record?.locales[locale] ? localeStatusOf(record.locales[locale]) : null, pending: dirty || saveState !== "saved", busy: pageBusy, flash: published, onPublish: () => { void doPublish(); }, onDiscard: () => { void doDiscard(); }, onUnpublish: () => { void doUnpublish(); }, onHistory: () => { void doHistory(); } })] }) }), target && _jsx(PresenceLine, { names: editorsOf(others, target), noun: "page" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), history && record?.locales[locale] && (_jsx(HistoryModal, { rows: history, draftId: record.locales[locale].draftVersionId, onClose: () => setHistory(null), onRestore: doRestore, render: (versionId) => _jsx("iframe", { className: "sm-history__frame", title: "Version preview", src: withVersionParam(siteUrl, versionId) }) })), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-canvas", children: [(banner || geometry === "missing") && (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 8, padding: "0 20px 10px" }, children: [banner && (_jsxs(BannerBox, { tone: banner.fields && banner.fields.length > 0 ? "warn" : "error", onDismiss: () => setBanner(null), children: [_jsx("p", { children: banner.text }), _jsx(FieldErrorList, { fields: banner.fields ?? [] })] })), geometry === "missing" && (_jsx(BannerBox, { tone: "warn", children: "Selection unavailable \u2014 the page didn't report geometry. The outline still works." }))] })), _jsx("div", { className: "sm-canvas__scroll", ref: scrollerRef, onClick: (e) => { if (e.target === e.currentTarget)
                                     setSelectedId(null); }, children: _jsxs("div", { className: "sm-page", style: { overflow: "hidden" }, children: [iframeSrc ? (_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: "Page canvas", style: { width: "100%", height: docH, border: 0, display: "block" } })) : (_jsx("div", { className: "sm-canvas__loading", children: "Loading canvas\u2026" })), _jsx(CanvasOverlay, { emptyZones: emptyZones, hoverRect: hoverRect, hoverGlobal: hoverGlobal, selection: selection, fieldHover: fieldHover, editing: editing, plusButtons: plusButtons, onPlus: (p, x, y) => setPicker({ zone: p.zone, index: p.index, x: x - 150, y: y + 12 }), onMove: doMove, onDuplicate: doDuplicate, onRemove: doRemove }), inline.richtext && (() => {
                                             const { session } = inline.richtext;
                                             const item = globalItemOf(session.node);
@@ -845,7 +845,7 @@ export function EditorView({ ops, registry, id }) {
                                                     else
                                                         mutate((t) => patchNodePath(t, session.node, session.path, doc));
                                                 }, onEscape: inline.end }));
-                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
+                                        })()] }) })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", ref: inspectorRef, children: [_jsxs("div", { className: "sm-card", children: [selectedSection || selectedItem ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "sm-inspector__head", children: [_jsxs("span", { style: { display: "flex", alignItems: "center", gap: 8, minWidth: 0 }, children: [_jsx("span", { className: "sm-blockglyph" }), _jsx("span", { className: "sm-title", style: { overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: selectedSection?.title ?? (selectedItem ? `${selectedItem.title} · global` : null) }), selectedItem && (globalTouched || globalEdit.saveState === "error") && _jsx(SaveIndicator, { state: globalEdit.saveState, pending: globalDirty })] }), _jsx(IconButton, { label: "Clear selection", onClick: () => setSelectedId(null), children: "\u00D7" })] }), tabs.length > 0 && selectedSection && (_jsx(Tabs, { tabs: tabs.map((t) => t.tab), value: activeTab, onChange: (t) => setTab(t) }))] })) : record ? (_jsx(PageInspector, { record: record, locale: locale, registry: registry, tree: tree, path: paths[locale], fixed: isFixedNode(record, registry), onRename: onRename, onPatch: doPatchPage, onRemoveLocale: Object.keys(record.locales).length > 1 &&
                                             !isFixedNode(record, registry) &&
                                             !(record.parentId === null && record.locales[registry.locales.default]?.slug === registry.homePageSlug)
                                             ? () => { void doRemoveLocale(); }

package/dist/admin/shell/AdminApp.js

@@ -12,7 +12,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (shell/IconRail.tsx), then the main column whose views own their own
 // 48px top bar (the editor adds the third, its inspector). The shell is
 // viewport-height; every column scrolls inside itself.
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { makeClientOps } from "../client-ops.js";
 import { PagesList } from "./PagesList.js";
 import { EntriesList } from "./EntriesList.js";
@@ -37,7 +37,7 @@ import { ElementsProvider } from "../forms/elements-context.js";
 import { TimeZoneProvider } from "../forms/time-zone-context.js";
 import { SchemaNotice } from "./SchemaNotice.js";
 import { schemaBehind } from "../../schema-version.js";
-import { createPresence } from "./presence.js";
+import { createPresence, followTokenRefresh } from "./presence.js";
 import { connectRealtime } from "./presence-realtime.js";
 import { PresenceProvider } from "./presence-context.js";
 export function AdminApp({ registry, op, auth, content }) {
@@ -81,9 +81,15 @@ export function AdminApp({ registry, op, auth, content }) {
         return () => { live = false; };
     }, [signedIn, ops]);
     const userId = session.state.status === "signed_in" ? session.state.session.user.id : "";
-    // Presence (spec 2026-09-26 concurrency §5): one channel per signed-in session,
-    // joined with the content project's public config; absent config = presence off.
+    // Presence (spec 2026-09-26 concurrency §5; gated 2026-09-26 security pass §1):
+    // one channel per signed-in session, the content project's public config as the
+    // gateway and the SESSION token on the socket; absent config = presence off.
+    // The token getter is a new closure every render — read it through a ref so
+    // the effect keys on the session, not on the render.
     const [presence, setPresence] = useState(null);
+    const tokenRef = useRef(session.token);
+    tokenRef.current = session.token;
+    const authClient = session.client;
     const contentUrl = content?.url, contentKey = content?.key, contentSpace = content?.spaceId;
     useEffect(() => {
         if (!signedIn || !contentUrl || !contentKey || !contentSpace || !email) {
@@ -91,11 +97,20 @@ export function AdminApp({ registry, op, auth, content }) {
             return;
         }
         const config = { url: contentUrl, key: contentKey, spaceId: contentSpace };
-        const p = createPresence({ email, connect: () => connectRealtime(config, email) });
+        const p = createPresence({
+            email,
+            connect: () => {
+                const token = tokenRef.current();
+                if (!token)
+                    throw new Error("smoodly: no session token for presence");
+                return connectRealtime(config, email, token);
+            },
+        });
         p.join();
         setPresence(p);
-        return () => { p.dispose(); setPresence(null); };
-    }, [signedIn, contentUrl, contentKey, contentSpace, email]);
+        const stop = followTokenRefresh(authClient.auth, p);
+        return () => { stop(); p.dispose(); setPresence(null); };
+    }, [signedIn, contentUrl, contentKey, contentSpace, email, authClient]);
     if (session.state.status === "loading") {
         return (_jsx("div", { style: { height: "100vh", display: "grid", placeItems: "center", color: "var(--text-muted)" }, children: "Loading\u2026" }));
     }

package/dist/admin/shell/EntryForm.js

@@ -411,6 +411,6 @@ export function EntryForm({ ops, registry, collection, id }) {
                                 trailing: multilingual && (_jsx(LocaleSwitcher, { registry: registry, present: present, parentLocales: parentLocales, value: locale, adding: adding, onSwitch: (l) => { void switchLocale(l); }, onAdd: (l) => void doAddLocale(l) })),
                             },
                             { label: heading },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "entry" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), urls[locale] && (_jsx(LinkButton, { icon: true, href: urls[locale], target: "_blank", rel: "noreferrer", "aria-label": "View live", title: "View live \u2014 opens the site route. While the admin's draft-mode cookie is on, this shows the DRAFT \u2014 open it in a private window to see what visitors see.", children: _jsx(Eye, { size: 16, strokeWidth: 1.5, "aria-hidden": "true" }) })), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsx("fieldset", { disabled: true, className: "sm-history__form", children: Object.entries(meta.fields).map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: snapshot.fields[key], refOptions: refTargets[key] ? refOptions[refTargets[key]] : undefined, prefix: d.type === "slug" ? slugPrefix : undefined, onChange: () => { } }, key))) })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "entry" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
                                             revealField(formRef.current, path); } })] })), absent ? (_jsxs("div", { style: { display: "flex", flexDirection: "column", gap: 12 }, children: [_jsxs("p", { children: ["This entry doesn't exist in ", locale, " yet. Adding it copies the ", entrySourceLocale(record, registry), " fields as the first ", locale, " draft."] }), _jsxs("div", { style: { display: "flex", gap: 8 }, children: [_jsxs(Button, { onClick: () => void doAddLocale(locale), disabled: adding || !parentLocales.includes(locale), title: parentLocales.includes(locale) ? undefined : `add ${locale} to the parent first`, children: ["Add ", locale] }), _jsxs(Button, { variant: "secondary", onClick: () => { void switchLocale(entrySourceLocale(record, registry)); }, children: ["Back to ", entrySourceLocale(record, registry)] })] })] })) : fields !== null ? (Object.entries(meta.fields).map(widget)) : !notice && _jsx("p", { style: { color: "var(--text-muted)" }, children: "Loading\u2026" })] }), _jsx(ResizeHandle, {}), _jsxs("aside", { className: "sm-inspector", children: [record && row && (_jsxs("div", { className: "sm-card", children: [_jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Created", value: relativeTime(record.createdAt) }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), multilingual && _jsx(InfoRow, { label: "Languages", value: Object.keys(record.locales).join(", ") }), _jsx(InfoRow, { label: "ID", value: id, mono: true })] })), record && (_jsxs("div", { className: "sm-card", children: [multilingual && row && Object.keys(record.locales).length > 1 && (_jsxs(Button, { variant: "secondary", onClick: () => void doRemoveLocale(), children: ["Remove from ", locale] })), _jsx(Button, { variant: "danger", onClick: destroy, children: "Delete" })] }))] })] })] }));
 }

package/dist/admin/shell/GlobalForm.js

@@ -298,6 +298,6 @@ export function GlobalForm({ ops, registry, name }) {
                                 trailing: multilingual && (_jsx(LocaleSwitcher, { registry: registry, present: registry.locales.supported, parentLocales: [], value: locale, adding: false, onSwitch: (l) => { void switchLocale(l); }, onAdd: () => undefined })),
                             },
                             { label: item.title },
-                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState }), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsxs("fieldset", { disabled: true, className: "sm-history__form", children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } })] }))] })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "item" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
+                        ] }) }), right: _jsxs(_Fragment, { children: [(touched || saveState === "error") && _jsx(SaveIndicator, { state: saveState, pending: dirty }), _jsx(PublishControl, { status: status, pending: dirty || saveState !== "saved", busy: busy, flash: published, disabled: !row, onPublish: () => { void publish(); }, onUnpublish: () => { void unpublish(); }, onDiscard: () => { void discard(); }, onHistory: () => { void openHistory(); } })] }) }), history && row && (_jsx(HistoryModal, { rows: history, draftId: row.draftVersionId, onSelect: (v) => { void loadSnapshot(v); }, onClose: () => setHistory(null), onRestore: restore, render: (versionId) => snapshot?.id === versionId ? (_jsxs("fieldset", { disabled: true, className: "sm-history__form", children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: snapshot.fields, refOptions: refOptions, multilingual: multilingual, onChange: () => { } })] }))] })) : _jsx("p", { className: "sm-hint", style: { padding: 16 }, children: "Loading\u2026" }) })), _jsx(PresenceLine, { names: editorsOf(others, target), noun: "item" }), stale && _jsx(StaleBanner, { info: stale, onReload: loadTheirs }), _jsxs("div", { className: "sm-editor", inert: stale ? true : undefined, children: [_jsxs("div", { className: "sm-form", ref: formRef, children: [notice && (_jsxs(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: [_jsx("p", { style: { margin: 0 }, children: notice.text }), _jsx(FieldErrorList, { fields: notice.fields ?? [], onReveal: (path) => { if (formRef.current)
                                             revealField(formRef.current, path); } })] })), record && (_jsxs("p", { className: "sm-hint", children: [pages.size === 0 ? "Not placed on any page yet." : `Used on ${pages.size} page${pages.size === 1 ? "" : "s"}: `, [...pages].map((id, i) => (_jsxs("span", { children: [i > 0 && ", ", _jsx("a", { href: adminHref(`/pages/${encodeURIComponent(id)}?locale=${encodeURIComponent(locale)}`), children: id })] }, id)))] })), fields !== null ? (_jsxs(_Fragment, { children: [_jsx(GlobalFields, { item: item, groups: contentGroups, fields: fields, errors: fieldErrors, refOptions: refOptions, multilingual: multilingual, onChange: onChange }), settingGroups.length > 0 && (_jsxs(_Fragment, { children: [_jsx(SectionLabel, { children: "Settings" }), _jsx(GlobalFields, { item: item, groups: settingGroups, fields: fields, errors: fieldErrors, refOptions: refOptions, multilingual: multilingual, onChange: onChange })] }))] })) : !notice && _jsx("p", { style: { color: "var(--text-muted)" }, children: "Loading\u2026" })] }), _jsx(ResizeHandle, {}), _jsx("aside", { className: "sm-inspector", children: record && row && (_jsxs("div", { className: "sm-card", children: [_jsx(SectionLabel, { children: "Document info" }), _jsx(InfoRow, { label: "Kind", value: item.section !== undefined ? `Visual · ${item.section}` : "Fields" }), _jsx(InfoRow, { label: "Updated", value: updatedLine(row.updatedAt, row.updatedBy) }), _jsx(InfoRow, { label: "ID", value: record.id, mono: true })] })) })] })] }));
 }

package/dist/admin/shell/presence-realtime.d.ts

@@ -1,3 +1,3 @@
 import type { ContentConfig } from "../../env.ts";
 import type { PresenceChannel } from "./presence.ts";
-export declare function connectRealtime(config: ContentConfig, email: string): PresenceChannel;
+export declare function connectRealtime(config: ContentConfig, email: string, token: string): PresenceChannel;

package/dist/admin/shell/presence-realtime.js

@@ -1,16 +1,26 @@
 "use client";
-// The real channel behind `createPresence` (spec 2026-09-26 concurrency §5–§6): one
-// supabase-js client on the CONTENT project with its public key (the anon key in
-// self-host, the read key in the cloud), a private channel named after the space,
-// presence keyed by the email. A key that is a JWT is also the realtime token.
+// The real channel behind `createPresence` (spec 2026-09-26 concurrency §5–§6;
+// gated 2026-09-26 security pass §1): one supabase-js client on the CONTENT
+// project whose public key (the anon key in self-host, the read key in the
+// cloud) is only the gateway apikey — the socket authenticates with the
+// editor's SESSION token, which the policies read auth.uid() from. A
+// private channel named after the space, presence keyed by the email.
+//
+// The token rides the client's `accessToken` callback, not a bare
+// `realtime.setAuth(token)`: realtime-js treats the callback as the source
+// of truth and re-asks it after every join and reconnect — with the
+// default callback that answer is the public key, which the server then
+// refuses ("no permissions to read"). The join itself waits for the first
+// setAuth, so it never goes out with the apikey alone.
 import { createClient } from "@supabase/supabase-js";
-export function connectRealtime(config, email) {
-    const client = createClient(config.url, config.key, { auth: { persistSession: false, autoRefreshToken: false } });
-    if (config.key.split(".").length === 3)
-        void client.realtime.setAuth(config.key);
+export function connectRealtime(config, email, token) {
+    let current = token;
+    const client = createClient(config.url, config.key, { accessToken: async () => current });
+    const ready = client.realtime.setAuth(token).catch(() => { });
     const channel = client.channel(`space:${config.spaceId}`, { config: { private: true, presence: { key: email } } });
     return {
-        subscribe: (onStatus) => { channel.subscribe((status) => onStatus(status)); },
+        subscribe: (onStatus) => { void ready.then(() => { channel.subscribe((status) => onStatus(status)); }); },
+        setAuth: (fresh) => { current = fresh; return client.realtime.setAuth(fresh); },
         track: (state) => channel.track(state),
         untrack: () => channel.untrack(),
         send: (message) => channel.send(message),

package/dist/admin/shell/presence.d.ts

@@ -18,6 +18,8 @@ export type PresenceState = {
 /** The slice of a Realtime channel presence uses. */
 export type PresenceChannel = {
     subscribe(onStatus: (status: string) => void): void;
+    /** A session token for the socket (spec 2026-09-26 security pass §1): the channel policies admit by auth.uid(). */
+    setAuth(token: string): Promise<unknown>;
     track(state: Record<string, unknown>): Promise<unknown>;
     untrack(): Promise<unknown>;
     send(message: {
@@ -37,6 +39,8 @@ export type Presence = {
     track(target: PresenceTarget | null): void;
     /** After a guarded op acked: tell the others. */
     announce(target: PresenceTarget, savedAt: string | null): void;
+    /** The session token was refreshed: re-authenticate the socket so the channel outlives the old token. No-op unless joined. */
+    setAuth(token: string): void;
     onSaved(listener: (event: SavedEvent) => void): () => void;
     getState(): PresenceState;
     subscribe(listener: () => void): () => void;
@@ -49,3 +53,17 @@ export declare function createPresence(opts: {
     email: string;
     connect: () => PresenceChannel;
 }): Presence;
+/** What the shell needs from the auth client to follow refreshes — supabase-js's `auth` satisfies it. */
+export type RefreshSource = {
+    onAuthStateChange(cb: (event: string, session: {
+        access_token: string;
+    } | null) => void): {
+        data: {
+            subscription: {
+                unsubscribe(): void;
+            };
+        };
+    };
+};
+/** Re-send every refreshed session token to the socket (spec 2026-09-26 security pass §1). Returns the stop function. */
+export declare function followTokenRefresh(auth: RefreshSource, presence: Pick<Presence, "setAuth">): () => void;

package/dist/admin/shell/presence.js

@@ -76,6 +76,11 @@ export function createPresence(opts) {
                 return;
             void channel.send({ type: "broadcast", event: "saved", payload: { ...target, email: opts.email, savedAt } }).catch(() => { });
         },
+        setAuth(token) {
+            if (!channel)
+                return;
+            void channel.setAuth(token).catch(() => { });
+        },
         onSaved(listener) { savedListeners.add(listener); return () => { savedListeners.delete(listener); }; },
         getState: () => state,
         subscribe(listener) { listeners.add(listener); return () => { listeners.delete(listener); }; },
@@ -88,3 +93,11 @@ export function createPresence(opts) {
         },
     };
 }
+/** Re-send every refreshed session token to the socket (spec 2026-09-26 security pass §1). Returns the stop function. */
+export function followTokenRefresh(auth, presence) {
+    const { data } = auth.onAuthStateChange((event, session) => {
+        if (event === "TOKEN_REFRESHED" && session)
+            presence.setAuth(session.access_token);
+    });
+    return () => data.subscription.unsubscribe();
+}

package/dist/admin/ui/primitives.d.ts

@@ -120,8 +120,11 @@ export declare function StatusBadge({ status }: {
     status: string;
 }): import("react").JSX.Element;
 /** The autosave indicator: a dot and one uppercase word. */
-export declare function SaveIndicator({ state }: {
+/** `pending`: an edit is waiting on the autosave debounce — shown as Saving, so "Saved" always means the
+ *  store holds what is on screen (the browser suite's `expectSaved` relies on exactly that). */
+export declare function SaveIndicator({ state, pending }: {
     state: SaveState;
+    pending?: boolean;
 }): import("react").JSX.Element;
 /** `caps`: the overline style — small, uppercase, tracked (2026-09-26; the mono face before). */
 export declare function SectionLabel({ children, action, caps, style }: {

package/dist/admin/ui/primitives.js

@@ -124,14 +124,16 @@ export function StatusBadge({ status }) {
         }, children: status }));
 }
 /** The autosave indicator: a dot and one uppercase word. */
-export function SaveIndicator({ state }) {
+/** `pending`: an edit is waiting on the autosave debounce — shown as Saving, so "Saved" always means the
+ *  store holds what is on screen (the browser suite's `expectSaved` relies on exactly that). */
+export function SaveIndicator({ state, pending = false }) {
     const map = {
         saved: { label: "Saved", dot: "var(--status-saved-dot)", color: "var(--text-muted)" },
         saving: { label: "Saving", dot: "var(--warn)", color: "var(--text-muted)" },
         error: { label: "Save failed — retrying", dot: "var(--danger)", color: "var(--danger)" },
         stale: { label: "Not saved — newer version exists", dot: "var(--danger)", color: "var(--danger)" },
     };
-    const { label, dot, color } = map[state];
+    const { label, dot, color } = map[pending && state === "saved" ? "saving" : state];
     return (_jsxs("span", { className: "sm-savestate", "data-testid": "save-status", style: { color }, title: label, children: [_jsx("span", { className: "sm-dot", style: { background: dot } }), label] }));
 }
 /** `caps`: the overline style — small, uppercase, tracked (2026-09-26; the mono face before). */

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 2;
+export declare const SCHEMA_VERSION = 3;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 2;
+export const SCHEMA_VERSION = 3;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/sql-space.d.ts

@@ -15,3 +15,9 @@ export declare function spaceLayerSQL(): string;
  *  Schema-qualified calls: storage policies do not run with public on
  *  the search path. Last in the migration, after the functions exist. */
 export declare function storageSQL(): string;
+/** The three mutation RPCs are the stores' verbs, never a browser's (spec
+ *  2026-09-26 security pass §2): executable by the service role and by
+ *  `authenticated` (the role a cloud write key carries), not by anon or
+ *  public. `smoodly_current_space` is NOT here — the stores read it through
+ *  rpc(). Last in the schema, after every definition exists. */
+export declare function grantsSQL(): string;

package/dist/sql-space.js

@@ -25,7 +25,7 @@ export function currentSpaceSQL() {
 -- default space in self-host (service role, anon key). Policies, the
 -- insert trigger and the reorder RPC all read this ONE function.
 create or replace function "smoodly_current_space"() returns uuid
-language sql stable as $$
+language sql stable set search_path = '' as $$
   select coalesce((auth.jwt() ->> 'space_id')::uuid, ${DEFAULT_SPACE});
 $$;`.trim();
 }
@@ -90,7 +90,7 @@ alter table "spaces" enable row level security;
 -- ── Claim readers. The two lookups run as definer so they can read the
 -- service-role-only tables from inside a policy; search_path is pinned.
 create or replace function "smoodly_key_kind"() returns text
-language sql stable as $$
+language sql stable set search_path = '' as $$
   select auth.jwt() ->> 'kind';
 $$;
 
@@ -107,12 +107,25 @@ language sql stable security definer set search_path = public as $$
   select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
 $$;
 
+-- The presence gate (spec 2026-09-26 security pass §1): the caller is a
+-- member of the space the Realtime topic names. auth.uid() is the session
+-- token's subject — the anon key and a read key carry none, so a visitor
+-- is refused at join. Definer, because members has no read policy for
+-- anyone but a write key. No space claim is read: the same rule serves
+-- the cloud once the content project accepts smoodly.io's tokens (OQ 32).
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
 -- ── Triggers. A key's claim wins over whatever the insert said, so an
 -- adapter never has to know its space and cannot write into another.
 -- No claim (service role, anon) leaves the given or default value —
 -- that is how smoodly.io writes cloud-state rows for a chosen space.
 create or replace function "smoodly_set_space"() returns trigger
-language plpgsql as $$
+language plpgsql set search_path = '' as $$
 begin
   if auth.jwt() ->> 'space_id' is not null then
     new."space_id" := (auth.jwt() ->> 'space_id')::uuid;
@@ -199,17 +212,19 @@ $$;`.trim());
     statements.push(`drop policy if exists "smoodly_read" on "smoodly_meta";\n` +
         `create policy "smoodly_read" on "smoodly_meta" for select\n` +
         `  using ((select "smoodly_key_kind"()) = 'write' and not (select "smoodly_space_key_revoked"()));`);
-    // The editing-presence channel (spec 2026-09-26 concurrency §6): one
-    // private Realtime topic per space, `space:<id>`. A caller receives on
-    // and sends to its own space's topic only — the anon key resolves to the
-    // default space, a cloud read key to its claim. Identical everywhere.
-    const topic = `(select realtime.topic()) = 'space:' || (select public."smoodly_current_space"())::text`;
+    // The editing-presence channel (spec 2026-09-26 concurrency §5; gated
+    // 2026-09-26 security pass §1): one private Realtime topic per space,
+    // `space:<id>`. A caller receives on and sends to a topic only when a
+    // members row of that space names their session's user — the browser
+    // authenticates the socket with the editor's session token, never with
+    // the public key alone. Identical in self-host and the cloud.
+    const member = `(select public."smoodly_presence_member"())`;
     statements.push(`drop policy if exists "smoodly_presence_read" on "realtime"."messages";\n` +
         `create policy "smoodly_presence_read" on "realtime"."messages" for select\n` +
-        `  using (${topic});`);
+        `  using (${member});`);
     statements.push(`drop policy if exists "smoodly_presence_write" on "realtime"."messages";\n` +
         `create policy "smoodly_presence_write" on "realtime"."messages" for insert\n` +
-        `  with check (${topic});`);
+        `  with check (${member});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }
@@ -238,3 +253,15 @@ create policy "smoodly_media_write" on storage.objects for all
   using (${write})
   with check (${write});`.trim();
 }
+/** The three mutation RPCs are the stores' verbs, never a browser's (spec
+ *  2026-09-26 security pass §2): executable by the service role and by
+ *  `authenticated` (the role a cloud write key carries), not by anon or
+ *  public. `smoodly_current_space` is NOT here — the stores read it through
+ *  rpc(). Last in the schema, after every definition exists. */
+export function grantsSQL() {
+    return [
+        `revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;`,
+        `revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;`,
+        `revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;`,
+    ].join("\n");
+}

package/dist/sql.js

@@ -11,7 +11,7 @@
 // locale (spec 2026-09-06 §7); a versioned collection reads its
 // fields from the published snapshot.
 import { BUILT_IN_ORDER_FIELDS } from "./collections.js";
-import { currentSpaceSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
+import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
 const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 const q = (s) => `"${s}"`;
 // Casts are fine in views (unlike index expressions, which must be
@@ -111,7 +111,7 @@ create table if not exists "page_locales" (
 );
 
 -- Sibling reorder for pages: same shape as smoodly_reorder for entries.
-create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql as $$
+create or replace function "smoodly_reorder_pages"(p_ids uuid[]) returns void language sql set search_path = public as $$
   update "pages" pg set "sort" = u.ord
   from unnest(p_ids) with ordinality as u(id, ord)
   where pg."id" = u.id
@@ -211,7 +211,7 @@ alter table "entry_locales" add constraint "entry_locales_draft_version_fkey"
 create or replace function "smoodly_reorder"(
   p_collection text,
   p_ids uuid[]
-) returns void language sql as $$
+) returns void language sql set search_path = public as $$
   update "entries" e set "sort" = u.ord
   from unnest(p_ids) with ordinality as u(id, ord)
   where e."id" = u.id
@@ -280,7 +280,7 @@ create index if not exists "assets_space_created_idx"
 -- function runs in the caller's transaction, so a primary-key collision
 -- rolls the whole rewrite back. Inserted rows get their space from the
 -- a_set_space trigger (the claim, or the default space).
-create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql as $$
+create or replace function "smoodly_rewrite_paths"(p_targets jsonb, p_rows jsonb) returns void language sql set search_path = public as $$
   delete from "paths" p
   using jsonb_to_recordset(p_targets) as t(kind text, id uuid)
   where p."kind" = t.kind and p."target_id" = t.id
@@ -318,5 +318,6 @@ alter table "assets" enable row level security;
 alter table "smoodly_meta" enable row level security;
 `.trim(),
         spaceLayerSQL(),
+        grantsSQL(),
     ].join("\n\n");
 }

package/migrations/20260926140000_smoodly_v3.sql

@@ -0,0 +1,38 @@
+-- Smoodly core schema, version 3 (docs/superpowers/specs/2026-09-26-security-pass-design.md).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 2: the presence channel admits a signed-in
+-- member of the topic's space (a definer lookup in members by the session
+-- token's user), the five unpinned functions get a search_path, and the
+-- three mutation RPCs are no longer executable by anon or public.
+
+set client_min_messages = warning;
+
+create or replace function "smoodly_presence_member"() returns boolean
+language sql stable security definer set search_path = public as $$
+  select exists (select 1 from "members" m
+    where m."user_id" = auth.uid()
+      and realtime.topic() = 'space:' || m."space_id"::text);
+$$;
+
+drop policy if exists "smoodly_presence_read" on "realtime"."messages";
+create policy "smoodly_presence_read" on "realtime"."messages" for select
+  using ((select public."smoodly_presence_member"()));
+
+drop policy if exists "smoodly_presence_write" on "realtime"."messages";
+create policy "smoodly_presence_write" on "realtime"."messages" for insert
+  with check ((select public."smoodly_presence_member"()));
+
+alter function "smoodly_current_space"() set search_path = '';
+alter function "smoodly_key_kind"() set search_path = '';
+alter function "smoodly_set_space"() set search_path = '';
+alter function "smoodly_reorder"(text, uuid[]) set search_path = public;
+alter function "smoodly_reorder_pages"(uuid[]) set search_path = public;
+alter function "smoodly_rewrite_paths"(jsonb, jsonb) set search_path = public;
+
+revoke execute on function "smoodly_reorder"(text, uuid[]) from public, anon;
+revoke execute on function "smoodly_reorder_pages"(uuid[]) from public, anon;
+revoke execute on function "smoodly_rewrite_paths"(jsonb, jsonb) from public, anon;
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '3')
+  on conflict ("key") do update set "value" = excluded."value";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {