chore: review, fmt, improve ui

bun.lock

···
 
     "@vanilla-extract/vite-plugin": ["@vanilla-extract/vite-plugin@5.2.1", "", { "dependencies": { "@vanilla-extract/compiler": "^0.6.0", "@vanilla-extract/integration": "^8.0.9" }, "peerDependencies": { "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-1dmCgmTmls/c4G+t453vZIzZ+82ftr+JC2J48C1drVkiwtZ7DscYSIko9Ci0CyDptBLWz5EO9fWnqzfHnns8tg=="],
 
-    "@vitest/expect": ["@vitest/expect@4.1.1", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.1", "@vitest/utils": "4.1.1", "chai": "^6.2.2", "tinyrainbow": "^3.0.3" } }, "sha512-xAV0fqBTk44Rn6SjJReEQkHP3RrqbJo6JQ4zZ7/uVOiJZRarBtblzrOfFIZeYUrukp2YD6snZG6IBqhOoHTm+A=="],
+    "@vitest/expect": ["@vitest/expect@4.1.2", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.2", "@vitest/utils": "4.1.2", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-gbu+7B0YgUJ2nkdsRJrFFW6X7NTP44WlhiclHniUhxADQJH5Szt9mZ9hWnJPJ8YwOK5zUOSSlSvyzRf0u1DSBQ=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.1.1", "", { "dependencies": { "@vitest/spy": "4.1.1", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-h3BOylsfsCLPeceuCPAAJ+BvNwSENgJa4hXoXu4im0bs9Lyp4URc4JYK4pWLZ4pG/UQn7AT92K6IByi6rE6g3A=="],
+    "@vitest/mocker": ["@vitest/mocker@4.1.2", "", { "dependencies": { "@vitest/spy": "4.1.2", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-Ize4iQtEALHDttPRCmN+FKqOl2vxTiNUhzobQFFt/BM1lRUTG7zRCLOykG/6Vo4E4hnUdfVLo5/eqKPukcWW7Q=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.1", "", { "dependencies": { "tinyrainbow": "^3.0.3" } }, "sha512-GM+TEQN5WhOygr1lp7skeVjdLPqqWMHsfzXrcHAqZJi/lIVh63H0kaRCY8MDhNWikx19zBUK8ceaLB7X5AH9NQ=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.2", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-dwQga8aejqeuB+TvXCMzSQemvV9hNEtDDpgUKDzOmNQayl2OG241PSWeJwKRH3CiC+sESrmoFd49rfnq7T4RnA=="],
 
-    "@vitest/runner": ["@vitest/runner@4.1.1", "", { "dependencies": { "@vitest/utils": "4.1.1", "pathe": "^2.0.3" } }, "sha512-f7+FPy75vN91QGWsITueq0gedwUZy1fLtHOCMeQpjs8jTekAHeKP80zfDEnhrleviLHzVSDXIWuCIOFn3D3f8A=="],
+    "@vitest/runner": ["@vitest/runner@4.1.2", "", { "dependencies": { "@vitest/utils": "4.1.2", "pathe": "^2.0.3" } }, "sha512-Gr+FQan34CdiYAwpGJmQG8PgkyFVmARK8/xSijia3eTFgVfpcpztWLuP6FttGNfPLJhaZVP/euvujeNYar36OQ=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.1.1", "", { "dependencies": { "@vitest/pretty-format": "4.1.1", "@vitest/utils": "4.1.1", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-kMVSgcegWV2FibXEx9p9WIKgje58lcTbXgnJixfcg15iK8nzCXhmalL0ZLtTWLW9PH1+1NEDShiFFedB3tEgWg=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.2", "", { "dependencies": { "@vitest/pretty-format": "4.1.2", "@vitest/utils": "4.1.2", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-g7yfUmxYS4mNxk31qbOYsSt2F4m1E02LFqO53Xpzg3zKMhLAPZAjjfyl9e6z7HrW6LvUdTwAQR3HHfLjpko16A=="],
 
-    "@vitest/spy": ["@vitest/spy@4.1.1", "", {}, "sha512-6Ti/KT5OVaiupdIZEuZN7l3CZcR0cxnxt70Z0//3CtwgObwA6jZhmVBA3yrXSVN3gmwjgd7oDNLlsXz526gpRA=="],
+    "@vitest/spy": ["@vitest/spy@4.1.2", "", {}, "sha512-DU4fBnbVCJGNBwVA6xSToNXrkZNSiw59H8tcuUspVMsBDBST4nfvsPsEHDHGtWRRnqBERBQu7TrTKskmjqTXKA=="],
 
-    "@vitest/utils": ["@vitest/utils@4.1.1", "", { "dependencies": { "@vitest/pretty-format": "4.1.1", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.0.3" } }, "sha512-cNxAlaB3sHoCdL6pj6yyUXv9Gry1NHNg0kFTXdvSIZXLHsqKH7chiWOkwJ5s5+d/oMwcoG9T0bKU38JZWKusrQ=="],
+    "@vitest/utils": ["@vitest/utils@4.1.2", "", { "dependencies": { "@vitest/pretty-format": "4.1.2", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-xw2/TiX82lQHA06cgbqRKFb5lCAy3axQ4H4SoUFhUsg+wztiet+co86IAMDtF6Vm1hc7J6j09oh/rgDn+JdKIQ=="],
 
     "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
 
···
 
     "vite-prerender-plugin": ["vite-prerender-plugin@0.5.13", "", { "dependencies": { "kolorist": "^1.8.0", "magic-string": "0.x >= 0.26.0", "node-html-parser": "^6.1.12", "simple-code-frame": "^1.3.0", "source-map": "^0.7.4", "stack-trace": "^1.0.0-pre2" }, "peerDependencies": { "vite": "5.x || 6.x || 7.x || 8.x" } }, "sha512-IKSpYkzDBsKAxa05naRbj7GvNVMSdww/Z/E89oO3xndz+gWnOBOKOAbEXv7qDhktY/j3vHgJmoV1pPzqU2tx9g=="],
 
-    "vitest": ["vitest@4.1.1", "", { "dependencies": { "@vitest/expect": "4.1.1", "@vitest/mocker": "4.1.1", "@vitest/pretty-format": "4.1.1", "@vitest/runner": "4.1.1", "@vitest/snapshot": "4.1.1", "@vitest/spy": "4.1.1", "@vitest/utils": "4.1.1", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.0.3", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.1", "@vitest/browser-preview": "4.1.1", "@vitest/browser-webdriverio": "4.1.1", "@vitest/ui": "4.1.1", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-yF+o4POL41rpAzj5KVILUxm1GCjKnELvaqmU9TLLUbMfDzuN0UpUR9uaDs+mCtjPe+uYPksXDRLQGGPvj1cTmA=="],
+    "vitest": ["vitest@4.1.2", "", { "dependencies": { "@vitest/expect": "4.1.2", "@vitest/mocker": "4.1.2", "@vitest/pretty-format": "4.1.2", "@vitest/runner": "4.1.2", "@vitest/snapshot": "4.1.2", "@vitest/spy": "4.1.2", "@vitest/utils": "4.1.2", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.2", "@vitest/browser-preview": "4.1.2", "@vitest/browser-webdriverio": "4.1.2", "@vitest/ui": "4.1.2", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-xjR1dMTVHlFLh98JE3i/f/WePqJsah4A0FK9cc8Ehp9Udk0AZk6ccpIZhh1qJ/yxVWRZ+Q54ocnD8TXmkhspGg=="],
 
     "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
 

drizzle/meta/0002_snapshot.json

···
       "indexes": {
         "idx_sphere_members_did": {
           "name": "idx_sphere_members_did",
-          "columns": [
-            "did"
-          ],
+          "columns": ["did"],
           "isUnique": false
         }
       },
···
           "name": "sphere_members_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_members",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_members_sphere_id_did_pk": {
-          "columns": [
-            "sphere_id",
-            "did"
-          ],
+          "columns": ["sphere_id", "did"],
           "name": "sphere_members_sphere_id_did_pk"
         }
       },
···
           "name": "sphere_modules_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_modules",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_modules_sphere_id_module_name_pk": {
-          "columns": [
-            "sphere_id",
-            "module_name"
-          ],
+          "columns": ["sphere_id", "module_name"],
           "name": "sphere_modules_sphere_id_module_name_pk"
         }
       },
···
           "name": "sphere_permissions_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_permissions",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_permissions_sphere_id_action_key_pk": {
-          "columns": [
-            "sphere_id",
-            "action_key"
-          ],
+          "columns": ["sphere_id", "action_key"],
           "name": "sphere_permissions_sphere_id_action_key_pk"
         }
       },
···
       "indexes": {
         "spheres_handle_unique": {
           "name": "spheres_handle_unique",
-          "columns": [
-            "handle"
-          ],
+          "columns": ["handle"],
           "isUnique": true
         }
       },
···
       "indexes": {
         "idx_feature_request_comment_votes_comment": {
           "name": "idx_feature_request_comment_votes_comment",
-          "columns": [
-            "comment_id"
-          ],
+          "columns": ["comment_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_comment_votes_comment_id_feature_request_comments_id_fk",
           "tableFrom": "feature_request_comment_votes",
           "tableTo": "feature_request_comments",
-          "columnsFrom": [
-            "comment_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["comment_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "feature_request_comment_votes_comment_id_author_did_pk": {
-          "columns": [
-            "comment_id",
-            "author_did"
-          ],
+          "columns": ["comment_id", "author_did"],
           "name": "feature_request_comment_votes_comment_id_author_did_pk"
         }
       },
···
       "indexes": {
         "idx_feature_request_comments_request": {
           "name": "idx_feature_request_comments_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         },
         "idx_feature_request_comments_author_request": {
           "name": "idx_feature_request_comments_author_request",
-          "columns": [
-            "author_did",
-            "request_id"
-          ],
+          "columns": ["author_did", "request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_comments_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_comments",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feature_request_statuses_request": {
           "name": "idx_feature_request_statuses_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_statuses_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_statuses",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feature_request_votes_request": {
           "name": "idx_feature_request_votes_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_votes_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_votes",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "feature_request_votes_request_id_author_did_pk": {
-          "columns": [
-            "request_id",
-            "author_did"
-          ],
+          "columns": ["request_id", "author_did"],
           "name": "feature_request_votes_request_id_author_did_pk"
         }
       },
···
       "indexes": {
         "idx_feature_requests_sphere_number": {
           "name": "idx_feature_requests_sphere_number",
-          "columns": [
-            "sphere_id",
-            "number"
-          ],
+          "columns": ["sphere_id", "number"],
           "isUnique": true
         },
         "idx_feature_requests_sphere": {
           "name": "idx_feature_requests_sphere",
-          "columns": [
-            "sphere_id"
-          ],
+          "columns": ["sphere_id"],
           "isUnique": false
         },
         "idx_feature_requests_status": {
           "name": "idx_feature_requests_status",
-          "columns": [
-            "status"
-          ],
+          "columns": ["status"],
           "isUnique": false
         },
         "idx_feature_requests_category": {
           "name": "idx_feature_requests_category",
-          "columns": [
-            "category"
-          ],
+          "columns": ["category"],
           "isUnique": false
         }
       },
···
           "name": "feature_requests_sphere_id_spheres_id_fk",
           "tableFrom": "feature_requests",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feed_posts_parent": {
           "name": "idx_feed_posts_parent",
-          "columns": [
-            "parent_id"
-          ],
+          "columns": ["parent_id"],
           "isUnique": false
         }
       },
···
   "internal": {
     "indexes": {}
   }
-}
+}

drizzle/meta/0003_snapshot.json

···
       "indexes": {
         "idx_sphere_members_did": {
           "name": "idx_sphere_members_did",
-          "columns": [
-            "did"
-          ],
+          "columns": ["did"],
           "isUnique": false
         }
       },
···
           "name": "sphere_members_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_members",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_members_sphere_id_did_pk": {
-          "columns": [
-            "sphere_id",
-            "did"
-          ],
+          "columns": ["sphere_id", "did"],
           "name": "sphere_members_sphere_id_did_pk"
         }
       },
···
           "name": "sphere_modules_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_modules",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_modules_sphere_id_module_name_pk": {
-          "columns": [
-            "sphere_id",
-            "module_name"
-          ],
+          "columns": ["sphere_id", "module_name"],
           "name": "sphere_modules_sphere_id_module_name_pk"
         }
       },
···
           "name": "sphere_permissions_sphere_id_spheres_id_fk",
           "tableFrom": "sphere_permissions",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "sphere_permissions_sphere_id_action_key_pk": {
-          "columns": [
-            "sphere_id",
-            "action_key"
-          ],
+          "columns": ["sphere_id", "action_key"],
           "name": "sphere_permissions_sphere_id_action_key_pk"
         }
       },
···
       "indexes": {
         "spheres_handle_unique": {
           "name": "spheres_handle_unique",
-          "columns": [
-            "handle"
-          ],
+          "columns": ["handle"],
           "isUnique": true
         }
       },
···
       "indexes": {
         "idx_feature_request_comment_votes_comment": {
           "name": "idx_feature_request_comment_votes_comment",
-          "columns": [
-            "comment_id"
-          ],
+          "columns": ["comment_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_comment_votes_comment_id_feature_request_comments_id_fk",
           "tableFrom": "feature_request_comment_votes",
           "tableTo": "feature_request_comments",
-          "columnsFrom": [
-            "comment_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["comment_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "feature_request_comment_votes_comment_id_author_did_pk": {
-          "columns": [
-            "comment_id",
-            "author_did"
-          ],
+          "columns": ["comment_id", "author_did"],
           "name": "feature_request_comment_votes_comment_id_author_did_pk"
         }
       },
···
       "indexes": {
         "idx_feature_request_comments_request": {
           "name": "idx_feature_request_comments_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         },
         "idx_feature_request_comments_author_request": {
           "name": "idx_feature_request_comments_author_request",
-          "columns": [
-            "author_did",
-            "request_id"
-          ],
+          "columns": ["author_did", "request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_comments_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_comments",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feature_request_statuses_request": {
           "name": "idx_feature_request_statuses_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_statuses_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_statuses",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feature_request_votes_request": {
           "name": "idx_feature_request_votes_request",
-          "columns": [
-            "request_id"
-          ],
+          "columns": ["request_id"],
           "isUnique": false
         }
       },
···
           "name": "feature_request_votes_request_id_feature_requests_id_fk",
           "tableFrom": "feature_request_votes",
           "tableTo": "feature_requests",
-          "columnsFrom": [
-            "request_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
       },
       "compositePrimaryKeys": {
         "feature_request_votes_request_id_author_did_pk": {
-          "columns": [
-            "request_id",
-            "author_did"
-          ],
+          "columns": ["request_id", "author_did"],
           "name": "feature_request_votes_request_id_author_did_pk"
         }
       },
···
       "indexes": {
         "idx_feature_requests_sphere_number": {
           "name": "idx_feature_requests_sphere_number",
-          "columns": [
-            "sphere_id",
-            "number"
-          ],
+          "columns": ["sphere_id", "number"],
           "isUnique": true
         },
         "idx_feature_requests_sphere": {
           "name": "idx_feature_requests_sphere",
-          "columns": [
-            "sphere_id"
-          ],
+          "columns": ["sphere_id"],
           "isUnique": false
         },
         "idx_feature_requests_status": {
           "name": "idx_feature_requests_status",
-          "columns": [
-            "status"
-          ],
+          "columns": ["status"],
           "isUnique": false
         },
         "idx_feature_requests_category": {
           "name": "idx_feature_requests_category",
-          "columns": [
-            "category"
-          ],
+          "columns": ["category"],
           "isUnique": false
         }
       },
···
           "name": "feature_requests_sphere_id_spheres_id_fk",
           "tableFrom": "feature_requests",
           "tableTo": "spheres",
-          "columnsFrom": [
-            "sphere_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["sphere_id"],
+          "columnsTo": ["id"],
           "onDelete": "no action",
           "onUpdate": "no action"
         }
···
       "indexes": {
         "idx_feed_posts_parent": {
           "name": "idx_feed_posts_parent",
-          "columns": [
-            "parent_id"
-          ],
+          "columns": ["parent_id"],
           "isUnique": false
         }
       },
···
   "internal": {
     "indexes": {}
   }
-}
+}

drizzle/meta/_journal.json

···
       "breakpoints": true
     }
   ]
-}
+}

package.json

···
     "bun-types": "^1.3.11",
     "drizzle-kit": "^0.31.10",
     "oxfmt": "^0.41.0",
-    "vitest": "^4.1.1"
+    "vitest": "^4.1.2"
   }
 }

packages/app/src/app.tsx

···
 import { SignIn } from "./pages/sign-in.tsx";
 import { CreateSphere } from "./pages/create-sphere.tsx";
 import { SpherePage } from "./pages/sphere.tsx";
+import { SphereMembersPage } from "./pages/sphere-members.tsx";
+import { SpherePermissionsPage } from "./pages/sphere-permissions.tsx";
 import { Dashboard } from "./pages/dashboard.tsx";
 import type { ModuleRoute } from "@exosphere/client/types";
 import { feedsModule } from "@exosphere/feeds/client";
···
         {routes.map((r) => (
           <Route key={r.path} path={r.path} component={r.component} />
         ))}
+        <Route
+          path="/s/:sphereHandle/settings/members"
+          component={withSphereLoader(SphereMembersPage)}
+        />
+        <Route
+          path="/s/:sphereHandle/settings/permissions"
+          component={withSphereLoader(SpherePermissionsPage)}
+        />
         <Route path="/s/:sphereHandle" component={withSphereLoader(SpherePage)} />
         <Route path="/" component={MultiSphereDefaultPage} />
         <Route default component={MultiSphereDefaultPage} />
···
   return (
     <Router>
       <Route path="/sign-in" component={SignInPage} />
+      <Route path="/settings/members" component={SphereMembersPage} />
+      <Route path="/settings/permissions" component={SpherePermissionsPage} />
       {moduleRoutes.map((r) => (
         <Route key={r.path} path={r.path} component={r.component} />
       ))}

packages/app/src/pages/dashboard.tsx

···
     initialData: ssrData,
   });
   const accepting = useSignal<string | null>(null);
+  const acceptError = useSignal("");
 
   if (!data || data.invitations.length === 0) return null;
 
   const handleAccept = async (inv: InvitationData) => {
     accepting.value = inv.sphere.handle;
+    acceptError.value = "";
     try {
       await acceptInvite(inv.sphere.handle);
       refetch();
       sphereListVersion.value++;
     } catch (err) {
-      console.error("Accept failed:", err);
+      acceptError.value = err instanceof Error ? err.message : "Failed to accept invitation.";
     } finally {
       accepting.value = null;
     }
···
     <div class={ui.section}>
       <h2 class={ui.sectionTitle}>Pending Invitations</h2>
       <div class={ui.stackSm}>
+        {acceptError.value && <p class={ui.errorText}>{acceptError.value}</p>}
         {data.invitations.map((inv) => (
           <div class={ui.card} key={inv.sphere.id}>
             <div class={ui.row}>
               <div>
-                <a href={`/s/${inv.sphere.handle}`}><strong>{inv.sphere.name}</strong></a>
+                <a href={`/s/${inv.sphere.handle}`}>
+                  <strong>{inv.sphere.name}</strong>
+                </a>
                 <span class={`${ui.muted} ${ui.inlineTag}`}>{inv.role}</span>
               </div>
               <button

packages/app/src/pages/sphere-members.tsx

···
+import { useSignal } from "@preact/signals";
+import { sphereState, sphereHandle } from "@exosphere/client/sphere";
+import { canDo } from "@exosphere/client/permissions";
+import { useQuery } from "@exosphere/client/hooks";
+import { spherePath } from "@exosphere/client/router";
+import * as ui from "@exosphere/client/ui.css";
+import {
+  getSphereMembers,
+  inviteMember,
+  revokeMember,
+  updateMemberRole,
+  type MemberData,
+} from "../api/spheres.ts";
+
+const roleLabels: Record<string, string> = {
+  owner: "Owner",
+  admin: "Admin",
+  member: "Member",
+};
+
+const statusLabels: Record<string, string> = {
+  active: "Active",
+  invited: "Invited",
+  revoked: "Revoked",
+};
+
+export function SphereMembersPage() {
+  const { data } = sphereState.value;
+  const handle = sphereHandle.value;
+
+  if (!data || !handle) return null;
+  // Allow access if user has any member management permission
+  const canManageMembers =
+    canDo("sphere", "invite-member") ||
+    canDo("sphere", "revoke-member") ||
+    canDo("sphere", "update-member-role");
+  if (!canManageMembers) return null;
+
+  return <MembersContent handle={handle} sphereName={data.sphere.name} />;
+}
+
+function MembersContent({ handle, sphereName }: { handle: string; sphereName: string }) {
+  const members = useQuery(() => getSphereMembers(handle), [handle]);
+  const inviteDid = useSignal("");
+  const inviteRole = useSignal<"admin" | "member">("member");
+  const inviteError = useSignal("");
+  const memberError = useSignal("");
+  const inviting = useSignal(false);
+  // Track pending role change: { did, role } — null when nothing pending
+  const pendingRole = useSignal<{ did: string; role: "admin" | "member" } | null>(null);
+
+  const handleInvite = async (e: Event) => {
+    e.preventDefault();
+    const did = inviteDid.value.trim();
+    if (!did) return;
+    inviting.value = true;
+    inviteError.value = "";
+    try {
+      await inviteMember(handle, did, inviteRole.value);
+      inviteDid.value = "";
+      members.refetch();
+    } catch (err) {
+      inviteError.value = err instanceof Error ? err.message : "Failed to invite member.";
+    } finally {
+      inviting.value = false;
+    }
+  };
+
+  const handleRevoke = async (did: string) => {
+    memberError.value = "";
+    try {
+      await revokeMember(handle, did);
+      members.refetch();
+    } catch (err) {
+      memberError.value = err instanceof Error ? err.message : "Failed to revoke member.";
+    }
+  };
+
+  const handleRoleChange = async (did: string, role: "admin" | "member") => {
+    memberError.value = "";
+    try {
+      await updateMemberRole(handle, did, role);
+      pendingRole.value = null;
+      members.refetch();
+    } catch (err) {
+      memberError.value = err instanceof Error ? err.message : "Failed to update role.";
+    }
+  };
+
+  return (
+    <div class={ui.container}>
+      <div class={ui.section}>
+        <a href={spherePath("/")} class={ui.muted}>
+          &larr; {sphereName}
+        </a>
+        <h1 class={ui.pageTitle}>Members</h1>
+      </div>
+
+      {members.loading && <p class={ui.muted}>Loading members...</p>}
+      {memberError.value && <p class={ui.errorText}>{memberError.value}</p>}
+
+      {members.data && (
+        <div class={ui.section}>
+          <div class={ui.stackSm}>
+            {members.data.members.map((m: MemberData) => (
+              <div class={ui.card} key={m.did}>
+                <div class={ui.row}>
+                  <div>
+                    <strong class={ui.didText}>{m.handle ? `@${m.handle}` : m.did}</strong>
+                    <span class={`${ui.muted} ${ui.inlineTag}`}>
+                      {roleLabels[m.role] ?? m.role}
+                    </span>
+                    <span class={`${ui.muted} ${ui.inlineTag}`}>
+                      {statusLabels[m.status] ?? m.status}
+                    </span>
+                  </div>
+                  {m.role !== "owner" &&
+                    m.status === "active" &&
+                    (canDo("sphere", "update-member-role") || canDo("sphere", "revoke-member")) && (
+                      <div class={ui.cluster}>
+                        {canDo("sphere", "update-member-role") && (
+                          <>
+                            <select
+                              class={ui.selectCompact}
+                              value={
+                                pendingRole.value?.did === m.did ? pendingRole.value.role : m.role
+                              }
+                              onChange={(e) => {
+                                const newRole = (e.target as HTMLSelectElement).value as
+                                  | "admin"
+                                  | "member";
+                                if (newRole !== m.role) {
+                                  pendingRole.value = { did: m.did, role: newRole };
+                                } else {
+                                  pendingRole.value = null;
+                                }
+                              }}
+                            >
+                              <option value="member">Member</option>
+                              <option value="admin">Admin</option>
+                            </select>
+                            {pendingRole.value?.did === m.did && (
+                              <>
+                                <button
+                                  class={ui.buttonCompact}
+                                  onClick={() => handleRoleChange(m.did, pendingRole.value!.role)}
+                                >
+                                  Confirm
+                                </button>
+                                <button
+                                  class={ui.buttonCompactSecondary}
+                                  onClick={() => (pendingRole.value = null)}
+                                >
+                                  Cancel
+                                </button>
+                              </>
+                            )}
+                          </>
+                        )}
+                        {canDo("sphere", "revoke-member") && (
+                          <button class={ui.buttonDanger} onClick={() => handleRevoke(m.did)}>
+                            Revoke
+                          </button>
+                        )}
+                      </div>
+                    )}
+                </div>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {canDo("sphere", "invite-member") && (
+        <div class={ui.section}>
+          <form onSubmit={handleInvite} class={ui.stack}>
+            <h2 class={ui.sectionTitle}>Invite member</h2>
+            <div class={ui.cluster}>
+              <input
+                class={`${ui.input} ${ui.flexGrow}`}
+                type="text"
+                placeholder="did:plc:..."
+                value={inviteDid.value}
+                onInput={(e) => (inviteDid.value = (e.target as HTMLInputElement).value)}
+              />
+              <select
+                class={ui.selectCompact}
+                value={inviteRole.value}
+                onChange={(e) =>
+                  (inviteRole.value = (e.target as HTMLSelectElement).value as "admin" | "member")
+                }
+              >
+                <option value="member">Member</option>
+                <option value="admin">Admin</option>
+              </select>
+              <button type="submit" class={ui.button} disabled={inviting.value}>
+                {inviting.value ? "Inviting..." : "Invite"}
+              </button>
+            </div>
+            {inviteError.value && <p class={ui.errorText}>{inviteError.value}</p>}
+          </form>
+        </div>
+      )}
+    </div>
+  );
+}

packages/app/src/pages/sphere-permissions.tsx

···
+import { useSignal } from "@preact/signals";
+import { sphereState, sphereHandle, refreshSphere } from "@exosphere/client/sphere";
+import { canDo } from "@exosphere/client/permissions";
+import { useQuery } from "@exosphere/client/hooks";
+import { spherePath } from "@exosphere/client/router";
+import * as ui from "@exosphere/client/ui.css";
+import { getSpherePermissions, updateSpherePermissions } from "../api/spheres.ts";
+
+const roleLabels: Record<string, string> = {
+  owner: "Owner",
+  admin: "Admin",
+  member: "Member",
+  authenticated: "Any user",
+};
+
+// Must match CORE_MODULE from @exosphere/core/permissions
+const CORE_MODULE = "sphere";
+
+const moduleLabels: Record<string, string> = {
+  sphere: "Sphere",
+  "feature-requests": "Infuse",
+};
+
+export function SpherePermissionsPage() {
+  const { data } = sphereState.value;
+  const handle = sphereHandle.value;
+
+  if (!data || !handle) return null;
+  if (!canDo("sphere", "update-permissions")) return null;
+
+  return <PermissionsContent handle={handle} sphereName={data.sphere.name} />;
+}
+
+function PermissionsContent({ handle, sphereName }: { handle: string; sphereName: string }) {
+  const perms = useQuery(() => getSpherePermissions(handle), [handle]);
+  const saving = useSignal(false);
+  const saveError = useSignal("");
+  const pendingChanges = useSignal<Record<string, string>>({});
+
+  const handleChange = (actionKey: string, role: string) => {
+    pendingChanges.value = { ...pendingChanges.value, [actionKey]: role };
+  };
+
+  const handleSave = async () => {
+    if (Object.keys(pendingChanges.value).length === 0) return;
+    saving.value = true;
+    saveError.value = "";
+    try {
+      await updateSpherePermissions(handle, pendingChanges.value);
+      pendingChanges.value = {};
+      perms.refetch();
+      refreshSphere();
+    } catch (err) {
+      saveError.value = err instanceof Error ? err.message : "Failed to save permissions.";
+    } finally {
+      saving.value = false;
+    }
+  };
+
+  const hasChanges = Object.keys(pendingChanges.value).length > 0;
+
+  return (
+    <div class={ui.container}>
+      <div class={ui.section}>
+        <a href={spherePath("/")} class={ui.muted}>
+          &larr; {sphereName}
+        </a>
+        <h1 class={ui.pageTitle}>Permissions</h1>
+      </div>
+
+      {perms.loading && <p class={ui.muted}>Loading permissions...</p>}
+
+      {perms.data &&
+        Object.entries(perms.data.modules).map(([moduleName, mod]) => (
+          <div class={ui.section} key={moduleName}>
+            <h2 class={ui.cardHeading}>{moduleLabels[moduleName] ?? moduleName}</h2>
+            <div class={ui.stackSm}>
+              {Object.entries(mod.actions).map(([action, info]) => {
+                const actionKey = `${moduleName}:${action}`;
+                const currentValue = pendingChanges.value[actionKey] ?? info.effectiveRole;
+                const isCoreModule = moduleName === CORE_MODULE;
+                return (
+                  <div class={ui.row} key={action}>
+                    <span class={ui.permissionLabel}>{info.label}</span>
+                    <div class={ui.cluster}>
+                      <select
+                        class={ui.selectCompact}
+                        value={currentValue}
+                        onChange={(e) =>
+                          handleChange(actionKey, (e.target as HTMLSelectElement).value)
+                        }
+                      >
+                        {!isCoreModule && <option value="authenticated">Any user</option>}
+                        {!isCoreModule && <option value="member">Member</option>}
+                        <option value="admin">Admin</option>
+                        <option value="owner">Owner</option>
+                      </select>
+                      {info.isOverridden && !(actionKey in pendingChanges.value) && (
+                        <span class={ui.muted}>(default: {roleLabels[info.defaultRole]})</span>
+                      )}
+                    </div>
+                  </div>
+                );
+              })}
+            </div>
+          </div>
+        ))}
+
+      {perms.data && (hasChanges || saveError.value) && (
+        <div class={ui.section}>
+          {saveError.value && <p class={ui.errorText}>{saveError.value}</p>}
+
+          {hasChanges && (
+            <div class={ui.row}>
+              <button class={ui.buttonSecondary} onClick={() => (pendingChanges.value = {})}>
+                Discard
+              </button>
+              <button class={ui.button} onClick={handleSave} disabled={saving.value}>
+                {saving.value ? "Saving..." : "Save permissions"}
+              </button>
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}

packages/app/src/pages/sphere.tsx

···
-import { useSignal } from "@preact/signals";
-import { auth } from "@exosphere/client/auth";
 import { sphereState, sphereHandle, refreshSphere } from "@exosphere/client/sphere";
+import { canDo } from "@exosphere/client/permissions";
 import { useQuery } from "@exosphere/client/hooks";
 import { spherePath } from "@exosphere/client/router";
-import { CollapsibleSection } from "@exosphere/client/components/collapsible-section";
 import * as ui from "@exosphere/client/ui.css";
 import {
   getSphereModules,
   enableModule as apiEnableModule,
   disableModule as apiDisableModule,
-  getSpherePermissions,
-  updateSpherePermissions,
-  getSphereMembers,
-  inviteMember,
-  revokeMember,
-  updateMemberRole,
-  type MemberData,
 } from "../api/spheres.ts";
 
 /** Map internal module names to user-facing labels (used for display and URL paths). */
···
   },
 };
 
-const roleLabels: Record<string, string> = {
-  owner: "Owner",
-  admin: "Admin",
-  member: "Member",
-  authenticated: "Any user",
-};
-
-const statusLabels: Record<string, string> = {
-  active: "Active",
-  invited: "Invited",
-  revoked: "Revoked",
-};
-
 export function SpherePage() {
   const { data } = sphereState.value;
   const handle = sphereHandle.value;
···
 
   const modules = useQuery(() => getSphereModules(handle), [handle]);
 
-  const isOwner = () => {
-    if (!auth.value.authenticated) return false;
-    return data.sphere.ownerDid === auth.value.did;
-  };
-
-  const isAdminOrOwner = () => {
-    if (!auth.value.authenticated) return false;
-    const role = data.role;
-    return role === "owner" || role === "admin";
-  };
+  const canManageMembers =
+    canDo("sphere", "invite-member") ||
+    canDo("sphere", "revoke-member") ||
+    canDo("sphere", "update-member-role");
 
   const enableModule = async (moduleName: string) => {
     await apiEnableModule(handle, moduleName);
···
                     </a>
                     <span class={`${ui.muted} ${ui.inlineTag}`}>enabled</span>
                   </div>
-                  {isAdminOrOwner() && (
+                  {canDo("sphere", "disable-module") && (
                     <button class={ui.buttonDanger} onClick={() => disableModule(mod.name)}>
                       Disable
                     </button>
···
           </div>
         )}
 
-        {isAdminOrOwner() && availableToEnable.length > 0 && (
+        {canDo("sphere", "enable-module") && availableToEnable.length > 0 && (
           <div class={ui.stackSm}>
             <h3 class={ui.subsectionTitle}>Available modules</h3>
             <div class={ui.stackSm}>
···
         )}
       </div>
 
-      {/* Members section — admin/owner only */}
-      {isAdminOrOwner() && <MembersSection handle={handle} />}
-
-      {/* Permissions section — owner only */}
-      {isOwner() && <PermissionsSection handle={handle} />}
-    </div>
-  );
-}
-
-function MembersSection({ handle }: { handle: string }) {
-  const members = useQuery(() => getSphereMembers(handle), [handle]);
-  const inviteDid = useSignal("");
-  const inviteRole = useSignal<"admin" | "member">("member");
-  const inviteError = useSignal("");
-  const inviting = useSignal(false);
-
-  const handleInvite = async (e: Event) => {
-    e.preventDefault();
-    const did = inviteDid.value.trim();
-    if (!did) return;
-    inviting.value = true;
-    inviteError.value = "";
-    try {
-      await inviteMember(handle, did, inviteRole.value);
-      inviteDid.value = "";
-      members.refetch();
-    } catch (err) {
-      inviteError.value = err instanceof Error ? err.message : "Failed to invite member.";
-    } finally {
-      inviting.value = false;
-    }
-  };
-
-  const handleRevoke = async (did: string) => {
-    try {
-      await revokeMember(handle, did);
-      members.refetch();
-    } catch (err) {
-      console.error("Revoke failed:", err);
-    }
-  };
-
-  const handleRoleChange = async (did: string, role: "admin" | "member") => {
-    try {
-      await updateMemberRole(handle, did, role);
-      members.refetch();
-    } catch (err) {
-      console.error("Role change failed:", err);
-    }
-  };
-
-  return (
-    <div class={ui.section}>
-      <CollapsibleSection title="Members">
-        {members.loading && <p class={ui.muted}>Loading members...</p>}
-
-        {members.data && (
+      {/* Settings — visible to users with relevant permissions */}
+      {(canManageMembers || canDo("sphere", "update-permissions")) && (
+        <div class={ui.section}>
+          <h2 class={ui.sectionTitle}>Settings</h2>
           <div class={ui.stackSm}>
-            {members.data.members.map((m: MemberData) => (
-              <div class={ui.card} key={m.did}>
-                <div class={ui.row}>
-                  <div>
-                    <strong class={ui.didText}>{m.handle ? `@${m.handle}` : m.did}</strong>
-                    <span class={`${ui.muted} ${ui.inlineTag}`}>
-                      {roleLabels[m.role] ?? m.role}
-                    </span>
-                    <span class={`${ui.muted} ${ui.inlineTag}`}>
-                      {statusLabels[m.status] ?? m.status}
-                    </span>
-                  </div>
-                  {m.role !== "owner" && m.status === "active" && (
-                    <div class={ui.cluster}>
-                      <select
-                        class={ui.selectCompact}
-                        value={m.role}
-                        onChange={(e) =>
-                          handleRoleChange(m.did, (e.target as HTMLSelectElement).value as "admin" | "member")
-                        }
-                      >
-                        <option value="member">Member</option>
-                        <option value="admin">Admin</option>
-                      </select>
-                      <button class={ui.buttonDanger} onClick={() => handleRevoke(m.did)}>
-                        Revoke
-                      </button>
-                    </div>
-                  )}
-                </div>
-              </div>
-            ))}
-          </div>
-        )}
-
-        <form onSubmit={handleInvite} class={ui.stack}>
-          <h3 class={ui.subsectionTitle}>Invite member</h3>
-          <div class={ui.cluster}>
-            <input
-              class={`${ui.input} ${ui.flexGrow}`}
-              type="text"
-              placeholder="did:plc:..."
-              value={inviteDid.value}
-              onInput={(e) => (inviteDid.value = (e.target as HTMLInputElement).value)}
-            />
-            <select
-              class={ui.selectCompact}
-              value={inviteRole.value}
-              onChange={(e) => (inviteRole.value = (e.target as HTMLSelectElement).value as "admin" | "member")}
-            >
-              <option value="member">Member</option>
-              <option value="admin">Admin</option>
-            </select>
-            <button type="submit" class={ui.button} disabled={inviting.value}>
-              {inviting.value ? "Inviting..." : "Invite"}
-            </button>
-          </div>
-          {inviteError.value && <p class={ui.errorText}>{inviteError.value}</p>}
-        </form>
-      </CollapsibleSection>
-    </div>
-  );
-}
-
-function PermissionsSection({ handle }: { handle: string }) {
-  const perms = useQuery(() => getSpherePermissions(handle), [handle]);
-  const saving = useSignal(false);
-  const pendingChanges = useSignal<Record<string, string>>({});
-
-  const handleChange = (actionKey: string, role: string) => {
-    pendingChanges.value = { ...pendingChanges.value, [actionKey]: role };
-  };
-
-  const handleSave = async () => {
-    if (Object.keys(pendingChanges.value).length === 0) return;
-    saving.value = true;
-    try {
-      await updateSpherePermissions(handle, pendingChanges.value);
-      pendingChanges.value = {};
-      perms.refetch();
-      refreshSphere();
-    } catch (err) {
-      console.error("Save permissions failed:", err);
-    } finally {
-      saving.value = false;
-    }
-  };
-
-  const hasChanges = Object.keys(pendingChanges.value).length > 0;
-
-  return (
-    <div class={ui.section}>
-      <CollapsibleSection title="Permissions">
-        {perms.loading && <p class={ui.muted}>Loading permissions...</p>}
-
-        {perms.data && (
-          <div class={ui.stackSm}>
-            {Object.entries(perms.data.modules).map(([moduleName, mod]) => (
-              <div key={moduleName}>
-                <h3 class={ui.sectionSubheading}>
-                  {moduleLabels[moduleName]?.label ?? moduleName}
-                </h3>
-                <div class={ui.stackSm}>
-                  {Object.entries(mod.actions).map(([action, info]) => {
-                    const actionKey = `${moduleName}:${action}`;
-                    const currentValue = pendingChanges.value[actionKey] ?? info.effectiveRole;
-                    return (
-                      <div class={ui.row} key={action}>
-                        <span class={ui.permissionLabel}>{info.label}</span>
-                        <div class={ui.cluster}>
-                          <select
-                            class={ui.selectCompact}
-                            value={currentValue}
-                            onChange={(e) =>
-                              handleChange(actionKey, (e.target as HTMLSelectElement).value)
-                            }
-                          >
-                            <option value="authenticated">Any user</option>
-                            <option value="member">Member</option>
-                            <option value="admin">Admin</option>
-                            <option value="owner">Owner</option>
-                          </select>
-                          {info.isOverridden && !(actionKey in pendingChanges.value) && (
-                            <span class={ui.muted}>
-                              (default: {roleLabels[info.defaultRole]})
-                            </span>
-                          )}
-                        </div>
-                      </div>
-                    );
-                  })}
-                </div>
-              </div>
-            ))}
-
-            {hasChanges && (
-              <div class={ui.row}>
-                <button
-                  class={ui.buttonSecondary}
-                  onClick={() => (pendingChanges.value = {})}
-                >
-                  Discard
-                </button>
-                <button class={ui.button} onClick={handleSave} disabled={saving.value}>
-                  {saving.value ? "Saving..." : "Save permissions"}
-                </button>
-              </div>
+            {canManageMembers && (
+              <a href={spherePath("/settings/members")} class={ui.cardLink}>
+                <strong>Members</strong>
+                <p class={ui.muted}>Invite, manage roles, and revoke members.</p>
+              </a>
+            )}
+            {canDo("sphere", "update-permissions") && (
+              <a href={spherePath("/settings/permissions")} class={ui.cardLink}>
+                <strong>Permissions</strong>
+                <p class={ui.muted}>Configure who can perform actions in this sphere.</p>
+              </a>
             )}
           </div>
-        )}
-      </CollapsibleSection>
+        </div>
+      )}
     </div>
   );
 }

packages/client/src/components/invitation-banner.tsx

···
 import * as ui from "../ui.css.ts";
 
 export function InvitationBanner() {
+  const accepting = useSignal(false);
+  const error = useSignal("");
+
   const { data } = sphereState.value;
   const handle = sphereHandle.value;
   const { authenticated } = auth.value;
 
   if (!data || !handle || !authenticated || data.memberStatus !== "invited") return null;
-
-  const accepting = useSignal(false);
-  const error = useSignal("");
 
   const accept = async () => {
     accepting.value = true;

packages/client/src/ui.css.ts

···
   fontSize: "0.875rem",
 });
 
+export const buttonCompact = style({
+  ...btnBase,
+  paddingBlock: "6px",
+  paddingInline: vars.space.md,
+  border: "none",
+  fontSize: "0.75rem",
+  minBlockSize: "36px",
+  backgroundColor: vars.color.primary,
+  color: "#fff",
+  ":hover": { backgroundColor: vars.color.primaryHover },
+  ":active": { transform: "scale(0.98)" },
+});
+
+export const buttonCompactSecondary = style({
+  ...btnBase,
+  paddingBlock: "6px",
+  paddingInline: vars.space.md,
+  border: `1px solid ${vars.color.border}`,
+  fontSize: "0.75rem",
+  minBlockSize: "36px",
+  backgroundColor: vars.color.surface,
+  color: vars.color.text,
+  ":hover": { borderColor: vars.color.primary },
+  ":active": { transform: "scale(0.98)" },
+});
+
 export const flexGrow = style({
   flex: 1,
 });

packages/core/src/generated/lexicon-records.ts

···
   subject: string;
 }
 
+export interface FeatureRequestPermissionsRecord {
+  /** Minimum role to create feature requests. */
+  create?: string;
+  /** Minimum role to vote on feature requests. */
+  vote?: string;
+  /** Minimum role to comment on feature requests. */
+  comment?: string;
+  /** Minimum role to change feature request status. */
+  "change-status"?: string;
+  /** Minimum role to mark feature requests as duplicate. */
+  "mark-duplicate"?: string;
+  /** Minimum role to hide/unhide content. */
+  moderate?: string;
+}
+
 export interface FeatureRequestStatusRecord {
   /** at-uri — AT URI of the feature request whose status is being changed. */
   subject: string;
···
   createdAt: string;
 }
 
-export interface FeatureRequestPermissionsRecord {
-  /** Minimum role to create feature requests. */
-  create?: string;
-  /** Minimum role to vote on feature requests. */
-  vote?: string;
-  /** Minimum role to comment on feature requests. */
-  comment?: string;
-  /** Minimum role to change feature request status. */
-  "change-status"?: string;
-  /** Minimum role to mark feature requests as duplicate. */
-  "mark-duplicate"?: string;
-  /** Minimum role to hide/unhide content. */
-  moderate?: string;
-}
-
 export interface SphereMemberRecord {
   /** at-uri — AT URI of the Sphere record (site.exosphere.sphere) on the owner's PDS. */
   sphere: string;
···
   role: string;
 }
 
+export interface SpherePermissionsRecord {
+  /** Minimum role to invite members. */
+  "invite-member"?: string;
+  /** Minimum role to revoke members. */
+  "revoke-member"?: string;
+  /** Minimum role to change member roles. */
+  "update-member-role"?: string;
+  /** Minimum role to enable modules. */
+  "enable-module"?: string;
+  /** Minimum role to disable modules. */
+  "disable-module"?: string;
+  /** Minimum role to update permissions. */
+  "update-permissions"?: string;
+}
+
 export interface PdsRecordMap {
   "site.exosphere.featureRequest": FeatureRequestRecord;
   "site.exosphere.featureRequestComment": FeatureRequestCommentRecord;
   "site.exosphere.featureRequestCommentVote": FeatureRequestCommentVoteRecord;
+  "site.exosphere.featureRequestPermissions": FeatureRequestPermissionsRecord;
   "site.exosphere.featureRequestStatus": FeatureRequestStatusRecord;
   "site.exosphere.featureRequestVote": FeatureRequestVoteRecord;
   "site.exosphere.moderation": ModerationRecord;
   "site.exosphere.sphere": SphereRecord;
-  "site.exosphere.featureRequestPermissions": FeatureRequestPermissionsRecord;
   "site.exosphere.sphereMember": SphereMemberRecord;
   "site.exosphere.sphereMemberApproval": SphereMemberApprovalRecord;
+  "site.exosphere.spherePermissions": SpherePermissionsRecord;
 }

packages/core/src/permissions/check.ts

···
 import { eq, and } from "../db/drizzle.ts";
 import { getDb } from "../db/index.ts";
 import { spherePermissions } from "../db/schema/index.ts";
-import { hasMinimumRole, type Role, type MemberRole } from "./roles.ts";
+import { hasMinimumRole, ROLE_LEVELS, type Role, type MemberRole } from "./roles.ts";
 import { getDefaultRole, getAllModulePermissions } from "./registry.ts";
+import { CORE_MODULE } from "./core.ts";
 
 /** Resolve the effective minimum role for an action in a sphere. */
 export function getRequiredRole(sphereId: string, moduleName: string, action: string): Role {
···
       and(eq(spherePermissions.sphereId, sphereId), eq(spherePermissions.actionKey, actionKey)),
     )
     .get();
-  if (override) return override.minRole as Role;
+  if (override) {
+    if (override.minRole in ROLE_LEVELS) return override.minRole as Role;
+    return "admin"; // invalid DB value — safe fallback
+  }
 
   // 2. Module default
   const defaultRole = getDefaultRole(moduleName, action);
···
     .from(spherePermissions)
     .where(eq(spherePermissions.sphereId, sphereId))
     .all();
-  const overrideMap = new Map(overrides.map((r) => [r.actionKey, r.minRole as Role]));
+  const overrideMap = new Map(
+    overrides.filter((r) => r.minRole in ROLE_LEVELS).map((r) => [r.actionKey, r.minRole as Role]),
+  );
 
   const result: Record<string, boolean> = {};
 
-  for (const moduleName of enabledModules) {
+  // Always include core sphere permissions
+  const modulesToProcess = new Set(enabledModules);
+  if (allPerms.has(CORE_MODULE)) modulesToProcess.add(CORE_MODULE);
+
+  for (const moduleName of modulesToProcess) {
     const modulePerms = allPerms.get(moduleName);
     if (!modulePerms) continue;
     for (const [action, perm] of Object.entries(modulePerms)) {

packages/core/src/permissions/core.ts

···
+import type { ModulePermission } from "./registry.ts";
+
+/** Module name used for core sphere-level permissions. */
+export const CORE_MODULE = "sphere";
+
+/** AT Protocol collection ID for core sphere permission overrides. */
+export const CORE_PERMISSIONS_COLLECTION = "site.exosphere.spherePermissions";
+
+/** Core sphere-level permission actions (configurable between owner and admin). */
+export const corePermissions = {
+  "invite-member": { label: "Invite members", defaultRole: "admin" },
+  "revoke-member": { label: "Revoke members", defaultRole: "admin" },
+  "update-member-role": { label: "Change member roles", defaultRole: "admin" },
+  "enable-module": { label: "Enable modules", defaultRole: "owner" },
+  "disable-module": { label: "Disable modules", defaultRole: "owner" },
+  "update-permissions": { label: "Update permissions", defaultRole: "owner" },
+} satisfies Record<string, ModulePermission>;

packages/core/src/permissions/index.ts

···
 export type { ModulePermission } from "./registry.ts";
 export { getRequiredRole, checkPermission, computeUserPermissions } from "./check.ts";
 export { requirePermission } from "./middleware.ts";
+export { CORE_MODULE, CORE_PERMISSIONS_COLLECTION, corePermissions } from "./core.ts";

packages/core/src/permissions/middleware.ts

···
 export function requirePermission(moduleName: string, action: string) {
   return createMiddleware<AuthEnv & SphereEnv>(async (c, next) => {
     const did = c.var.did;
+    if (!did) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
     const sphereId = c.var.sphereId;
     const userRole = getActiveMemberRole(sphereId, did);
 

packages/core/src/permissions/registry.ts

···
   perms: Record<string, ModulePermission>,
   permissionsCollection?: string,
 ): void {
+  if (modulePermissions.has(moduleName)) {
+    console.warn(`[permissions] Module "${moduleName}" already registered, skipping.`);
+    return;
+  }
   modulePermissions.set(moduleName, perms);
   if (permissionsCollection) {
     moduleCollections.set(moduleName, permissionsCollection);

packages/core/src/sphere/api/members.ts

···
 import { sphereMembers } from "../../db/schema/index.ts";
 import { requireAuth, type AuthEnv } from "../../auth/index.ts";
 import { putPdsRecord, deletePdsRecord, generateRkey } from "../../pds.ts";
+import { parseAtUri } from "../../indexer/uri.ts";
 import { inviteMemberSchema } from "../schemas.ts";
-import {
-  getActiveMemberRole,
-  isAdminOrOwner,
-  upsertMemberInvite,
-  activateMember,
-} from "../operations.ts";
+import { getActiveMemberRole, upsertMemberInvite, activateMember } from "../operations.ts";
+import { checkPermission } from "../../permissions/check.ts";
 import { findSphere } from "./helpers.ts";
 import { resolveDidHandles } from "../../identity/index.ts";
 
···
     return c.json({ error: "Sphere not found" }, 404);
   }
 
+  // Allow access if user has any member management permission
   const role = getActiveMemberRole(sphere.id, c.var.did);
-  if (!isAdminOrOwner(role)) {
+  if (
+    !checkPermission(sphere.id, "sphere", "invite-member", role) &&
+    !checkPermission(sphere.id, "sphere", "revoke-member", role) &&
+    !checkPermission(sphere.id, "sphere", "update-member-role", role)
+  ) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
···
 
   const inviterDid = c.var.did;
   const inviterRole = getActiveMemberRole(sphere.id, inviterDid);
-  if (!isAdminOrOwner(inviterRole)) {
+  if (!checkPermission(sphere.id, "sphere", "invite-member", inviterRole)) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
···
 
   const revokerDid = c.var.did;
   const revokerRole = getActiveMemberRole(sphere.id, revokerDid);
-  if (!isAdminOrOwner(revokerRole)) {
+  if (!checkPermission(sphere.id, "sphere", "revoke-member", revokerRole)) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
···
   // Note: only works if the current admin is the one who published the approval
   if (membership.approvalPdsUri) {
     const session = c.var.session;
-    const rkey = membership.approvalPdsUri.split("/").pop();
-    if (rkey) {
-      await deletePdsRecord(session, APPROVAL_COLLECTION, rkey);
+    const parsed = parseAtUri(membership.approvalPdsUri);
+    if (parsed) {
+      await deletePdsRecord(session, APPROVAL_COLLECTION, parsed.rkey);
     }
   }
 
···
   }
 
   const callerRole = getActiveMemberRole(sphere.id, c.var.did);
-  if (!isAdminOrOwner(callerRole)) {
+  if (!checkPermission(sphere.id, "sphere", "update-member-role", callerRole)) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
···
 
   // Delete the old approval record before publishing the new one
   if (membership.approvalPdsUri) {
-    const oldRkey = membership.approvalPdsUri.split("/").pop();
-    if (oldRkey) {
-      await deletePdsRecord(session, APPROVAL_COLLECTION, oldRkey);
+    const parsed = parseAtUri(membership.approvalPdsUri);
+    if (parsed) {
+      await deletePdsRecord(session, APPROVAL_COLLECTION, parsed.rkey);
     }
   }
 

packages/core/src/sphere/api/modules.ts

···
 import { requireAuth, type AuthEnv } from "../../auth/index.ts";
 import { putPdsRecord } from "../../pds.ts";
 import { enableModuleSchema } from "../schemas.ts";
+import { getActiveMemberRole } from "../operations.ts";
+import { checkPermission } from "../../permissions/check.ts";
 import { findSphere, getEnabledModules, formatModules } from "./helpers.ts";
 
 const SPHERE_COLLECTION = "site.exosphere.sphere" as const;
···
       return c.json({ error: "Sphere not found" }, 404);
     }
 
-    if (c.var.did !== sphere.ownerDid) {
+    const callerRole = getActiveMemberRole(sphere.id, c.var.did);
+    if (!checkPermission(sphere.id, "sphere", "enable-module", callerRole)) {
       return c.json({ error: "Forbidden" }, 403);
     }
 
···
       .onConflictDoNothing()
       .run();
 
-    await syncSpherePds(c, sphere);
+    // PDS sync requires the owner's session — skip if caller is an admin
+    if (c.var.did === sphere.ownerDid) {
+      await syncSpherePds(c, sphere);
+    } else {
+      console.info("[modules] PDS sync skipped — caller is not the owner");
+    }
 
     return c.json({
       modules: formatModules(getEnabledModules(sphere.id)),
···
       return c.json({ error: "Sphere not found" }, 404);
     }
 
-    if (c.var.did !== sphere.ownerDid) {
+    const callerRole = getActiveMemberRole(sphere.id, c.var.did);
+    if (!checkPermission(sphere.id, "sphere", "disable-module", callerRole)) {
       return c.json({ error: "Forbidden" }, 403);
     }
 
···
       )
       .run();
 
-    await syncSpherePds(c, sphere);
+    // PDS sync requires the owner's session — skip if caller is an admin
+    if (c.var.did === sphere.ownerDid) {
+      await syncSpherePds(c, sphere);
+    } else {
+      console.info("[modules] PDS sync skipped — caller is not the owner");
+    }
 
     return c.json({
       modules: formatModules(getEnabledModules(sphere.id)),

packages/core/src/sphere/api/permissions.ts

···
   getAllModulePermissions,
   getModulePermissionsCollection,
   getRequiredRole,
+  checkPermission,
+  CORE_MODULE,
   type Role,
 } from "../../permissions/index.ts";
-import { getActiveMemberRole, isAdminOrOwner } from "../operations.ts";
+import { getActiveMemberRole } from "../operations.ts";
 import { findSphere, getEnabledModules } from "./helpers.ts";
 
 const updatePermissionsSchema = z.object({
···
 
 const app = new Hono<AuthEnv>();
 
-// Get full permissions configuration for a sphere (admin/owner only, for the admin panel)
+// Get full permissions configuration for a sphere (requires update-permissions permission)
 app.get("/:handle/permissions", requireAuth, (c) => {
   const sphere = findSphere(c.req.param("handle"));
   if (!sphere) {
···
   }
 
   const role = getActiveMemberRole(sphere.id, c.var.did);
-  if (!isAdminOrOwner(role)) {
+  if (!checkPermission(sphere.id, "sphere", "update-permissions", role)) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
···
     }
   > = {};
 
-  for (const moduleName of enabledModules) {
+  // Include core sphere permissions + enabled module permissions
+  const modulesToInclude = [CORE_MODULE, ...enabledModules];
+  for (const moduleName of modulesToInclude) {
     const modulePerms = allPerms.get(moduleName);
     if (!modulePerms) continue;
 
···
   return c.json({ modules });
 });
 
-// Update permission overrides (owner only)
+// Update permission overrides (requires update-permissions permission)
 app.put("/:handle/permissions", requireAuth, async (c) => {
   const sphere = findSphere(c.req.param("handle"));
   if (!sphere) {
     return c.json({ error: "Sphere not found" }, 404);
   }
 
-  // Owner only — only the owner can write to their PDS
-  if (c.var.did !== sphere.ownerDid) {
+  const callerRole = getActiveMemberRole(sphere.id, c.var.did);
+  if (!checkPermission(sphere.id, "sphere", "update-permissions", callerRole)) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
-  const body = await c.req.json();
+  let body: unknown;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON" }, 400);
+  }
   const parsed = updatePermissionsSchema.safeParse(body);
   if (!parsed.success) {
     return c.json({ error: z.flattenError(parsed.error) }, 400);
···
   const db = getDb();
 
   // Parse and validate all action keys up front
-  const validatedOverrides: { actionKey: string; moduleName: string; action: string; minRole: string }[] = [];
+  const validatedOverrides: {
+    actionKey: string;
+    moduleName: string;
+    action: string;
+    minRole: string;
+  }[] = [];
   for (const [actionKey, minRole] of Object.entries(overrides)) {
-    const sepIdx = actionKey.indexOf(":");
-    if (sepIdx === -1) {
+    const parsed = parseActionKey(actionKey);
+    if (!parsed) {
       return c.json({ error: `Invalid permission key: ${actionKey}` }, 400);
     }
-    const moduleName = actionKey.slice(0, sepIdx);
-    const action = actionKey.slice(sepIdx + 1);
-    const modulePerms = allPerms.get(moduleName);
-    if (!modulePerms || !modulePerms[action]) {
+    const modulePerms = allPerms.get(parsed.moduleName);
+    if (!modulePerms || !modulePerms[parsed.action]) {
       return c.json({ error: `Unknown permission: ${actionKey}` }, 400);
     }
-    validatedOverrides.push({ actionKey, moduleName, action, minRole });
+    // Core permissions can only be set to owner or admin
+    if (parsed.moduleName === CORE_MODULE && minRole !== "owner" && minRole !== "admin") {
+      return c.json(
+        { error: `Core permission "${actionKey}" can only be set to "owner" or "admin"` },
+        400,
+      );
+    }
+    // Only the owner can change core permissions that default to owner (prevents privilege escalation)
+    const defaultRole = modulePerms[parsed.action]?.defaultRole;
+    if (
+      parsed.moduleName === CORE_MODULE &&
+      defaultRole === "owner" &&
+      c.var.did !== sphere.ownerDid
+    ) {
+      return c.json({ error: "Only the owner can change owner-level core permissions" }, 403);
+    }
+    validatedOverrides.push({ actionKey, ...parsed, minRole });
   }
 
   // Upsert overrides — delete if matching the default
···
     }
   });
 
-  // Sync per-module permission records to PDS
-  // Group all overrides by module
-  const allOverrides = db
-    .select({ actionKey: spherePermissions.actionKey, minRole: spherePermissions.minRole })
-    .from(spherePermissions)
-    .where(eq(spherePermissions.sphereId, sphere.id))
-    .all();
+  // PDS sync requires the owner's session — skip if caller is an admin
+  if (c.var.did !== sphere.ownerDid) {
+    console.info("[permissions] PDS sync skipped — caller is not the owner");
+  } else {
+    // Group all overrides by module
+    const allOverrides = db
+      .select({ actionKey: spherePermissions.actionKey, minRole: spherePermissions.minRole })
+      .from(spherePermissions)
+      .where(eq(spherePermissions.sphereId, sphere.id))
+      .all();
 
-  const byModule = new Map<string, Record<string, string>>();
-  for (const row of allOverrides) {
-    const sepIdx = row.actionKey.indexOf(":");
-    if (sepIdx === -1) continue;
-    const moduleName = row.actionKey.slice(0, sepIdx);
-    const action = row.actionKey.slice(sepIdx + 1);
-    if (!byModule.has(moduleName)) byModule.set(moduleName, {});
-    byModule.get(moduleName)![action] = row.minRole;
-  }
+    const byModule = new Map<string, Record<string, string>>();
+    for (const row of allOverrides) {
+      const parsed = parseActionKey(row.actionKey);
+      if (!parsed) continue;
+      if (!byModule.has(parsed.moduleName)) byModule.set(parsed.moduleName, {});
+      byModule.get(parsed.moduleName)![parsed.action] = row.minRole;
+    }
 
-  // Write (or delete) a PDS record for each module that has a permissions collection
-  const enabledModules = getEnabledModules(sphere.id).map((m) => m.moduleName);
-  for (const moduleName of enabledModules) {
-    const collection = getModulePermissionsCollection(moduleName);
-    if (!collection) continue;
+    // Write (or delete) a PDS record for each module that has a permissions collection
+    const enabledModules = getEnabledModules(sphere.id).map((m) => m.moduleName);
+    const allModules = [CORE_MODULE, ...enabledModules];
+    for (const moduleName of allModules) {
+      const collection = getModulePermissionsCollection(moduleName);
+      if (!collection) continue;
 
-    const moduleOverrides = byModule.get(moduleName);
-    if (moduleOverrides && Object.keys(moduleOverrides).length > 0) {
-      await putPdsRecord(
-        c.var.session,
-        collection as "site.exosphere.featureRequestPermissions",
-        "self",
-        moduleOverrides as PdsRecordMap["site.exosphere.featureRequestPermissions"],
-      );
-    } else {
-      // No overrides — delete the record so PDS only holds actual overrides
-      await deletePdsRecord(c.var.session, collection, "self");
+      const moduleOverrides = byModule.get(moduleName);
+      if (moduleOverrides && Object.keys(moduleOverrides).length > 0) {
+        // Type assertions required: collection comes from the permissions registry at runtime
+        await putPdsRecord(
+          c.var.session,
+          collection as keyof PdsRecordMap,
+          "self",
+          moduleOverrides as PdsRecordMap[keyof PdsRecordMap],
+        );
+      } else {
+        // No overrides — delete the record so PDS only holds actual overrides
+        await deletePdsRecord(c.var.session, collection, "self");
+      }
     }
   }
 
   return c.json({ ok: true });
 });
+
+function parseActionKey(key: string): { moduleName: string; action: string } | null {
+  const sepIdx = key.indexOf(":");
+  if (sepIdx === -1) return null;
+  return { moduleName: key.slice(0, sepIdx), action: key.slice(sepIdx + 1) };
+}
 
 export { app as permissionsApi };

packages/core/src/sphere/api/spheres.ts

···
     })
     .from(sphereMembers)
     .innerJoin(spheres, eq(spheres.id, sphereMembers.sphereId))
-    .where(
-      and(eq(sphereMembers.did, did), eq(sphereMembers.status, "invited")),
-    )
+    .where(and(eq(sphereMembers.did, did), eq(sphereMembers.status, "invited")))
     .orderBy(sphereMembers.createdAt)
     .all();
 

packages/core/src/sphere/index.ts

···
-export { createSphereRoutes, getCurrentSphere, getMemberSpheres, getPendingInvitations } from "./routes.ts";
+export {
+  createSphereRoutes,
+  getCurrentSphere,
+  getMemberSpheres,
+  getPendingInvitations,
+} from "./routes.ts";
 export { createCoreIndexer } from "./indexer.ts";
 export {
   getActiveMemberRole,

packages/core/src/sphere/indexer.ts

···
     collectionToModule.set(collection, moduleName);
   }
 
-  const baseCollections = [SPHERE_COLLECTION, MEMBER_COLLECTION, APPROVAL_COLLECTION, MODERATION_COLLECTION];
+  const baseCollections = [
+    SPHERE_COLLECTION,
+    MEMBER_COLLECTION,
+    APPROVAL_COLLECTION,
+    MODERATION_COLLECTION,
+  ];
   const allCollections = [...baseCollections, ...collectionToModule.keys()];
 
   return {
···
     },
   };
 }
-

packages/core/src/sphere/operations.ts

···
   const row = getDb()
     .select({ role: sphereMembers.role, status: sphereMembers.status })
     .from(sphereMembers)
-    .where(
-      and(eq(sphereMembers.sphereId, sphereId), eq(sphereMembers.did, did)),
-    )
+    .where(and(eq(sphereMembers.sphereId, sphereId), eq(sphereMembers.did, did)))
     .get();
   return row ?? null;
 }
···
   } else {
     // Ignore sphere records for DIDs not on this instance —
     // spheres are created locally, not via Jetstream from other instances.
+    console.warn("[sphere] Ignoring sphere record from external DID:", did);
     return;
   }
 }
···
 // ---- Per-module permission sync from PDS ----
 
 function findSphereByOwner(did: string): { id: string } | undefined {
-  return getDb()
-    .select({ id: spheres.id })
-    .from(spheres)
-    .where(eq(spheres.ownerDid, did))
-    .get();
+  return getDb().select({ id: spheres.id }).from(spheres).where(eq(spheres.ownerDid, did)).get();
 }
 
 /** Sync a module's permission overrides from a PDS record into the local DB. */
···
   const sphere = findSphereByOwner(did);
   if (!sphere) return;
 
-  getDb().delete(spherePermissions)
+  getDb()
+    .delete(spherePermissions)
     .where(
       and(
         eq(spherePermissions.sphereId, sphere.id),

packages/feature-requests/src/api/comments.ts

···
 });
 
 // Create a comment (one top-level comment per user per request)
-app.post("/:id/comments", requireAuth, requirePermission("feature-requests", "comment"), async (c) => {
-  const requestId = c.req.param("id");
-  const body = await c.req.json();
-  const result = createCommentSchema.safeParse(body);
-  if (!result.success) {
-    return c.json({ error: z.flattenError(result.error) }, 400);
-  }
+app.post(
+  "/:id/comments",
+  requireAuth,
+  requirePermission("feature-requests", "comment"),
+  async (c) => {
+    const requestId = c.req.param("id");
+    const body = await c.req.json();
+    const result = createCommentSchema.safeParse(body);
+    if (!result.success) {
+      return c.json({ error: z.flattenError(result.error) }, 400);
+    }
 
-  const { content } = result.data;
-  const sphereId = c.var.sphereId;
-  const sphereVisibility = c.var.sphereVisibility;
-  const db = getDb();
-  const did = c.var.did;
+    const { content } = result.data;
+    const sphereId = c.var.sphereId;
+    const sphereVisibility = c.var.sphereVisibility;
+    const db = getDb();
+    const did = c.var.did;
 
-  // Check feature request exists, belongs to this sphere, and is visible
-  const existing = db
-    .select({ id: featureRequests.id, pdsUri: featureRequests.pdsUri })
-    .from(featureRequests)
-    .where(
-      and(
-        eq(featureRequests.id, requestId),
-        eq(featureRequests.sphereId, sphereId),
-        sql`${featureRequests.hiddenAt} is null`,
-      ),
-    )
-    .get();
-  if (!existing) {
-    return c.json({ error: "Feature request not found" }, 404);
-  }
+    // Check feature request exists, belongs to this sphere, and is visible
+    const existing = db
+      .select({ id: featureRequests.id, pdsUri: featureRequests.pdsUri })
+      .from(featureRequests)
+      .where(
+        and(
+          eq(featureRequests.id, requestId),
+          eq(featureRequests.sphereId, sphereId),
+          sql`${featureRequests.hiddenAt} is null`,
+        ),
+      )
+      .get();
+    if (!existing) {
+      return c.json({ error: "Feature request not found" }, 404);
+    }
 
-  // Enforce one top-level comment per user per request (ignore moderated comments)
-  const alreadyCommented = db
-    .select({ id: featureRequestComments.id })
-    .from(featureRequestComments)
-    .where(
-      and(
-        eq(featureRequestComments.requestId, requestId),
-        eq(featureRequestComments.authorDid, did),
-        sql`${featureRequestComments.hiddenAt} is null`,
-      ),
-    )
-    .get();
-  if (alreadyCommented) {
-    return c.json({ error: "You have already commented on this request" }, 409);
-  }
+    // Enforce one top-level comment per user per request (ignore moderated comments)
+    const alreadyCommented = db
+      .select({ id: featureRequestComments.id })
+      .from(featureRequestComments)
+      .where(
+        and(
+          eq(featureRequestComments.requestId, requestId),
+          eq(featureRequestComments.authorDid, did),
+          sql`${featureRequestComments.hiddenAt} is null`,
+        ),
+      )
+      .get();
+    if (alreadyCommented) {
+      return c.json({ error: "You have already commented on this request" }, 409);
+    }
 
-  const id = generateRkey();
-  let pdsUri: string | null = null;
+    const id = generateRkey();
+    let pdsUri: string | null = null;
 
-  // Write to PDS for public spheres
-  if (sphereVisibility === "public") {
-    const session = c.var.session;
-    pdsUri = await putPdsRecord(session, COMMENT_COLLECTION, id, {
-      subject: existing.pdsUri!,
-      content,
-    });
-  }
+    // Write to PDS for public spheres
+    if (sphereVisibility === "public") {
+      const session = c.var.session;
+      pdsUri = await putPdsRecord(session, COMMENT_COLLECTION, id, {
+        subject: existing.pdsUri!,
+        content,
+      });
+    }
 
-  insertComment({ id, requestId, authorDid: did, content, pdsUri });
+    insertComment({ id, requestId, authorDid: did, content, pdsUri });
 
-  const comment = db
-    .select()
-    .from(featureRequestComments)
-    .where(eq(featureRequestComments.id, id))
-    .get();
+    const comment = db
+      .select()
+      .from(featureRequestComments)
+      .where(eq(featureRequestComments.id, id))
+      .get();
 
-  return c.json({ comment: comment ? { ...comment, createdAt: tidToDate(id) } : comment }, 201);
-});
+    return c.json({ comment: comment ? { ...comment, createdAt: tidToDate(id) } : comment }, 201);
+  },
+);
 
 // Update own comment (author only)
 app.put("/comments/:id", requireAuth, async (c) => {
···
       .where(eq(featureRequests.id, comment.requestId))
       .get();
 
+    if (!parent?.pdsUri) {
+      return c.json({ error: "Parent feature request not found" }, 404);
+    }
+
     await putPdsRecord(session, COMMENT_COLLECTION, id, {
-      subject: parent!.pdsUri!,
+      subject: parent.pdsUri,
       content,
       updatedAt: new Date().toISOString(),
     });
···
 });
 
 // Admin/owner-only: unhide a moderated comment
-app.post("/comments/:id/unhide", requireAuth, requirePermission("feature-requests", "moderate"), async (c) => {
-  const id = c.req.param("id");
-  const sphereId = c.var.sphereId;
-  const did = c.var.did;
+app.post(
+  "/comments/:id/unhide",
+  requireAuth,
+  requirePermission("feature-requests", "moderate"),
+  async (c) => {
+    const id = c.req.param("id");
+    const sphereId = c.var.sphereId;
+    const did = c.var.did;
 
-  const row = findCommentInSphere(id, sphereId);
-  if (!row) {
-    return c.json({ error: "Comment not found" }, 404);
-  }
-  const comment = row.feature_request_comments;
-  if (!comment.hiddenAt) {
-    return c.json({ ok: true });
-  }
+    const row = findCommentInSphere(id, sphereId);
+    if (!row) {
+      return c.json({ error: "Comment not found" }, 404);
+    }
+    const comment = row.feature_request_comments;
+    if (!comment.hiddenAt) {
+      return c.json({ ok: true });
+    }
 
-  // Delete the moderation record from PDS if the current admin is the one who hid it
-  if (comment.moderatedBy === did) {
-    const session = c.var.session;
-    await deletePdsRecord(session, MODERATION_COLLECTION, id);
-  }
+    // Delete the moderation record from PDS if the current admin is the one who hid it
+    if (comment.moderatedBy === did) {
+      const session = c.var.session;
+      await deletePdsRecord(session, MODERATION_COLLECTION, id);
+    }
 
-  unhideComment(id);
+    unhideComment(id);
 
-  return c.json({ ok: true });
-});
+    return c.json({ ok: true });
+  },
+);
 
 // ---- Comment Votes ----
 
···
 });
 
 // Cast a vote on a comment
-app.post("/comments/:id/vote", requireAuth, requirePermission("feature-requests", "vote"), async (c) => {
-  const id = c.req.param("id");
-  const db = getDb();
-  const did = c.var.did;
-  const sphereId = c.var.sphereId;
-  const sphereVisibility = c.var.sphereVisibility;
+app.post(
+  "/comments/:id/vote",
+  requireAuth,
+  requirePermission("feature-requests", "vote"),
+  async (c) => {
+    const id = c.req.param("id");
+    const db = getDb();
+    const did = c.var.did;
+    const sphereId = c.var.sphereId;
+    const sphereVisibility = c.var.sphereVisibility;
 
-  const row = findCommentInSphere(id, sphereId);
-  if (!row) {
-    return c.json({ error: "Comment not found" }, 404);
-  }
-  const comment = row.feature_request_comments;
+    const row = findCommentInSphere(id, sphereId);
+    if (!row) {
+      return c.json({ error: "Comment not found" }, 404);
+    }
+    const comment = row.feature_request_comments;
 
-  const alreadyVoted = db
-    .select({ commentId: featureRequestCommentVotes.commentId })
-    .from(featureRequestCommentVotes)
-    .where(
-      and(
-        eq(featureRequestCommentVotes.commentId, id),
-        eq(featureRequestCommentVotes.authorDid, did),
-      ),
-    )
-    .get();
-  if (alreadyVoted) {
-    return c.json({ error: "Already voted" }, 409);
-  }
+    const alreadyVoted = db
+      .select({ commentId: featureRequestCommentVotes.commentId })
+      .from(featureRequestCommentVotes)
+      .where(
+        and(
+          eq(featureRequestCommentVotes.commentId, id),
+          eq(featureRequestCommentVotes.authorDid, did),
+        ),
+      )
+      .get();
+    if (alreadyVoted) {
+      return c.json({ error: "Already voted" }, 409);
+    }
 
-  let votePdsUri: string | null = null;
+    let votePdsUri: string | null = null;
 
-  if (sphereVisibility === "public" && comment.pdsUri) {
-    const session = c.var.session;
-    votePdsUri = await putPdsRecord(session, COMMENT_VOTE_COLLECTION, id, {
-      subject: comment.pdsUri,
-    });
-  }
+    if (sphereVisibility === "public" && comment.pdsUri) {
+      const session = c.var.session;
+      votePdsUri = await putPdsRecord(session, COMMENT_VOTE_COLLECTION, id, {
+        subject: comment.pdsUri,
+      });
+    }
 
-  insertCommentVote(id, did, votePdsUri);
+    insertCommentVote(id, did, votePdsUri);
 
-  const result = db
-    .select({ voteCount: count() })
-    .from(featureRequestCommentVotes)
-    .where(eq(featureRequestCommentVotes.commentId, id))
-    .get();
+    const result = db
+      .select({ voteCount: count() })
+      .from(featureRequestCommentVotes)
+      .where(eq(featureRequestCommentVotes.commentId, id))
+      .get();
 
-  return c.json({ voteCount: result?.voteCount ?? 0 }, 201);
-});
+    return c.json({ voteCount: result?.voteCount ?? 0 }, 201);
+  },
+);
 
 // Remove a vote from a comment
-app.delete("/comments/:id/vote", requireAuth, requirePermission("feature-requests", "vote"), async (c) => {
-  const id = c.req.param("id");
-  const db = getDb();
-  const did = c.var.did;
-  const sphereId = c.var.sphereId;
+app.delete(
+  "/comments/:id/vote",
+  requireAuth,
+  requirePermission("feature-requests", "vote"),
+  async (c) => {
+    const id = c.req.param("id");
+    const db = getDb();
+    const did = c.var.did;
+    const sphereId = c.var.sphereId;
 
-  // Verify the comment's FR belongs to this sphere
-  const row = findCommentInSphere(id, sphereId);
-  if (!row) {
-    return c.json({ error: "Comment not found" }, 404);
-  }
+    // Verify the comment's FR belongs to this sphere
+    const row = findCommentInSphere(id, sphereId);
+    if (!row) {
+      return c.json({ error: "Comment not found" }, 404);
+    }
 
-  const vote = db
-    .select({ pdsUri: featureRequestCommentVotes.pdsUri })
-    .from(featureRequestCommentVotes)
-    .where(
-      and(
-        eq(featureRequestCommentVotes.commentId, id),
-        eq(featureRequestCommentVotes.authorDid, did),
-      ),
-    )
-    .get();
-  if (!vote) {
-    return c.json({ error: "Vote not found" }, 404);
-  }
+    const vote = db
+      .select({ pdsUri: featureRequestCommentVotes.pdsUri })
+      .from(featureRequestCommentVotes)
+      .where(
+        and(
+          eq(featureRequestCommentVotes.commentId, id),
+          eq(featureRequestCommentVotes.authorDid, did),
+        ),
+      )
+      .get();
+    if (!vote) {
+      return c.json({ error: "Vote not found" }, 404);
+    }
 
-  if (vote.pdsUri) {
-    const session = c.var.session;
-    const res = await session.fetchHandler("/xrpc/com.atproto.repo.deleteRecord", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        repo: session.did,
-        collection: COMMENT_VOTE_COLLECTION,
-        rkey: id,
-      }),
-    });
+    if (vote.pdsUri) {
+      const session = c.var.session;
+      const res = await session.fetchHandler("/xrpc/com.atproto.repo.deleteRecord", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          repo: session.did,
+          collection: COMMENT_VOTE_COLLECTION,
+          rkey: id,
+        }),
+      });
 
-    if (!res.ok) {
-      console.error(
-        "[feature-requests] PDS comment vote delete failed:",
-        res.status,
-        await res.text().catch(() => ""),
-      );
+      if (!res.ok) {
+        console.error(
+          "[feature-requests] PDS comment vote delete failed:",
+          res.status,
+          await res.text().catch(() => ""),
+        );
+      }
     }
-  }
 
-  deleteCommentVoteByAuthor(id, did);
+    deleteCommentVoteByAuthor(id, did);
 
-  const result = db
-    .select({ voteCount: count() })
-    .from(featureRequestCommentVotes)
-    .where(eq(featureRequestCommentVotes.commentId, id))
-    .get();
+    const result = db
+      .select({ voteCount: count() })
+      .from(featureRequestCommentVotes)
+      .where(eq(featureRequestCommentVotes.commentId, id))
+      .get();
 
-  return c.json({ voteCount: result?.voteCount ?? 0 });
-});
+    return c.json({ voteCount: result?.voteCount ?? 0 });
+  },
+);
 
 export { app as commentsApi };

packages/feature-requests/src/api/requests.ts

···
 });
 
 // Admin/owner-only: unhide a feature request
-app.post("/:id/unhide", requireAuth, requirePermission("feature-requests", "moderate"), async (c) => {
-  const id = c.req.param("id");
-  const db = getDb();
-  const did = c.var.did;
-  const sphereId = c.var.sphereId;
+app.post(
+  "/:id/unhide",
+  requireAuth,
+  requirePermission("feature-requests", "moderate"),
+  async (c) => {
+    const id = c.req.param("id");
+    const db = getDb();
+    const did = c.var.did;
+    const sphereId = c.var.sphereId;
 
-  const existing = db
-    .select({
-      id: featureRequests.id,
-      hiddenAt: featureRequests.hiddenAt,
-      moderatedBy: featureRequests.moderatedBy,
-    })
-    .from(featureRequests)
-    .where(and(eq(featureRequests.id, id), eq(featureRequests.sphereId, sphereId)))
-    .get();
-  if (!existing) {
-    return c.json({ error: "Feature request not found" }, 404);
-  }
+    const existing = db
+      .select({
+        id: featureRequests.id,
+        hiddenAt: featureRequests.hiddenAt,
+        moderatedBy: featureRequests.moderatedBy,
+      })
+      .from(featureRequests)
+      .where(and(eq(featureRequests.id, id), eq(featureRequests.sphereId, sphereId)))
+      .get();
+    if (!existing) {
+      return c.json({ error: "Feature request not found" }, 404);
+    }
 
-  if (!existing.hiddenAt) {
-    return c.json({ ok: true });
-  }
+    if (!existing.hiddenAt) {
+      return c.json({ ok: true });
+    }
 
-  // Delete the moderation record from PDS if the current admin is the one who hid it
-  if (existing.moderatedBy === did) {
-    const session = c.var.session;
-    await deletePdsRecord(session, MODERATION_COLLECTION, id);
-  }
+    // Delete the moderation record from PDS if the current admin is the one who hid it
+    if (existing.moderatedBy === did) {
+      const session = c.var.session;
+      await deletePdsRecord(session, MODERATION_COLLECTION, id);
+    }
 
-  unhideFeatureRequest(id);
+    unhideFeatureRequest(id);
 
-  return c.json({ ok: true });
-});
+    return c.json({ ok: true });
+  },
+);
 
 // ---- Search ----
 

packages/feature-requests/src/api/statuses.ts

···
 
   // Permission: admin/owner OR author
   const role = getActiveMemberRole(sphereId, did);
-  const canMark = checkPermission(sphereId, "feature-requests", "mark-duplicate", role) || fr.authorDid === did;
+  const canMark =
+    checkPermission(sphereId, "feature-requests", "mark-duplicate", role) || fr.authorDid === did;
   if (!canMark) {
     return c.json({ error: "Forbidden" }, 403);
   }
···
 // ---- Statuses ----
 
 // Admin/owner-only: set status on a feature request
-app.post("/:id/status", requireAuth, requirePermission("feature-requests", "change-status"), async (c) => {
-  const id = c.req.param("id");
-  const body = await c.req.json();
-  const result = updateStatusSchema.safeParse(body);
-  if (!result.success) {
-    return c.json({ error: z.flattenError(result.error) }, 400);
-  }
+app.post(
+  "/:id/status",
+  requireAuth,
+  requirePermission("feature-requests", "change-status"),
+  async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json();
+    const result = updateStatusSchema.safeParse(body);
+    if (!result.success) {
+      return c.json({ error: z.flattenError(result.error) }, 400);
+    }
 
-  const { status } = result.data;
-  const db = getDb();
-  const did = c.var.did;
-  const sphereId = c.var.sphereId;
-  const sphereVisibility = c.var.sphereVisibility;
+    const { status } = result.data;
+    const db = getDb();
+    const did = c.var.did;
+    const sphereId = c.var.sphereId;
+    const sphereVisibility = c.var.sphereVisibility;
 
-  const existing = db
-    .select({
-      id: featureRequests.id,
-      status: featureRequests.status,
-      pdsUri: featureRequests.pdsUri,
-    })
-    .from(featureRequests)
-    .where(and(eq(featureRequests.id, id), eq(featureRequests.sphereId, sphereId)))
-    .get();
-  if (!existing) {
-    return c.json({ error: "Feature request not found" }, 404);
-  }
+    const existing = db
+      .select({
+        id: featureRequests.id,
+        status: featureRequests.status,
+        pdsUri: featureRequests.pdsUri,
+      })
+      .from(featureRequests)
+      .where(and(eq(featureRequests.id, id), eq(featureRequests.sphereId, sphereId)))
+      .get();
+    if (!existing) {
+      return c.json({ error: "Feature request not found" }, 404);
+    }
+
+    let pdsUri: string | null = null;
 
-  let pdsUri: string | null = null;
+    // Write to PDS for public spheres
+    if (sphereVisibility === "public" && existing.pdsUri) {
+      const session = c.var.session;
+      pdsUri = await putPdsRecord(session, STATUS_COLLECTION, id, {
+        subject: existing.pdsUri,
+        status,
+      });
+    }
 
-  // Write to PDS for public spheres
-  if (sphereVisibility === "public" && existing.pdsUri) {
-    const session = c.var.session;
-    pdsUri = await putPdsRecord(session, STATUS_COLLECTION, id, {
-      subject: existing.pdsUri,
+    const statusId = generateRkey();
+    insertStatusAndUpdateFR({
+      id: statusId,
+      requestId: id,
+      authorDid: did,
       status,
+      pdsUri,
+      clearDuplicateOfId: existing.status === "duplicate",
     });
-  }
 
-  const statusId = generateRkey();
-  insertStatusAndUpdateFR({
-    id: statusId,
-    requestId: id,
-    authorDid: did,
-    status,
-    pdsUri,
-    clearDuplicateOfId: existing.status === "duplicate",
-  });
-
-  return c.json({ status });
-});
+    return c.json({ status });
+  },
+);
 
 // Get status change history for a feature request
 app.get("/:id/statuses", async (c) => {

packages/feature-requests/src/ui/pages/feature-request.tsx

···
   authorDid: string;
   authorHandle: string | null;
 }) {
-  const statuses = useSignal<
-    Array<{ id: string; authorDid: string; authorHandle: string | null; status: string; createdAt: string }> | null
-  >(null);
+  const statuses = useSignal<Array<{
+    id: string;
+    authorDid: string;
+    authorHandle: string | null;
+    status: string;
+    createdAt: string;
+  }> | null>(null);
   const loading = useSignal(false);
   const expandedRef = useRef(false);
 
···
               authorHandle={fr.authorHandle ?? null}
             />
 
-            {((currentDid === fr.authorDid || canMarkDuplicate.value) && fr.status === "requested") ||
+            {((currentDid === fr.authorDid || canMarkDuplicate.value) &&
+              fr.status === "requested") ||
             data.duplicateCount > 0 ? (
               <MergedRequestsSection
                 requestId={fr.id}

packages/indexer/src/modules.ts

···
 import type { ExosphereModule } from "@exosphere/core/types";
 import { createCoreIndexer } from "@exosphere/core/sphere";
-import { registerModulePermissions } from "@exosphere/core/permissions";
+import {
+  registerModulePermissions,
+  CORE_MODULE,
+  CORE_PERMISSIONS_COLLECTION,
+  corePermissions,
+} from "@exosphere/core/permissions";
 // import { feedsModule } from "@exosphere/feeds";
 import { featureRequestsModule } from "@exosphere/feature-requests";
 
 export const modules: ExosphereModule[] = [featureRequestsModule];
+
+// Register core sphere-level permissions.
+// This runs as a side effect on import — the server (app/src/server.ts) imports from
+// this module, so both the indexer and server share the same registration.
+registerModulePermissions(CORE_MODULE, corePermissions, CORE_PERMISSIONS_COLLECTION);
 
 // Register module permissions so the indexer can check them
 for (const mod of modules) {

scripts/generate-lexicon-types.ts

···
   items?: { type: string };
   knownValues?: string[];
   maxLength?: number;
+  ref?: string;
+}
+
+interface LexiconDef {
+  type: string;
+  description?: string;
+  knownValues?: string[];
 }
 
 interface LexiconSchema {
   lexicon: number;
   id: string;
-  defs: {
+  defs: Record<string, LexiconDef> & {
     main: {
       type: string;
       record: {
         type: string;
-        required: string[];
+        required?: string[];
         properties: Record<string, LexiconProperty>;
       };
     };
···
   return name.charAt(0).toUpperCase() + name.slice(1) + "Record";
 }
 
-function tsType(prop: LexiconProperty): string {
+/** Quote property names that aren't valid JS identifiers. */
+function formatKey(key: string): string {
+  return /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : `"${key}"`;
+}
+
+function tsType(prop: LexiconProperty, defs: Record<string, LexiconDef>): string {
   if (prop.type === "array" && prop.items?.type === "string") return "string[]";
   if (prop.type === "string") return "string";
+  // Resolve local refs like "#role" → defs.role
+  if (prop.type === "ref" && prop.ref) {
+    const defName = prop.ref.replace(/^#/, "");
+    const resolved = defs[defName];
+    if (resolved) return tsType({ type: resolved.type } as LexiconProperty, defs);
+  }
   throw new Error(`Unsupported lexicon property type: ${JSON.stringify(prop)}`);
 }
 
···
   for (const schema of schemas) {
     const name = toInterfaceName(schema.id);
     const record = schema.defs.main.record;
-    const required = new Set(record.required);
+    const required = new Set(record.required ?? []);
 
     lines.push(`export interface ${name} {`);
     for (const [key, prop] of Object.entries(record.properties)) {
···
         lines.push(`  /** ${comment} */`);
       }
       const optional = required.has(key) ? "" : "?";
-      lines.push(`  ${key}${optional}: ${tsType(prop)};`);
+      lines.push(`  ${formatKey(key)}${optional}: ${tsType(prop, schema.defs)};`);
     }
     lines.push("}");
     lines.push("");