From 206ea48010cae7701954819e574ff19e00acb22a Mon Sep 17 00:00:00 2001
From: kartikeya <67143288+kartikeya-27@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:58:17 +0530
Subject: [PATCH 1/5] feat(admin): use the real logo in the console

The bracket glyph was a stand-in that needed an accent tile to be
legible. BrandMark is the artwork the public sites ship, so the tile
comes off with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/admin/src/app/styles/admin.css           | 14 ++-----
 apps/admin/src/components/mark.tsx            | 35 ++++++++---------
 apps/admin/src/components/rail.tsx            |  2 +-
 .../src/views/subscription/confirm-page.tsx   |  2 +-
 .../views/subscription/unsubscribe-page.tsx   |  2 +-
 apps/admin/vitest.config.mts                  | 39 ++++++++++++++++++-
 6 files changed, 62 insertions(+), 32 deletions(-)

diff --git a/apps/admin/src/app/styles/admin.css b/apps/admin/src/app/styles/admin.css
index 3d7bb38f..53076380 100644
--- a/apps/admin/src/app/styles/admin.css
+++ b/apps/admin/src/app/styles/admin.css
@@ -110,14 +110,12 @@
     font-size: 1rem;
     letter-spacing: -0.02em;
   }
+  /* No tile. The logo is a multi-tone leaf that brings its own colour — the
+     accent square existed to make a flat white glyph legible, and the glyph
+     has gone. */
   .rail-brand .mark {
     display: grid;
     place-items: center;
-    width: 24px;
-    height: 24px;
-    border-radius: 7px;
-    background: var(--accent);
-    color: var(--accent-ink);
     flex: none;
   }
   .rail-brand small {
@@ -862,12 +860,8 @@
   .sheet-card .mark {
     display: grid;
     place-items: center;
-    width: 38px;
-    height: 38px;
+    width: fit-content;
     margin: 0 auto 18px;
-    border-radius: 11px;
-    background: var(--accent);
-    color: var(--accent-ink);
   }
   .sheet-card h1 {
     font-family: var(--font-display);
diff --git a/apps/admin/src/components/mark.tsx b/apps/admin/src/components/mark.tsx
index fd24a782..c80b0790 100644
--- a/apps/admin/src/components/mark.tsx
+++ b/apps/admin/src/components/mark.tsx
@@ -1,19 +1,18 @@
-/** The ByteVeda bracket glyph, matching the wordmark on the public sites. */
-export function Mark({ size = 16 }: { size?: number }) {
-  return (
-    <svg
-      viewBox="0 0 24 24"
-      width={size}
-      height={size}
-      fill="none"
-      stroke="currentColor"
-      strokeWidth={2.1}
-      strokeLinecap="round"
-      strokeLinejoin="round"
-      aria-hidden
-    >
-      <path d="M5 7h9a4 4 0 0 1 0 8H9l5 6" />
-      <path d="M9 3v18" />
-    </svg>
-  );
+import { BrandMark } from "@byteveda/ui";
+
+/**
+ * The ByteVeda logo, as the public sites draw it.
+ *
+ * This used to be an inline bracket glyph — a single white path that needed
+ * the accent tile behind it to be legible, and which was never the logo. The
+ * real mark is a multi-tone leaf: it cannot take `currentColor`, there is
+ * nothing for one path to carry, and it brings its own colour, so the tile it
+ * used to sit on comes off with it.
+ *
+ * Wrapping `BrandMark` rather than importing it at each of the five call sites
+ * keeps the console's sizes in one place, and keeps "which artwork is the
+ * logo" a question with one answer and one import to change.
+ */
+export function Mark({ size = 30 }: { size?: number }) {
+  return <BrandMark height={size} />;
 }
diff --git a/apps/admin/src/components/rail.tsx b/apps/admin/src/components/rail.tsx
index 1fb51c10..472e9823 100644
--- a/apps/admin/src/components/rail.tsx
+++ b/apps/admin/src/components/rail.tsx
@@ -30,7 +30,7 @@ export function Rail({ user, children }: Props) {
     <nav className="rail" aria-label="Admin sections">
       <Link href="/" className="rail-brand">
         <span className="mark">
-          <Mark size={14} />
+          <Mark size={22} />
         </span>
         <span>
           byteveda <small>admin</small>
diff --git a/apps/admin/src/views/subscription/confirm-page.tsx b/apps/admin/src/views/subscription/confirm-page.tsx
index e94d55cd..6e8780a2 100644
--- a/apps/admin/src/views/subscription/confirm-page.tsx
+++ b/apps/admin/src/views/subscription/confirm-page.tsx
@@ -30,7 +30,7 @@ export async function ConfirmPage({ searchParams }: Props) {
     <main className="sheet">
       <div className="sheet-card">
         <span className="mark">
-          <Mark size={20} />
+          <Mark />
         </span>
 
         {!state.found ? (
diff --git a/apps/admin/src/views/subscription/unsubscribe-page.tsx b/apps/admin/src/views/subscription/unsubscribe-page.tsx
index f0a34838..8db42fc8 100644
--- a/apps/admin/src/views/subscription/unsubscribe-page.tsx
+++ b/apps/admin/src/views/subscription/unsubscribe-page.tsx
@@ -29,7 +29,7 @@ export async function UnsubscribePage({ searchParams }: Props) {
     <main className="sheet">
       <div className="sheet-card">
         <span className="mark">
-          <Mark size={20} />
+          <Mark />
         </span>
 
         {!state.found ? (
diff --git a/apps/admin/vitest.config.mts b/apps/admin/vitest.config.mts
index 6920ed80..8d773aa7 100644
--- a/apps/admin/vitest.config.mts
+++ b/apps/admin/vitest.config.mts
@@ -1,7 +1,44 @@
+import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { defineConfig } from "vitest/config";
+import { defineConfig, type Plugin } from "vitest/config";
+
+/**
+ * Makes a static image import look the way `next build` makes it look.
+ *
+ * Next turns `import mark from "./mark.png"` into `{ src, width, height }`,
+ * and components use the dimensions — the brand mark derives its width from
+ * the artwork's ratio. Vite hands back a URL string instead, so those reads
+ * are `undefined`, the ratio is `NaN`, and `next/image` throws inside any test
+ * that renders a page with the logo on it.
+ *
+ * The size is read from the PNG header rather than faked, so a test is looking
+ * at the same aspect ratio the browser will.
+ */
+function nextStaticImages(): Plugin {
+  return {
+    name: "next-static-images",
+    enforce: "pre",
+    load(id) {
+      const path = id.split("?")[0];
+      if (!/\.(png|jpe?g|gif|webp|avif)$/i.test(path)) return null;
+
+      // PNG: 8-byte signature, then the IHDR chunk with width and height as
+      // big-endian 32-bit integers at byte 16 and byte 20.
+      let width = 1;
+      let height = 1;
+      if (path.toLowerCase().endsWith(".png")) {
+        const header = readFileSync(path).subarray(0, 24);
+        width = header.readUInt32BE(16);
+        height = header.readUInt32BE(20);
+      }
+
+      return `export default ${JSON.stringify({ src: path, width, height })};`;
+    },
+  };
+}
 
 export default defineConfig({
+  plugins: [nextStaticImages()],
   resolve: {
     alias: {
       "@": fileURLToPath(new URL("./src", import.meta.url)),

From 985326a7f4951cd6f4524b1118e69dad3223fd39 Mon Sep 17 00:00:00 2001
From: kartikeya <67143288+kartikeya-27@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:58:56 +0530
Subject: [PATCH 2/5] fix(admin): stop the members table overlapping itself

The row's columns add up to more than the 720px `.content-form` allows,
so the name track collapsed to zero and every column printed on top of
its neighbour. A list belongs in `.content-narrow`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/admin/src/app/styles/admin.css           | 4 ++++
 apps/admin/src/views/members/members-page.tsx | 7 ++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/apps/admin/src/app/styles/admin.css b/apps/admin/src/app/styles/admin.css
index 53076380..51aada8a 100644
--- a/apps/admin/src/app/styles/admin.css
+++ b/apps/admin/src/app/styles/admin.css
@@ -413,6 +413,10 @@
   .row-broadcast {
     grid-template-columns: 80px minmax(0, 1fr) 70px 28px;
   }
+  /* The name column is `1fr`, so these tracks plus the gaps are the row's real
+     minimum: put this list in a container narrower than that and the name gets
+     0px and every column lands on top of the one before it. It belongs in
+     `.content-narrow`, not `.content-form`. */
   .row-member {
     grid-template-columns: minmax(0, 1fr) 104px 140px 92px minmax(0, 320px);
   }
diff --git a/apps/admin/src/views/members/members-page.tsx b/apps/admin/src/views/members/members-page.tsx
index 0de2d171..f5aac2d7 100644
--- a/apps/admin/src/views/members/members-page.tsx
+++ b/apps/admin/src/views/members/members-page.tsx
@@ -12,6 +12,11 @@ import { InviteForm, MemberControls } from "./member-controls";
  * Only a super admin can change anything here — `members.manage` is in no
  * role's permission set — but `members.read` lets an admin see the list, which
  * is the difference between "you cannot do this" and "you cannot see who can".
+ *
+ * A list, not a form, so it takes the full width. It used to be `content-form`
+ * at 720px, which is narrower than the row's own columns add up to: the name
+ * column collapsed to nothing and the header printed "Member" and "Role" on
+ * top of each other. The invite panel is the form, and it constrains itself.
  */
 export async function MembersPage() {
   const { access, user } = await requirePermission("members.read");
@@ -27,7 +32,7 @@ export async function MembersPage() {
         sub={`${members.length} with access${pending > 0 ? `, ${pending} not signed in yet` : ""}`}
       />
 
-      <div className="content content-form">
+      <div className="content content-narrow">
         {!manage && (
           <div className="notice notice-warn block-gap">
             <span>

From 5821c7e355cb643c69d7d554450914b496889819 Mon Sep 17 00:00:00 2001
From: kartikeya <67143288+kartikeya-27@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:59:19 +0530
Subject: [PATCH 3/5] feat(db): permission catalogue and custom roles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The permission list moves to constants so it can back a Postgres enum,
and a super admin can now write roles of their own — bounded to the
same catalogue the built-in ones use.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/db/migrations/0009_custom_roles.sql  |   17 +
 .../db/migrations/meta/0009_snapshot.json     | 2015 +++++++++++++++++
 packages/db/migrations/meta/_journal.json     |    9 +-
 packages/db/src/constants.ts                  |  114 +-
 packages/db/src/schema/auth.ts                |   92 +-
 5 files changed, 2240 insertions(+), 7 deletions(-)
 create mode 100644 packages/db/migrations/0009_custom_roles.sql
 create mode 100644 packages/db/migrations/meta/0009_snapshot.json

diff --git a/packages/db/migrations/0009_custom_roles.sql b/packages/db/migrations/0009_custom_roles.sql
new file mode 100644
index 00000000..2c46f5fe
--- /dev/null
+++ b/packages/db/migrations/0009_custom_roles.sql
@@ -0,0 +1,17 @@
+CREATE TYPE "public"."admin_permission" AS ENUM('posts.read', 'posts.write', 'posts.publish', 'stats.read', 'stats.write', 'subscribers.read', 'subscribers.write', 'broadcasts.send', 'mail.read', 'mail.send', 'mail.manage', 'settings.read', 'settings.write', 'members.read', 'members.manage');--> statement-breakpoint
+CREATE TABLE "admin_custom_roles" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"key" text NOT NULL,
+	"label" text NOT NULL,
+	"description" text,
+	"permissions" "admin_permission"[] DEFAULT '{}' NOT NULL,
+	"created_by" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "admin_custom_roles_key_unique" UNIQUE("key")
+);
+--> statement-breakpoint
+ALTER TABLE "admin_users" ADD COLUMN "custom_role_id" uuid;--> statement-breakpoint
+ALTER TABLE "admin_users" ADD COLUMN "extra_permissions" "admin_permission"[] DEFAULT '{}' NOT NULL;--> statement-breakpoint
+ALTER TABLE "admin_users" ADD COLUMN "denied_permissions" "admin_permission"[] DEFAULT '{}' NOT NULL;--> statement-breakpoint
+ALTER TABLE "admin_users" ADD CONSTRAINT "admin_users_custom_role_id_admin_custom_roles_id_fk" FOREIGN KEY ("custom_role_id") REFERENCES "public"."admin_custom_roles"("id") ON DELETE set null ON UPDATE no action;
\ No newline at end of file
diff --git a/packages/db/migrations/meta/0009_snapshot.json b/packages/db/migrations/meta/0009_snapshot.json
new file mode 100644
index 00000000..1cb30580
--- /dev/null
+++ b/packages/db/migrations/meta/0009_snapshot.json
@@ -0,0 +1,2015 @@
+{
+  "id": "cfc26b2d-2116-451c-bf1e-a65e4ff9b790",
+  "prevId": "0e4ec473-5918-4703-817b-d2e17c499485",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "academy.sample_requests": {
+      "name": "sample_requests",
+      "schema": "academy",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reference": {
+          "name": "reference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "sample_kind",
+          "typeSchema": "academy",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chapter_id": {
+          "name": "chapter_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "request": {
+          "name": "request",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "list_value": {
+          "name": "list_value",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sample_requests_created_idx": {
+          "name": "sample_requests_created_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "sample_requests_email_key": {
+          "name": "sample_requests_email_key",
+          "nullsNotDistinct": false,
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.admin_custom_roles": {
+      "name": "admin_custom_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "admin_permission[]",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "admin_custom_roles_key_unique": {
+          "name": "admin_custom_roles_key_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.admin_users": {
+      "name": "admin_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "github_id": {
+          "name": "github_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "login": {
+          "name": "login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "avatar_url": {
+          "name": "avatar_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "admin_role",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'viewer'"
+        },
+        "custom_role_id": {
+          "name": "custom_role_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "extra_permissions": {
+          "name": "extra_permissions",
+          "type": "admin_permission[]",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "denied_permissions": {
+          "name": "denied_permissions",
+          "type": "admin_permission[]",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "status": {
+          "name": "status",
+          "type": "admin_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "mail_workspaces": {
+          "name": "mail_workspaces",
+          "type": "mail_workspace[]",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "invited_by": {
+          "name": "invited_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_login_at": {
+          "name": "last_login_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "admin_users_custom_role_id_admin_custom_roles_id_fk": {
+          "name": "admin_users_custom_role_id_admin_custom_roles_id_fk",
+          "tableFrom": "admin_users",
+          "tableTo": "admin_custom_roles",
+          "columnsFrom": [
+            "custom_role_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "admin_users_github_id_unique": {
+          "name": "admin_users_github_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "github_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sessions": {
+      "name": "sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "ip": {
+          "name": "ip",
+          "type": "inet",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "sessions_user_id_idx": {
+          "name": "sessions_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sessions_expires_at_idx": {
+          "name": "sessions_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sessions_user_id_admin_users_id_fk": {
+          "name": "sessions_user_id_admin_users_id_fk",
+          "tableFrom": "sessions",
+          "tableTo": "admin_users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "sessions_token_hash_unique": {
+          "name": "sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "token_hash"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.broadcasts": {
+      "name": "broadcasts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body_markdown": {
+          "name": "body_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "post_id": {
+          "name": "post_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recipient_count": {
+          "name": "recipient_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "broadcasts_status_idx": {
+          "name": "broadcasts_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "broadcasts_post_idx": {
+          "name": "broadcasts_post_idx",
+          "columns": [
+            {
+              "expression": "post_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"post_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "broadcasts_post_id_posts_id_fk": {
+          "name": "broadcasts_post_id_posts_id_fk",
+          "tableFrom": "broadcasts",
+          "tableTo": "posts",
+          "columnsFrom": [
+            "post_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "broadcasts_status_check": {
+          "name": "broadcasts_status_check",
+          "value": "\"status\" in ('draft', 'sending', 'sent', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.email_attachments": {
+      "name": "email_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "filename": {
+          "name": "filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'application/octet-stream'"
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "bytea",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_attachments_scope_idx": {
+          "name": "email_attachments_scope_idx",
+          "columns": [
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"message_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_attachments_message_idx": {
+          "name": "email_attachments_message_idx",
+          "columns": [
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "email_attachments_message_id_outbound_messages_id_fk": {
+          "name": "email_attachments_message_id_outbound_messages_id_fk",
+          "tableFrom": "email_attachments",
+          "tableTo": "outbound_messages",
+          "columnsFrom": [
+            "message_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_attachments_uploaded_by_admin_users_id_fk": {
+          "name": "email_attachments_uploaded_by_admin_users_id_fk",
+          "tableFrom": "email_attachments",
+          "tableTo": "admin_users",
+          "columnsFrom": [
+            "uploaded_by"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_threads": {
+      "name": "email_threads",
+      "schema": "",
+      "columns": {
+        "thread_key": {
+          "name": "thread_key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "correspondent_email": {
+          "name": "correspondent_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "correspondent_name": {
+          "name": "correspondent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mailbox": {
+          "name": "mailbox",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "workspace": {
+          "name": "workspace",
+          "type": "mail_workspace",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'byteveda'"
+        },
+        "preview": {
+          "name": "preview",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "last_message_at": {
+          "name": "last_message_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_inbound_at": {
+          "name": "last_inbound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_outbound_at": {
+          "name": "last_outbound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "read_at": {
+          "name": "read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_threads_active_idx": {
+          "name": "email_threads_active_idx",
+          "columns": [
+            {
+              "expression": "workspace",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_message_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"archived_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_threads_archived_idx": {
+          "name": "email_threads_archived_idx",
+          "columns": [
+            {
+              "expression": "workspace",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_message_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"archived_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbound_messages": {
+      "name": "inbound_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "resend_id": {
+          "name": "resend_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_key": {
+          "name": "thread_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_email": {
+          "name": "from_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_name": {
+          "name": "from_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_email": {
+          "name": "to_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "text": {
+          "name": "text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "html": {
+          "name": "html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "received_at": {
+          "name": "received_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbound_messages_resend_idx": {
+          "name": "inbound_messages_resend_idx",
+          "columns": [
+            {
+              "expression": "resend_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbound_messages_thread_idx": {
+          "name": "inbound_messages_thread_idx",
+          "columns": [
+            {
+              "expression": "thread_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "received_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbound_messages_received_idx": {
+          "name": "inbound_messages_received_idx",
+          "columns": [
+            {
+              "expression": "received_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbound_messages_thread_key_email_threads_thread_key_fk": {
+          "name": "inbound_messages_thread_key_email_threads_thread_key_fk",
+          "tableFrom": "inbound_messages",
+          "tableTo": "email_threads",
+          "columnsFrom": [
+            "thread_key"
+          ],
+          "columnsTo": [
+            "thread_key"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.outbound_messages": {
+      "name": "outbound_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "resend_id": {
+          "name": "resend_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_email": {
+          "name": "to_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_email": {
+          "name": "from_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_key": {
+          "name": "thread_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body_text": {
+          "name": "body_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "body_html": {
+          "name": "body_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "broadcast_id": {
+          "name": "broadcast_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "outbound_messages_sent_idx": {
+          "name": "outbound_messages_sent_idx",
+          "columns": [
+            {
+              "expression": "sent_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbound_messages_broadcast_idx": {
+          "name": "outbound_messages_broadcast_idx",
+          "columns": [
+            {
+              "expression": "broadcast_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbound_messages_thread_idx": {
+          "name": "outbound_messages_thread_idx",
+          "columns": [
+            {
+              "expression": "thread_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sent_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"thread_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "outbound_messages_thread_key_email_threads_thread_key_fk": {
+          "name": "outbound_messages_thread_key_email_threads_thread_key_fk",
+          "tableFrom": "outbound_messages",
+          "tableTo": "email_threads",
+          "columnsFrom": [
+            "thread_key"
+          ],
+          "columnsTo": [
+            "thread_key"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "outbound_messages_broadcast_id_broadcasts_id_fk": {
+          "name": "outbound_messages_broadcast_id_broadcasts_id_fk",
+          "tableFrom": "outbound_messages",
+          "tableTo": "broadcasts",
+          "columnsFrom": [
+            "broadcast_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "outbound_messages_kind_check": {
+          "name": "outbound_messages_kind_check",
+          "value": "\"kind\" in ('transactional', 'confirmation', 'broadcast', 'announcement', 'reply')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.subscribers": {
+      "name": "subscribers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "confirmed_at": {
+          "name": "confirmed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unsubscribed_at": {
+          "name": "unsubscribed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "subscribers_email_idx": {
+          "name": "subscribers_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "subscribers_token_idx": {
+          "name": "subscribers_token_idx",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "subscribers_status_idx": {
+          "name": "subscribers_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "subscribers_status_check": {
+          "name": "subscribers_status_check",
+          "value": "\"status\" in ('pending', 'active', 'unsubscribed', 'bounced')"
+        },
+        "subscribers_email_lowercase_check": {
+          "name": "subscribers_email_lowercase_check",
+          "value": "\"email\" = lower(\"email\")"
+        },
+        "subscribers_email_shape_check": {
+          "name": "subscribers_email_shape_check",
+          "value": "\"email\" ~ '^[^@[:space:]]+@[^@[:space:]]+$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.post_revisions": {
+      "name": "post_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "post_id": {
+          "name": "post_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "body_mdx": {
+          "name": "body_mdx",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "body_format": {
+          "name": "body_format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'richtext'"
+        },
+        "editor_json": {
+          "name": "editor_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_id": {
+          "name": "author_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "post_revisions_post_id_created_idx": {
+          "name": "post_revisions_post_id_created_idx",
+          "columns": [
+            {
+              "expression": "post_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "post_revisions_post_id_posts_id_fk": {
+          "name": "post_revisions_post_id_posts_id_fk",
+          "tableFrom": "post_revisions",
+          "tableTo": "posts",
+          "columnsFrom": [
+            "post_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "post_revisions_author_id_admin_users_id_fk": {
+          "name": "post_revisions_author_id_admin_users_id_fk",
+          "tableFrom": "post_revisions",
+          "tableTo": "admin_users",
+          "columnsFrom": [
+            "author_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.posts": {
+      "name": "posts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "site": {
+          "name": "site",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'flexiq'"
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "body_mdx": {
+          "name": "body_mdx",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "body_format": {
+          "name": "body_format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'richtext'"
+        },
+        "editor_json": {
+          "name": "editor_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tags": {
+          "name": "tags",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::text[]"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "seo": {
+          "name": "seo",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"keywords\":[]}'::jsonb"
+        },
+        "author": {
+          "name": "author",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ByteVeda'"
+        },
+        "published_at": {
+          "name": "published_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "posts_site_slug_idx": {
+          "name": "posts_site_slug_idx",
+          "columns": [
+            {
+              "expression": "site",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "posts_site_status_published_idx": {
+          "name": "posts_site_status_published_idx",
+          "columns": [
+            {
+              "expression": "site",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "published_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "posts_site_check": {
+          "name": "posts_site_check",
+          "value": "\"site\" in ('flexiq')"
+        },
+        "posts_status_check": {
+          "name": "posts_status_check",
+          "value": "\"status\" in ('draft', 'published', 'archived')"
+        },
+        "posts_body_format_check": {
+          "name": "posts_body_format_check",
+          "value": "\"body_format\" in ('richtext', 'mdx')"
+        },
+        "posts_slug_check": {
+          "name": "posts_slug_check",
+          "value": "\"slug\" ~ '^[a-z0-9]+(-[a-z0-9]+)*$'"
+        },
+        "posts_published_at_check": {
+          "name": "posts_published_at_check",
+          "value": "(\"status\" = 'published') = (\"published_at\" is not null)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.settings": {
+      "name": "settings",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.collection_runs": {
+      "name": "collection_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "package_id": {
+          "name": "package_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "ok": {
+          "name": "ok",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "days_written": {
+          "name": "days_written",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        }
+      },
+      "indexes": {
+        "collection_runs_started_idx": {
+          "name": "collection_runs_started_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "collection_runs_package_id_project_packages_id_fk": {
+          "name": "collection_runs_package_id_project_packages_id_fk",
+          "tableFrom": "collection_runs",
+          "tableTo": "project_packages",
+          "columnsFrom": [
+            "package_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.download_snapshots": {
+      "name": "download_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "package_id": {
+          "name": "package_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "day": {
+          "name": "day",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "downloads": {
+          "name": "downloads",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fetched_at": {
+          "name": "fetched_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "download_snapshots_package_day_idx": {
+          "name": "download_snapshots_package_day_idx",
+          "columns": [
+            {
+              "expression": "package_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "day",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "download_snapshots_day_idx": {
+          "name": "download_snapshots_day_idx",
+          "columns": [
+            {
+              "expression": "day",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "download_snapshots_package_id_project_packages_id_fk": {
+          "name": "download_snapshots_package_id_project_packages_id_fk",
+          "tableFrom": "download_snapshots",
+          "tableTo": "project_packages",
+          "columnsFrom": [
+            "package_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "download_snapshots_downloads_check": {
+          "name": "download_snapshots_downloads_check",
+          "value": "\"downloads\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.package_totals": {
+      "name": "package_totals",
+      "schema": "",
+      "columns": {
+        "package_id": {
+          "name": "package_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "total": {
+          "name": "total",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fetched_at": {
+          "name": "fetched_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "package_totals_package_id_project_packages_id_fk": {
+          "name": "package_totals_package_id_project_packages_id_fk",
+          "tableFrom": "package_totals",
+          "tableTo": "project_packages",
+          "columnsFrom": [
+            "package_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_packages": {
+      "name": "project_packages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "project_slug": {
+          "name": "project_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ecosystem": {
+          "name": "ecosystem",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_packages_ecosystem_name_idx": {
+          "name": "project_packages_ecosystem_name_idx",
+          "columns": [
+            {
+              "expression": "ecosystem",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "package_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_packages_project_idx": {
+          "name": "project_packages_project_idx",
+          "columns": [
+            {
+              "expression": "project_slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "project_packages_ecosystem_check": {
+          "name": "project_packages_ecosystem_check",
+          "value": "\"ecosystem\" in ('pypi', 'npm', 'crates', 'maven')"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "academy.sample_kind": {
+      "name": "sample_kind",
+      "schema": "academy",
+      "values": [
+        "chapter",
+        "custom"
+      ]
+    },
+    "public.admin_permission": {
+      "name": "admin_permission",
+      "schema": "public",
+      "values": [
+        "posts.read",
+        "posts.write",
+        "posts.publish",
+        "stats.read",
+        "stats.write",
+        "subscribers.read",
+        "subscribers.write",
+        "broadcasts.send",
+        "mail.read",
+        "mail.send",
+        "mail.manage",
+        "settings.read",
+        "settings.write",
+        "members.read",
+        "members.manage"
+      ]
+    },
+    "public.admin_role": {
+      "name": "admin_role",
+      "schema": "public",
+      "values": [
+        "admin",
+        "editor",
+        "support",
+        "viewer"
+      ]
+    },
+    "public.admin_status": {
+      "name": "admin_status",
+      "schema": "public",
+      "values": [
+        "active",
+        "suspended"
+      ]
+    },
+    "public.mail_workspace": {
+      "name": "mail_workspace",
+      "schema": "public",
+      "values": [
+        "byteveda",
+        "academy"
+      ]
+    }
+  },
+  "schemas": {
+    "academy": "academy"
+  },
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/migrations/meta/_journal.json b/packages/db/migrations/meta/_journal.json
index 8766533d..7397ae43 100644
--- a/packages/db/migrations/meta/_journal.json
+++ b/packages/db/migrations/meta/_journal.json
@@ -64,6 +64,13 @@
       "when": 1790050390750,
       "tag": "0008_rbac_and_attachments",
       "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1790053866766,
+      "tag": "0009_custom_roles",
+      "breakpoints": true
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/packages/db/src/constants.ts b/packages/db/src/constants.ts
index bbeeb888..1d3d32fe 100644
--- a/packages/db/src/constants.ts
+++ b/packages/db/src/constants.ts
@@ -56,13 +56,121 @@ export type SampleKind = (typeof SAMPLE_KINDS)[number];
  * `apps/admin/src/lib/auth/roles.ts` — because a permission is a statement
  * about the code, and the code is where it can be kept true.
  *
- * "Super admin" is deliberately absent. It is not a row anyone can be given;
- * it is a hardcoded list of GitHub IDs, and no write to this database can
- * widen it.
+ * A super admin may also define roles of their own, which are rows in
+ * `admin_custom_roles` carrying an explicit permission list. Those cannot be
+ * in this enum — it is a column's type, and a new value would mean a migration
+ * per role — so a member is either on one of these four or on a custom one,
+ * and `custom_role_id` is what says which.
+ *
+ * "Super admin" is deliberately absent from both. It is not a row anyone can be
+ * given; it is a hardcoded list of GitHub IDs, and no write to this database
+ * can widen it.
  */
 export const ADMIN_ROLES = ["admin", "editor", "support", "viewer"] as const;
 export type AdminRole = (typeof ADMIN_ROLES)[number];
 
+/**
+ * Everything the console can be asked to allow, named `resource.verb`.
+ *
+ * Here rather than in the admin app because the set is now a Postgres enum:
+ * a custom role stores its permissions as a column, and the column's type
+ * should be the closed set rather than `text[]` that any typo fits into. The
+ * admin app re-exports this as `PERMISSIONS` and remains the only place that
+ * decides which of them each built-in role carries.
+ *
+ * Groups of two or three — read, write, and the irreversible one — because
+ * "may edit a post" and "may put it in front of the public" are genuinely
+ * different grants, and so are "may read the mail" and "may answer it as us".
+ */
+export const ADMIN_PERMISSIONS = [
+  "posts.read",
+  "posts.write",
+  "posts.publish",
+  "stats.read",
+  "stats.write",
+  "subscribers.read",
+  "subscribers.write",
+  "broadcasts.send",
+  "mail.read",
+  "mail.send",
+  "mail.manage",
+  "settings.read",
+  "settings.write",
+  "members.read",
+  "members.manage",
+] as const;
+
+export type AdminPermission = (typeof ADMIN_PERMISSIONS)[number];
+
+/**
+ * The thing a permission is about, derived from the name rather than declared.
+ *
+ * Deriving it means a new permission cannot be added to a resource that does
+ * not exist, and cannot be forgotten by the screen that groups them.
+ */
+export type AdminResource = AdminPermission extends `${infer Resource}.${string}`
+  ? Resource
+  : never;
+
+/** The order resources are shown in, which is roughly the order of the rail. */
+export const ADMIN_RESOURCES = [
+  "posts",
+  "stats",
+  "subscribers",
+  "broadcasts",
+  "mail",
+  "settings",
+  "members",
+] as const satisfies readonly AdminResource[];
+
+export function resourceOf(permission: AdminPermission): AdminResource {
+  return permission.slice(0, permission.indexOf(".")) as AdminResource;
+}
+
+export const ADMIN_RESOURCE_LABELS: Record<AdminResource, string> = {
+  posts: "Posts",
+  stats: "Downloads",
+  subscribers: "Subscribers",
+  broadcasts: "Broadcasts",
+  mail: "Inbox",
+  settings: "Settings",
+  members: "Members",
+};
+
+/**
+ * What ticking one actually hands over, in the second person.
+ *
+ * Written out rather than generated from the verb: "manage" means archiving a
+ * conversation in one place and editing every grant in the console in another,
+ * and a screen that says "Manage" twice has told the person nothing.
+ */
+export const ADMIN_PERMISSION_LABELS: Record<AdminPermission, { verb: string; hint: string }> = {
+  "posts.read": { verb: "Read", hint: "See every post, draft ones included." },
+  "posts.write": { verb: "Write", hint: "Create and edit posts, and upload their images." },
+  "posts.publish": { verb: "Publish", hint: "Put a post in front of the public, or take it down." },
+  "stats.read": { verb: "Read", hint: "See download figures and the registries behind them." },
+  "stats.write": { verb: "Write", hint: "Add or remove a tracked package, and force a refresh." },
+  "subscribers.read": { verb: "Read", hint: "See the list and each address's state." },
+  "subscribers.write": { verb: "Write", hint: "Add, edit and unsubscribe addresses." },
+  "broadcasts.send": {
+    verb: "Send",
+    hint: "Mail the whole list. This one cannot be taken back.",
+  },
+  "mail.read": { verb: "Read", hint: "Open conversations in the granted inboxes." },
+  "mail.send": { verb: "Send", hint: "Reply as ByteVeda, with attachments." },
+  "mail.manage": { verb: "Manage", hint: "Archive, reopen and assign conversations." },
+  "settings.read": { verb: "Read", hint: "See the console's configuration." },
+  "settings.write": {
+    verb: "Write",
+    hint: "Change it, including anything integrations depend on.",
+  },
+  "members.read": { verb: "Read", hint: "See who has access and what it amounts to." },
+  "members.manage": {
+    verb: "Manage",
+    hint: "Grant and withdraw access. Reserved for super admins.",
+  },
+};
+
 /** Suspended keeps the record and the history; only signing in stops. */
 export const ADMIN_STATUSES = ["active", "suspended"] as const;
 export type AdminStatus = (typeof ADMIN_STATUSES)[number];
diff --git a/packages/db/src/schema/auth.ts b/packages/db/src/schema/auth.ts
index 09fe5e76..f7a2123a 100644
--- a/packages/db/src/schema/auth.ts
+++ b/packages/db/src/schema/auth.ts
@@ -1,22 +1,64 @@
 import { relations } from "drizzle-orm";
 import { bigint, index, inet, pgEnum, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
 import {
+  ADMIN_PERMISSIONS,
   ADMIN_ROLES,
   ADMIN_STATUSES,
+  type AdminPermission,
   type AdminRole,
   type AdminStatus,
   MAIL_WORKSPACES,
   type MailWorkspace,
 } from "../constants";
 
-export type { AdminRole, AdminStatus };
-export { ADMIN_ROLES, ADMIN_STATUSES };
+export type { AdminPermission, AdminRole, AdminStatus };
+export { ADMIN_PERMISSIONS, ADMIN_ROLES, ADMIN_STATUSES };
 
 /** Real Postgres enums, so the closed set is the column's type. */
 export const adminRole = pgEnum("admin_role", ADMIN_ROLES);
 export const adminStatus = pgEnum("admin_status", ADMIN_STATUSES);
+export const adminPermission = pgEnum("admin_permission", ADMIN_PERMISSIONS);
 export const mailWorkspace = pgEnum("mail_workspace", MAIL_WORKSPACES);
 
+/**
+ * A role a super admin wrote, rather than one the source ships.
+ *
+ * The four built-in roles are jobs — editor, support — and they are in the
+ * code because they are claims about what the code allows. This table is for
+ * the shape that does not have a name yet: "everything support can do, plus
+ * publishing", asked for once, on a Tuesday. Inventing a role in the source
+ * for it would mean a deploy; inventing one here means a row.
+ *
+ * What it can hold is still bounded. `permissions` is an array of the
+ * `admin_permission` enum, so nothing outside the catalogue in `constants.ts`
+ * can be stored at all — a custom role can only ever recombine grants the
+ * application already knows how to enforce. It cannot mint a new power, and it
+ * cannot carry `members.manage` either: that check is a super admin's, and
+ * `sanitisePermissions` in the admin app strips it on the way in.
+ *
+ * Scope is deliberately not here. Which inboxes somebody may read stays on
+ * their own row — a role says *what*, a scope says *where*, and folding them
+ * together would need a role per combination, which is the thing this exists
+ * to avoid.
+ */
+export const adminCustomRoles = pgTable("admin_custom_roles", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  /** Slug derived from the label. Stable across renames, and what a log reads. */
+  key: text("key").notNull().unique(),
+  label: text("label").notNull(),
+  /** What this role is for, in the words of whoever made it. */
+  description: text("description"),
+  permissions: adminPermission("permissions")
+    .array()
+    .notNull()
+    .$type<AdminPermission[]>()
+    .default([]),
+  /** Who made it. A plain id, like `invited_by` — deleting them keeps the role. */
+  createdBy: uuid("created_by"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
 /**
  * Everyone who may use the admin app, and what they may do in it.
  *
@@ -46,6 +88,40 @@ export const adminUsers = pgTable("admin_users", {
    * about what the code allows, and only the code can keep it honest.
    */
   role: adminRole("role").notNull().default("viewer"),
+  /**
+   * A role a super admin wrote, which replaces `role` when it is set.
+   *
+   * `role` is kept rather than cleared, and that is what makes deleting a
+   * custom role safe: the foreign key nulls this column, and the member lands
+   * back on the built-in role they were on before. A grant that evaporated
+   * with the role would be a way to lock the console's last editor out by
+   * tidying up.
+   */
+  customRoleId: uuid("custom_role_id").references(() => adminCustomRoles.id, {
+    onDelete: "set null",
+  }),
+  /**
+   * One person's exceptions to whichever role they are on.
+   *
+   * The reason a console this size does not need twelve roles. "Support, but
+   * they also publish the release notes" is one permission in `extra`, not a
+   * role nobody else will ever hold; "editor, but not this quarter's launch
+   * posts" is one in `denied`. Both are computed against the role rather than
+   * replacing it, so changing the role still changes what they can do.
+   *
+   * Denied wins over extra and over the role — the only ordering that makes
+   * "take this away" mean it, whatever else is ticked.
+   */
+  extraPermissions: adminPermission("extra_permissions")
+    .array()
+    .notNull()
+    .$type<AdminPermission[]>()
+    .default([]),
+  deniedPermissions: adminPermission("denied_permissions")
+    .array()
+    .notNull()
+    .$type<AdminPermission[]>()
+    .default([]),
   status: adminStatus("status").notNull().default("active"),
   /**
    * Which mail they may read, independent of the role.
@@ -92,8 +168,16 @@ export const sessions = pgTable(
   ],
 );
 
-export const adminUsersRelations = relations(adminUsers, ({ many }) => ({
+export const adminUsersRelations = relations(adminUsers, ({ many, one }) => ({
   sessions: many(sessions),
+  customRole: one(adminCustomRoles, {
+    fields: [adminUsers.customRoleId],
+    references: [adminCustomRoles.id],
+  }),
+}));
+
+export const adminCustomRolesRelations = relations(adminCustomRoles, ({ many }) => ({
+  members: many(adminUsers),
 }));
 
 export const sessionsRelations = relations(sessions, ({ one }) => ({
@@ -102,4 +186,6 @@ export const sessionsRelations = relations(sessions, ({ one }) => ({
 
 export type AdminUser = typeof adminUsers.$inferSelect;
 export type NewAdminUser = typeof adminUsers.$inferInsert;
+export type AdminCustomRole = typeof adminCustomRoles.$inferSelect;
+export type NewAdminCustomRole = typeof adminCustomRoles.$inferInsert;
 export type Session = typeof sessions.$inferSelect;

From 491a74e21ecb3c2b447771290e555ffab1cd91a7 Mon Sep 17 00:00:00 2001
From: kartikeya <67143288+kartikeya-27@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:59:33 +0530
Subject: [PATCH 4/5] feat(admin): granular access, on a screen with room for
 it

A super admin picks a role, a mail scope and per-resource permissions
in one dialog, and can write custom roles from the same matrix. A
member's exceptions are stored as a diff, so changing their role still
moves everything nobody touched by hand.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/admin/src/app/styles/admin.css           | 260 +++++++++++++++++-
 apps/admin/src/lib/auth/auth.test.ts          |  97 +++++++
 apps/admin/src/lib/auth/roles.ts              | 166 +++++++++--
 apps/admin/src/lib/auth/session.ts            |  10 +-
 apps/admin/src/lib/members/actions.ts         | 255 +++++++++++++++--
 apps/admin/src/lib/members/queries.ts         |  55 +++-
 .../admin/src/views/members/access-dialog.tsx | 227 +++++++++++++++
 .../src/views/members/member-controls.tsx     | 165 ++++++-----
 apps/admin/src/views/members/members-page.tsx |  58 +++-
 apps/admin/src/views/members/modal.tsx        |  75 +++++
 .../src/views/members/permission-picker.tsx   | 129 +++++++++
 apps/admin/src/views/members/role-dialog.tsx  | 159 +++++++++++
 apps/admin/src/views/members/roles-panel.tsx  | 209 ++++++++++++++
 apps/admin/src/views/members/types.ts         |  19 ++
 14 files changed, 1717 insertions(+), 167 deletions(-)
 create mode 100644 apps/admin/src/views/members/access-dialog.tsx
 create mode 100644 apps/admin/src/views/members/modal.tsx
 create mode 100644 apps/admin/src/views/members/permission-picker.tsx
 create mode 100644 apps/admin/src/views/members/role-dialog.tsx
 create mode 100644 apps/admin/src/views/members/roles-panel.tsx
 create mode 100644 apps/admin/src/views/members/types.ts

diff --git a/apps/admin/src/app/styles/admin.css b/apps/admin/src/app/styles/admin.css
index 51aada8a..199991ad 100644
--- a/apps/admin/src/app/styles/admin.css
+++ b/apps/admin/src/app/styles/admin.css
@@ -418,7 +418,10 @@
      0px and every column lands on top of the one before it. It belongs in
      `.content-narrow`, not `.content-form`. */
   .row-member {
-    grid-template-columns: minmax(0, 1fr) 104px 140px 92px minmax(0, 320px);
+    grid-template-columns: minmax(0, 1fr) 132px 140px 92px minmax(0, 240px);
+  }
+  .row-role {
+    grid-template-columns: minmax(0, 190px) minmax(0, 1fr) minmax(0, 210px) 96px;
   }
 
   /* An identifier in a list — an address, a slug, a package name. */
@@ -556,6 +559,14 @@
   .panel-body {
     padding: 14px;
   }
+  /* A list inside a panel: the panel head is already a rule above it, and the
+     panel's own border closes it off below. */
+  .panel > .rows {
+    border-top: none;
+  }
+  .panel > .rows > .row:last-child {
+    border-bottom: none;
+  }
 
   /* ---------- forms ---------- */
 
@@ -810,7 +821,10 @@
     font-weight: 600;
     letter-spacing: -0.015em;
   }
-  .dialog-card p {
+  /* The direct child only. This is the confirm dialog's body copy, and a
+     descendant selector would also claim every paragraph in the form dialogs
+     built on the same card — at a higher specificity than their own classes. */
+  .dialog-card > p {
     margin-top: 7px;
     color: var(--text-dim);
     font-size: 0.88rem;
@@ -983,12 +997,6 @@
     align-items: center;
     gap: 10px;
   }
-  .member-scopes .field-label {
-    color: var(--text-dim);
-    font-size: 0.82rem;
-    font-weight: 500;
-  }
-
   /* A checkbox with its word beside it, small enough to live inside a row. */
   .tick {
     display: inline-flex;
@@ -1024,6 +1032,229 @@
     grid-template-columns: minmax(0, 1fr) 140px auto;
   }
 
+  /* ---------- roles and permissions ---------- */
+
+  .member-role {
+    display: flex;
+    align-items: center;
+    gap: 7px;
+    min-width: 0;
+  }
+  /* "+2 −1": this person's grant is not their role's. Small, but the one thing
+     on the row a reader has to look twice at. */
+  .member-exceptions {
+    color: var(--text-faint);
+    font-family: var(--font-mono);
+    font-size: 0.7rem;
+    white-space: nowrap;
+  }
+
+  .role-grants {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 4px;
+  }
+  .role-why {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .role-lock {
+    color: var(--text-faint);
+  }
+
+  /* One permission: a checkbox, the verb, and a line saying what it hands over. */
+  .perm-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(232px, 1fr));
+    gap: 10px;
+  }
+  /* A `<div role="group">` rather than a fieldset: a legend is laid out by
+     rules of its own that a flex or grid fieldset has never handled the same
+     way twice across browsers, and the heading here has to sit in a row with
+     the all/none control. */
+  .perm-group {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    padding: 10px 11px 11px;
+    border: 1px solid var(--line);
+    border-radius: var(--r-sm);
+    background: var(--surface-2);
+    transition: border-color 0.15s;
+  }
+  .perm-group[data-active="true"] {
+    border-color: color-mix(in oklab, var(--accent) 34%, var(--line));
+  }
+  .perm-legend {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 8px;
+    width: 100%;
+    margin-bottom: 6px;
+    font-size: 0.78rem;
+    font-weight: 600;
+  }
+  .perm-all {
+    color: var(--text-faint);
+    font-family: var(--font-mono);
+    font-size: 0.68rem;
+    font-weight: 400;
+  }
+  .perm-all:hover:not(:disabled) {
+    color: var(--accent);
+  }
+
+  .perm {
+    display: grid;
+    grid-template-columns: auto minmax(0, 1fr);
+    gap: 8px;
+    padding: 5px 6px;
+    border-radius: var(--r-sm);
+    cursor: pointer;
+  }
+  .perm:hover {
+    background: var(--chip);
+  }
+  .perm input {
+    margin-top: 3px;
+    accent-color: var(--accent);
+  }
+  .perm-text {
+    display: flex;
+    flex-direction: column;
+    gap: 1px;
+    min-width: 0;
+  }
+  .perm-verb {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    color: var(--text-dim);
+    font-size: 0.8rem;
+  }
+  .perm[data-on="true"] .perm-verb {
+    color: var(--text);
+    font-weight: 500;
+  }
+  /* Only the differences are labelled. A tick that matches the role is the
+     default state and needs no word for it. */
+  .perm-flag {
+    padding: 0 5px;
+    border-radius: var(--r-sm);
+    background: color-mix(in oklab, var(--ok) 18%, transparent);
+    color: var(--ok);
+    font-family: var(--font-mono);
+    font-size: 0.62rem;
+    font-weight: 500;
+    letter-spacing: 0.02em;
+  }
+  .perm-flag-off {
+    background: color-mix(in oklab, var(--danger) 16%, transparent);
+    color: var(--danger);
+  }
+  .perm-hint {
+    color: var(--text-faint);
+    font-size: 0.72rem;
+    line-height: 1.45;
+  }
+
+  /* ---------- form dialogs ---------- */
+
+  /* Wider than the confirm dialog, and scrolls: a permission matrix is taller
+     than a short viewport, and the actions have to stay reachable. */
+  .dialog-card-wide {
+    display: flex;
+    flex-direction: column;
+    width: min(760px, calc(100vw - 32px));
+    max-height: min(88vh, 860px);
+    padding: 0;
+  }
+  .dialog-head {
+    display: flex;
+    align-items: flex-start;
+    gap: 12px;
+    padding: 16px 18px 13px;
+    border-bottom: 1px solid var(--line-soft);
+  }
+  .dialog-sub {
+    margin-top: 3px;
+    color: var(--text-faint);
+    font-size: 0.78rem;
+    line-height: 1.45;
+  }
+  .dialog-close {
+    margin-left: auto;
+    color: var(--text-faint);
+    line-height: 1;
+  }
+  .dialog-close:hover {
+    color: var(--text);
+  }
+  .dialog-body {
+    padding: 16px 18px;
+    overflow-y: auto;
+  }
+  .dialog-card-wide .dialog-actions {
+    align-items: center;
+    margin-top: 0;
+    padding: 12px 18px;
+    border-top: 1px solid var(--line-soft);
+    background: var(--surface-2);
+    border-radius: 0 0 var(--r-md) var(--r-md);
+  }
+  /* What the draft currently amounts to, beside the button that will save it. */
+  .dialog-status {
+    margin-right: auto;
+    color: var(--text-faint);
+    font-size: 0.76rem;
+  }
+
+  .dialog-split {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+    gap: 0 16px;
+  }
+  .dialog-section {
+    margin: 4px 0 12px;
+  }
+  .dialog-section h3 {
+    margin-bottom: 4px;
+    font-size: 0.85rem;
+    font-weight: 600;
+  }
+  .dialog-section .side-note {
+    line-height: 1.5;
+  }
+
+  /* A label outside a `<label>` — a group of checkboxes has no single control
+     to point at, so the heading is a span and matches `.field > label`. */
+  .field-label {
+    color: var(--text-dim);
+    font-size: 0.82rem;
+    font-weight: 500;
+  }
+  .scope-row {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 8px;
+  }
+  /* The row version of `.tick` is bare; inside a form it needs an edge. */
+  .tick-box {
+    padding: 6px 10px;
+    border: 1px solid var(--line);
+    border-radius: var(--r-sm);
+    background: var(--bg);
+    font-size: 0.82rem;
+  }
+  .tick-box:has(input:checked) {
+    border-color: color-mix(in oklab, var(--accent) 45%, var(--line));
+    background: var(--chip);
+    color: var(--text);
+  }
+
   /* ---------- attachments ---------- */
 
   /*
@@ -1147,13 +1378,24 @@
   /* A member's row is five columns of controls; below this it is a card. */
   @media (max-width: 1000px) {
     .row-member {
-      grid-template-columns: minmax(0, 1fr) 104px;
+      grid-template-columns: minmax(0, 1fr) 132px;
+      row-gap: 8px;
+    }
+    .row-role {
+      grid-template-columns: minmax(0, 1fr) auto;
       row-gap: 8px;
     }
     .row-member .member-mail,
     .row-member .num {
       text-align: left;
     }
+    .role-grants,
+    .role-why {
+      grid-column: 1 / -1;
+    }
+    .role-why {
+      white-space: normal;
+    }
     .member-actions,
     .member-locked {
       grid-column: 1 / -1;
diff --git a/apps/admin/src/lib/auth/auth.test.ts b/apps/admin/src/lib/auth/auth.test.ts
index 0812b2ec..b20551ee 100644
--- a/apps/admin/src/lib/auth/auth.test.ts
+++ b/apps/admin/src/lib/auth/auth.test.ts
@@ -4,11 +4,14 @@ import {
   accessFor,
   can,
   canReadWorkspace,
+  hasOverrides,
   PERMISSIONS,
   permissionsFor,
   readableWorkspaces,
+  resolvePermissions,
   roleLabel,
   SUPER_ADMIN_GITHUB_IDS,
+  sanitisePermissions,
 } from "./roles";
 import { safeNext } from "./urls";
 
@@ -105,6 +108,100 @@ describe("members.manage", () => {
       expect(permissionsFor(role)).not.toContain("members.manage");
     }
   });
+
+  it("cannot be stored on a custom role or granted to one person", () => {
+    expect(sanitisePermissions(["members.manage", "posts.read"])).toEqual(["posts.read"]);
+  });
+
+  it("is dropped at resolution even if a row somehow holds it", () => {
+    const permissions = resolvePermissions({ role: "viewer", extra: ["members.manage"] });
+    expect(permissions).not.toContain("members.manage");
+  });
+});
+
+describe("sanitisePermissions", () => {
+  it("drops anything that is not a permission", () => {
+    expect(sanitisePermissions(["posts.read", "posts.delete", ""])).toEqual(["posts.read"]);
+  });
+
+  it("returns catalogue order, so two equal sets compare equal", () => {
+    expect(sanitisePermissions(["mail.read", "posts.read"])).toEqual(
+      sanitisePermissions(["posts.read", "mail.read"]),
+    );
+  });
+});
+
+describe("resolvePermissions", () => {
+  const releaseManager = {
+    id: "role-1",
+    key: "release-manager",
+    label: "Release manager",
+    permissions: ["posts.read", "posts.publish"] as const,
+  };
+
+  it("uses the custom role in place of the built-in one, not on top of it", () => {
+    const permissions = resolvePermissions({ role: "admin", customRole: releaseManager });
+
+    expect(permissions).toEqual(["posts.read", "posts.publish"]);
+    expect(permissions).not.toContain("settings.write");
+  });
+
+  it("adds a grant made to one person by name", () => {
+    const permissions = resolvePermissions({
+      role: "support",
+      extra: ["posts.publish"],
+    });
+
+    expect(permissions).toContain("posts.publish");
+    expect(permissions).toContain("mail.send");
+  });
+
+  it("lets denied win over the role and over an extra that contradicts it", () => {
+    const permissions = resolvePermissions({
+      role: "editor",
+      extra: ["posts.publish"],
+      denied: ["posts.publish"],
+    });
+
+    expect(permissions).not.toContain("posts.publish");
+    expect(permissions).toContain("posts.write");
+  });
+});
+
+describe("a member on a custom role", () => {
+  const role = {
+    id: "role-1",
+    key: "release-manager",
+    label: "Release manager",
+    permissions: ["posts.read", "posts.publish"] as const,
+  };
+
+  it("is named by the role, and keeps the built-in one underneath for a fallback", () => {
+    const access = accessFor(
+      { role: "viewer", mailWorkspaces: [], deniedPermissions: ["posts.publish"] },
+      false,
+      role,
+    );
+
+    expect(roleLabel(access)).toBe("Release manager");
+    expect(access.role).toBe("viewer");
+    expect(access.customRole?.id).toBe("role-1");
+    expect(can(access, "posts.read")).toBe(true);
+    expect(can(access, "posts.publish")).toBe(false);
+    expect(hasOverrides(access)).toBe(true);
+  });
+
+  it("is ignored entirely for a super admin, as their row always is", () => {
+    const access = accessFor(
+      { role: "viewer", mailWorkspaces: [], deniedPermissions: ["posts.read"] },
+      true,
+      role,
+    );
+
+    expect(access.customRole).toBeNull();
+    expect(access.permissions).toEqual(PERMISSIONS);
+    expect(hasOverrides(access)).toBe(false);
+  });
 });
 
 describe("safeNext", () => {
diff --git a/apps/admin/src/lib/auth/roles.ts b/apps/admin/src/lib/auth/roles.ts
index fc2aa546..c807a97e 100644
--- a/apps/admin/src/lib/auth/roles.ts
+++ b/apps/admin/src/lib/auth/roles.ts
@@ -13,7 +13,9 @@
  */
 
 import {
+  ADMIN_PERMISSIONS,
   ADMIN_ROLE_LABELS,
+  type AdminPermission,
   type AdminRole,
   MAIL_WORKSPACES,
   type MailWorkspace,
@@ -40,30 +42,41 @@ export const SUPER_ADMIN_GITHUB_IDS: readonly number[] = [67143288, 56130065];
 /**
  * Everything the console can be asked to allow.
  *
- * One flat list, named `resource.verb`. Groups of three — read, write, and the
- * irreversible one — because "may edit a post" and "may put it in front of the
- * public" are genuinely different grants, and so are "may read the mail" and
- * "may answer it as us".
+ * The list itself moved to `@byteveda/db/constants` when custom roles arrived:
+ * a role's permissions are now a column, and the column's type should be the
+ * closed set rather than `text[]`. Re-exported under the name the rest of this
+ * app has always used, because where the strings are written down is not worth
+ * a rename across forty files.
  */
-export const PERMISSIONS = [
-  "posts.read",
-  "posts.write",
-  "posts.publish",
-  "stats.read",
-  "stats.write",
-  "subscribers.read",
-  "subscribers.write",
-  "broadcasts.send",
-  "mail.read",
-  "mail.send",
-  "mail.manage",
-  "settings.read",
-  "settings.write",
-  "members.read",
-  "members.manage",
-] as const;
-
-export type Permission = (typeof PERMISSIONS)[number];
+export const PERMISSIONS = ADMIN_PERMISSIONS;
+
+export type Permission = AdminPermission;
+
+/**
+ * The one permission no role may carry, custom or otherwise.
+ *
+ * `members.manage` is the grant that grants grants. A role holding it could
+ * write itself every other line in this file, which would make the rest of
+ * them advisory — so the built-in sets leave it out, and `sanitise` strips it
+ * from anything a form sends. Only the hardcoded super admin list has it.
+ */
+export const RESERVED_PERMISSIONS: readonly Permission[] = ["members.manage"];
+
+/**
+ * Filters an untrusted list down to permissions that exist and may be granted.
+ *
+ * Every path that writes permissions goes through here — the custom role
+ * editor, the per-member overrides, both of them server actions that are
+ * public URLs. The returned list is in catalogue order rather than the order
+ * it arrived in, so two equal sets compare equal and a diff of the column is
+ * a real change.
+ */
+export function sanitisePermissions(values: readonly string[]): Permission[] {
+  const asked = new Set(values);
+  return PERMISSIONS.filter(
+    (permission) => asked.has(permission) && !RESERVED_PERMISSIONS.includes(permission),
+  );
+}
 
 /**
  * What each role carries.
@@ -124,16 +137,80 @@ const ROLE_PERMISSIONS: Record<AdminRole, readonly Permission[]> = {
 export type AccessSnapshot = {
   /** Their role as stored. Ignored entirely when `superAdmin` is true. */
   role: AdminRole;
+  /**
+   * The role a super admin wrote, when they are on one. Takes the place of
+   * `role` — which is kept underneath it, and is what they fall back to if
+   * this role is ever deleted.
+   */
+  customRole: { id: string; key: string; label: string } | null;
   superAdmin: boolean;
   permissions: readonly Permission[];
   /** Which mail they may read. Every workspace, for a super admin. */
   workspaces: readonly MailWorkspace[];
+  /** Their exceptions to the role, kept so the console can show which is which. */
+  extra: readonly Permission[];
+  denied: readonly Permission[];
+};
+
+/** A custom role, in the shape the resolver needs. The row satisfies it. */
+export type CustomRoleGrant = {
+  id: string;
+  key: string;
+  label: string;
+  permissions: readonly Permission[];
 };
 
+/** What a member is on, whichever kind of role that is. */
+export type RoleChoice =
+  | { kind: "builtin"; key: AdminRole }
+  | { kind: "custom"; id: string; key: string; label: string };
+
 export function permissionsFor(role: AdminRole): readonly Permission[] {
   return ROLE_PERMISSIONS[role] ?? [];
 }
 
+/**
+ * The permissions a member gets before their own exceptions are applied.
+ *
+ * One function so that the members page, the access dialog and `accessFor`
+ * cannot disagree about what "inherited" means — the dialog draws a tick as
+ * coming from the role, and the server decides whether it is an override, and
+ * those two have to be the same sentence.
+ */
+export function basePermissionsFor(
+  role: AdminRole,
+  customRole: CustomRoleGrant | null | undefined,
+): readonly Permission[] {
+  return customRole ? customRole.permissions : permissionsFor(role);
+}
+
+/**
+ * Role, plus exceptions, in catalogue order.
+ *
+ * Denied is applied last and wins over everything, including the role and an
+ * `extra` that contradicts it. Any other ordering makes "take this away" a
+ * suggestion, and the one case that matters — withdrawing a grant from
+ * somebody in a hurry — is the case where it must not be.
+ */
+export function resolvePermissions(input: {
+  role: AdminRole;
+  customRole?: CustomRoleGrant | null;
+  extra?: readonly Permission[];
+  denied?: readonly Permission[];
+}): Permission[] {
+  const granted = new Set<Permission>([
+    ...basePermissionsFor(input.role, input.customRole),
+    ...(input.extra ?? []),
+  ]);
+
+  for (const permission of input.denied ?? []) granted.delete(permission);
+  // Nothing stored may hold the reserved grant, but resolving is the last gate
+  // before a check, and it costs one filter to make that true by construction.
+  for (const permission of RESERVED_PERMISSIONS) granted.delete(permission);
+
+  return PERMISSIONS.filter((permission) => granted.has(permission));
+}
+
 /**
  * Resolves what a member may do.
  *
@@ -151,23 +228,40 @@ export function permissionsFor(role: AdminRole): readonly Permission[] {
  * form submission still has the console.
  */
 export function accessFor(
-  user: { role: AdminRole; mailWorkspaces: readonly MailWorkspace[] },
+  user: {
+    role: AdminRole;
+    mailWorkspaces: readonly MailWorkspace[];
+    extraPermissions?: readonly Permission[];
+    deniedPermissions?: readonly Permission[];
+  },
   superAdmin: boolean,
+  customRole?: CustomRoleGrant | null,
 ): AccessSnapshot {
   if (superAdmin) {
     return {
       role: user.role,
+      customRole: null,
       superAdmin: true,
       permissions: PERMISSIONS,
       workspaces: MAIL_WORKSPACES,
+      extra: [],
+      denied: [],
     };
   }
 
+  const extra = user.extraPermissions ?? [];
+  const denied = user.deniedPermissions ?? [];
+
   return {
     role: user.role,
+    customRole: customRole
+      ? { id: customRole.id, key: customRole.key, label: customRole.label }
+      : null,
     superAdmin: false,
-    permissions: permissionsFor(user.role),
+    permissions: resolvePermissions({ role: user.role, customRole, extra, denied }),
     workspaces: user.mailWorkspaces,
+    extra,
+    denied,
   };
 }
 
@@ -200,7 +294,23 @@ export function readableWorkspaces(access: AccessSnapshot): MailWorkspace[] {
   return MAIL_WORKSPACES.filter((workspace) => access.workspaces.includes(workspace));
 }
 
-/** How the role is named in the interface. Super admin is a rank, not a role. */
-export function roleLabel(access: Pick<AccessSnapshot, "role" | "superAdmin">): string {
-  return access.superAdmin ? "Super admin" : ADMIN_ROLE_LABELS[access.role];
+/**
+ * How the role is named in the interface. Super admin is a rank, not a role.
+ *
+ * A custom role's own label wins over the built-in one underneath it: that
+ * label is what the person granting access typed, and showing "Viewer" for
+ * somebody on "Release manager" would describe a column rather than a grant.
+ */
+export function roleLabel(
+  access: Pick<AccessSnapshot, "role" | "superAdmin"> & {
+    customRole?: AccessSnapshot["customRole"];
+  },
+): string {
+  if (access.superAdmin) return "Super admin";
+  return access.customRole?.label ?? ADMIN_ROLE_LABELS[access.role];
+}
+
+/** Whether a member's grant differs from the role they are on. */
+export function hasOverrides(access: Pick<AccessSnapshot, "extra" | "denied">): boolean {
+  return access.extra.length > 0 || access.denied.length > 0;
 }
diff --git a/apps/admin/src/lib/auth/session.ts b/apps/admin/src/lib/auth/session.ts
index 6496a230..70e62ded 100644
--- a/apps/admin/src/lib/auth/session.ts
+++ b/apps/admin/src/lib/auth/session.ts
@@ -1,5 +1,5 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { type AdminUser, adminUsers, getDb, sessions } from "@byteveda/db";
+import { type AdminUser, adminCustomRoles, adminUsers, getDb, sessions } from "@byteveda/db";
 import { and, eq, gt, lt } from "drizzle-orm";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
@@ -91,10 +91,14 @@ export async function getSession(): Promise<SessionContext | null> {
   if (!token) return null;
 
   const db = getDb();
+  // The custom role joins here rather than being fetched when something asks
+  // for it: `access` is resolved once per request and handed to the browser,
+  // and a role read later would be a second answer to the same question.
   const [row] = await db
-    .select({ session: sessions, user: adminUsers })
+    .select({ session: sessions, user: adminUsers, customRole: adminCustomRoles })
     .from(sessions)
     .innerJoin(adminUsers, eq(sessions.userId, adminUsers.id))
+    .leftJoin(adminCustomRoles, eq(adminUsers.customRoleId, adminCustomRoles.id))
     .where(and(eq(sessions.tokenHash, hashToken(token)), gt(sessions.expiresAt, new Date())))
     .limit(1);
 
@@ -126,7 +130,7 @@ export async function getSession(): Promise<SessionContext | null> {
     user: row.user,
     sessionId: row.session.id,
     expiresAt,
-    access: accessFor(row.user, superAdmin),
+    access: accessFor(row.user, superAdmin, row.customRole),
   };
 }
 
diff --git a/apps/admin/src/lib/members/actions.ts b/apps/admin/src/lib/members/actions.ts
index d913e9e2..04e9737a 100644
--- a/apps/admin/src/lib/members/actions.ts
+++ b/apps/admin/src/lib/members/actions.ts
@@ -1,6 +1,12 @@
 "use server";
 
-import { type AdminRole, type AdminStatus, adminUsers, getDb } from "@byteveda/db";
+import {
+  type AdminRole,
+  type AdminStatus,
+  adminCustomRoles,
+  adminUsers,
+  getDb,
+} from "@byteveda/db";
 import {
   ADMIN_ROLES,
   ADMIN_STATUSES,
@@ -11,8 +17,9 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { isSuperAdminId } from "@/lib/auth/allowlist";
 import { findUserByLogin } from "@/lib/auth/github";
+import { basePermissionsFor, type Permission, sanitisePermissions } from "@/lib/auth/roles";
 import { refuse, requireSession, revokeSessionsFor } from "@/lib/auth/session";
-import { findMember } from "./queries";
+import { findCustomRole, findMember } from "./queries";
 
 export type MemberResult = { ok: boolean; message: string };
 
@@ -55,6 +62,8 @@ function cleanWorkspaces(values: string[]): MailWorkspace[] {
 export async function inviteMember(input: {
   handle: string;
   role: string;
+  /** A custom role to start them on. The built-in `role` is kept underneath it. */
+  customRoleId?: string | null;
   workspaces: string[];
 }): Promise<MemberResult> {
   const refused = await guard();
@@ -66,6 +75,11 @@ export async function inviteMember(input: {
   if (!handle) return { ok: false, message: "Give a GitHub login or a numeric user id." };
   if (!isRole(input.role)) return { ok: false, message: "Pick a role." };
 
+  const custom = input.customRoleId ? await findCustomRole(input.customRoleId) : null;
+  if (input.customRoleId && !custom) {
+    return { ok: false, message: "That role has been deleted. Reload and pick another." };
+  }
+
   const numeric = /^\d+$/.test(handle) ? Number(handle) : null;
   const profile = numeric === null ? await findUserByLogin(handle) : null;
 
@@ -91,6 +105,7 @@ export async function inviteMember(input: {
       name: profile?.name ?? null,
       avatarUrl: profile?.avatarUrl ?? null,
       role: input.role,
+      customRoleId: custom?.id ?? null,
       status: "active",
       mailWorkspaces: workspaces,
       invitedBy: actor.id,
@@ -108,50 +123,88 @@ export async function inviteMember(input: {
 }
 
 /**
- * Changes what a member may do.
+ * What one member may do, and where, written in a single act.
  *
- * A super admin's role is not editable here, and refusing is better than
- * silently ignoring it: their access comes from the hardcoded list, so a
- * successful-looking change to the column would be a lie about what the console
- * will do next.
+ * Three columns used to be three actions firing as fast as the boxes were
+ * ticked. Granular access is not that shape: "editor, both inboxes, but no
+ * publishing" is one decision, and applying its parts one at a time means a
+ * window in which somebody is an editor who can publish — and a half-applied
+ * grant if the person closes the tab. So the dialog gathers the whole answer
+ * and this writes it once.
+ *
+ * `permissions` is the set the operator ticked — what they want to be true —
+ * rather than a pair of override lists. The diff against the role is computed
+ * here, which is what keeps an override *an override*: change the role later
+ * and everything they did not explicitly touch follows it.
  */
-export async function setMemberRole(id: string, role: string): Promise<MemberResult> {
+export type AccessDraft = {
+  /** A built-in role's key, or a custom role's id when `custom` is true. */
+  role: string;
+  custom: boolean;
+  /** The effective permissions, as ticked. */
+  permissions: string[];
+  workspaces: string[];
+};
+
+export async function setMemberAccess(id: string, draft: AccessDraft): Promise<MemberResult> {
   const refused = await guard();
   if (refused) return refused;
 
-  if (!isRole(role)) return { ok: false, message: "That is not a role." };
-
   const member = await findMember(id);
   if (!member) return { ok: false, message: "That member no longer exists." };
+
+  // Refused rather than applied. A super admin's permissions come from the
+  // hardcoded list and `accessFor` never reads these columns for them, so a
+  // change that appeared to work would be a lie about what happens next.
   if (isSuperAdminId(member.githubId)) {
     return {
       ok: false,
-      message: `${member.login} is a super admin. That is set in the source, not here.`,
+      message: `${member.login} is a super admin, which is set in lib/auth/roles.ts. Nothing here applies to them.`,
     };
   }
 
-  await getDb().update(adminUsers).set({ role }).where(eq(adminUsers.id, id));
+  const custom = draft.custom ? await findCustomRole(draft.role) : null;
+  if (draft.custom && !custom) {
+    return { ok: false, message: "That role has been deleted. Reload and pick another." };
+  }
 
-  revalidatePath("/members");
-  return { ok: true, message: `${member.login} is now a ${role}.` };
-}
+  if (!custom && !isRole(draft.role)) {
+    return { ok: false, message: "That is not a role." };
+  }
 
-/** Which inboxes a member may read. Nothing to do with their role. */
-export async function setMemberWorkspaces(id: string, workspaces: string[]): Promise<MemberResult> {
-  const refused = await guard();
-  if (refused) return refused;
+  // The built-in role underneath a custom one is kept rather than cleared, so
+  // deleting the custom role drops them back to something rather than nothing.
+  const role: AdminRole = custom ? member.role : (draft.role as AdminRole);
 
-  const [updated] = await getDb()
-    .update(adminUsers)
-    .set({ mailWorkspaces: cleanWorkspaces(workspaces) })
-    .where(eq(adminUsers.id, id))
-    .returning({ login: adminUsers.login });
+  const wanted = new Set(sanitisePermissions(draft.permissions));
+  const base = basePermissionsFor(role, custom);
 
-  if (!updated) return { ok: false, message: "That member no longer exists." };
+  const extra = [...wanted].filter((permission) => !base.includes(permission));
+  const denied = base.filter((permission) => !wanted.has(permission));
+
+  await getDb()
+    .update(adminUsers)
+    .set({
+      role,
+      customRoleId: custom?.id ?? null,
+      extraPermissions: sanitisePermissions(extra),
+      deniedPermissions: sanitisePermissions(denied),
+      mailWorkspaces: cleanWorkspaces(draft.workspaces),
+    })
+    .where(eq(adminUsers.id, id));
 
   revalidatePath("/members");
   revalidatePath("/inbox");
-  return { ok: true, message: `Updated the mail access for ${updated.login}.` };
+
+  const label = custom?.label ?? role;
+  const exceptions = extra.length + denied.length;
+
+  return {
+    ok: true,
+    message: `${member.login} is now ${label}${
+      exceptions > 0 ? ` with ${exceptions} exception${exceptions === 1 ? "" : "s"}` : ""
+    }.`,
+  };
 }
 
 /**
@@ -229,3 +282,153 @@ export async function removeMember(id: string): Promise<MemberResult> {
   revalidatePath("/members");
   return { ok: true, message: `${member.login} no longer has access.` };
 }
+
+/* ---------------------------------------------------------------- custom roles */
+
+export type RoleDraft = {
+  label: string;
+  description: string;
+  permissions: string[];
+};
+
+/**
+ * A stable handle for a role, derived from its name.
+ *
+ * Kept when the label is edited later: the key is what a log line and a
+ * support conversation say, and renaming "Release manager" to "Releases"
+ * should not make last month's audit trail refer to something that no longer
+ * exists.
+ */
+function slugify(label: string): string {
+  return label
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 48);
+}
+
+/** The checks both writers share: a usable name, and at least one grant. */
+function validateRole(
+  draft: RoleDraft,
+): { label: string; permissions: Permission[] } | MemberResult {
+  const label = draft.label.trim().replace(/\s+/g, " ");
+
+  if (label.length < 2) return { ok: false, message: "Give the role a name." };
+  if (label.length > 48) return { ok: false, message: "That name is too long for a role." };
+
+  // A role reserving the built-in names would put two different answers behind
+  // one word in every dropdown in the console.
+  if ((ADMIN_ROLES as readonly string[]).includes(label.toLowerCase())) {
+    return { ok: false, message: `“${label}” is a built-in role. Pick another name.` };
+  }
+
+  const permissions = sanitisePermissions(draft.permissions);
+  if (permissions.length === 0) {
+    return { ok: false, message: "A role with no permissions grants nothing. Tick at least one." };
+  }
+
+  return { label, permissions };
+}
+
+function isRefusal(value: unknown): value is MemberResult {
+  return typeof value === "object" && value !== null && "ok" in value;
+}
+
+/**
+ * Writes a role of the operator's own.
+ *
+ * What it can hold is bounded by the same catalogue every built-in role is:
+ * `sanitisePermissions` drops anything that is not a real permission and
+ * anything reserved, so a custom role can only recombine grants the code
+ * already enforces. It cannot mint a new power, and it cannot carry
+ * `members.manage` — the grant that grants grants stays a super admin's.
+ */
+export async function createRole(draft: RoleDraft): Promise<MemberResult> {
+  const refused = await guard();
+  if (refused) return refused;
+
+  const checked = validateRole(draft);
+  if (isRefusal(checked)) return checked;
+
+  const { user: actor } = await requireSession();
+  const key = slugify(checked.label);
+  if (!key) return { ok: false, message: "That name has no letters or digits in it." };
+
+  const [created] = await getDb()
+    .insert(adminCustomRoles)
+    .values({
+      key,
+      label: checked.label,
+      description: draft.description.trim() || null,
+      permissions: checked.permissions,
+      createdBy: actor.id,
+    })
+    .onConflictDoNothing({ target: adminCustomRoles.key })
+    .returning({ label: adminCustomRoles.label });
+
+  if (!created) return { ok: false, message: "A role with that name already exists." };
+
+  revalidatePath("/members");
+  return { ok: true, message: `“${created.label}” is ready to assign.` };
+}
+
+/**
+ * Edits one.
+ *
+ * Every member on the role is affected at once, which is the point of a role
+ * and the reason the dialog says how many that is before it saves. Their own
+ * exceptions survive: those are stored as a diff against the role, so removing
+ * a permission from the role removes it from everybody who inherited it and
+ * leaves it with whoever was granted it by name.
+ */
+export async function updateRole(id: string, draft: RoleDraft): Promise<MemberResult> {
+  const refused = await guard();
+  if (refused) return refused;
+
+  const checked = validateRole(draft);
+  if (isRefusal(checked)) return checked;
+
+  const [updated] = await getDb()
+    .update(adminCustomRoles)
+    .set({
+      label: checked.label,
+      description: draft.description.trim() || null,
+      permissions: checked.permissions,
+      updatedAt: new Date(),
+    })
+    .where(eq(adminCustomRoles.id, id))
+    .returning({ label: adminCustomRoles.label });
+
+  if (!updated) return { ok: false, message: "That role no longer exists." };
+
+  revalidatePath("/members");
+  revalidatePath("/inbox");
+  return { ok: true, message: `“${updated.label}” updated.` };
+}
+
+/**
+ * Deletes one.
+ *
+ * Nobody loses their account. The foreign key nulls `custom_role_id`, and the
+ * built-in role kept underneath it takes over — which is why that column is
+ * never cleared when a custom role is assigned. Tidying up a role should not
+ * be a way to lock the console's last editor out.
+ */
+export async function deleteRole(id: string): Promise<MemberResult> {
+  const refused = await guard();
+  if (refused) return refused;
+
+  const [deleted] = await getDb()
+    .delete(adminCustomRoles)
+    .where(eq(adminCustomRoles.id, id))
+    .returning({ label: adminCustomRoles.label });
+
+  if (!deleted) return { ok: false, message: "That role no longer exists." };
+
+  revalidatePath("/members");
+  revalidatePath("/inbox");
+  return {
+    ok: true,
+    message: `“${deleted.label}” is gone. Anyone on it is back on their built-in role.`,
+  };
+}
diff --git a/apps/admin/src/lib/members/queries.ts b/apps/admin/src/lib/members/queries.ts
index 06c14bc5..be732044 100644
--- a/apps/admin/src/lib/members/queries.ts
+++ b/apps/admin/src/lib/members/queries.ts
@@ -1,4 +1,11 @@
-import { type AdminUser, adminUsers, getDb, sessions } from "@byteveda/db";
+import {
+  type AdminCustomRole,
+  type AdminUser,
+  adminCustomRoles,
+  adminUsers,
+  getDb,
+  sessions,
+} from "@byteveda/db";
 import { asc, desc, eq, gt, sql } from "drizzle-orm";
 import { superAdmins } from "@/lib/auth/allowlist";
 import { type AccessSnapshot, accessFor } from "@/lib/auth/roles";
@@ -11,6 +18,9 @@ export type Member = {
   activeSessions: number;
 };
 
+/** A custom role, with the one number that says whether deleting it is safe. */
+export type CustomRoleSummary = AdminCustomRole & { members: number };
+
 export async function findMemberByGithubId(githubId: number): Promise<AdminUser | null> {
   const [row] = await getDb()
     .select()
@@ -41,7 +51,11 @@ export async function listMembers(): Promise<Member[]> {
   const supers = superAdmins();
 
   const [rows, open] = await Promise.all([
-    db.select().from(adminUsers).orderBy(desc(adminUsers.lastLoginAt), asc(adminUsers.createdAt)),
+    db
+      .select({ user: adminUsers, customRole: adminCustomRoles })
+      .from(adminUsers)
+      .leftJoin(adminCustomRoles, eq(adminUsers.customRoleId, adminCustomRoles.id))
+      .orderBy(desc(adminUsers.lastLoginAt), asc(adminUsers.createdAt)),
 
     db
       .select({ userId: sessions.userId, total: sql<number>`count(*)::int` })
@@ -52,9 +66,42 @@ export async function listMembers(): Promise<Member[]> {
 
   const counted = new Map(open.map((row) => [row.userId, row.total]));
 
-  return rows.map((user) => ({
+  return rows.map(({ user, customRole }) => ({
     user,
-    access: accessFor(user, supers.includes(user.githubId)),
+    access: accessFor(user, supers.includes(user.githubId), customRole),
     activeSessions: counted.get(user.id) ?? 0,
   }));
 }
+
+/**
+ * The roles a super admin has written, with how many people are on each.
+ *
+ * The count is what turns "delete" from a guess into a decision: deleting a
+ * role nobody holds is tidying, and deleting one four people hold drops all
+ * four back to the built-in role underneath. The dialog says which it is.
+ */
+export async function listCustomRoles(): Promise<CustomRoleSummary[]> {
+  const db = getDb();
+
+  const rows = await db
+    .select({
+      role: adminCustomRoles,
+      members: sql<number>`count(${adminUsers.id})::int`,
+    })
+    .from(adminCustomRoles)
+    .leftJoin(adminUsers, eq(adminUsers.customRoleId, adminCustomRoles.id))
+    .groupBy(adminCustomRoles.id)
+    .orderBy(asc(adminCustomRoles.label));
+
+  return rows.map(({ role, members }) => ({ ...role, members }));
+}
+
+export async function findCustomRole(id: string): Promise<AdminCustomRole | null> {
+  const [row] = await getDb()
+    .select()
+    .from(adminCustomRoles)
+    .where(eq(adminCustomRoles.id, id))
+    .limit(1);
+
+  return row ?? null;
+}
diff --git a/apps/admin/src/views/members/access-dialog.tsx b/apps/admin/src/views/members/access-dialog.tsx
new file mode 100644
index 00000000..3615dedc
--- /dev/null
+++ b/apps/admin/src/views/members/access-dialog.tsx
@@ -0,0 +1,227 @@
+"use client";
+
+import {
+  ADMIN_ROLE_LABELS,
+  ADMIN_ROLES,
+  type AdminRole,
+  MAIL_WORKSPACE_LABELS,
+  MAIL_WORKSPACES,
+  type MailWorkspace,
+} from "@byteveda/db/constants";
+import { useMemo, useState, useTransition } from "react";
+import { basePermissionsFor, type Permission, permissionsFor } from "@/lib/auth/roles";
+import { type AccessDraft, setMemberAccess } from "@/lib/members/actions";
+import { Modal } from "./modal";
+import { PermissionPicker } from "./permission-picker";
+import type { RoleOption } from "./types";
+
+/**
+ * Everything one member is allowed to do, on one screen.
+ *
+ * Three questions that used to be three controls squeezed into a table row,
+ * where the third one — which permissions, exactly — had nowhere to go at all.
+ * Given room, they read as what they are: a role as the starting point, a
+ * scope for the axis a role deliberately says nothing about, and a matrix for
+ * the exceptions.
+ *
+ * The draft lives here and is written once. Nothing is saved until Save, which
+ * is the opposite of the old row's behaviour and the right one for a form with
+ * this many parts: a half-applied grant is worse than an unapplied one.
+ */
+export function AccessDialog({
+  member,
+  roles,
+  onClose,
+  onSaved,
+}: {
+  member: {
+    id: string;
+    login: string;
+    name: string | null;
+    role: AdminRole;
+    customRoleId: string | null;
+    permissions: readonly Permission[];
+    workspaces: readonly MailWorkspace[];
+  };
+  roles: readonly RoleOption[];
+  onClose: () => void;
+  onSaved: (message: string, ok: boolean) => void;
+}) {
+  // A custom role is picked by its id, a built-in one by its key. They cannot
+  // collide — one is a uuid — so a single select value covers both.
+  const [choice, setChoice] = useState<string>(member.customRoleId ?? member.role);
+  const [permissions, setPermissions] = useState<Permission[]>([...member.permissions]);
+  const [workspaces, setWorkspaces] = useState<MailWorkspace[]>([...member.workspaces]);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, startTransition] = useTransition();
+
+  const custom = roles.find((role) => role.id === choice) ?? null;
+
+  /** What the chosen role hands over before this member's exceptions. */
+  const base = useMemo(
+    () => basePermissionsFor(custom ? member.role : (choice as AdminRole), custom),
+    [choice, custom, member.role],
+  );
+
+  const added = permissions.filter((permission) => !base.includes(permission));
+  const removed = base.filter((permission) => !permissions.includes(permission));
+
+  /**
+   * Switching role rebases the exceptions rather than discarding them.
+   *
+   * Somebody moved from support to editor who had `posts.publish` granted by
+   * name should keep it; the rest of their permissions should become the
+   * editor's. Replacing the whole set would silently undo a deliberate grant,
+   * and keeping it wholesale would make the new role decorative.
+   */
+  function changeRole(next: string) {
+    const nextCustom = roles.find((role) => role.id === next) ?? null;
+    const nextBase = basePermissionsFor(nextCustom ? member.role : (next as AdminRole), nextCustom);
+
+    setChoice(next);
+    setPermissions([...new Set([...nextBase, ...added])].filter((p) => !removed.includes(p)));
+  }
+
+  function save() {
+    setError(null);
+
+    const draft: AccessDraft = {
+      role: choice,
+      custom: Boolean(custom),
+      permissions,
+      workspaces,
+    };
+
+    startTransition(async () => {
+      const result = await setMemberAccess(member.id, draft);
+      if (!result.ok) {
+        setError(result.message);
+        return;
+      }
+      onSaved(result.message, true);
+      onClose();
+    });
+  }
+
+  const exceptions = added.length + removed.length;
+
+  return (
+    <Modal
+      title="Access"
+      sub={`${member.name ?? member.login} · @${member.login}`}
+      onClose={onClose}
+      footer={
+        <>
+          <span className="dialog-status">
+            {exceptions === 0
+              ? "Exactly what the role grants."
+              : `${exceptions} exception${exceptions === 1 ? "" : "s"} to the role.`}
+          </span>
+          <button
+            type="button"
+            className="abtn abtn-quiet"
+            disabled={pending || exceptions === 0}
+            onClick={() => setPermissions([...base])}
+          >
+            Reset to role
+          </button>
+          <button type="button" className="abtn abtn-quiet" onClick={onClose} disabled={pending}>
+            Cancel
+          </button>
+          <button type="button" className="abtn abtn-primary" onClick={save} disabled={pending}>
+            {pending ? "Saving…" : "Save access"}
+          </button>
+        </>
+      }
+    >
+      <div className="dialog-split">
+        <div className="field">
+          <label htmlFor="access-role">Role</label>
+          <select
+            id="access-role"
+            className="input"
+            value={choice}
+            disabled={pending}
+            onChange={(event) => changeRole(event.target.value)}
+          >
+            <optgroup label="Built in">
+              {ADMIN_ROLES.map((role) => (
+                <option key={role} value={role}>
+                  {ADMIN_ROLE_LABELS[role]}
+                </option>
+              ))}
+            </optgroup>
+            {roles.length > 0 && (
+              <optgroup label="Custom">
+                {roles.map((role) => (
+                  <option key={role.id} value={role.id}>
+                    {role.label}
+                  </option>
+                ))}
+              </optgroup>
+            )}
+          </select>
+          <span className="hint">
+            {custom?.description ??
+              (custom
+                ? "A role a super admin wrote."
+                : `${permissionsFor(choice as AdminRole).length} permissions by default.`)}
+          </span>
+        </div>
+
+        <div className="field">
+          {/* Not a permission, and deliberately not part of one. "Admin, but
+              only the academy inbox" and "support, both inboxes" are both real
+              grants, and folding the two axes together would need a role per
+              combination. */}
+          <span className="field-label">Inbox scope</span>
+          <div className="scope-row">
+            {MAIL_WORKSPACES.map((workspace) => (
+              <label key={workspace} className="tick tick-box">
+                <input
+                  type="checkbox"
+                  checked={workspaces.includes(workspace)}
+                  disabled={pending}
+                  onChange={() =>
+                    setWorkspaces((current) =>
+                      current.includes(workspace)
+                        ? current.filter((candidate) => candidate !== workspace)
+                        : MAIL_WORKSPACES.filter(
+                            (candidate) => candidate === workspace || current.includes(candidate),
+                          ),
+                    )
+                  }
+                />
+                {MAIL_WORKSPACE_LABELS[workspace]}
+              </label>
+            ))}
+          </div>
+          <span className="hint">
+            Which mail they may open. Reading it still needs the Inbox permission below.
+          </span>
+        </div>
+      </div>
+
+      <div className="dialog-section">
+        <h3>Permissions</h3>
+        <p className="side-note">
+          Ticked by the role unless you change it here. A change is stored as an exception, so
+          moving them to another role later still moves everything you have not touched.
+        </p>
+      </div>
+
+      <PermissionPicker
+        value={permissions}
+        base={base}
+        onChange={setPermissions}
+        disabled={pending}
+      />
+
+      {error && (
+        <p className="note" data-tone="error" role="status">
+          {error}
+        </p>
+      )}
+    </Modal>
+  );
+}
diff --git a/apps/admin/src/views/members/member-controls.tsx b/apps/admin/src/views/members/member-controls.tsx
index a8e2c2a5..2c6c0d55 100644
--- a/apps/admin/src/views/members/member-controls.tsx
+++ b/apps/admin/src/views/members/member-controls.tsx
@@ -9,16 +9,13 @@ import {
   MAIL_WORKSPACES,
   type MailWorkspace,
 } from "@byteveda/db/constants";
-import { Ban, Trash2, UndoDot, UserPlus } from "lucide-react";
+import { Ban, KeyRound, Trash2, UndoDot, UserPlus } from "lucide-react";
 import { useState, useTransition } from "react";
 import { useConfirm } from "@/components";
-import {
-  inviteMember,
-  removeMember,
-  setMemberRole,
-  setMemberStatus,
-  setMemberWorkspaces,
-} from "@/lib/members/actions";
+import type { Permission } from "@/lib/auth/roles";
+import { inviteMember, removeMember, setMemberStatus } from "@/lib/members/actions";
+import { AccessDialog } from "./access-dialog";
+import type { RoleOption } from "./types";
 
 type Message = { text: string; ok: boolean } | null;
 
@@ -34,38 +31,42 @@ function Note({ message }: { message: Message }) {
 /**
  * What one member's row can do.
  *
- * Every control writes immediately — there is no save button, because there is
- * no form: a role is one value and a mailbox is one checkbox, and a page of
- * pending changes is a page somebody walks away from half applied.
+ * Two of the three controls that used to live here have moved into a dialog,
+ * and the row is better for it: a role, a scope and fifteen permissions do not
+ * fit beside a name, and the version that tried made the table overlap itself.
+ * What is left are the two acts that are genuinely one click — suspend, and
+ * remove — plus the button that opens everything else.
  *
  * Nothing here is the enforcement. Each action re-asks the server whether this
  * operator may manage members, and refuses if not; this is what stops them
  * being offered the question.
  */
 export function MemberControls({
-  id,
-  login,
-  role,
-  status,
-  workspaces,
+  member,
+  roles,
   locked,
   lockedReason,
 }: {
-  id: string;
-  login: string;
-  role: AdminRole;
-  status: AdminStatus;
-  workspaces: MailWorkspace[];
+  member: {
+    id: string;
+    login: string;
+    name: string | null;
+    role: AdminRole;
+    customRoleId: string | null;
+    status: AdminStatus;
+    permissions: readonly Permission[];
+    workspaces: readonly MailWorkspace[];
+  };
+  roles: RoleOption[];
   locked: boolean;
   lockedReason: string;
 }) {
   const [message, setMessage] = useState<Message>(null);
   const [pending, startTransition] = useTransition();
+  const [editing, setEditing] = useState(false);
   const confirm = useConfirm();
 
-  const [currentRole, setCurrentRole] = useState(role);
-  const [currentStatus, setCurrentStatus] = useState(status);
-  const [mail, setMail] = useState(workspaces);
+  const [currentStatus, setCurrentStatus] = useState(member.status);
 
   if (locked) {
     return (
@@ -83,34 +84,12 @@ export function MemberControls({
     });
   }
 
-  function changeRole(next: AdminRole) {
-    const previous = currentRole;
-    setCurrentRole(next);
-    run(
-      () => setMemberRole(id, next),
-      () => setCurrentRole(previous),
-    );
-  }
-
-  function toggleWorkspace(workspace: MailWorkspace) {
-    const previous = mail;
-    const next = mail.includes(workspace)
-      ? mail.filter((candidate) => candidate !== workspace)
-      : [...mail, workspace];
-
-    setMail(next);
-    run(
-      () => setMemberWorkspaces(id, next),
-      () => setMail(previous),
-    );
-  }
-
   async function toggleStatus() {
     const next: AdminStatus = currentStatus === "active" ? "suspended" : "active";
 
     if (next === "suspended") {
       const go = await confirm({
-        title: `Suspend ${login}?`,
+        title: `Suspend ${member.login}?`,
         body: "They are signed out immediately and cannot sign back in until this is undone. Their account and its history stay.",
         confirmLabel: "Suspend",
         destructive: true,
@@ -121,14 +100,14 @@ export function MemberControls({
     const previous = currentStatus;
     setCurrentStatus(next);
     run(
-      () => setMemberStatus(id, next),
+      () => setMemberStatus(member.id, next),
       () => setCurrentStatus(previous),
     );
   }
 
   async function remove() {
     const go = await confirm({
-      title: `Remove ${login}?`,
+      title: `Remove ${member.login}?`,
       body: "Their access, their sessions and the record that they were here all go. Suspending is the reversible one.",
       confirmLabel: "Remove",
       destructive: true,
@@ -136,47 +115,29 @@ export function MemberControls({
     if (!go) return;
 
     run(
-      () => removeMember(id),
+      () => removeMember(member.id),
       () => undefined,
     );
   }
 
   return (
     <span className="member-actions row-actions">
-      <select
-        className="input input-sm"
-        aria-label={`Role for ${login}`}
-        value={currentRole}
+      <button
+        type="button"
+        className="abtn abtn-sm"
+        onClick={() => setEditing(true)}
         disabled={pending}
-        onChange={(event) => changeRole(event.target.value as AdminRole)}
       >
-        {ADMIN_ROLES.map((option) => (
-          <option key={option} value={option}>
-            {ADMIN_ROLE_LABELS[option]}
-          </option>
-        ))}
-      </select>
-
-      <span className="member-scopes">
-        {MAIL_WORKSPACES.map((workspace) => (
-          <label key={workspace} className="tick">
-            <input
-              type="checkbox"
-              checked={mail.includes(workspace)}
-              disabled={pending}
-              onChange={() => toggleWorkspace(workspace)}
-            />
-            {MAIL_WORKSPACE_LABELS[workspace]}
-          </label>
-        ))}
-      </span>
+        <KeyRound aria-hidden />
+        Access
+      </button>
 
       <button
         type="button"
         className="abtn abtn-quiet abtn-sm"
         onClick={toggleStatus}
         disabled={pending}
-        title={currentStatus === "active" ? `Suspend ${login}` : `Restore ${login}`}
+        title={currentStatus === "active" ? `Suspend ${member.login}` : `Restore ${member.login}`}
       >
         {currentStatus === "active" ? <Ban aria-hidden /> : <UndoDot aria-hidden />}
         {currentStatus === "active" ? "Suspend" : "Restore"}
@@ -187,12 +148,21 @@ export function MemberControls({
         className="tape-remove"
         onClick={remove}
         disabled={pending}
-        aria-label={`Remove ${login}`}
+        aria-label={`Remove ${member.login}`}
       >
         <Trash2 width={13} height={13} aria-hidden />
       </button>
 
       <Note message={message} />
+
+      {editing && (
+        <AccessDialog
+          member={member}
+          roles={roles}
+          onClose={() => setEditing(false)}
+          onSaved={(text, ok) => setMessage({ text, ok })}
+        />
+      )}
     </span>
   );
 }
@@ -205,19 +175,31 @@ export function MemberControls({
  * freed name registered by a stranger, and a grant that followed the name would
  * follow it to them.
  *
+ * Deliberately the short version of the access dialog: a role and a scope, and
+ * nothing about exceptions. Somebody being invited does not yet have a shape
+ * that needs one, and the row's Access button is a click away if they turn out
+ * to.
+ *
  * No invitation is sent. There is nothing to accept: the row is the access, and
  * they sign in with GitHub whenever they are told to.
  */
-export function InviteForm() {
+export function InviteForm({ roles }: { roles: RoleOption[] }) {
   const [handle, setHandle] = useState("");
-  const [role, setRole] = useState<AdminRole>("viewer");
+  const [role, setRole] = useState<string>("viewer");
   const [workspaces, setWorkspaces] = useState<MailWorkspace[]>([...MAIL_WORKSPACES]);
   const [message, setMessage] = useState<Message>(null);
   const [pending, startTransition] = useTransition();
 
+  const custom = roles.find((option) => option.id === role) ?? null;
+
   function submit() {
     startTransition(async () => {
-      const result = await inviteMember({ handle, role, workspaces });
+      const result = await inviteMember({
+        handle,
+        role: custom ? "viewer" : (role as AdminRole),
+        customRoleId: custom?.id ?? null,
+        workspaces,
+      });
       setMessage({ text: result.message, ok: result.ok });
       if (result.ok) setHandle("");
     });
@@ -251,13 +233,24 @@ export function InviteForm() {
               id="invite-role"
               className="input"
               value={role}
-              onChange={(event) => setRole(event.target.value as AdminRole)}
+              onChange={(event) => setRole(event.target.value)}
             >
-              {ADMIN_ROLES.map((option) => (
-                <option key={option} value={option}>
-                  {ADMIN_ROLE_LABELS[option]}
-                </option>
-              ))}
+              <optgroup label="Built in">
+                {ADMIN_ROLES.map((option) => (
+                  <option key={option} value={option}>
+                    {ADMIN_ROLE_LABELS[option]}
+                  </option>
+                ))}
+              </optgroup>
+              {roles.length > 0 && (
+                <optgroup label="Custom">
+                  {roles.map((option) => (
+                    <option key={option.id} value={option.id}>
+                      {option.label}
+                    </option>
+                  ))}
+                </optgroup>
+              )}
             </select>
           </div>
 
diff --git a/apps/admin/src/views/members/members-page.tsx b/apps/admin/src/views/members/members-page.tsx
index f5aac2d7..434f26f8 100644
--- a/apps/admin/src/views/members/members-page.tsx
+++ b/apps/admin/src/views/members/members-page.tsx
@@ -1,10 +1,12 @@
 import { MAIL_WORKSPACE_LABELS, MAIL_WORKSPACES } from "@byteveda/db/constants";
 import { PageHeader } from "@/components";
-import { can, roleLabel } from "@/lib/auth/roles";
+import { can, hasOverrides, roleLabel } from "@/lib/auth/roles";
 import { requirePermission } from "@/lib/auth/session";
 import { ago } from "@/lib/format";
-import { listMembers, type Member } from "@/lib/members/queries";
+import { listCustomRoles, listMembers, type Member } from "@/lib/members/queries";
 import { InviteForm, MemberControls } from "./member-controls";
+import { RolesPanel } from "./roles-panel";
+import type { RoleOption } from "./types";
 
 /**
  * Who has access, and what to.
@@ -20,11 +22,22 @@ import { InviteForm, MemberControls } from "./member-controls";
  */
 export async function MembersPage() {
   const { access, user } = await requirePermission("members.read");
-  const members = await listMembers();
+  const [members, customRoles] = await Promise.all([listMembers(), listCustomRoles()]);
   const manage = can(access, "members.manage");
 
   const pending = members.filter((member) => member.user.lastLoginAt === null).length;
 
+  // The rows travel to the browser, so only the fields a dropdown and a matrix
+  // read — not the timestamps, and not who wrote the role.
+  const roles: RoleOption[] = customRoles.map((role) => ({
+    id: role.id,
+    key: role.key,
+    label: role.label,
+    description: role.description,
+    permissions: [...role.permissions],
+    members: role.members,
+  }));
+
   return (
     <>
       <PageHeader
@@ -55,13 +68,16 @@ export async function MembersPage() {
             <MemberRow
               key={member.user.id}
               member={member}
+              roles={roles}
               manage={manage}
               isSelf={member.user.id === user.id}
             />
           ))}
         </div>
 
-        {manage && <InviteForm />}
+        <RolesPanel roles={roles} manage={manage} />
+
+        {manage && <InviteForm roles={roles} />}
       </div>
     </>
   );
@@ -69,10 +85,12 @@ export async function MembersPage() {
 
 function MemberRow({
   member,
+  roles,
   manage,
   isSelf,
 }: {
   member: Member;
+  roles: RoleOption[];
   manage: boolean;
   isSelf: boolean;
 }) {
@@ -89,8 +107,20 @@ function MemberRow({
         </span>
       </span>
 
-      <span className={`state ${access.superAdmin ? "state-published" : "state-draft"}`}>
-        {roleLabel(access)}
+      <span className="member-role">
+        <span className={`state ${access.superAdmin ? "state-published" : "state-draft"}`}>
+          {roleLabel(access)}
+        </span>
+        {/* Somebody whose grant no longer matches their role is the one row a
+            reader has to look twice at. Saying so is cheaper than making them
+            open the dialog to find out. */}
+        {hasOverrides(access) && (
+          <span className="member-exceptions">
+            {access.extra.length > 0 && `+${access.extra.length}`}
+            {access.extra.length > 0 && access.denied.length > 0 && " "}
+            {access.denied.length > 0 && `−${access.denied.length}`}
+          </span>
+        )}
       </span>
 
       <span className="member-mail">
@@ -110,11 +140,17 @@ function MemberRow({
 
       {manage ? (
         <MemberControls
-          id={user.id}
-          login={user.login}
-          role={user.role}
-          status={user.status}
-          workspaces={[...user.mailWorkspaces]}
+          member={{
+            id: user.id,
+            login: user.login,
+            name: user.name,
+            role: user.role,
+            customRoleId: user.customRoleId,
+            status: user.status,
+            permissions: access.permissions,
+            workspaces: access.workspaces,
+          }}
+          roles={roles}
           // A super admin's row is a display of something set in the source.
           // Locked rather than hidden: the reason is worth seeing.
           locked={access.superAdmin || isSelf}
diff --git a/apps/admin/src/views/members/modal.tsx b/apps/admin/src/views/members/modal.tsx
new file mode 100644
index 00000000..f5e6fb56
--- /dev/null
+++ b/apps/admin/src/views/members/modal.tsx
@@ -0,0 +1,75 @@
+"use client";
+
+import { X } from "lucide-react";
+import { useEffect, useId, useRef } from "react";
+
+/**
+ * The shell the two access dialogs share.
+ *
+ * `ConfirmProvider` already wraps `<dialog>`, but it answers one question with
+ * a yes or a no. These are forms: they hold a draft, they are cancelled rather
+ * than declined, and closing one has to throw the draft away. Rather than
+ * bending the confirm dialog into a form host, this is the same platform
+ * element with the same manners — focus trapped, Escape closes, the page
+ * behind it inert, backdrop click dismisses — wrapped around arbitrary
+ * children.
+ *
+ * Mounted only while open, so each opening starts from a fresh draft instead
+ * of whatever the last one was left on.
+ */
+export function Modal({
+  title,
+  sub,
+  onClose,
+  children,
+  footer,
+}: {
+  title: string;
+  /** Who or what is being edited. Sits under the title, not in it. */
+  sub?: string;
+  onClose: () => void;
+  children: React.ReactNode;
+  footer: React.ReactNode;
+}) {
+  const dialog = useRef<HTMLDialogElement>(null);
+  const titleId = useId();
+
+  // `showModal()` rather than the `open` attribute: only the method makes the
+  // page behind inert and gives us the backdrop and the focus trap.
+  useEffect(() => {
+    const element = dialog.current;
+    if (!element?.open) element?.showModal();
+  }, []);
+
+  return (
+    // biome-ignore lint/a11y/useKeyWithClickEvents: the keyboard route out is Escape, handled by onCancel; the click handler only adds pointer dismissal on the backdrop
+    <dialog
+      ref={dialog}
+      className="dialog"
+      aria-labelledby={titleId}
+      onCancel={(event) => {
+        event.preventDefault();
+        onClose();
+      }}
+      onClick={(event) => {
+        if (event.target === dialog.current) onClose();
+      }}
+    >
+      <div className="dialog-card dialog-card-wide">
+        <header className="dialog-head">
+          <div>
+            <h2 id={titleId}>{title}</h2>
+            {sub && <p className="dialog-sub">{sub}</p>}
+          </div>
+          <button type="button" className="dialog-close" onClick={onClose} aria-label="Close">
+            <X width={15} height={15} aria-hidden />
+          </button>
+        </header>
+
+        <div className="dialog-body">{children}</div>
+
+        <div className="dialog-actions">{footer}</div>
+      </div>
+    </dialog>
+  );
+}
diff --git a/apps/admin/src/views/members/permission-picker.tsx b/apps/admin/src/views/members/permission-picker.tsx
new file mode 100644
index 00000000..4ad6d6df
--- /dev/null
+++ b/apps/admin/src/views/members/permission-picker.tsx
@@ -0,0 +1,129 @@
+"use client";
+
+import {
+  ADMIN_PERMISSION_LABELS,
+  ADMIN_RESOURCE_LABELS,
+  ADMIN_RESOURCES,
+  type AdminResource,
+  resourceOf,
+} from "@byteveda/db/constants";
+import { PERMISSIONS, type Permission, RESERVED_PERMISSIONS } from "@/lib/auth/roles";
+
+/**
+ * Which permissions are ticked, grouped by the thing they are about.
+ *
+ * Grouped rather than one flat list of fifteen checkboxes, because the question
+ * a super admin is actually answering is "what do they do with the inbox" —
+ * and the answer is three ticks that belong together. The resource is the
+ * heading; the verbs sit under it with a sentence each saying what ticking one
+ * hands over.
+ *
+ * Used twice with the same markup and a different meaning for `base`: editing
+ * a role, where there is nothing to inherit from and a tick is simply a grant;
+ * and editing one person, where `base` is what their role already gives and
+ * every difference is labelled as an exception. Drawing both from one component
+ * is what keeps "inherited" meaning the same thing on both screens — and the
+ * same thing the server means when it computes the diff.
+ */
+export function PermissionPicker({
+  value,
+  base,
+  onChange,
+  disabled = false,
+}: {
+  value: readonly Permission[];
+  /**
+   * What the chosen role grants, when there is one. Undefined while editing a
+   * role itself — a role inherits from nothing.
+   */
+  base?: readonly Permission[];
+  onChange: (next: Permission[]) => void;
+  disabled?: boolean;
+}) {
+  const ticked = new Set(value);
+
+  // Reserved grants are not offered at all. Showing a permanently disabled
+  // `members.manage` would invite the question of how to enable it, and the
+  // answer is a commit to lib/auth/roles.ts, not a checkbox.
+  const grantable = PERMISSIONS.filter((permission) => !RESERVED_PERMISSIONS.includes(permission));
+
+  function toggle(permission: Permission) {
+    onChange(
+      grantable.filter((candidate) =>
+        candidate === permission ? !ticked.has(candidate) : ticked.has(candidate),
+      ),
+    );
+  }
+
+  /** The header control: everything in this resource, or none of it. */
+  function setResource(resource: AdminResource, on: boolean) {
+    const inGroup = new Set(grantable.filter((permission) => resourceOf(permission) === resource));
+    onChange(
+      grantable.filter((permission) => (inGroup.has(permission) ? on : ticked.has(permission))),
+    );
+  }
+
+  return (
+    <div className="perm-grid">
+      {ADMIN_RESOURCES.map((resource) => {
+        const group = grantable.filter((permission) => resourceOf(permission) === resource);
+        if (group.length === 0) return null;
+
+        const on = group.filter((permission) => ticked.has(permission)).length;
+
+        return (
+          // biome-ignore lint/a11y/useSemanticElements: the semantic element is <fieldset>, whose <legend> is laid out by rules of its own that no browser applies consistently inside a flex or grid fieldset — and this heading has to sit in a row with the all/none button. `role="group"` plus a label carries the same semantics with none of that.
+          <div
+            key={resource}
+            className="perm-group"
+            data-active={on > 0}
+            role="group"
+            aria-label={ADMIN_RESOURCE_LABELS[resource]}
+          >
+            <p className="perm-legend">
+              <span>{ADMIN_RESOURCE_LABELS[resource]}</span>
+              <button
+                type="button"
+                className="perm-all"
+                disabled={disabled}
+                onClick={() => setResource(resource, on < group.length)}
+              >
+                {on < group.length ? "All" : "None"}
+              </button>
+            </p>
+
+            {group.map((permission) => {
+              const label = ADMIN_PERMISSION_LABELS[permission];
+              const checked = ticked.has(permission);
+              const inherited = base?.includes(permission);
+
+              return (
+                <label key={permission} className="perm" data-on={checked}>
+                  <input
+                    type="checkbox"
+                    checked={checked}
+                    disabled={disabled}
+                    onChange={() => toggle(permission)}
+                  />
+                  <span className="perm-text">
+                    <span className="perm-verb">
+                      {label.verb}
+                      {/* Only the differences are called out. A tick that
+                          matches the role needs no explanation; one that does
+                          not is the whole reason this screen exists. */}
+                      {base && checked && !inherited && <b className="perm-flag">added</b>}
+                      {base && !checked && inherited && (
+                        <b className="perm-flag perm-flag-off">removed</b>
+                      )}
+                    </span>
+                    <span className="perm-hint">{label.hint}</span>
+                  </span>
+                </label>
+              );
+            })}
+          </div>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/apps/admin/src/views/members/role-dialog.tsx b/apps/admin/src/views/members/role-dialog.tsx
new file mode 100644
index 00000000..bb6a4a89
--- /dev/null
+++ b/apps/admin/src/views/members/role-dialog.tsx
@@ -0,0 +1,159 @@
+"use client";
+
+import { useState, useTransition } from "react";
+import { type Permission, permissionsFor } from "@/lib/auth/roles";
+import { createRole, type RoleDraft, updateRole } from "@/lib/members/actions";
+import { Modal } from "./modal";
+import { PermissionPicker } from "./permission-picker";
+import type { RoleOption } from "./types";
+
+/**
+ * Writing a role, or editing one.
+ *
+ * The same form either way: the difference between creating and editing is
+ * which action it calls and one extra sentence about who is already on it.
+ * Splitting them into two components would mean two permission matrices to
+ * keep in step, for one line of copy.
+ *
+ * Starting from a built-in role rather than from nothing is offered because
+ * that is what these are for — "support, plus publishing" is the shape people
+ * actually ask for, and typing fifteen ticks to express it invites a mistake
+ * in the ones they did not mean to change.
+ */
+export function RoleDialog({
+  // Named `existing` rather than `role`, which is what it is: a JSX attribute
+  // called `role` is an ARIA role as far as a linter is concerned, whatever
+  // component it is on.
+  existing,
+  onClose,
+  onSaved,
+}: {
+  /** The role being edited, or null to write a new one. */
+  existing: RoleOption | null;
+  onClose: () => void;
+  onSaved: (message: string, ok: boolean) => void;
+}) {
+  const [label, setLabel] = useState(existing?.label ?? "");
+  const [description, setDescription] = useState(existing?.description ?? "");
+  const [permissions, setPermissions] = useState<Permission[]>(
+    existing ? [...existing.permissions] : [],
+  );
+  const [error, setError] = useState<string | null>(null);
+  const [pending, startTransition] = useTransition();
+
+  function save() {
+    setError(null);
+    const draft: RoleDraft = { label, description, permissions };
+
+    startTransition(async () => {
+      const result = existing ? await updateRole(existing.id, draft) : await createRole(draft);
+      if (!result.ok) {
+        setError(result.message);
+        return;
+      }
+      onSaved(result.message, true);
+      onClose();
+    });
+  }
+
+  return (
+    <Modal
+      title={existing ? "Edit role" : "New role"}
+      sub={
+        existing
+          ? `${existing.key} · ${existing.members} ${existing.members === 1 ? "member" : "members"}`
+          : "A role of your own, built from the same permissions the built-in ones use."
+      }
+      onClose={onClose}
+      footer={
+        <>
+          <span className="dialog-status">
+            {permissions.length} permission{permissions.length === 1 ? "" : "s"}
+            {existing && existing.members > 0 && ` · affects ${existing.members} now`}
+          </span>
+          <button type="button" className="abtn abtn-quiet" onClick={onClose} disabled={pending}>
+            Cancel
+          </button>
+          <button type="button" className="abtn abtn-primary" onClick={save} disabled={pending}>
+            {pending ? "Saving…" : existing ? "Save role" : "Create role"}
+          </button>
+        </>
+      }
+    >
+      <div className="dialog-split">
+        <div className="field">
+          <label htmlFor="role-label">Name</label>
+          <input
+            id="role-label"
+            className="input"
+            value={label}
+            placeholder="Release manager"
+            disabled={pending}
+            onChange={(event) => setLabel(event.target.value)}
+          />
+          <span className="hint">
+            {existing
+              ? `Renaming is safe — ${existing.key} stays the handle this role is known by.`
+              : "What the job is called. It appears in every role dropdown."}
+          </span>
+        </div>
+
+        <div className="field">
+          <label htmlFor="role-description">Description</label>
+          <input
+            id="role-description"
+            className="input"
+            value={description}
+            placeholder="Ships posts, answers nothing."
+            disabled={pending}
+            onChange={(event) => setDescription(event.target.value)}
+          />
+          <span className="hint">Optional. Shown when somebody picks this role.</span>
+        </div>
+      </div>
+
+      {!existing && (
+        <div className="dialog-section">
+          <h3>Start from</h3>
+          <div className="scope-row">
+            {(["admin", "editor", "support", "viewer"] as const).map((builtin) => (
+              <button
+                key={builtin}
+                type="button"
+                className="abtn abtn-quiet abtn-sm"
+                disabled={pending}
+                onClick={() => setPermissions([...permissionsFor(builtin)])}
+              >
+                {builtin}
+              </button>
+            ))}
+            <button
+              type="button"
+              className="abtn abtn-quiet abtn-sm"
+              disabled={pending}
+              onClick={() => setPermissions([])}
+            >
+              nothing
+            </button>
+          </div>
+        </div>
+      )}
+
+      <div className="dialog-section">
+        <h3>Permissions</h3>
+        <p className="side-note">
+          Everyone on this role gets exactly these, unless their own row says otherwise. Managing
+          members is not on the list — that stays with the super admins named in the source.
+        </p>
+      </div>
+
+      <PermissionPicker value={permissions} onChange={setPermissions} disabled={pending} />
+
+      {error && (
+        <p className="note" data-tone="error" role="status">
+          {error}
+        </p>
+      )}
+    </Modal>
+  );
+}
diff --git a/apps/admin/src/views/members/roles-panel.tsx b/apps/admin/src/views/members/roles-panel.tsx
new file mode 100644
index 00000000..f3b5b230
--- /dev/null
+++ b/apps/admin/src/views/members/roles-panel.tsx
@@ -0,0 +1,209 @@
+"use client";
+
+import {
+  ADMIN_PERMISSION_LABELS,
+  ADMIN_RESOURCE_LABELS,
+  ADMIN_ROLE_LABELS,
+  ADMIN_ROLES,
+  type AdminResource,
+  resourceOf,
+} from "@byteveda/db/constants";
+import { Lock, Pencil, Plus, Trash2 } from "lucide-react";
+import { useState, useTransition } from "react";
+import { useConfirm } from "@/components";
+import { type Permission, permissionsFor } from "@/lib/auth/roles";
+import { deleteRole } from "@/lib/members/actions";
+import { RoleDialog } from "./role-dialog";
+import type { RoleOption } from "./types";
+
+/**
+ * Every role the console has, whether the source ships it or a super admin
+ * wrote it.
+ *
+ * Shown together on purpose. The built-in four are the answer most of the time
+ * and the starting point for the rest, and a screen that listed only the
+ * custom ones would make them look like the whole system — a super admin would
+ * write "Editor" again rather than discover it already exists.
+ *
+ * The built-in rows are locked, and say why. Editing them is a commit to
+ * `lib/auth/roles.ts`, which is a reviewable, revertable, attributable act,
+ * and that is the property worth keeping for the roles most people are on.
+ */
+export function RolesPanel({ roles, manage }: { roles: RoleOption[]; manage: boolean }) {
+  const [editing, setEditing] = useState<RoleOption | null>(null);
+  const [creating, setCreating] = useState(false);
+  const [message, setMessage] = useState<{ text: string; ok: boolean } | null>(null);
+  const [pending, startTransition] = useTransition();
+  const confirm = useConfirm();
+
+  async function remove(role: RoleOption) {
+    const go = await confirm({
+      title: `Delete “${role.label}”?`,
+      body:
+        role.members > 0
+          ? `${role.members} ${role.members === 1 ? "person is" : "people are"} on this role. They keep their account and fall back to their built-in role, which may grant them less — or more.`
+          : "Nobody is on this role. Nothing else changes.",
+      confirmLabel: "Delete role",
+      destructive: true,
+    });
+    if (!go) return;
+
+    startTransition(async () => {
+      const result = await deleteRole(role.id);
+      setMessage({ text: result.message, ok: result.ok });
+    });
+  }
+
+  return (
+    <div className="panel stack-top">
+      <div className="panel-head">
+        <h2>Roles</h2>
+        <span className="meta">
+          {ADMIN_ROLES.length} built in
+          {roles.length > 0 && `, ${roles.length} custom`}
+        </span>
+        {manage && (
+          <button type="button" className="abtn abtn-sm" onClick={() => setCreating(true)}>
+            <Plus aria-hidden />
+            New role
+          </button>
+        )}
+      </div>
+
+      <div className="rows">
+        {ADMIN_ROLES.map((role) => (
+          <RoleRow
+            key={role}
+            label={ADMIN_ROLE_LABELS[role]}
+            handle={role}
+            description="Shipped in the source. Changing it takes a commit."
+            permissions={permissionsFor(role)}
+            locked
+          />
+        ))}
+
+        {roles.map((role) => (
+          <RoleRow
+            key={role.id}
+            label={role.label}
+            handle={role.key}
+            description={role.description ?? `Written here. ${role.members} on it.`}
+            permissions={role.permissions}
+            actions={
+              manage && (
+                <>
+                  <button
+                    type="button"
+                    className="abtn abtn-quiet abtn-sm"
+                    onClick={() => setEditing(role)}
+                    disabled={pending}
+                  >
+                    <Pencil aria-hidden />
+                    Edit
+                  </button>
+                  <button
+                    type="button"
+                    className="tape-remove"
+                    onClick={() => remove(role)}
+                    disabled={pending}
+                    aria-label={`Delete ${role.label}`}
+                  >
+                    <Trash2 width={13} height={13} aria-hidden />
+                  </button>
+                </>
+              )
+            }
+          />
+        ))}
+      </div>
+
+      {message && (
+        <div className="panel-body">
+          <p className="note" data-tone={message.ok ? "ok" : "error"} role="status">
+            {message.text}
+          </p>
+        </div>
+      )}
+
+      {creating && (
+        <RoleDialog
+          existing={null}
+          onClose={() => setCreating(false)}
+          onSaved={(text, ok) => setMessage({ text, ok })}
+        />
+      )}
+      {editing && (
+        <RoleDialog
+          existing={editing}
+          onClose={() => setEditing(null)}
+          onSaved={(text, ok) => setMessage({ text, ok })}
+        />
+      )}
+    </div>
+  );
+}
+
+function RoleRow({
+  label,
+  handle,
+  description,
+  permissions,
+  locked = false,
+  actions,
+}: {
+  label: string;
+  handle: string;
+  description: string;
+  permissions: readonly Permission[];
+  locked?: boolean;
+  actions?: React.ReactNode;
+}) {
+  return (
+    <div className="row row-role">
+      <span>
+        <b className="row-title">{label}</b>
+        <span className="row-sub">{handle}</span>
+      </span>
+
+      <span className="role-grants">
+        {permissions.length === 0 ? (
+          <span className="num-dim">nothing</span>
+        ) : (
+          summarise(permissions).map((line) => (
+            <span key={line} className="tag">
+              {line}
+            </span>
+          ))
+        )}
+      </span>
+
+      <span className="side-note role-why">{description}</span>
+
+      <span className="row-actions">
+        {locked ? <Lock width={13} height={13} aria-hidden className="role-lock" /> : actions}
+      </span>
+    </div>
+  );
+}
+
+/**
+ * "Posts read·write, Inbox read" — one chip per resource rather than fifteen.
+ *
+ * A row that listed every permission would be a wall of identical words, and
+ * the question it has to answer at a glance is which parts of the console this
+ * role touches at all.
+ */
+function summarise(permissions: readonly Permission[]): string[] {
+  const byResource = new Map<AdminResource, string[]>();
+
+  for (const permission of permissions) {
+    const resource = resourceOf(permission);
+    const verbs = byResource.get(resource) ?? [];
+    verbs.push(ADMIN_PERMISSION_LABELS[permission].verb.toLowerCase());
+    byResource.set(resource, verbs);
+  }
+
+  return [...byResource].map(
+    ([resource, verbs]) => `${ADMIN_RESOURCE_LABELS[resource]} ${verbs.join("·")}`,
+  );
+}
diff --git a/apps/admin/src/views/members/types.ts b/apps/admin/src/views/members/types.ts
new file mode 100644
index 00000000..f602878f
--- /dev/null
+++ b/apps/admin/src/views/members/types.ts
@@ -0,0 +1,19 @@
+import type { Permission } from "@/lib/auth/roles";
+
+/**
+ * A custom role as the browser sees it.
+ *
+ * The row minus its timestamps and its author — the parts a dropdown and a
+ * permission matrix actually read. Declared here rather than derived from the
+ * table type so that a client component never has a reason to import
+ * `@byteveda/db`, which would drag `pg` into the bundle.
+ */
+export type RoleOption = {
+  id: string;
+  key: string;
+  label: string;
+  description: string | null;
+  permissions: Permission[];
+  /** How many people are on it. What makes deleting one a decision. */
+  members: number;
+};

From 352b8c88cc3c1cb0facf3bb768e81c02fc6a22ab Mon Sep 17 00:00:00 2001
From: kartikeya <67143288+kartikeya-27@users.noreply.github.com>
Date: Tue, 22 Sep 2026 11:12:05 +0530
Subject: [PATCH 5/5] chore(db): format the generated migration meta

drizzle-kit writes these unformatted; every snapshot already in the
tree has been through Biome.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../db/migrations/meta/0009_snapshot.json     | 144 +++++-------------
 packages/db/migrations/meta/_journal.json     |   2 +-
 2 files changed, 36 insertions(+), 110 deletions(-)

diff --git a/packages/db/migrations/meta/0009_snapshot.json b/packages/db/migrations/meta/0009_snapshot.json
index 1cb30580..cba6c577 100644
--- a/packages/db/migrations/meta/0009_snapshot.json
+++ b/packages/db/migrations/meta/0009_snapshot.json
@@ -97,9 +97,7 @@
         "sample_requests_email_key": {
           "name": "sample_requests_email_key",
           "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
+          "columns": ["email"]
         }
       },
       "policies": {},
@@ -171,9 +169,7 @@
         "admin_custom_roles_key_unique": {
           "name": "admin_custom_roles_key_unique",
           "nullsNotDistinct": false,
-          "columns": [
-            "key"
-          ]
+          "columns": ["key"]
         }
       },
       "policies": {},
@@ -293,12 +289,8 @@
           "name": "admin_users_custom_role_id_admin_custom_roles_id_fk",
           "tableFrom": "admin_users",
           "tableTo": "admin_custom_roles",
-          "columnsFrom": [
-            "custom_role_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["custom_role_id"],
+          "columnsTo": ["id"],
           "onDelete": "set null",
           "onUpdate": "no action"
         }
@@ -308,9 +300,7 @@
         "admin_users_github_id_unique": {
           "name": "admin_users_github_id_unique",
           "nullsNotDistinct": false,
-          "columns": [
-            "github_id"
-          ]
+          "columns": ["github_id"]
         }
       },
       "policies": {},
@@ -410,12 +400,8 @@
           "name": "sessions_user_id_admin_users_id_fk",
           "tableFrom": "sessions",
           "tableTo": "admin_users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -425,9 +411,7 @@
         "sessions_token_hash_unique": {
           "name": "sessions_token_hash_unique",
           "nullsNotDistinct": false,
-          "columns": [
-            "token_hash"
-          ]
+          "columns": ["token_hash"]
         }
       },
       "policies": {},
@@ -537,12 +521,8 @@
           "name": "broadcasts_post_id_posts_id_fk",
           "tableFrom": "broadcasts",
           "tableTo": "posts",
-          "columnsFrom": [
-            "post_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["post_id"],
+          "columnsTo": ["id"],
           "onDelete": "set null",
           "onUpdate": "no action"
         }
@@ -664,12 +644,8 @@
           "name": "email_attachments_message_id_outbound_messages_id_fk",
           "tableFrom": "email_attachments",
           "tableTo": "outbound_messages",
-          "columnsFrom": [
-            "message_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["message_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         },
@@ -677,12 +653,8 @@
           "name": "email_attachments_uploaded_by_admin_users_id_fk",
           "tableFrom": "email_attachments",
           "tableTo": "admin_users",
-          "columnsFrom": [
-            "uploaded_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
           "onDelete": "set null",
           "onUpdate": "no action"
         }
@@ -969,12 +941,8 @@
           "name": "inbound_messages_thread_key_email_threads_thread_key_fk",
           "tableFrom": "inbound_messages",
           "tableTo": "email_threads",
-          "columnsFrom": [
-            "thread_key"
-          ],
-          "columnsTo": [
-            "thread_key"
-          ],
+          "columnsFrom": ["thread_key"],
+          "columnsTo": ["thread_key"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -1125,12 +1093,8 @@
           "name": "outbound_messages_thread_key_email_threads_thread_key_fk",
           "tableFrom": "outbound_messages",
           "tableTo": "email_threads",
-          "columnsFrom": [
-            "thread_key"
-          ],
-          "columnsTo": [
-            "thread_key"
-          ],
+          "columnsFrom": ["thread_key"],
+          "columnsTo": ["thread_key"],
           "onDelete": "set null",
           "onUpdate": "no action"
         },
@@ -1138,12 +1102,8 @@
           "name": "outbound_messages_broadcast_id_broadcasts_id_fk",
           "tableFrom": "outbound_messages",
           "tableTo": "broadcasts",
-          "columnsFrom": [
-            "broadcast_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["broadcast_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -1375,12 +1335,8 @@
           "name": "post_revisions_post_id_posts_id_fk",
           "tableFrom": "post_revisions",
           "tableTo": "posts",
-          "columnsFrom": [
-            "post_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["post_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         },
@@ -1388,12 +1344,8 @@
           "name": "post_revisions_author_id_admin_users_id_fk",
           "tableFrom": "post_revisions",
           "tableTo": "admin_users",
-          "columnsFrom": [
-            "author_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["author_id"],
+          "columnsTo": ["id"],
           "onDelete": "set null",
           "onUpdate": "no action"
         }
@@ -1686,12 +1638,8 @@
           "name": "collection_runs_package_id_project_packages_id_fk",
           "tableFrom": "collection_runs",
           "tableTo": "project_packages",
-          "columnsFrom": [
-            "package_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["package_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -1782,12 +1730,8 @@
           "name": "download_snapshots_package_id_project_packages_id_fk",
           "tableFrom": "download_snapshots",
           "tableTo": "project_packages",
-          "columnsFrom": [
-            "package_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["package_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -1839,12 +1783,8 @@
           "name": "package_totals_package_id_project_packages_id_fk",
           "tableFrom": "package_totals",
           "tableTo": "project_packages",
-          "columnsFrom": [
-            "package_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
+          "columnsFrom": ["package_id"],
+          "columnsTo": ["id"],
           "onDelete": "cascade",
           "onUpdate": "no action"
         }
@@ -1947,10 +1887,7 @@
     "academy.sample_kind": {
       "name": "sample_kind",
       "schema": "academy",
-      "values": [
-        "chapter",
-        "custom"
-      ]
+      "values": ["chapter", "custom"]
     },
     "public.admin_permission": {
       "name": "admin_permission",
@@ -1976,28 +1913,17 @@
     "public.admin_role": {
       "name": "admin_role",
       "schema": "public",
-      "values": [
-        "admin",
-        "editor",
-        "support",
-        "viewer"
-      ]
+      "values": ["admin", "editor", "support", "viewer"]
     },
     "public.admin_status": {
       "name": "admin_status",
       "schema": "public",
-      "values": [
-        "active",
-        "suspended"
-      ]
+      "values": ["active", "suspended"]
     },
     "public.mail_workspace": {
       "name": "mail_workspace",
       "schema": "public",
-      "values": [
-        "byteveda",
-        "academy"
-      ]
+      "values": ["byteveda", "academy"]
     }
   },
   "schemas": {
@@ -2012,4 +1938,4 @@
     "schemas": {},
     "tables": {}
   }
-}
\ No newline at end of file
+}
diff --git a/packages/db/migrations/meta/_journal.json b/packages/db/migrations/meta/_journal.json
index 7397ae43..bbdf3f44 100644
--- a/packages/db/migrations/meta/_journal.json
+++ b/packages/db/migrations/meta/_journal.json
@@ -73,4 +73,4 @@
       "breakpoints": true
     }
   ]
-}
\ No newline at end of file
+}