@actuate-media/cms-admin 0.66.0 → 0.68.0

package/dist/views/settings/useSecuritySettings.js

@@ -6,18 +6,44 @@ const EMPTY_FORM = {
     mfaRequired: false,
     mfaGracePeriodDays: 7,
     maxConcurrentSessions: 5,
+    timeoutHours: 168,
+    idleLogoutEnabled: false,
+    ipAllowlistText: '',
+    auditLoggingEnabled: true,
 };
+/** Split the textarea into trimmed, de-duplicated entries (one per line). */
+export function parseAllowlistText(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const entry = line.trim();
+        if (entry && !out.includes(entry))
+            out.push(entry);
+    }
+    return out;
+}
 function formFromSettings(s) {
     return {
         mfaRequired: s.mfa.required,
         mfaGracePeriodDays: s.mfa.gracePeriodDays,
         maxConcurrentSessions: s.session.maxConcurrentSessions,
+        timeoutHours: s.session.timeoutHours ?? 168,
+        idleLogoutEnabled: s.session.idleLogoutEnabled ?? false,
+        ipAllowlistText: (s.access?.ipAllowlist ?? []).join('\n'),
+        auditLoggingEnabled: s.access?.auditLoggingEnabled ?? true,
     };
 }
 function formToSettings(f) {
     return {
         mfa: { required: f.mfaRequired, gracePeriodDays: f.mfaGracePeriodDays },
-        session: { maxConcurrentSessions: f.maxConcurrentSessions },
+        session: {
+            maxConcurrentSessions: f.maxConcurrentSessions,
+            timeoutHours: f.timeoutHours,
+            idleLogoutEnabled: f.idleLogoutEnabled,
+        },
+        access: {
+            ipAllowlist: parseAllowlistText(f.ipAllowlistText),
+            auditLoggingEnabled: f.auditLoggingEnabled,
+        },
     };
 }
 /**
@@ -35,6 +61,7 @@ export function useSecuritySettings(canEdit) {
     const [form, setForm] = useState(EMPTY_FORM);
     const [saveState, setSaveState] = useState('idle');
     const [saveError, setSaveError] = useState(null);
+    const [lockoutPrompt, setLockoutPrompt] = useState(null);
     const [revokeState, setRevokeState] = useState('idle');
     const [reloadKey, setReloadKey] = useState(0);
     useEffect(() => {
@@ -85,18 +112,30 @@ export function useSecuritySettings(canEdit) {
         return list;
     }, [form, baseline.mfaRequired, data]);
     const hasErrors = issues.some((i) => i.severity === 'error');
-    const save = useCallback(async () => {
+    const save = useCallback(async (options) => {
         if (!canEdit || hasErrors || !dirty)
             return;
         setSaveState('saving');
         setSaveError(null);
+        setLockoutPrompt(null);
         try {
             const res = await cmsApi('/security', {
                 method: 'PUT',
-                body: JSON.stringify(formToSettings(form)),
+                body: JSON.stringify({
+                    ...formToSettings(form),
+                    ...(options?.confirmLockout ? { confirmLockout: true } : {}),
+                }),
             });
-            if (res.error || !res.data)
+            // The server's lockout guard: surface a confirm dialog instead of a
+            // generic failure so the operator can retry with confirmLockout.
+            if (res.code === 'IP_LOCKOUT_RISK') {
+                setSaveState('idle');
+                setLockoutPrompt(res.error ?? 'This allowlist may lock you out. Save anyway?');
+                return;
+            }
+            if (res.error || !res.data) {
                 throw new Error(res.error ?? 'Failed to save security settings.');
+            }
             setData(res.data);
             const f = formFromSettings(res.data.settings);
             setBaseline(f);
@@ -108,10 +147,12 @@ export function useSecuritySettings(canEdit) {
             setSaveError(err instanceof Error ? err.message : 'Failed to save security settings.');
         }
     }, [canEdit, hasErrors, dirty, form]);
+    const dismissLockoutPrompt = useCallback(() => setLockoutPrompt(null), []);
     const reset = useCallback(() => {
         setForm(baseline);
         setSaveState('idle');
         setSaveError(null);
+        setLockoutPrompt(null);
     }, [baseline]);
     const refetch = useCallback(() => setReloadKey((k) => k + 1), []);
     const revokeAllOtherSessions = useCallback(async () => {
@@ -147,6 +188,8 @@ export function useSecuritySettings(canEdit) {
         save,
         reset,
         refetch,
+        lockoutPrompt,
+        dismissLockoutPrompt,
         revokeState,
         revokeAllOtherSessions,
     };

package/dist/views/settings/useSecuritySettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAYzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;CACzB,CAAA;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;KACvD,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE;KAC5D,CAAA;AACH,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAErC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAiBzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,GAAG;IACjB,iBAAiB,EAAE,KAAK;IACxB,eAAe,EAAE,EAAE;IACnB,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;QACtD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG;QAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK;QACvD,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,mBAAmB,IAAI,IAAI;KAC3D,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE;YACP,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;SACvC;QACD,MAAM,EAAE;YACN,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;YAClD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C;KACF,CAAA;AACH,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,OAAsC,EAAE,EAAE;QAC/C,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,cAAc,CAAC,IAAI,CAAC;oBACvB,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D,CAAC;aACH,CAAC,CAAA;YACF,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACnC,YAAY,CAAC,MAAM,CAAC,CAAA;gBACpB,gBAAgB,CAAC,GAAG,CAAC,KAAK,IAAI,+CAA+C,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,aAAa;QACb,oBAAoB;QACpB,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.66.0",
+  "version": "0.68.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -95,7 +95,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.86.0",
+    "@actuate-media/cms-core": "0.88.0",
     "@actuate-media/component-blocks": "0.2.1"
   },
   "scripts": {

package/src/AdminRoot.tsx

@@ -26,7 +26,6 @@ import { FormSubmissions } from './views/FormSubmissions.js'
 import { FormEntries } from './views/FormEntries.js'
 import { SEO } from './views/SEO.js'
 import { ScriptTags } from './views/ScriptTags.js'
-import { ScriptTagEditor } from './views/ScriptTagEditor.js'
 import { SetupWizard } from './views/SetupWizard.js'
 import { Login } from './views/Login.js'
 import { HiddenLoginNotFound } from './views/HiddenLoginNotFound.js'
@@ -39,6 +38,7 @@ import { ThemeProvider } from './components/ThemeProvider.js'
 import { LocaleProvider } from './components/LocaleProvider.js'
 import { useKeyboardShortcuts } from './hooks/useKeyboardShortcuts.js'
 import { useAppearanceBootstrap } from './hooks/useAppearanceBootstrap.js'
+import { useIdleLogout } from './hooks/useIdleLogout.js'
 import { PageBuilder } from './views/page-builder/PageBuilder.js'
 import { PageSectionEditor } from './views/page-editor/PageSectionEditor.js'
 import { PagePreview } from './views/page-editor/PagePreview.js'
@@ -53,6 +53,7 @@ import { PagesListView } from './views/Pages/PagesListView.js'
 import { PageTagManager } from './views/Pages/PageTagManager.js'
 import { PostsListView } from './views/Posts/PostsListView.js'
 import { PostTypesView } from './views/Posts/PostTypesView.js'
+import { PostTypeEditor } from './views/Posts/PostTypeEditor.js'
 import { NewPostPicker } from './views/Posts/NewPostPicker.js'
 import { NewPostTypeInstructions } from './views/Posts/NewPostTypeInstructions.js'
 import { PostSectionEditor } from './views/post-editor/PostSectionEditor.js'
@@ -180,6 +181,39 @@ function AdminShell({
     [buildHref],
   )
 
+  // Idle auto-logout (Settings → Security). The policy is read from the
+  // non-admin-gated /auth/session-policy endpoint so every member's client
+  // enforces it, not just admins. When enabled, `timeoutHours` of inactivity
+  // signs the user out through the normal logout flow (server revocation +
+  // cookie clear + local state reset).
+  const [sessionPolicy, setSessionPolicy] = useState<{
+    timeoutHours: number
+    idleLogoutEnabled: boolean
+  } | null>(null)
+  useEffect(() => {
+    if (!session) {
+      setSessionPolicy(null)
+      return
+    }
+    let cancelled = false
+    void cmsApi<{ timeoutHours: number; idleLogoutEnabled: boolean }>('/auth/session-policy').then(
+      (res) => {
+        if (!cancelled && res.data && typeof res.data.timeoutHours === 'number') {
+          setSessionPolicy(res.data)
+        }
+      },
+    )
+    return () => {
+      cancelled = true
+    }
+  }, [session])
+
+  useIdleLogout({
+    enabled: Boolean(session && sessionPolicy?.idleLogoutEnabled),
+    timeoutMs: (sessionPolicy?.timeoutHours ?? 0) * 3_600_000,
+    onIdle: handleLogout,
+  })
+
   useBranding(config)
   useAppearanceBootstrap(session)
   useAdminPageTitle(config, currentPath)
@@ -359,13 +393,7 @@ function AdminShell({
     }
     const postTypeEdit = matchRoute('/posts/types/:slug/edit')
     if (postTypeEdit?.slug) {
-      // V1 falls through to the per-collection list view; future
-      // PR introduces a dedicated PostTypeEditor with field-level
-      // metadata. The list view is the natural per-type management
-      // surface today (it already shows posts in that type).
-      return (
-        <CollectionList collectionSlug={postTypeEdit.slug} config={config} onNavigate={navigate} />
-      )
+      return <PostTypeEditor slug={postTypeEdit.slug} onNavigate={navigate} />
     }
     if (matchRoute('/posts/types')) {
       return <PostTypesView onNavigate={navigate} />
@@ -432,8 +460,13 @@ function AdminShell({
       return <PageTagManager onNavigate={navigate} />
     }
     if (matchRoute('/pages/new')) {
+      // "Add sub-page" in the Pages tree view arrives with the parent id
+      // in the query string (`/pages/new?parent=<id>`); matchRoute ignores
+      // the query so it's parsed here and preselected in the editor.
+      const newPageQuery = new URLSearchParams(currentPath.split('?')[1] ?? '')
       return (
         <PageSectionEditor
+          initialParentId={newPageQuery.get('parent')}
           config={config}
           session={session}
           onNavigate={navigate}
@@ -509,11 +542,11 @@ function AdminShell({
     }
 
     if (matchRoute('/script-tags/new')) {
-      return <ScriptTagEditor onNavigate={navigate} />
+      return <ScriptTags onNavigate={navigate} initialNew />
     }
     const scriptTagEdit = matchRoute('/script-tags/:id')
     if (scriptTagEdit?.id) {
-      return <ScriptTagEditor tagId={scriptTagEdit.id} onNavigate={navigate} />
+      return <ScriptTags onNavigate={navigate} initialSelectedId={scriptTagEdit.id} />
     }
     if (matchRoute('/script-tags')) {
       return <ScriptTags onNavigate={navigate} />

package/src/__tests__/components/inspector-pane.test.tsx

@@ -0,0 +1,64 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import {
+  InspectorPane,
+  InspectorPaneBody,
+  InspectorPaneFooter,
+  InspectorPaneHeader,
+  InspectorPaneSection,
+  SplitPaneLayout,
+  SplitPaneList,
+} from '../../components/ui/InspectorPane.js'
+
+function Pane({ open }: { open: boolean }) {
+  return (
+    <SplitPaneLayout>
+      <SplitPaneList>
+        <table aria-label="Rows" />
+      </SplitPaneList>
+      <InspectorPane open={open} width={420} aria-label="Row editor">
+        <InspectorPaneHeader onClose={() => {}}>
+          <span>Editing</span>
+        </InspectorPaneHeader>
+        <InspectorPaneBody>
+          <InspectorPaneSection title="Details">content</InspectorPaneSection>
+        </InspectorPaneBody>
+        <InspectorPaneFooter>
+          <button type="button">Save</button>
+        </InspectorPaneFooter>
+      </InspectorPane>
+    </SplitPaneLayout>
+  )
+}
+
+describe('InspectorPane', () => {
+  it('renders pane content with a labelled region when open', () => {
+    render(<Pane open />)
+    expect(screen.getByRole('region', { name: 'Row editor' })).toBeTruthy()
+    expect(screen.getByText('Editing')).toBeTruthy()
+    expect(screen.getByText('Details')).toBeTruthy()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeTruthy()
+  })
+
+  it('collapses to zero width and hides content when closed', () => {
+    const { container } = render(<Pane open={false} />)
+    const shell = container.querySelector('[aria-hidden="true"]') as HTMLElement
+    expect(shell).toBeTruthy()
+    expect(shell.style.width).toBe('0px')
+    expect(screen.queryByText('Editing')).toBeNull()
+  })
+
+  it('close button in the header fires onClose with an accessible label', () => {
+    const onClose = vi.fn()
+    render(
+      <InspectorPane open width={400} aria-label="Detail">
+        <InspectorPaneHeader onClose={onClose} closeLabel="Close detail">
+          <span>Title</span>
+        </InspectorPaneHeader>
+      </InspectorPane>,
+    )
+    screen.getByRole('button', { name: 'Close detail' }).click()
+    expect(onClose).toHaveBeenCalledTimes(1)
+  })
+})

package/src/__tests__/hooks/useIdleLogout.test.tsx

@@ -0,0 +1,86 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { render } from '@testing-library/react'
+
+import { useIdleLogout } from '../../hooks/useIdleLogout.js'
+
+function Harness({
+  enabled,
+  timeoutMs,
+  onIdle,
+}: {
+  enabled: boolean
+  timeoutMs: number
+  onIdle: () => void
+}) {
+  useIdleLogout({ enabled, timeoutMs, onIdle })
+  return null
+}
+
+const TIMEOUT_MS = 60_000
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useIdleLogout', () => {
+  it('fires onIdle exactly once after the timeout with no activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    vi.advanceTimersByTime(TIMEOUT_MS - 1_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+
+    // The idle callback must not re-fire on subsequent ticks.
+    vi.advanceTimersByTime(TIMEOUT_MS * 3)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('resets the idle deadline on user activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Just before the deadline the user types — the clock restarts.
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    window.dispatchEvent(new Event('keydown'))
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    // A full quiet timeout after the last activity signs the user out.
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('does nothing when disabled', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled={false} timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('tears everything down on unmount', () => {
+    const onIdle = vi.fn()
+    const { unmount } = render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    unmount()
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('checks the deadline immediately when a hidden tab becomes visible', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Simulate the deadline passing while the tab was hidden (the interval is
+    // shared with visibility, so freeze it by only moving the mocked clock).
+    vi.setSystemTime(Date.now() + TIMEOUT_MS + 1_000)
+    document.dispatchEvent(new Event('visibilitychange'))
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+})

package/src/__tests__/lib/pages-tree.test.ts

@@ -0,0 +1,197 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildPageTree,
+  defaultExpandedIds,
+  flattenPageTree,
+  type PageTreeNode,
+} from '../../lib/pages-tree.js'
+import type { Page } from '../../lib/pages-service.js'
+
+/**
+ * Unit coverage for the Pages tree hierarchy resolution. Pure functions —
+ * locked independent of the REST layer and the view. The contract:
+ * explicit `parentPageId` wins, path-prefix derivation fills the gaps,
+ * and no input (orphans, cycles, duplicates) can lose or duplicate a page.
+ */
+
+function page(partial: Partial<Page> & Pick<Page, 'id' | 'title' | 'path'>): Page {
+  return {
+    id: partial.id,
+    title: partial.title,
+    path: partial.path,
+    slug: partial.slug ?? partial.path.split('/').filter(Boolean).pop() ?? '',
+    parentPageId: partial.parentPageId ?? null,
+    tags: [],
+    primaryTagId: null,
+    authorId: 'u1',
+    authorName: 'Maria K.',
+    authorInitials: 'MK',
+    status: partial.status ?? 'PUBLISHED',
+    publishDate: null,
+    scheduledDate: null,
+    lastModified: '2026-05-01',
+    seoScore: null,
+    seoTitle: null,
+    seoDescription: null,
+    templateId: partial.templateId ?? null,
+    isHomepage: partial.path === '/',
+    isSystemPage: false,
+    createdAt: '2026-01-01',
+    updatedAt: '2026-05-01',
+  }
+}
+
+function titles(nodes: PageTreeNode[]): string[] {
+  return nodes.map((n) => n.page.title)
+}
+
+function countNodes(nodes: PageTreeNode[]): number {
+  return nodes.reduce((n, node) => n + 1 + countNodes(node.children), 0)
+}
+
+describe('buildPageTree', () => {
+  it('nests children under explicit parentPageId parents', () => {
+    const roots = buildPageTree([
+      page({ id: 'about', title: 'About Us', path: '/about' }),
+      page({ id: 'team', title: 'Our Team', path: '/team-page', parentPageId: 'about' }),
+    ])
+    expect(titles(roots)).toEqual(['About Us'])
+    expect(titles(roots[0]!.children)).toEqual(['Our Team'])
+  })
+
+  it('derives parents from path prefixes when parentPageId is null', () => {
+    const roots = buildPageTree([
+      page({ id: 'home', title: 'Home', path: '/' }),
+      page({ id: 'about', title: 'About Us', path: '/about' }),
+      page({ id: 'team', title: 'Our Team', path: '/about/team' }),
+      page({ id: 'story', title: 'Our Story', path: '/about/story' }),
+      page({ id: 'contact', title: 'Contact', path: '/contact' }),
+    ])
+    expect(titles(roots)).toEqual(['About Us', 'Contact', 'Home'])
+    const about = roots[0]!
+    expect(titles(about.children)).toEqual(['Our Story', 'Our Team'])
+  })
+
+  it('skips missing intermediate path levels to the longest existing prefix', () => {
+    const roots = buildPageTree([
+      page({ id: 'svc', title: 'Services', path: '/services' }),
+      // No "/services/web" page exists — attaches to "/services".
+      page({ id: 'design', title: 'Web Design', path: '/services/web/design' }),
+    ])
+    expect(titles(roots)).toEqual(['Services'])
+    expect(titles(roots[0]!.children)).toEqual(['Web Design'])
+  })
+
+  it('never derives the homepage ("/") as a path parent', () => {
+    const roots = buildPageTree([
+      page({ id: 'home', title: 'Home', path: '/' }),
+      page({ id: 'blog', title: 'Blog', path: '/blog' }),
+    ])
+    expect(titles(roots)).toEqual(['Blog', 'Home'])
+  })
+
+  it('prefers explicit parentPageId over the path prefix', () => {
+    const roots = buildPageTree([
+      page({ id: 'about', title: 'About', path: '/about' }),
+      page({ id: 'lp', title: 'Landing', path: '/lp' }),
+      // Path says "/about/…" but the explicit link says "lp" — link wins.
+      page({ id: 'x', title: 'Campaign', path: '/about/campaign', parentPageId: 'lp' }),
+    ])
+    const lp = roots.find((n) => n.page.id === 'lp')!
+    expect(titles(lp.children)).toEqual(['Campaign'])
+    expect(roots.find((n) => n.page.id === 'about')!.children).toHaveLength(0)
+  })
+
+  it('treats orphans (parent not in the set) as roots', () => {
+    const roots = buildPageTree([
+      page({ id: 'a', title: 'A', path: '/a', parentPageId: 'missing' }),
+      page({ id: 'b', title: 'B', path: '/b' }),
+    ])
+    expect(titles(roots)).toEqual(['A', 'B'])
+  })
+
+  it('breaks parentPageId cycles to the root without losing pages', () => {
+    const roots = buildPageTree([
+      page({ id: 'a', title: 'A', path: '/x-a', parentPageId: 'b' }),
+      page({ id: 'b', title: 'B', path: '/x-b', parentPageId: 'a' }),
+      page({ id: 'c', title: 'C', path: '/x-c' }),
+    ])
+    expect(countNodes(roots)).toBe(3)
+    // One of the cycle members must have been rooted.
+    const rootIds = roots.map((n) => n.page.id)
+    expect(rootIds).toContain('c')
+    expect(rootIds.some((id) => id === 'a' || id === 'b')).toBe(true)
+  })
+
+  it('ignores a self-referencing parentPageId', () => {
+    const roots = buildPageTree([page({ id: 'a', title: 'A', path: '/a', parentPageId: 'a' })])
+    expect(titles(roots)).toEqual(['A'])
+  })
+
+  it('orders siblings by title then path, at every depth', () => {
+    const roots = buildPageTree([
+      page({ id: 'svc', title: 'Services', path: '/services' }),
+      page({ id: 's2', title: 'Web Design', path: '/services/web-design' }),
+      page({ id: 's1', title: 'CMS Solutions', path: '/services/cms' }),
+      page({ id: 's3', title: 'SEO Services', path: '/services/seo' }),
+      page({ id: 'blog', title: 'Blog', path: '/blog' }),
+    ])
+    expect(titles(roots)).toEqual(['Blog', 'Services'])
+    expect(titles(roots.find((n) => n.page.id === 'svc')!.children)).toEqual([
+      'CMS Solutions',
+      'SEO Services',
+      'Web Design',
+    ])
+  })
+
+  it('keeps every page exactly once on messy input', () => {
+    const pages = [
+      page({ id: 'home', title: 'Home', path: '/' }),
+      page({ id: 'dup1', title: 'Dup A', path: '/dup' }),
+      page({ id: 'dup2', title: 'Dup B', path: '/dup' }),
+      page({ id: 'kid', title: 'Kid', path: '/dup/kid' }),
+      page({ id: 'cyc1', title: 'Cyc 1', path: '/c1', parentPageId: 'cyc2' }),
+      page({ id: 'cyc2', title: 'Cyc 2', path: '/c2', parentPageId: 'cyc1' }),
+      page({ id: 'orph', title: 'Orphan', path: '/orphan', parentPageId: 'gone' }),
+    ]
+    const roots = buildPageTree(pages)
+    expect(countNodes(roots)).toBe(pages.length)
+    // "/dup/kid" attaches to the first page seen with path "/dup".
+    expect(roots.some((n) => n.page.id === 'dup1' && n.children.length === 1)).toBe(true)
+  })
+})
+
+describe('flattenPageTree', () => {
+  const roots = buildPageTree([
+    page({ id: 'about', title: 'About Us', path: '/about' }),
+    page({ id: 'team', title: 'Our Team', path: '/about/team' }),
+    page({ id: 'blog', title: 'Blog', path: '/blog' }),
+  ])
+
+  it('renders children only when the parent is expanded', () => {
+    const collapsed = flattenPageTree(roots, new Set())
+    expect(collapsed.map((r) => r.page.id)).toEqual(['about', 'blog'])
+
+    const open = flattenPageTree(roots, new Set(['about']))
+    expect(open.map((r) => r.page.id)).toEqual(['about', 'team', 'blog'])
+  })
+
+  it('reports depth and hasChildren per row', () => {
+    const rows = flattenPageTree(roots, new Set(['about']))
+    expect(rows[0]).toMatchObject({ depth: 0, hasChildren: true })
+    expect(rows[1]).toMatchObject({ depth: 1, hasChildren: false })
+    expect(rows[2]).toMatchObject({ depth: 0, hasChildren: false })
+  })
+})
+
+describe('defaultExpandedIds', () => {
+  it('expands only root nodes that have children', () => {
+    const roots = buildPageTree([
+      page({ id: 'about', title: 'About Us', path: '/about' }),
+      page({ id: 'team', title: 'Our Team', path: '/about/team' }),
+      page({ id: 'deep', title: 'Deep', path: '/about/team/deep' }),
+      page({ id: 'blog', title: 'Blog', path: '/blog' }),
+    ])
+    expect([...defaultExpandedIds(roots)]).toEqual(['about'])
+  })
+})