smoodly 0.0.21 → 0.0.23

package/README.md

@@ -239,7 +239,7 @@ Implemented:
 
 - The space layer (spec 2026-09-04 §3): `space_id` on every content
   table, `smoodly_current_space()`, the insert trigger, the row cap, the
-  three cloud-state tables (`editors`, `space_keys`, `space_caps`) and
+  three cloud-state tables (`members`, `space_keys`, `spaces`) and
   the policy set. Service role bypasses it; a write key is scoped to its
   space. Contract suites run in both modes; `test/isolation.supabase.test.ts`
   proves isolation. Generated per-collection views are `security_invoker`,
@@ -495,6 +495,14 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-25, docs session)
+
+- `f.slug({ from })` stores `from` on the descriptor, but nothing reads it:
+  the admin never derives a slug from the named field. Either wire it (fill
+  the slug from `from` while the slug is untouched, in the entry form) or
+  drop the option. The Fields guide documents the slug as a plain text box
+  with the URL prefix and does not mention `from`.
+
 ## Follow-ups (logged 2026-09-17, admin path spec)
 
 - A robots `Disallow` for the admin path from `next/meta`.
@@ -624,6 +632,26 @@ tool — reset and reseed a development database (`supabase db reset`,
   the control never offers it there, so nothing shows — the store could
   answer it as a no-op instead.
 
+## Follow-ups (logged 2026-09-25, settings + members spec)
+
+- Existing databases (every install so far is ours; DESIGN.md OQ #2):
+  `alter table "editors" rename to "members";`
+  `alter table "members" add column "email" text;`
+  `alter table "space_caps" rename to "spaces";`
+  `alter table "spaces" alter column "row_cap" drop not null;`
+  `alter table "spaces" add column "console_url" text;`
+  then re-run the regenerated migration's `smoodly_space_row_cap` function
+  and the `smoodly_read` policy on `spaces` (both `create or replace` /
+  `drop … if exists`, so the whole migration file can be re-applied).
+  Policies and triggers follow a table rename. Rows written before the
+  column show their user id on the Members page until re-inserted (the
+  demo-editor upsert fills it on the next seed).
+- The Members page is read-only; adding, re-roling and removing members
+  in self-host, the role vocabulary and its enforcement at the gate, and
+  the API Keys page's contents are DESIGN.md OQ #33.
+- The members list is not paged (tens of rows, not thousands).
+- The `api-keys` page id is a URL segment; the title reads "API Keys".
+
 ## Follow-ups (logged 2026-09-13, history spec)
 
 - Existing databases (every install so far is ours; DESIGN.md OQ #2):
@@ -1616,7 +1644,7 @@ the toolbar instead of pushing the content.
 - Light/dark toggle (nav foot): the choice is stored in `localStorage`
   (`smoodly-theme`) and written as `data-theme` on the admin wrapper, never on
   the host `<html>`. It is per browser, not per editor account — a server-side
-  preference would need a place to live (`editors`, or a cloud user profile).
+  preference would need a place to live (`members`, or a cloud user profile).
 - `lucide-react` is now a runtime dependency, for the toggle's two icons. The
   rest of the UI still uses the design system's unicode glyphs (↑ ↓ ⧉ × ··· ▾
   ← ⋮⋮); swapping them for Lucide is the next step whenever it is wanted.
@@ -1636,7 +1664,7 @@ the toolbar instead of pushing the content.
 - Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
 - A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
 - Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- `isEditor` reads `editors` with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
+- `isEditor` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
 - `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.

package/dist/admin/client-ops.js

@@ -3,6 +3,7 @@ const GROUPS = {
     entries: ["list", "distinct", "get", "create", "save", "setStatus", "discardDraft", "delete", "move", "addLocale", "removeLocale", "listVersions", "getVersion", "restore"],
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
+    members: ["list"],
     preview: ["enable", "disable"],
 };
 export function makeClientOps(action, token) {

package/dist/admin/index.d.ts

@@ -1,4 +1,4 @@
-export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem } from "./ops.ts";
+export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
 export { createAdminOps, runAdminOp, type AdminEffects } from "./ops-impl.ts";
 export { fixedNodeSpecs, fixedNodeOf, ensureFixedNodes, type FixedNode } from "./fixed-nodes.ts";
 export { ensureGlobalItems, initialGlobalFields } from "./global-items.ts";

package/dist/admin/next/index.d.ts

@@ -1,6 +1,6 @@
 export { createAdminOpHandler } from "./op-handler.ts";
 export { createSmoodlyAdmin } from "./create-admin.tsx";
-export type { AdminOpCall, AdminOpAction, AdminOps, OpResult } from "../ops.ts";
+export type { AdminOpCall, AdminOpAction, AdminOps, OpResult, MembersListResult } from "../ops.ts";
 export type { AuthConfig } from "../shell/session.ts";
 export type { AdminAuth } from "../auth.ts";
 export { supabaseAdminAuth } from "../supabase-auth.ts";

package/dist/admin/next/op-handler.d.ts

@@ -2,6 +2,7 @@ import type { ResolvedConfig } from "../../config.ts";
 import type { EntryStore } from "../../entry-store.ts";
 import type { PageStore } from "../../store.ts";
 import type { AssetStore } from "../../asset-store.ts";
+import type { MemberStore } from "../../member-store.ts";
 import { type AdminAuth } from "../auth.ts";
 import type { AdminOpAction } from "../ops.ts";
 export declare function createAdminOpHandler(deps: {
@@ -12,4 +13,6 @@ export declare function createAdminOpHandler(deps: {
     href?: (path: string, locale: string) => string;
     /** The media library; without it the assets ops answer "no media store". */
     assets?: AssetStore;
+    /** The admission table; without it members.list answers "no member store". */
+    members?: MemberStore;
 }): AdminOpAction;

package/dist/admin/next/op-handler.js

@@ -13,6 +13,7 @@ export function createAdminOpHandler(deps) {
         entries: deps.entries,
         href: deps.href,
         assets: deps.assets,
+        members: deps.members,
         effects: {
             // updateTag, not revalidateTag(tag, profile): the profile form is
             // stale-while-revalidate, so the first request after publish still

package/dist/admin/ops-impl.d.ts

@@ -1,6 +1,7 @@
 import type { ResolvedConfig } from "../config.ts";
 import type { EntryStore } from "../entry-store.ts";
 import type { AssetStore } from "../asset-store.ts";
+import type { MemberStore } from "../member-store.ts";
 import type { PageStore } from "../store.ts";
 import type { AdminOpCall, AdminOps, OpResult } from "./ops.ts";
 import type { AdminSession } from "./auth.ts";
@@ -21,6 +22,8 @@ export declare function createAdminOps(deps: {
     href?: (path: string, locale: string) => string;
     /** The media library; absent = every assets op answers "no media store". */
     assets?: AssetStore;
+    /** The admission table (spec 2026-09-25 §4); absent = members.list answers "no member store". */
+    members?: MemberStore;
     /** The verified editor; their email is every write's `by`. Absent for the seed and tests (spec 2026-09-13 history §2). */
     actor?: AdminSession;
 }): AdminOps;

package/dist/admin/ops-impl.js

@@ -200,6 +200,7 @@ export function createAdminOps(deps) {
     const nameOf = (r) => r.locales[def]?.slug ?? Object.values(r.locales)[0]?.slug ?? r.id;
     const assets = deps.assets;
     const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
+    const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
     const mb = (bytes) => `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
     const isDim = (v) => v === undefined || (typeof v === "number" && Number.isFinite(v) && v >= 0);
     /** What an asset's usage row points at, labelled for the Media screen. */
@@ -849,6 +850,14 @@ export function createAdminOps(deps) {
                 return ok(out);
             }),
         },
+        members: {
+            list: () => guard(async () => {
+                if (!deps.members)
+                    return noMembers();
+                const [members, consoleUrl] = await Promise.all([deps.members.list(), deps.members.consoleUrl()]);
+                return ok({ members, consoleUrl });
+            }),
+        },
         preview: {
             enable: () => guard(async () => (await effects?.draft?.enable(), ok(null))),
             disable: () => guard(async () => (await effects?.draft?.disable(), ok(null))),

package/dist/admin/ops.d.ts

@@ -3,6 +3,7 @@ import type { PageTree } from "../render.tsx";
 import type { EntryRecord, EntryUsage } from "../entry-store.ts";
 import type { AssetRecord, AssetMeta } from "../media.ts";
 import type { AssetPage, AssetQuery, FinishInput, UploadTicket } from "../asset-store.ts";
+import type { MemberRecord } from "../member-store.ts";
 import type { FieldError } from "./validate.ts";
 export type OpError = {
     ok: false;
@@ -91,6 +92,11 @@ export type AssetUsageItem = {
     title: string;
     href: string | null;
 };
+/** The Members page's read (spec 2026-09-25 §4): the rows and, when the control plane manages them, where. */
+export type MembersListResult = {
+    members: MemberRecord[];
+    consoleUrl: string | null;
+};
 export type AdminOps = {
     pages: {
         /** Lists every node, materializing fixed pages and collection mounts (in every supported locale) first. */
@@ -189,6 +195,10 @@ export type AdminOps = {
         delete(id: string): Promise<OpResult<null>>;
         usage(id: string): Promise<OpResult<AssetUsageItem[]>>;
     };
+    members: {
+        /** The space's members, read-only in this cut; `consoleUrl` set means smoodly.io manages them. */
+        list(): Promise<OpResult<MembersListResult>>;
+    };
     preview: {
         enable(): Promise<OpResult<null>>;
         disable(): Promise<OpResult<null>>;

package/dist/admin/shell/AdminApp.js

@@ -28,6 +28,7 @@ import { AdminPathProvider } from "./base.js";
 import { mountMismatch } from "../../admin-path.js";
 import { ErrorPane } from "./ErrorPane.js";
 import { MediaScreen } from "./MediaScreen.js";
+import { SettingsView } from "./SettingsView.js";
 import { AssetsProvider } from "../forms/assets-context.js";
 import { ElementsProvider } from "../forms/elements-context.js";
 export function AdminApp({ registry, op, auth }) {
@@ -59,6 +60,8 @@ export function AdminApp({ registry, op, auth }) {
         main = _jsx(GlobalList, { ops: ops, registry: registry });
     else if (head === "globals" && tail)
         main = _jsx(GlobalForm, { ops: ops, registry: registry, name: decodeURIComponent(tail) });
+    else if (head === "settings")
+        main = _jsx(SettingsView, { ops: ops, tail: tail });
     else if (head === "media")
         main = _jsx(MediaScreen, {});
     else

package/dist/admin/shell/IconRail.js

@@ -9,8 +9,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Items are registry-derived, never separately configured: Pages, then
 // Collections — one rail item whose flyout lists every collection — then
 // Media, Globals (the global content items, when the registry has any;
-// the route is /globals), and Settings, shown but inert until it
-// exists. The user avatar is pinned to the bottom and opens the same
+// the route is /globals), and Settings (the Settings area, spec
+// 2026-09-25; the route is /settings). The user avatar is pinned to the bottom and opens the same
 // flyout with the theme toggle and Sign out, which the old nav's footer
 // held.
 //
@@ -72,11 +72,11 @@ export function IconRail({ registry, active, email, onSignOut }) {
             items[(i + (e.key === "ArrowDown" ? 1 : -1) + items.length) % items.length].focus();
         }
     };
-    const link = (key, label, icon, href) => (_jsx("li", { className: "sm-rail__item", children: href ? (_jsxs(RouteLink, { className: "sm-rail__btn", href: href, "aria-current": key === active ? "page" : undefined, onClick: close, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] })) : (_jsxs("a", { className: "sm-rail__btn", "aria-disabled": true, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] })) }));
+    const link = (key, label, icon, href) => (_jsx("li", { className: "sm-rail__item", children: _jsxs(RouteLink, { className: "sm-rail__btn", href: href, "aria-current": key === active ? "page" : undefined, onClick: close, children: [_jsx("span", { className: "sm-rail__tile", children: icon }), _jsx("span", { className: "sm-rail__label", children: label })] }) }));
     const collections = registry.collections;
     const collectionActive = collections.some((c) => c.name === active);
     const collectionsOpen = open === "collections" || (hovered && open === null);
     const name = email?.split("@")[0] ?? "Editor";
     const initials = name.slice(0, 2).toUpperCase();
-    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), link("settings", "Settings", _jsx(Settings, { ...ICON }), null)] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
+    return (_jsxs("nav", { className: "sm-rail", "aria-label": "Primary", ref: root, onKeyDown: onKeyDown, children: [_jsx(AppIcon, {}), _jsxs("ul", { className: "sm-rail__list", children: [link("pages", "Pages", _jsx(PanelTop, { ...ICON }), adminHref("/pages")), collections.length > 0 && (_jsxs("li", { className: "sm-rail__item", onMouseEnter: () => setHovered(true), onMouseLeave: hoverLeave, children: [_jsxs("button", { type: "button", className: "sm-rail__btn", "aria-current": collectionActive ? "page" : undefined, "aria-haspopup": "menu", "aria-expanded": collectionsOpen, "aria-controls": menuId("collections"), onClick: () => toggle("collections"), children: [_jsx("span", { className: "sm-rail__tile", children: _jsx(LibraryBig, { ...ICON }) }), _jsx("span", { className: "sm-rail__label", children: "Collections" })] }), _jsx("ul", { className: "sm-rail__menu sm-rail__menu--collections", role: "menu", id: menuId("collections"), "data-open": collectionsOpen, children: collections.map((c) => (_jsx("li", { role: "none", children: _jsx(RouteLink, { role: "menuitem", className: "sm-rail__menu-item", href: adminHref(`/${c.name}`), "aria-current": c.name === active ? "page" : undefined, onClick: () => { close(); hoverLeave(); }, children: _jsx("span", { children: c.title }) }) }, c.name))) })] })), link("media", "Media", _jsx(Image, { ...ICON }), adminHref("/media")), registry.globals.length > 0 && link("globals", "Globals", _jsx(Globe, { ...ICON }), adminHref("/globals")), link("settings", "Settings", _jsx(Settings, { ...ICON }), adminHref("/settings"))] }), _jsxs("div", { className: "sm-rail__item sm-rail__foot", children: [_jsx("button", { type: "button", className: "sm-rail__user", title: name, "aria-haspopup": "menu", "aria-expanded": open === "user", "aria-controls": menuId("user"), onClick: () => toggle("user"), children: initials }), _jsxs("ul", { className: "sm-rail__menu sm-rail__menu--up", role: "menu", id: menuId("user"), "data-open": open === "user", children: [_jsx("li", { className: "sm-rail__menu-title", role: "presentation", children: name }), _jsx("li", { role: "none", children: _jsx(ThemeToggle, {}) }), _jsx("li", { role: "none", children: _jsx("button", { type: "button", role: "menuitem", className: "sm-rail__menu-item", onClick: () => { close(); onSignOut(); }, children: "Sign out" }) })] })] })] }));
 }

package/dist/admin/shell/ListView.d.ts

@@ -4,11 +4,13 @@ export type ListColumn = {
     label: string;
     width: string;
 };
-export declare function ListView({ title, titleTrailing, actions, columns, rows, empty, sortable }: {
+export declare function ListView({ title, titleTrailing, actions, notice, columns, rows, empty, sortable }: {
     title: string;
     /** Rides right after the title — the locale picker, in the place every form's switch has. */
     titleTrailing?: ReactNode;
     actions?: ReactNode;
+    /** Between the top bar and the list card — a Banner, as the Media screen places its error. */
+    notice?: ReactNode;
     columns: ListColumn[];
     rows: {
         key: string;

package/dist/admin/shell/ListView.js

@@ -3,10 +3,10 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Grip, TopBar, cx } from "../ui/primitives.js";
 import { navigate } from "./router.js";
-export function ListView({ title, titleTrailing, actions, columns, rows, empty, sortable }) {
+export function ListView({ title, titleTrailing, actions, notice, columns, rows, empty, sortable }) {
     const widths = sortable ? ["24px", ...columns.map((c) => c.width)] : columns.map((c) => c.width);
     const grid = { gridTemplateColumns: widths.join(" ") };
-    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsxs(_Fragment, { children: [_jsx("span", { className: "sm-title", children: title }), titleTrailing] }), right: actions }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [sortable && _jsx("span", { "aria-hidden": "true" }), columns.map((c) => _jsx("span", { children: c.label }, c.label))] }), _jsxs("div", { className: "sm-table__body", ref: sortable?.hook.containerRef, children: [rows.map((r, i) => {
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsxs(_Fragment, { children: [_jsx("span", { className: "sm-title", children: title }), titleTrailing] }), right: actions }), notice, _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [sortable && _jsx("span", { "aria-hidden": "true" }), columns.map((c) => _jsx("span", { children: c.label }, c.label))] }), _jsxs("div", { className: "sm-table__body", ref: sortable?.hook.containerRef, children: [rows.map((r, i) => {
                                     const clickable = Boolean(r.href || r.onClick);
                                     const href = r.href;
                                     const go = r.onClick ?? (href ? () => { navigate(href); } : undefined);

package/dist/admin/shell/MembersPage.d.ts

@@ -0,0 +1,5 @@
+import type { AdminOps, MembersListResult } from "../ops.ts";
+export declare function MembersPage({ ops, initial }: {
+    ops: AdminOps;
+    initial?: MembersListResult | null;
+}): import("react").JSX.Element;

package/dist/admin/shell/MembersPage.js

@@ -0,0 +1,36 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/MembersPage.tsx
+// The Members page (spec 2026-09-25 §7): the admission table, read-only
+// in this cut — Email and Role, no actions, no row click. A console URL
+// from the op means smoodly.io manages the rows, and a banner under the
+// top bar says so.
+import { useEffect, useState } from "react";
+import { Banner, StatusBadge } from "../ui/primitives.js";
+import { ErrorPane } from "./ErrorPane.js";
+import { ListView } from "./ListView.js";
+import { memberRows } from "./members-list.js";
+export function MembersPage({ ops, initial = null }) {
+    const [data, setData] = useState(initial);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        if (initial)
+            return;
+        ops.members.list()
+            .then((r) => (r.ok ? setData(r.data) : setError(r.message)))
+            .catch(() => setError("Couldn't reach the server."));
+    }, [ops, initial]);
+    if (error)
+        return _jsx(ErrorPane, { message: error });
+    const rows = data ? memberRows(data.members) : [];
+    return (_jsx(ListView, { title: "Members", notice: data?.consoleUrl && (_jsxs(Banner, { tone: "ok", children: ["Members are managed at smoodly.io.", " ", _jsx("a", { href: data.consoleUrl, target: "_blank", rel: "noreferrer", children: "Open the console" })] })), columns: [
+            { label: "Email", width: "minmax(200px,1fr)" },
+            { label: "Role", width: "120px" },
+        ], rows: rows.map((r) => ({
+            key: r.key,
+            cells: [
+                r.fallback ? _jsx("span", { style: { color: "var(--text-muted)" }, children: r.email }) : r.email,
+                _jsx(StatusBadge, { status: r.role }),
+            ],
+        })), empty: "No members yet" }));
+}

package/dist/admin/shell/SettingsView.d.ts

@@ -0,0 +1,5 @@
+import type { AdminOps } from "../ops.ts";
+export declare function SettingsView({ ops, tail }: {
+    ops: AdminOps;
+    tail: string | undefined;
+}): import("react").JSX.Element;

package/dist/admin/shell/SettingsView.js

@@ -0,0 +1,28 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/SettingsView.tsx
+// The Settings area (spec 2026-09-25 §5): a 200px secondary nav at the
+// left of the main column, then the page with its own top bar. The head
+// segment alone replaces itself with the default page, so Back skips the
+// empty URL. An unknown page is the shell's Not found pane.
+import { useEffect } from "react";
+import { TopBar } from "../ui/primitives.js";
+import { useAdminHref } from "./base.js";
+import { ErrorPane } from "./ErrorPane.js";
+import { MembersPage } from "./MembersPage.js";
+import { RouteLink } from "./RouteLink.js";
+import { navigate } from "./router.js";
+import { DEFAULT_SETTINGS_PAGE, SETTINGS_PAGES, settingsPage, settingsTitle } from "./settings.js";
+export function SettingsView({ ops, tail }) {
+    const adminHref = useAdminHref();
+    const page = settingsPage(tail);
+    useEffect(() => {
+        if (tail === undefined)
+            navigate(adminHref(`/settings/${DEFAULT_SETTINGS_PAGE}`), { replace: true });
+    }, [tail, adminHref]);
+    if (!page)
+        return _jsx(ErrorPane, { message: "Not found." });
+    return (_jsxs("div", { className: "sm-settings", children: [_jsx("nav", { className: "sm-settings__nav", "aria-label": "Settings", children: SETTINGS_PAGES.map((p) => (_jsx(RouteLink, { className: "sm-settings__link", href: adminHref(`/settings/${p.id}`), "aria-current": p.id === page ? "page" : undefined, children: p.title }, p.id))) }), _jsx("section", { className: "sm-settings__page", children: page === "members"
+                    ? _jsx(MembersPage, { ops: ops })
+                    : _jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: settingsTitle(page) }) }), _jsx("div", { className: "sm-listwrap" })] }) })] }));
+}

package/dist/admin/shell/members-list.d.ts

@@ -0,0 +1,9 @@
+import type { MemberRecord } from "../../member-store.ts";
+export type MemberRow = {
+    key: string;
+    email: string;
+    fallback: boolean;
+    role: string;
+};
+export declare const roleLabel: (role: string) => string;
+export declare function memberRows(members: MemberRecord[]): MemberRow[];

package/dist/admin/shell/members-list.js

@@ -0,0 +1,9 @@
+export const roleLabel = (role) => (role ? role[0].toUpperCase() + role.slice(1) : "");
+export function memberRows(members) {
+    return members.map((m) => ({
+        key: m.userId,
+        email: m.email ?? m.userId,
+        fallback: m.email === null,
+        role: roleLabel(m.role),
+    }));
+}

package/dist/admin/shell/settings.d.ts

@@ -0,0 +1,15 @@
+export declare const SETTINGS_PAGES: readonly [{
+    readonly id: "members";
+    readonly title: "Members";
+}, {
+    readonly id: "roles";
+    readonly title: "Roles";
+}, {
+    readonly id: "api-keys";
+    readonly title: "API Keys";
+}];
+export type SettingsPageId = (typeof SETTINGS_PAGES)[number]["id"];
+export declare const DEFAULT_SETTINGS_PAGE: SettingsPageId;
+/** The page for the segment after /settings: the default for none, null for an unknown one. */
+export declare function settingsPage(tail: string | undefined): SettingsPageId | null;
+export declare function settingsTitle(page: SettingsPageId): string;

package/dist/admin/shell/settings.js

@@ -0,0 +1,18 @@
+// The Settings area's pages (spec 2026-09-25 §5): ids are URL segments
+// under /settings, titles are what the secondary nav and each top bar
+// show. Pure, so routing is testable without React.
+export const SETTINGS_PAGES = [
+    { id: "members", title: "Members" },
+    { id: "roles", title: "Roles" },
+    { id: "api-keys", title: "API Keys" },
+];
+export const DEFAULT_SETTINGS_PAGE = "members";
+/** The page for the segment after /settings: the default for none, null for an unknown one. */
+export function settingsPage(tail) {
+    if (tail === undefined)
+        return DEFAULT_SETTINGS_PAGE;
+    return SETTINGS_PAGES.some((p) => p.id === tail) ? tail : null;
+}
+export function settingsTitle(page) {
+    return SETTINGS_PAGES.find((p) => p.id === page).title;
+}

package/dist/admin/supabase-auth.js

@@ -1,6 +1,6 @@
 // The Supabase-backed AdminAuth: the session is verified against the
 // AUTH project (smoodly.io's in the cloud, the customer's own in self-
-// host — same code, different SMOODLY_AUTH_URL), the editors row is read
+// host — same code, different SMOODLY_AUTH_URL), the members row is read
 // from the CONTENT project with the write key. No space filter: the
 // policy set scopes the write key, and self-host has one space.
 import { createClient } from "@supabase/supabase-js";
@@ -14,7 +14,7 @@ export function supabaseAdminAuth(input) {
             return res.data.user ? { userId: res.data.user.id, email: res.data.user.email ?? null } : null;
         },
         async isEditor(userId) {
-            const res = await input.db.from("editors").select("user_id").eq("user_id", userId).limit(1);
+            const res = await input.db.from("members").select("user_id").eq("user_id", userId).limit(1);
             if (res.error)
                 throw new Error(`smoodly: ${res.error.message}`);
             return res.data.length > 0;

package/dist/admin/ui/theme.js

@@ -975,6 +975,19 @@ body:has(.sm-admin){margin:0}
 }
 .sm-facts{display:grid;grid-template-columns:auto 1fr;gap:4px 10px;font-size:var(--text-sm);color:var(--text-muted)}
 .sm-usage{display:flex;flex-direction:column;gap:4px}
+/* The Settings area (spec 2026-09-25 §5): a 200px nav card beside the
+   page, both under the main column; the page keeps its own top bar. */
+.sm-settings{display:grid;grid-template-columns:200px 1fr;column-gap:var(--gutter);flex:1;min-height:0}
+.sm-settings__nav{
+  display:flex;flex-direction:column;gap:2px;padding:var(--table-pad);overflow:auto;
+  background:var(--surface-form);border-radius:var(--radius-card-lg);
+}
+.sm-settings__link{
+  display:block;padding:8px 10px;border-radius:var(--radius-md);color:var(--text);text-decoration:none;font-size:var(--text-md);
+}
+.sm-settings__link:hover{background:var(--surface-inset)}
+.sm-settings__link[aria-current="page"],.sm-settings__link[aria-current="page"]:hover{background:var(--nav-active-bg);color:var(--nav-active-fg);font-weight:600}
+.sm-settings__page{display:flex;flex-direction:column;min-width:0;min-height:0}
 `;
 /** Where the theme toggle's choice is remembered, browser-side only. */
 export const THEME_KEY = "smoodly-theme";

package/dist/index.d.ts

@@ -33,6 +33,9 @@ export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, Begi
 export { imageDimensions } from "./image-dimensions.ts";
 export { SupabasePageStore } from "./supabase-store.ts";
 export { SupabaseAssetStore } from "./supabase-asset-store.ts";
+export { MemoryMemberStore, sortMembers } from "./member-store.ts";
+export type { MemberStore, MemberRecord } from "./member-store.ts";
+export { SupabaseMemberStore } from "./supabase-member-store.ts";
 export { collectEntryRefs, collectTreeRefs } from "./refs.ts";
 export type { RefEdge, SectionLike } from "./refs.ts";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.ts";

package/dist/index.js

@@ -26,6 +26,8 @@ export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDo
 export { imageDimensions } from "./image-dimensions.js";
 export { SupabasePageStore } from "./supabase-store.js";
 export { SupabaseAssetStore } from "./supabase-asset-store.js";
+export { MemoryMemberStore, sortMembers } from "./member-store.js";
+export { SupabaseMemberStore } from "./supabase-member-store.js";
 export { collectEntryRefs, collectTreeRefs } from "./refs.js";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.js";
 export { MemoryRefIndex } from "./ref-index.js";

package/dist/member-store.d.ts

@@ -0,0 +1,20 @@
+export type MemberRecord = {
+    userId: string;
+    email: string | null;
+    role: string;
+};
+export interface MemberStore {
+    /** Every member of the current space, by email then user id. */
+    list(): Promise<MemberRecord[]>;
+    /** The space's console URL when the control plane manages its members; null in self-host. */
+    consoleUrl(): Promise<string | null>;
+}
+/** Email first (case-insensitive), rows without one last, ties by user id. */
+export declare function sortMembers(rows: MemberRecord[]): MemberRecord[];
+export declare class MemoryMemberStore implements MemberStore {
+    private rows;
+    private url;
+    constructor(rows?: MemberRecord[], url?: string | null);
+    list(): Promise<MemberRecord[]>;
+    consoleUrl(): Promise<string | null>;
+}

package/dist/member-store.js

@@ -0,0 +1,29 @@
+// The members contract (spec 2026-09-25 §4) and its memory adapter. A
+// member is one row of the admission table: the Auth user id, the email
+// stored beside it, and a role from the package's vocabulary. Read-only
+// in this cut; the console URL says whether the control plane manages
+// the rows (a cloud space) — no row, no URL, self-host.
+/** Email first (case-insensitive), rows without one last, ties by user id. */
+export function sortMembers(rows) {
+    return [...rows].sort((a, b) => {
+        if (a.email === null && b.email === null)
+            return a.userId.localeCompare(b.userId);
+        if (a.email === null)
+            return 1;
+        if (b.email === null)
+            return -1;
+        return a.email.localeCompare(b.email, undefined, { sensitivity: "base" }) || a.userId.localeCompare(b.userId);
+    });
+}
+export class MemoryMemberStore {
+    constructor(rows = [], url = null) {
+        this.rows = rows;
+        this.url = url;
+    }
+    async list() {
+        return sortMembers(this.rows);
+    }
+    async consoleUrl() {
+        return this.url;
+    }
+}

package/dist/sql-space.js

@@ -30,7 +30,7 @@ language sql stable as $$
 $$;`.trim();
 }
 /** Which rows a read key (or the anon key, which has no claim) may see.
- *  null = write keys only — refs is editor tooling; editors is admission
+ *  null = write keys only — refs is editor tooling; members is admission
  *  data; nothing a browser needs. Global content (spec 2026-09-07) rides
  *  the three entry predicates: it is stored as entries. */
 const PUBLISHED_READ = {
@@ -41,7 +41,7 @@ const PUBLISHED_READ = {
     entry_locales: `"status" = 'published'`,
     entry_versions: `exists (select 1 from "entry_locales" l where l."published_version_id" = "entry_versions"."id")`,
     refs: null,
-    editors: null,
+    members: null,
     assets: `"status" = 'ready'`,
     paths: `(("kind" = 'page' and exists (select 1 from "page_locales" l where l."page_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')) or ("kind" = 'entry' and exists (select 1 from "entry_locales" l where l."entry_id" = "paths"."target_id" and l."locale" = "paths"."locale" and l."status" = 'published')))`,
 };
@@ -52,13 +52,17 @@ const NEEDS_SPACE_INDEX = [
 export function spaceLayerSQL() {
     const statements = [];
     statements.push(`
--- ── Cloud state (spec 2026-09-04 §1): three ordinary tables, shipped
--- for everyone with ONE definition. Self-host fills them by hand or
--- leaves them empty; smoodly.io writes rows with the service role.
--- There is never cloud-only SQL on a content database.
-create table if not exists "editors" (
+-- ── Cloud state (spec 2026-09-04 §1, names 2026-09-25): three ordinary
+-- tables, shipped for everyone with ONE definition. Self-host fills them
+-- by hand or leaves them empty; smoodly.io writes rows with the service
+-- role. There is never cloud-only SQL on a content database.
+-- members: who may open /admin for a space (spec 2026-09-25 §1–§2). The
+-- email is stored so the Members page needs no Auth lookup — the auth
+-- project is not the content project in the cloud.
+create table if not exists "members" (
   ${SPACE_COL},
   "user_id" uuid not null,
+  "email" text,
   "role" text not null default 'editor',
   primary key ("space_id", "user_id")
 );
@@ -70,14 +74,18 @@ create table if not exists "space_keys" (
   "revoked_at" timestamptz
 );
 
-create table if not exists "space_caps" (
+-- spaces: the control plane's row for a space (spec 2026-09-25 §3). No
+-- row = self-host: no cap, members managed in /admin. console_url set =
+-- smoodly.io manages the members and /admin links there.
+create table if not exists "spaces" (
   "space_id" uuid primary key,
-  "row_cap" integer not null
+  "row_cap" integer,
+  "console_url" text
 );
 
-alter table "editors" enable row level security;
+alter table "members" enable row level security;
 alter table "space_keys" enable row level security;
-alter table "space_caps" enable row level security;
+alter table "spaces" enable row level security;
 
 -- ── Claim readers. The two lookups run as definer so they can read the
 -- service-role-only tables from inside a policy; search_path is pinned.
@@ -96,7 +104,7 @@ $$;
 
 create or replace function "smoodly_space_row_cap"() returns integer
 language sql stable security definer set search_path = public as $$
-  select c."row_cap" from "space_caps" c where c."space_id" = "smoodly_current_space"();
+  select c."row_cap" from "spaces" c where c."space_id" = "smoodly_current_space"();
 $$;
 
 -- ── Triggers. A key's claim wins over whatever the insert said, so an
@@ -113,7 +121,7 @@ begin
 end;
 $$;
 
--- Per table, per space. No space_caps row = no cap (self-host). Trigger
+-- Per table, per space. No spaces row, or a null cap = no cap (self-host). Trigger
 -- a_ (smoodly_set_space) runs first, so new.space_id already equals the
 -- current space for a keyed insert; smoodly_space_row_cap() reads the
 -- current space itself, so this never needs the row's space_id as an
@@ -148,7 +156,7 @@ $$;`.trim());
         statements.push(`create index if not exists "${table}_space_idx" on "${table}" ("space_id");`);
     }
     // Trigger names sort a_ before b_: same-event triggers fire alphabetically.
-    for (const table of [...CONTENT_TABLES, "editors"]) {
+    for (const table of [...CONTENT_TABLES, "members"]) {
         statements.push(`drop trigger if exists "smoodly_a_set_space" on "${table}";\n` +
             `create trigger "smoodly_a_set_space" before insert on "${table}"\n` +
             `  for each row execute function "smoodly_set_space"();`);
@@ -166,7 +174,7 @@ $$;`.trim());
     // Postgres never inlines; applied to all three calls for the same win.
     const own = `"space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"())`;
     const write = `${own} and (select "smoodly_key_kind"()) = 'write'`;
-    for (const table of [...CONTENT_TABLES, "editors"]) {
+    for (const table of [...CONTENT_TABLES, "members"]) {
         statements.push(`drop policy if exists "smoodly_write" on "${table}";\n` +
             `create policy "smoodly_write" on "${table}" for all\n` +
             `  using (${write})\n` +
@@ -179,6 +187,12 @@ $$;`.trim());
                 `  using (${predicate});`);
         }
     }
+    // A write key reads its own space's row — the console URL the Members
+    // page links to (spec 2026-09-25 §3). Nothing else touches spaces or
+    // space_keys but the two definer functions and the service role.
+    statements.push(`drop policy if exists "smoodly_read" on "spaces";\n` +
+        `create policy "smoodly_read" on "spaces" for select\n` +
+        `  using (${write});`);
     statements.push(storageSQL());
     return statements.join("\n\n");
 }

package/dist/supabase-member-store.d.ts

@@ -0,0 +1,8 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type MemberRecord, type MemberStore } from "./member-store.ts";
+export declare class SupabaseMemberStore implements MemberStore {
+    private db;
+    constructor(db: SupabaseClient);
+    list(): Promise<MemberRecord[]>;
+    consoleUrl(): Promise<string | null>;
+}

package/dist/supabase-member-store.js

@@ -0,0 +1,18 @@
+import { sortMembers } from "./member-store.js";
+export class SupabaseMemberStore {
+    constructor(db) {
+        this.db = db;
+    }
+    async list() {
+        const res = await this.db.from("members").select("user_id, email, role");
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return sortMembers(res.data.map((r) => ({ userId: r.user_id, email: r.email, role: r.role })));
+    }
+    async consoleUrl() {
+        const res = await this.db.from("spaces").select("console_url").limit(1).maybeSingle();
+        if (res.error)
+            throw new Error(`smoodly: ${res.error.message}`);
+        return res.data?.console_url ?? null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.21",
+  "version": "0.0.23",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {