smoodly 0.0.22 → 0.0.24

package/dist/admin/shell/LoginView.js

@@ -4,10 +4,18 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Google/GitHub when the auth project has them. Errors come from
 // Supabase Auth verbatim. Being an editor is checked by the server on
 // the first op — a signed-in non-editor sees that message in the shell.
+// Forgot password (members management §6) mails a reset link; the reply
+// is the same whatever the email, so the form reveals no membership.
 import { useState } from "react";
 import { Banner, Button, Field, Logo } from "../ui/primitives.js";
 const LABELS = { google: "Continue with Google", github: "Continue with GitHub" };
+const CARD = {
+    width: 320, display: "flex", flexDirection: "column", gap: 14,
+    background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
+    border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
+};
 export function LoginView({ client, providers = [] }) {
+    const [mode, setMode] = useState("signin");
     const [email, setEmail] = useState("");
     const [password, setPassword] = useState("");
     const [error, setError] = useState(null);
@@ -28,6 +36,20 @@ export function LoginView({ client, providers = [] }) {
             setBusy(false);
         }
     };
+    const forgot = async (e) => {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            // The answer is not shown: the form must not reveal whether an email is registered.
+            await client.auth.resetPasswordForEmail(email, { redirectTo: window.location.origin + window.location.pathname });
+        }
+        catch { /* same */ }
+        finally {
+            setBusy(false);
+            setMode("sent");
+        }
+    };
     const oauth = async (provider) => {
         setBusy(true);
         setError(null);
@@ -43,9 +65,16 @@ export function LoginView({ client, providers = [] }) {
             setBusy(false);
         }
     };
-    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: _jsxs("form", { onSubmit: submit, style: {
-                width: 320, display: "flex", flexDirection: "column", gap: 14,
-                background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
-                border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
-            }, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", value: password, required: true, autoComplete: "current-password", onChange: (e) => setPassword(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Signing in…" : "Sign in" }), providers.map((p) => (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => oauth(p), children: LABELS[p] }, p)))] }) }));
+    const back = (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => { setError(null); setMode("signin"); }, children: "Back to sign in" }));
+    let card;
+    if (mode === "sent") {
+        card = (_jsxs("div", { style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx("span", { children: "Check your email for a link to choose a new password." }), back] }));
+    }
+    else if (mode === "forgot") {
+        card = (_jsxs("form", { onSubmit: forgot, style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", autoFocus: true, onChange: (e) => setEmail(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Sending…" : "Send reset link" }), back] }));
+    }
+    else {
+        card = (_jsxs("form", { onSubmit: submit, style: CARD, children: [_jsx(Logo, { height: 20 }), _jsx(Field, { label: "Email", children: _jsx("input", { className: "sm-input", type: "email", value: email, required: true, autoComplete: "email", onChange: (e) => setEmail(e.target.value) }) }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", value: password, required: true, autoComplete: "current-password", onChange: (e) => setPassword(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Signing in…" : "Sign in" }), providers.map((p) => (_jsx(Button, { variant: "secondary", size: "lg", disabled: busy, onClick: () => oauth(p), children: LABELS[p] }, p))), _jsx("button", { type: "button", className: "sm-link", disabled: busy, onClick: () => { setError(null); setMode("forgot"); }, style: { background: "transparent", border: 0, color: "var(--text-muted)", cursor: "pointer", font: "inherit", padding: 0 }, children: "Forgot password?" })] }));
+    }
+    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: card }));
 }

package/dist/admin/shell/MembersPage.d.ts

@@ -0,0 +1,6 @@
+import type { AdminOps, MembersListResult } from "../ops.ts";
+export declare function MembersPage({ ops, userId, initial }: {
+    ops: AdminOps;
+    userId: string;
+    initial?: MembersListResult | null;
+}): import("react").JSX.Element;

package/dist/admin/shell/MembersPage.js

@@ -0,0 +1,83 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/MembersPage.tsx
+// The Members page (spec 2026-09-25 §7; management §4): the admission
+// table with Invite, an in-place role control and Remove — all off when
+// the control plane manages the space (the console URL banner stays).
+// Own row and the last admin render their controls disabled with the
+// guard's reason, so the rule is visible before it is hit.
+import { useEffect, useState } from "react";
+import { MEMBER_ROLES } from "../../permissions.js";
+import { ActionMenu } from "../ui/ActionMenu.js";
+import { Banner, Button, Segmented, StatusBadge } from "../ui/primitives.js";
+import { ErrorPane } from "./ErrorPane.js";
+import { InviteModal } from "./InviteModal.js";
+import { ListView } from "./ListView.js";
+import { GUARD_TITLE, memberRows, roleLabel } from "./members-list.js";
+export function MembersPage({ ops, userId, initial = null }) {
+    const [data, setData] = useState(initial);
+    const [error, setError] = useState(null);
+    const [notice, setNotice] = useState(null);
+    const [inviting, setInviting] = useState(false);
+    const load = () => ops.members.list()
+        .then((r) => (r.ok ? setData(r.data) : setError(r.message)))
+        .catch(() => setError("Couldn't reach the server."));
+    useEffect(() => { if (!initial)
+        void load(); }, [ops, initial]); // eslint-disable-line react-hooks/exhaustive-deps
+    const invite = async (input) => {
+        // The admin's own origin and mount: /settings/… stripped, so the invite lands on the shell.
+        const redirectTo = window.location.origin + window.location.pathname.replace(/\/settings(\/.*)?$/, "");
+        const r = await ops.members.invite({ ...input, redirectTo });
+        if (!r.ok)
+            return r.message;
+        setInviting(false);
+        setNotice({
+            tone: "ok",
+            text: r.data.invited ? `Invite sent to ${input.email}.` : `${input.email} added — they can sign in with their existing account.`,
+        });
+        void load();
+        return null;
+    };
+    const setRole = async (row, role) => {
+        if (role === row.value)
+            return;
+        const r = await ops.members.setRole(row.key, role);
+        if (!r.ok) {
+            setNotice({ tone: "error", text: r.message });
+            return;
+        }
+        setData((d) => d && { ...d, members: d.members.map((m) => (m.userId === row.key ? r.data : m)) });
+    };
+    const remove = async (row) => {
+        if (!window.confirm(`Remove ${row.email} from this site? They keep their account and lose access to the admin.`))
+            return;
+        const r = await ops.members.remove(row.key);
+        if (!r.ok) {
+            setNotice({ tone: "error", text: r.message });
+            return;
+        }
+        void load();
+    };
+    if (error)
+        return _jsx(ErrorPane, { message: error });
+    const managed = Boolean(data?.consoleUrl);
+    const rows = data ? memberRows(data.members, { me: userId }) : [];
+    const guardTitle = (r) => (r.own ? GUARD_TITLE.own : r.lastAdmin ? GUARD_TITLE.lastAdmin : undefined);
+    return (_jsxs(_Fragment, { children: [_jsx(ListView, { title: "Members", actions: !managed && data && _jsx(Button, { onClick: () => setInviting(true), children: "Invite" }), notice: _jsxs(_Fragment, { children: [data?.consoleUrl && (_jsxs(Banner, { tone: "ok", children: ["Members are managed at smoodly.io.", " ", _jsx("a", { href: data.consoleUrl, target: "_blank", rel: "noreferrer", children: "Open the console" })] })), notice && _jsx(Banner, { tone: notice.tone, onDismiss: () => setNotice(null), children: notice.text })] }), columns: [
+                    { label: "Email", width: "minmax(200px,1fr)" },
+                    { label: "Role", width: managed ? "120px" : "180px" },
+                    ...(managed ? [] : [{ label: "", width: "48px" }]),
+                ], rows: rows.map((r) => ({
+                    key: r.key,
+                    cells: [
+                        r.fallback ? _jsx("span", { style: { color: "var(--text-muted)" }, children: r.email }) : r.email,
+                        managed
+                            ? _jsx(StatusBadge, { status: r.role })
+                            : _jsx(Segmented, { options: MEMBER_ROLES, value: r.value, onChange: (v) => void setRole(r, v), label: roleLabel, disabled: r.own || r.lastAdmin, option: () => (guardTitle(r) ? { title: guardTitle(r) } : undefined) }),
+                        ...(managed ? [] : [
+                            // ActionMenu has no title of its own when disabled: the span carries the guard's reason.
+                            _jsx("span", { title: guardTitle(r), children: _jsx(ActionMenu, { label: "Member actions", small: true, disabled: r.own || r.lastAdmin, items: [{ label: "Remove", danger: true, run: () => void remove(r) }] }) }),
+                        ]),
+                    ],
+                })), empty: "No members yet" }), inviting && _jsx(InviteModal, { onClose: () => setInviting(false), onInvite: invite })] }));
+}

package/dist/admin/shell/PagesList.js

@@ -17,6 +17,7 @@ import { useSortable } from "../ui/useSortable.js";
 import { useAdminHref } from "./base.js";
 import { navigate } from "./router.js";
 import { ErrorPane } from "./ErrorPane.js";
+import { confirmLiveUrl } from "./live-url.js";
 const LOCALE_KEY = "smoodly.pages.locale";
 /** The selected locale survives a reload within the session; a stored
  *  value that is no longer supported falls back to the default. */
@@ -74,6 +75,10 @@ export function PagesList({ ops, registry }) {
                 return;
             if (projection.parentId === row.parentId && projection.index === row.index)
                 return;
+            // A published page under a new parent is a new live URL (members management §5).
+            const current = row.record.locales[locale];
+            if (!confirmLiveUrl({ status: current?.status, from: row.parentId ?? "", to: projection.parentId ?? "" }))
+                return;
             const ok = await run(() => ops.pages.move(row.id, { parentId: projection.parentId, index: projection.index }));
             if (!ok)
                 throw new Error("move refused");
@@ -153,6 +158,8 @@ export function PagesList({ ops, registry }) {
         const slug = window.prompt("Slug (the URL segment):", current.slug);
         if (slug === null)
             return;
+        if (!confirmLiveUrl({ status: current.status, from: current.slug, to: slug }))
+            return;
         void run(() => ops.pages.rename(row.id, { locale, title, slug }));
     };
     const destroy = (row) => {

package/dist/admin/shell/SetPasswordView.d.ts

@@ -0,0 +1,7 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Arrival } from "./session.ts";
+export declare function SetPasswordView({ client, mode, onDone }: {
+    client: SupabaseClient;
+    mode: Arrival;
+    onDone(): void;
+}): import("react").JSX.Element;

package/dist/admin/shell/SetPasswordView.js

@@ -0,0 +1,41 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/SetPasswordView.tsx
+// The arrival screen (spec 2026-09-25 members management §6): an invite
+// link or a reset link signed the person in; now they choose a password.
+// An invite cannot skip it (the account has none yet); a recovery may.
+import { useState } from "react";
+import { Banner, Button, Field, Logo } from "../ui/primitives.js";
+export function SetPasswordView({ client, mode, onDone }) {
+    const [password, setPassword] = useState("");
+    const [again, setAgain] = useState("");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const submit = async (e) => {
+        e.preventDefault();
+        if (password !== again) {
+            setError("The two passwords differ.");
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await client.auth.updateUser({ password });
+            if (res.error)
+                setError(res.error.message);
+            else
+                onDone();
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : String(e));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (_jsx("div", { style: { minHeight: "100vh", display: "grid", placeItems: "center", background: "var(--bg)" }, children: _jsxs("form", { onSubmit: submit, style: {
+                width: 320, display: "flex", flexDirection: "column", gap: 14,
+                background: "var(--surface)", padding: 28, borderRadius: "var(--radius-card-lg)",
+                border: "var(--menu-border)", boxShadow: "var(--shadow-page)",
+            }, children: [_jsx(Logo, { height: 20 }), _jsx("span", { className: "sm-title", children: mode === "invite" ? "Set your password" : "Choose a new password" }), _jsx(Field, { label: "Password", children: _jsx("input", { className: "sm-input", type: "password", required: true, minLength: 8, autoComplete: "new-password", value: password, onChange: (e) => setPassword(e.target.value) }) }), _jsx(Field, { label: "Again", children: _jsx("input", { className: "sm-input", type: "password", required: true, autoComplete: "new-password", value: again, onChange: (e) => setAgain(e.target.value) }) }), error && _jsx(Banner, { tone: "error", children: error }), _jsx("button", { type: "submit", disabled: busy, className: "sm-btn sm-btn--primary sm-btn--lg", children: busy ? "Saving…" : "Save" }), mode === "recovery" && _jsx(Button, { variant: "secondary", size: "lg", onClick: onDone, children: "Skip" })] }) }));
+}

package/dist/admin/shell/SettingsView.d.ts

@@ -0,0 +1,9 @@
+import { type MemberRole } from "../../permissions.ts";
+import type { AdminOps } from "../ops.ts";
+export declare function SettingsView({ ops, tail, role, userId }: {
+    ops: AdminOps;
+    tail: string | undefined;
+    /** The caller's role from `members.me`; null while it loads. */
+    role: MemberRole | null;
+    userId: string;
+}): import("react").JSX.Element;

package/dist/admin/shell/SettingsView.js

@@ -0,0 +1,49 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// packages/smoodly/src/admin/shell/SettingsView.tsx
+// The Settings area (spec 2026-09-25 §5): a 200px secondary nav at the
+// left of the main column, then the page with its own top bar. The head
+// segment alone replaces itself with the default page, so Back skips the
+// empty URL. An unknown page is the shell's Not found pane. Admins only
+// (members management §2): an editor gets the error pane, and until the
+// role is known the area is loading.
+import { useEffect } from "react";
+import { can } from "../../permissions.js";
+import { TopBar } from "../ui/primitives.js";
+import { useAdminHref } from "./base.js";
+import { ErrorPane } from "./ErrorPane.js";
+import { MembersPage } from "./MembersPage.js";
+import { RouteLink } from "./RouteLink.js";
+import { navigate } from "./router.js";
+import { DEFAULT_SETTINGS_PAGE, SETTINGS_PAGES, settingsPage, settingsTitle } from "./settings.js";
+export function SettingsView({ ops, tail, role, userId }) {
+    const adminHref = useAdminHref();
+    const page = settingsPage(tail);
+    useEffect(() => {
+        if (tail === undefined)
+            navigate(adminHref(`/settings/${DEFAULT_SETTINGS_PAGE}`), { replace: true });
+    }, [tail, adminHref]);
+    if (role === null)
+        return _jsx("div", { className: "sm-empty", children: "Loading\u2026" });
+    if (!can(role, "settings"))
+        return _jsx(ErrorPane, { message: "Settings are for admins." });
+    if (!page)
+        return _jsx(ErrorPane, { message: "Not found." });
+    return (_jsxs("div", { className: "sm-settings", children: [_jsx("nav", { className: "sm-settings__nav", "aria-label": "Settings", children: SETTINGS_PAGES.map((p) => (_jsx(RouteLink, { className: "sm-settings__link", href: adminHref(`/settings/${p.id}`), "aria-current": p.id === page ? "page" : undefined, children: p.title }, p.id))) }), _jsx("section", { className: "sm-settings__page", children: page === "members"
+                    ? _jsx(MembersPage, { ops: ops, userId: userId })
+                    : page === "roles"
+                        ? _jsx(RolesPage, {})
+                        : _jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: settingsTitle(page) }) }), _jsx("div", { className: "sm-listwrap" })] }) })] }));
+}
+// The two roles, read-only (members management §1): what each may do.
+// A row per capability group, not per Capability — the table explains,
+// permissions.ts decides.
+const ROLE_ROWS = [
+    ["Edit, publish, unpublish and delete content; upload and delete media", true, true],
+    ["Open Settings and every page under it", true, false],
+    ["Invite, re-role and remove members", true, false],
+];
+function RolesPage() {
+    const grid = { gridTemplateColumns: "minmax(240px,1fr) 100px 100px" };
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Roles" }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table", children: [_jsxs("div", { className: "sm-table__head", style: grid, children: [_jsx("span", { children: "What a role may do" }), _jsx("span", { children: "Admin" }), _jsx("span", { children: "Editor" })] }), _jsx("div", { className: "sm-table__body", children: ROLE_ROWS.map(([what, admin, editor]) => (_jsxs("div", { className: "sm-row", style: grid, children: [_jsx("span", { className: "sm-cell", children: what }), _jsx("span", { className: "sm-cell", children: admin ? "yes" : "no" }), _jsx("span", { className: "sm-cell", children: editor ? "yes" : "no" })] }, what))) })] }) })] }));
+}

package/dist/admin/shell/live-url.d.ts

@@ -0,0 +1,9 @@
+export declare const LIVE_URL_MESSAGE = "This changes the live URL. Old links stop working until a redirect exists (there are none yet). Continue?";
+/** `from` null = there was no URL part to change (a new row, a collection without a path). */
+export declare function liveUrlChanges(input: {
+    status: "draft" | "published" | undefined;
+    from: string | null;
+    to: string | null;
+}): boolean;
+/** True when the change may go ahead: not a live change, or confirmed. */
+export declare const confirmLiveUrl: (input: Parameters<typeof liveUrlChanges>[0]) => boolean;

package/dist/admin/shell/live-url.js

@@ -0,0 +1,10 @@
+// The one confirm on anything that changes a live URL (spec 2026-09-25
+// members management §5): a published page's or entry's slug, or a
+// published page's parent. Whoever the role — the mistake is the same.
+export const LIVE_URL_MESSAGE = "This changes the live URL. Old links stop working until a redirect exists (there are none yet). Continue?";
+/** `from` null = there was no URL part to change (a new row, a collection without a path). */
+export function liveUrlChanges(input) {
+    return input.status === "published" && input.from !== null && input.to !== input.from;
+}
+/** True when the change may go ahead: not a live change, or confirmed. */
+export const confirmLiveUrl = (input) => !liveUrlChanges(input) || window.confirm(LIVE_URL_MESSAGE);

package/dist/admin/shell/members-list.d.ts

@@ -0,0 +1,21 @@
+import type { MemberRecord } from "../../member-store.ts";
+import { type MemberRole } from "../../permissions.ts";
+export type MemberRow = {
+    key: string;
+    email: string;
+    fallback: boolean;
+    /** Display label. */
+    role: string;
+    /** The normalized role, what the control holds. */
+    value: MemberRole;
+    own: boolean;
+    lastAdmin: boolean;
+};
+export declare const roleLabel: (role: string) => string;
+export declare function memberRows(members: MemberRecord[], opts: {
+    me: string;
+}): MemberRow[];
+export declare const GUARD_TITLE: {
+    readonly own: "You cannot change your own membership.";
+    readonly lastAdmin: "This site needs at least one admin.";
+};

package/dist/admin/shell/members-list.js

@@ -0,0 +1,21 @@
+import { normalizeRole } from "../../permissions.js";
+export const roleLabel = (role) => (role ? role[0].toUpperCase() + role.slice(1) : "");
+export function memberRows(members, opts) {
+    const admins = members.filter((m) => normalizeRole(m.role) === "admin").length;
+    return members.map((m) => {
+        const value = normalizeRole(m.role);
+        return {
+            key: m.userId,
+            email: m.email ?? m.userId,
+            fallback: m.email === null,
+            role: roleLabel(value),
+            value,
+            own: m.userId === opts.me,
+            lastAdmin: value === "admin" && admins <= 1,
+        };
+    });
+}
+export const GUARD_TITLE = {
+    own: "You cannot change your own membership.",
+    lastAdmin: "This site needs at least one admin.",
+};

package/dist/admin/shell/session.d.ts

@@ -4,6 +4,9 @@ export type AuthConfig = {
     key: string;
     providers?: ("google" | "github")[];
 };
+export type Arrival = "invite" | "recovery";
+/** What an auth email link says it is: GoTrue's implicit flow puts `type=` in the fragment; a query form is accepted too. */
+export declare function arrivalOf(hash: string, search: string): Arrival | null;
 export type SessionState = {
     status: "loading";
 } | {
@@ -16,4 +19,7 @@ export declare function useAdminSession(auth: AuthConfig): {
     client: SupabaseClient;
     state: SessionState;
     token: () => string | null;
+    /** The email link this visit arrived on, until the Set password screen is done. */
+    arrival: Arrival | null;
+    clearArrival: () => void;
 };

package/dist/admin/shell/session.js

@@ -3,10 +3,21 @@
 // project (smoodly.io's in the cloud, the customer's own in self-host —
 // the app passes the URL and publishable key). The token getter reads a
 // ref so the ops facade, created once, always sends the current token.
+// An auth email link (invite, reset) says what it is in the URL before
+// the client consumes the fragment; the shell shows Set password for it
+// (spec 2026-09-25 members management §6).
 import { useEffect, useRef, useState } from "react";
 import { createClient } from "@supabase/supabase-js";
+/** What an auth email link says it is: GoTrue's implicit flow puts `type=` in the fragment; a query form is accepted too. */
+export function arrivalOf(hash, search) {
+    const fromHash = new URLSearchParams(hash.replace(/^#/, "")).get("type");
+    const type = fromHash ?? new URLSearchParams(search).get("type");
+    return type === "invite" || type === "recovery" ? type : null;
+}
 export function useAdminSession(auth) {
     const browser = typeof window !== "undefined";
+    // Read BEFORE the client exists: it consumes and strips the fragment as soon as it is constructed.
+    const [arrival, setArrival] = useState(() => browser ? arrivalOf(window.location.hash, window.location.search) : null);
     const [client] = useState(() => createClient(auth.url, auth.key, {
         // Own storage key: a self-hoster's own supabase-js client in the same
         // browser must never share the admin's session slot (DESIGN.md §1).
@@ -29,11 +40,15 @@ export function useAdminSession(auth) {
                 return;
             apply(null);
         });
-        const { data } = client.auth.onAuthStateChange((_event, session) => apply(session));
+        const { data } = client.auth.onAuthStateChange((event, session) => {
+            if (event === "PASSWORD_RECOVERY")
+                setArrival("recovery");
+            apply(session);
+        });
         return () => {
             active = false;
             data.subscription.unsubscribe();
         };
     }, [client]);
-    return { client, state, token: () => current.current?.access_token ?? null };
+    return { client, state, token: () => current.current?.access_token ?? null, arrival, clearArrival: () => setArrival(null) };
 }

package/dist/admin/shell/settings.d.ts

@@ -0,0 +1,15 @@
+export declare const SETTINGS_PAGES: readonly [{
+    readonly id: "members";
+    readonly title: "Members";
+}, {
+    readonly id: "roles";
+    readonly title: "Roles";
+}, {
+    readonly id: "api-keys";
+    readonly title: "API Keys";
+}];
+export type SettingsPageId = (typeof SETTINGS_PAGES)[number]["id"];
+export declare const DEFAULT_SETTINGS_PAGE: SettingsPageId;
+/** The page for the segment after /settings: the default for none, null for an unknown one. */
+export declare function settingsPage(tail: string | undefined): SettingsPageId | null;
+export declare function settingsTitle(page: SettingsPageId): string;

package/dist/admin/shell/settings.js

@@ -0,0 +1,18 @@
+// The Settings area's pages (spec 2026-09-25 §5): ids are URL segments
+// under /settings, titles are what the secondary nav and each top bar
+// show. Pure, so routing is testable without React.
+export const SETTINGS_PAGES = [
+    { id: "members", title: "Members" },
+    { id: "roles", title: "Roles" },
+    { id: "api-keys", title: "API Keys" },
+];
+export const DEFAULT_SETTINGS_PAGE = "members";
+/** The page for the segment after /settings: the default for none, null for an unknown one. */
+export function settingsPage(tail) {
+    if (tail === undefined)
+        return DEFAULT_SETTINGS_PAGE;
+    return SETTINGS_PAGES.some((p) => p.id === tail) ? tail : null;
+}
+export function settingsTitle(page) {
+    return SETTINGS_PAGES.find((p) => p.id === page).title;
+}

package/dist/admin/supabase-auth.js

@@ -1,8 +1,9 @@
 // The Supabase-backed AdminAuth: the session is verified against the
 // AUTH project (smoodly.io's in the cloud, the customer's own in self-
-// host — same code, different SMOODLY_AUTH_URL), the editors row is read
-// from the CONTENT project with the write key. No space filter: the
-// policy set scopes the write key, and self-host has one space.
+// host — same code, different SMOODLY_AUTH_URL), the members row is read
+// from the CONTENT project with the write key, its role onto the session.
+// No space filter: the policy set scopes the write key, and self-host
+// has one space.
 import { createClient } from "@supabase/supabase-js";
 export function supabaseAdminAuth(input) {
     const auth = createClient(input.authUrl, input.authKey, {
@@ -13,11 +14,11 @@ export function supabaseAdminAuth(input) {
             const res = await auth.auth.getUser(token);
             return res.data.user ? { userId: res.data.user.id, email: res.data.user.email ?? null } : null;
         },
-        async isEditor(userId) {
-            const res = await input.db.from("editors").select("user_id").eq("user_id", userId).limit(1);
+        async memberOf(userId) {
+            const res = await input.db.from("members").select("role").eq("user_id", userId).limit(1);
             if (res.error)
                 throw new Error(`smoodly: ${res.error.message}`);
-            return res.data.length > 0;
+            return res.data.length > 0 ? String(res.data[0].role) : null;
         },
     };
 }

package/dist/admin/ui/theme.js

@@ -975,6 +975,19 @@ body:has(.sm-admin){margin:0}
 }
 .sm-facts{display:grid;grid-template-columns:auto 1fr;gap:4px 10px;font-size:var(--text-sm);color:var(--text-muted)}
 .sm-usage{display:flex;flex-direction:column;gap:4px}
+/* The Settings area (spec 2026-09-25 §5): a 200px nav card beside the
+   page, both under the main column; the page keeps its own top bar. */
+.sm-settings{display:grid;grid-template-columns:200px 1fr;column-gap:var(--gutter);flex:1;min-height:0}
+.sm-settings__nav{
+  display:flex;flex-direction:column;gap:2px;padding:var(--table-pad);overflow:auto;
+  background:var(--surface-form);border-radius:var(--radius-card-lg);
+}
+.sm-settings__link{
+  display:block;padding:8px 10px;border-radius:var(--radius-md);color:var(--text);text-decoration:none;font-size:var(--text-md);
+}
+.sm-settings__link:hover{background:var(--surface-inset)}
+.sm-settings__link[aria-current="page"],.sm-settings__link[aria-current="page"]:hover{background:var(--nav-active-bg);color:var(--nav-active-fg);font-weight:600}
+.sm-settings__page{display:flex;flex-direction:column;min-width:0;min-height:0}
 `;
 /** Where the theme toggle's choice is remembered, browser-side only. */
 export const THEME_KEY = "smoodly-theme";

package/dist/index.d.ts

@@ -33,6 +33,11 @@ export type { AssetStore, UploadTicket, FinishInput, AssetQuery, AssetPage, Begi
 export { imageDimensions } from "./image-dimensions.ts";
 export { SupabasePageStore } from "./supabase-store.ts";
 export { SupabaseAssetStore } from "./supabase-asset-store.ts";
+export { MemoryMemberStore, sortMembers, memberErrors } from "./member-store.ts";
+export type { MemberStore, MemberRecord, InviteInput, InviteResult } from "./member-store.ts";
+export { SupabaseMemberStore } from "./supabase-member-store.ts";
+export { MEMBER_ROLES, can, normalizeRole, isMemberRole } from "./permissions.ts";
+export type { MemberRole, Capability } from "./permissions.ts";
 export { collectEntryRefs, collectTreeRefs } from "./refs.ts";
 export type { RefEdge, SectionLike } from "./refs.ts";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.ts";

package/dist/index.js

@@ -26,6 +26,9 @@ export { MemoryAssetStore, assetErrors, kindOf, extensionFor, objectPath, withDo
 export { imageDimensions } from "./image-dimensions.js";
 export { SupabasePageStore } from "./supabase-store.js";
 export { SupabaseAssetStore } from "./supabase-asset-store.js";
+export { MemoryMemberStore, sortMembers, memberErrors } from "./member-store.js";
+export { SupabaseMemberStore } from "./supabase-member-store.js";
+export { MEMBER_ROLES, can, normalizeRole, isMemberRole } from "./permissions.js";
 export { collectEntryRefs, collectTreeRefs } from "./refs.js";
 export { richtextBlocks, elementSchemas, IMAGE_NODE, ELEMENT_NODE } from "./richtext-walk.js";
 export { MemoryRefIndex } from "./ref-index.js";

package/dist/member-store.d.ts

@@ -0,0 +1,49 @@
+import type { MemberRole } from "./permissions.ts";
+export type MemberRecord = {
+    userId: string;
+    email: string | null;
+    role: string;
+};
+export type InviteInput = {
+    email: string;
+    role: MemberRole;
+    redirectTo: string;
+};
+/** `invited` false = the email already had a confirmed account, so no mail was sent; the row was added. (A pending invitee is re-invited: same account, mail again, `invited` true.) */
+export type InviteResult = {
+    member: MemberRecord;
+    invited: boolean;
+};
+export interface MemberStore {
+    /** Every member of the current space, by email then user id. */
+    list(): Promise<MemberRecord[]>;
+    /** The space's console URL when the control plane manages its members; null in self-host. */
+    consoleUrl(): Promise<string | null>;
+    /** Creates or finds the Auth user for the email, mails the invite when it created one, upserts the row (spec 2026-09-25 members management §3). */
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    /** Deletes the member row only; the Auth account stays. */
+    remove(userId: string): Promise<void>;
+}
+export declare const memberErrors: {
+    notFound: (userId: string) => Error;
+    noAccount: (email: string) => Error;
+};
+/** Email first (case-insensitive), rows without one last, ties by user id. */
+export declare function sortMembers(rows: MemberRecord[]): MemberRecord[];
+export declare class MemoryMemberStore implements MemberStore {
+    private rows;
+    private url;
+    /** Auth accounts that exist without a member row: email → user id. */
+    private accounts;
+    /** Emails an invite was "sent" to, in order — what a test asserts. */
+    readonly sent: string[];
+    constructor(rows?: MemberRecord[], url?: string | null, 
+    /** Auth accounts that exist without a member row: email → user id. */
+    accounts?: Record<string, string>);
+    list(): Promise<MemberRecord[]>;
+    consoleUrl(): Promise<string | null>;
+    invite(input: InviteInput): Promise<InviteResult>;
+    setRole(userId: string, role: MemberRole): Promise<MemberRecord>;
+    remove(userId: string): Promise<void>;
+}