@aphexcms/cms-core 2.0.10 → 2.0.11

package/dist/types/capabilities.js

@@ -0,0 +1,216 @@
+// types/capabilities.ts
+//
+// Capability-based access control.
+//
+// Roles are per-organization rows in `cms_roles`, each mapping a role name to
+// a set of capability strings. Four built-in roles are seeded for every org
+// (owner/admin/editor/viewer); additional custom roles are purely additive.
+//
+// Authorization checks consult an auth-scoped capability set that is resolved
+// once per request (see RolesService + handleAuthHook) so `hasCapability` is
+// a synchronous set-membership check in request handlers and UI code.
+// Note: organization deletion is NOT a delegable capability — it's an
+// ownership-only action, enforced by a hardcoded `membership.role === 'owner'`
+// check in the DELETE /organizations/[id] handler. No `org.delete` cap exists
+// so it can't be granted to custom roles or picked in the role editor.
+/**
+ * Enumerate every capability. Useful for owner seeding and validation.
+ */
+export const ALL_CAPABILITIES = [
+    'document.read',
+    'document.create',
+    'document.update',
+    'document.delete',
+    'document.publish',
+    'document.unpublish',
+    'asset.read',
+    'asset.upload',
+    'asset.delete',
+    'member.invite',
+    'member.remove',
+    'member.changeRole',
+    'apiKey.manage',
+    'role.manage',
+    'org.settings'
+];
+/**
+ * Built-in role names. These are the guaranteed defaults every org receives.
+ * Custom role names are any other string.
+ */
+export const BUILTIN_ROLE_NAMES = [
+    'owner',
+    'admin',
+    'editor',
+    'viewer'
+];
+/**
+ * Seed data for the four built-in roles.
+ *
+ * This is the **default floor** — the set of capabilities a freshly-created
+ * org starts with. Once seeded, rows live in `cms_roles` and can be edited by
+ * admins (via future Roles UI). Custom roles live alongside these.
+ *
+ * Also acts as the defense-in-depth fallback: if a role lookup misses (e.g.
+ * a row got deleted out-of-band for a built-in name), the checker falls back
+ * to this map rather than locking the org out.
+ */
+export const BUILTIN_ROLE_SEED = {
+    viewer: {
+        description: 'Read-only access to documents and assets.',
+        capabilities: ['document.read', 'asset.read']
+    },
+    editor: {
+        description: 'Create, edit, and publish content.',
+        capabilities: [
+            'document.read',
+            'document.create',
+            'document.update',
+            'document.delete',
+            'document.publish',
+            'document.unpublish',
+            'asset.read',
+            'asset.upload',
+            'asset.delete'
+        ]
+    },
+    admin: {
+        description: 'All content permissions plus member and settings management.',
+        capabilities: [
+            'document.read',
+            'document.create',
+            'document.update',
+            'document.delete',
+            'document.publish',
+            'document.unpublish',
+            'asset.read',
+            'asset.upload',
+            'asset.delete',
+            'member.invite',
+            'member.remove',
+            'member.changeRole',
+            'apiKey.manage',
+            'role.manage',
+            'org.settings'
+        ]
+    },
+    owner: {
+        description: 'Full access including organization deletion.',
+        capabilities: ALL_CAPABILITIES
+    }
+};
+/**
+ * Write capabilities that imply a matching read. Keeps the UI/API from
+ * producing degenerate roles/keys that can mutate a resource but not see it.
+ */
+const DOCUMENT_WRITE_CAPS = [
+    'document.create',
+    'document.update',
+    'document.delete',
+    'document.publish',
+    'document.unpublish'
+];
+const ASSET_WRITE_CAPS = ['asset.upload', 'asset.delete'];
+/**
+ * Idempotently expand a capability list so that any write cap drags in the
+ * corresponding read. Used by both the role schema and the API-key schema.
+ */
+export function normalizeCapabilities(caps) {
+    const set = new Set(caps);
+    if (DOCUMENT_WRITE_CAPS.some((c) => set.has(c)))
+        set.add('document.read');
+    if (ASSET_WRITE_CAPS.some((c) => set.has(c)))
+        set.add('asset.read');
+    return Array.from(set);
+}
+/**
+ * Build the four built-in role rows for a newly-created organization.
+ * Used by migration, org-creation, and the runtime seeder.
+ */
+export function buildBuiltinRoleRows(organizationId) {
+    return BUILTIN_ROLE_NAMES.map((name) => ({
+        organizationId,
+        name,
+        description: BUILTIN_ROLE_SEED[name].description,
+        capabilities: [...BUILTIN_ROLE_SEED[name].capabilities],
+        isBuiltIn: true
+    }));
+}
+/**
+ * Instance roles that override everything else.
+ *
+ * `super_admin` and `admin` on the user profile receive the full capability
+ * set regardless of their per-org role. Keeps the "break glass" path usable
+ * even if an admin accidentally locks their own role down.
+ */
+const INSTANCE_ROLE_OVERRIDES = new Set(['super_admin', 'admin']);
+/**
+ * Check whether an Auth already has a capability.
+ *
+ * Expects `auth.capabilities` to have been populated by the auth hook via
+ * RolesService. If absent (e.g. legacy call site), falls back to the built-in
+ * seed for the org role so behavior remains safe.
+ */
+export function hasCapability(auth, capability) {
+    return resolveCapabilities(auth).has(capability);
+}
+/**
+ * Resolve the effective capability set for an Auth.
+ *
+ * Precedence:
+ *   1. `auth.capabilities` (pre-resolved by the auth hook) — authoritative.
+ *   2. Instance-role override (super_admin/admin) → all capabilities.
+ *   3. API keys → derived from `read`/`write` scopes.
+ *   4. Session fallback → built-in seed for the org role.
+ *   5. Partial session → empty set.
+ */
+export function resolveCapabilities(auth) {
+    if (auth.type === 'partial_session')
+        return EMPTY;
+    // Authoritative source once hydrated by the auth hook.
+    if ('capabilities' in auth && Array.isArray(auth.capabilities)) {
+        return new Set(auth.capabilities);
+    }
+    if (auth.type === 'session' && INSTANCE_ROLE_OVERRIDES.has(auth.user.role)) {
+        return new Set(ALL_CAPABILITIES);
+    }
+    if (auth.type === 'api_key') {
+        // Explicit capability allowlist wins — lets operators issue keys scoped
+        // to exactly what they need (e.g. a key that can only publish one
+        // collection). Falls back to the coarse read/write mapping otherwise
+        // for keys issued before the capability model existed.
+        if (Array.isArray(auth.capabilities) && auth.capabilities.length > 0) {
+            return new Set(auth.capabilities);
+        }
+        const caps = new Set(['document.read', 'asset.read']);
+        if (auth.permissions.includes('write')) {
+            caps.add('document.create');
+            caps.add('document.update');
+            caps.add('document.delete');
+            caps.add('document.publish');
+            caps.add('document.unpublish');
+            caps.add('asset.upload');
+            caps.add('asset.delete');
+        }
+        return caps;
+    }
+    // Session without pre-resolved capabilities → seed fallback.
+    const builtin = BUILTIN_ROLE_SEED[auth.organizationRole];
+    return builtin ? new Set(builtin.capabilities) : EMPTY;
+}
+/**
+ * Resolve the effective organization role name for an Auth, honoring
+ * instance-role overrides. Returns the role name as a string — built-in or
+ * custom — or `null` for partial sessions and API keys.
+ *
+ * Used by schema-level access lists: an allowlist like
+ * `['admin','owner','Testing']` is matched literally against this value, so
+ * custom role names participate just like built-ins do.
+ */
+export function effectiveOrganizationRole(auth) {
+    if (auth.type !== 'session')
+        return null;
+    if (INSTANCE_ROLE_OVERRIDES.has(auth.user.role))
+        return 'owner';
+    return auth.organizationRole ?? null;
+}
+const EMPTY = new Set();

package/dist/types/index.d.ts

@@ -6,6 +6,7 @@ export * from './config.js';
 export * from './user.js';
 export * from './sidebar.js';
 export * from './organization.js';
+export * from './capabilities.js';
 export * from './filters.js';
 export * from './instance.js';
 export * from './version.js';

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/types/index.js

@@ -6,6 +6,7 @@ export * from './config.js';
 export * from './user.js';
 export * from './sidebar.js';
 export * from './organization.js';
+export * from './capabilities.js';
 export * from './filters.js';
 export * from './instance.js';
 export * from './version.js';

package/dist/types/organization.d.ts

@@ -1,4 +1,13 @@
+/**
+ * Built-in organization roles. Custom roles use free-form strings — see
+ * `OrganizationRoleName` for the widened type used on persisted records.
+ */
 export type OrganizationRole = 'owner' | 'admin' | 'editor' | 'viewer';
+/**
+ * Role name stored on organization_members / invitations.
+ * Built-ins plus any custom role name defined for the organization.
+ */
+export type OrganizationRoleName = OrganizationRole | string;
 export interface Organization {
     id: string;
     name: string;
@@ -43,14 +52,14 @@ export interface OrganizationMember {
     updatedAt: Date;
     organizationId: string;
     userId: string;
-    role: OrganizationRole;
+    role: OrganizationRoleName;
     preferences: Record<string, any> | null;
     invitationId: string | null;
 }
 export interface NewOrganizationMember {
     organizationId: string;
     userId: string;
-    role: OrganizationRole;
+    role: OrganizationRoleName;
     id?: string;
     createdAt?: Date;
     updatedAt?: Date;
@@ -61,7 +70,7 @@ export interface Invitation {
     id: string;
     createdAt: Date;
     organizationId: string;
-    role: OrganizationRole;
+    role: OrganizationRoleName;
     invitedBy: string;
     email: string;
     token: string;
@@ -70,7 +79,7 @@ export interface Invitation {
 }
 export interface NewInvitation {
     organizationId: string;
-    role: OrganizationRole;
+    role: OrganizationRoleName;
     invitedBy: string;
     email: string;
     token: string;

package/dist/types/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/lib/types/organization.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAGD,MAAM,WAAW,sBAAsB;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AAGD,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,CAAC;CACF"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/lib/types/organization.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,oBAAoB,CAAC;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACtC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAGD,MAAM,WAAW,sBAAsB;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AAGD,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,CAAC;CACF"}

package/dist/types/schemas.d.ts

@@ -1,5 +1,57 @@
 import type { Rule } from '../field-validation/rule.js';
 import type { Icon as LucideIcon } from '@lucide/svelte';
+import type { OrganizationRole } from './organization.js';
+/**
+ * Declarative per-schema access control.
+ *
+ * Each operation lists the organization roles allowed to perform it. When an
+ * operation is omitted, the default capability map applies. Instance roles
+ * (`super_admin`, `admin`) always bypass these lists — see
+ * `effectiveOrganizationRole` in types/capabilities.
+ */
+/**
+ * Context passed to access policy functions.
+ *
+ * `auth` is whatever the request carries (session or API key). `doc` is the
+ * stored document for operations that target one (read/update/delete/publish/
+ * unpublish) and `undefined` for `create` — the doc doesn't exist yet.
+ */
+export interface AccessPolicyContext {
+    auth: import('./auth.js').Auth;
+    doc?: import('./document.js').Document;
+}
+/**
+ * A rule can be either a static role allowlist or a function evaluated per
+ * request. Role lists accept built-in role names (`OrganizationRole`) plus
+ * any custom role name defined on the organization. Policy functions unlock
+ * ownership-style rules that role lists can't express, e.g.
+ * `doc.createdBy === auth.user.id`.
+ */
+export type AccessRule = Array<OrganizationRole | (string & {})> | ((ctx: AccessPolicyContext) => boolean);
+export interface SchemaAccess {
+    read?: AccessRule;
+    create?: AccessRule;
+    update?: AccessRule;
+    delete?: AccessRule;
+    publish?: AccessRule;
+    unpublish?: AccessRule;
+}
+/**
+ * Per-field access control. Applied after SchemaAccess passes.
+ *
+ * - `read` — roles listed see the field in responses and UI; others get it
+ *   stripped from the payload. When omitted, the field is readable by anyone
+ *   who can read the document.
+ * - `update` — roles listed can write the field; others have their writes
+ *   silently dropped at the API boundary and the UI renders read-only.
+ *
+ * Built-in instance roles (super_admin, admin) always bypass field rules —
+ * same precedence as document-level access.
+ */
+export interface FieldAccess {
+    read?: Array<OrganizationRole | (string & {})>;
+    update?: Array<OrganizationRole | (string & {})>;
+}
 export type FieldType = 'string' | 'text' | 'number' | 'boolean' | 'slug' | 'url' | 'image' | 'file' | 'array' | 'object' | 'reference' | 'date' | 'datetime';
 export interface BaseField {
     name: string;
@@ -7,6 +59,16 @@ export interface BaseField {
     title: string;
     description?: string;
     validation?: ((rule: Rule) => Rule) | Array<(rule: Rule) => Rule>;
+    group?: string | string[];
+    /** Per-field access control — see FieldAccess. */
+    access?: FieldAccess;
+}
+export interface FieldGroup {
+    name: string;
+    title: string;
+    icon?: typeof LucideIcon;
+    default?: boolean;
+    hidden?: boolean;
 }
 export interface DependentList {
     dependsOn: string;
@@ -143,9 +205,12 @@ export interface DocumentType {
     title: string;
     description?: string;
     icon?: typeof LucideIcon;
+    group?: string;
+    groups?: FieldGroup[];
     fields: Field[];
     preview?: PreviewConfig;
     orderings?: Ordering[];
+    access?: SchemaAccess;
     createdAt?: Date | null;
     updatedAt?: Date | null;
 }
@@ -168,9 +233,12 @@ export interface SchemaType {
     title: string;
     description?: string;
     icon?: typeof LucideIcon;
+    group?: string;
+    groups?: FieldGroup[];
     fields: Field[];
     preview?: PreviewConfig;
     orderings?: Ordering[];
+    access?: SchemaAccess;
     createdAt?: Date | null;
     updatedAt?: Date | null;
 }
@@ -181,9 +249,12 @@ export interface NewSchemaType {
     title: string;
     description?: string;
     icon?: typeof LucideIcon;
+    group?: string;
+    groups?: FieldGroup[];
     fields: Field[];
     preview?: PreviewConfig;
     orderings?: Ordering[];
+    access?: SchemaAccess;
     createdAt?: Date | null;
     updatedAt?: Date | null;
 }

package/dist/types/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/types/schemas.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGzD,MAAM,MAAM,SAAS,GAClB,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,SAAS,GACT,MAAM,GACN,KAAK,GACL,OAAO,GACP,MAAM,GACN,OAAO,GACP,QAAQ,GACR,WAAW,GACX,MAAM,GACN,UAAU,CAAC;AAEd,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,aAAa,CAAC;IACxE,OAAO,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAC9B,SAAS,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;KACtC,CAAC;CACF;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IAC1C,IAAI,EAAE,KAAK,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,aAAa,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,cAAe,SAAQ,SAAS;IAChD,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,KAAK,GACd,WAAW,GACX,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,CAAC;AAElB,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,YAAY,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;CACxB;AAGD;;GAEG;AAEH,MAAM,WAAW,UAAU;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/types/schemas.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,QAAQ,EAAE,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,OAAO,YAAY,EAAE,QAAQ,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GACnB,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,GACvC,CAAC,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC5B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,SAAS,CAAC,EAAE,UAAU,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,CAAC,EAAE,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;CACjD;AAGD,MAAM,MAAM,SAAS,GAClB,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,SAAS,GACT,MAAM,GACN,KAAK,GACL,OAAO,GACP,MAAM,GACN,OAAO,GACP,QAAQ,GACR,WAAW,GACX,MAAM,GACN,UAAU,CAAC;AAEd,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,aAAa,CAAC;IACxE,OAAO,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAC9B,SAAS,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;KACtC,CAAC;CACF;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IAC1C,IAAI,EAAE,KAAK,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,aAAa,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,cAAe,SAAQ,SAAS;IAChD,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,KAAK,GACd,WAAW,GACX,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,CAAC;AAElB,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,YAAY,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;CACxB;AAGD;;GAEG;AAEH,MAAM,WAAW,UAAU;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,UAAU,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB"}

package/dist/types/sidebar.d.ts

@@ -19,7 +19,7 @@ export interface SidebarOrganization {
     id: string;
     name: string;
     slug: string;
-    role: 'owner' | 'admin' | 'editor' | 'viewer';
+    role: string;
     isActive: boolean;
     metadata?: any;
 }

package/dist/types/sidebar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar.d.ts","sourceRoot":"","sources":["../../src/lib/types/sidebar.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACtC,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC"}
+{"version":3,"file":"sidebar.d.ts","sourceRoot":"","sources":["../../src/lib/types/sidebar.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACtC,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC"}

package/dist/utils/mime-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AAuCD,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CA8EtB"}
+{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AAgED,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CA8EtB"}

package/dist/utils/mime-detect.js

@@ -116,12 +116,34 @@ const BLOCKED_MIME_TYPES = new Set([
  * Blocked file extensions (regardless of MIME type).
  */
 const BLOCKED_EXTENSIONS = new Set([
-    '.exe', '.dll', '.bat', '.cmd', '.com', '.msi', '.scr', '.pif',
-    '.sh', '.bash', '.zsh', '.csh', '.ksh',
-    '.app', '.command', '.action',
-    '.ps1', '.psm1', '.psd1',
-    '.vbs', '.vbe', '.js', '.jse', '.wsf', '.wsh',
-    '.reg', '.inf', '.hta',
+    '.exe',
+    '.dll',
+    '.bat',
+    '.cmd',
+    '.com',
+    '.msi',
+    '.scr',
+    '.pif',
+    '.sh',
+    '.bash',
+    '.zsh',
+    '.csh',
+    '.ksh',
+    '.app',
+    '.command',
+    '.action',
+    '.ps1',
+    '.psm1',
+    '.psd1',
+    '.vbs',
+    '.vbe',
+    '.js',
+    '.jse',
+    '.wsf',
+    '.wsh',
+    '.reg',
+    '.inf',
+    '.hta',
     '.wasm'
 ]);
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aphexcms/cms-core",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Aphex CMS Core - A Sanity-style CMS with ports and adapters architecture",
   "publishConfig": {
     "access": "public",
@@ -36,6 +36,10 @@
       "types": "./dist/schema/index.d.ts",
       "default": "./dist/schema/index.js"
     },
+    "./app-augment": {
+      "types": "./dist/app-augment.d.ts",
+      "default": "./dist/app-augment.js"
+    },
     "./routes/*": {
       "types": "./dist/routes/*.d.ts",
       "default": "./dist/routes/*.js"
@@ -73,7 +77,7 @@
     "svelte": "^5.44.0",
     "tailwind-merge": "^3.4.0",
     "tailwind-variants": "^3.2.2",
-    "@aphexcms/ui": "0.3.2"
+    "@aphexcms/ui": "0.3.3"
   },
   "peerDependenciesMeta": {
     "graphql": {