@aphexcms/cms-core 2.0.10 → 2.1.0

package/dist/api/api-keys.d.ts

@@ -1,10 +1,14 @@
 import type { ApiResponse } from './types.js';
 import type { ApiKeyPermission, CreateApiKeyRequest } from './schemas/api-keys.js';
+import type { Capability } from '../types/capabilities.js';
 export interface ApiKey {
     id: string;
     name: string | null;
     key?: string;
+    /** Legacy coarse scopes; preserved for UI compatibility. */
     permissions: ApiKeyPermission[];
+    /** Fine-grained capability allowlist (if this key was issued with one). */
+    capabilities?: Capability[];
     createdAt: Date | null;
     lastRequest: Date | null;
     expiresAt: Date | null;

package/dist/api/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAID,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC;AAED,qBAAa,UAAU;IACtB;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAI1F;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAED,eAAO,MAAM,OAAO;;;CAGnB,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAID,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC;AAED,qBAAa,UAAU;IACtB;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAI1F;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAED,eAAO,MAAM,OAAO;;;CAGnB,CAAC"}

package/dist/api/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/api/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,qBAAa,SAAS;IACrB;;OAEG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAI7D;;;OAGG;WACU,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAIpE;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAItF;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,UAAU,CACtB,GAAG,EAAE,MAAM,EAAE,GACX,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI5D;;OAEG;WACU,aAAa,CACzB,EAAE,EAAE,MAAM,GACR,OAAO,CAAC,WAAW,CAAC;QAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMxE;;OAEG;WACU,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAG5F;AAGD,eAAO,MAAM,MAAM;;;;;;;;;CASlB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/api/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI5F,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,qBAAa,SAAS;IACrB;;OAEG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAI7D;;;OAGG;WACU,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAIpE;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAItF;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,UAAU,CACtB,GAAG,EAAE,MAAM,EAAE,GACX,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI5D;;OAEG;WACU,aAAa,CACzB,EAAE,EAAE,MAAM,GACR,OAAO,CAAC,WAAW,CAAC;QAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMxE;;OAEG;WACU,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAG5F;AAGD,eAAO,MAAM,MAAM;;;;;;;;;CASlB,CAAC"}

package/dist/api/index.d.ts

@@ -2,6 +2,7 @@ export { type ApiClient, ApiError, apiClient } from './client.js';
 export { type ApiResponse } from './types.js';
 export { documents } from './documents.js';
 export { organizations } from './organizations.js';
+export { roles } from './roles.js';
 export { assets } from './assets.js';
 export { user } from './user.js';
 export { apiKeys } from './api-keys.js';

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,mBAAmB,gBAAgB,CAAC;AACpC,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,QAAQ,CAAC;AAC5B,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,mBAAmB,gBAAgB,CAAC;AACpC,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,QAAQ,CAAC;AAC5B,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,eAAe,CAAC"}

package/dist/api/index.js

@@ -2,6 +2,7 @@
 export { ApiError, apiClient } from './client.js';
 export { documents } from './documents.js';
 export { organizations } from './organizations.js';
+export { roles } from './roles.js';
 export { assets } from './assets.js';
 export { user } from './user.js';
 export { apiKeys } from './api-keys.js';

package/dist/api/roles.d.ts

@@ -0,0 +1,22 @@
+import type { ApiResponse } from './types.js';
+import type { Role } from '../types/capabilities.js';
+import type { CreateRoleRequest, UpdateRoleRequest } from './schemas/roles.js';
+export declare class RolesApi {
+    /** List all roles (built-in + custom) for the active organization. */
+    static list(): Promise<ApiResponse<Role[]>>;
+    /** Create a custom role. Built-in names are rejected server-side. */
+    static create(data: CreateRoleRequest): Promise<ApiResponse<Role>>;
+    /** Edit description or capabilities. Works on built-ins too. */
+    static update(name: string, data: UpdateRoleRequest): Promise<ApiResponse<Role>>;
+    /** Delete a custom role. Built-ins and in-use roles are blocked server-side. */
+    static remove(name: string): Promise<ApiResponse<{
+        success: boolean;
+    }>>;
+}
+export declare const roles: {
+    list: typeof RolesApi.list;
+    create: typeof RolesApi.create;
+    update: typeof RolesApi.update;
+    remove: typeof RolesApi.remove;
+};
+//# sourceMappingURL=roles.d.ts.map

package/dist/api/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/lib/api/roles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,qBAAa,QAAQ;IACpB,sEAAsE;WACzD,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAIjD,qEAAqE;WACxD,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAIxE,gEAAgE;WACnD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAItF,gFAAgF;WACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG7E;AAED,eAAO,MAAM,KAAK;;;;;CAKjB,CAAC"}

package/dist/api/roles.js

@@ -0,0 +1,26 @@
+// Roles API client — per-organization role CRUD.
+import { apiClient } from './client.js';
+export class RolesApi {
+    /** List all roles (built-in + custom) for the active organization. */
+    static async list() {
+        return apiClient.get('/roles');
+    }
+    /** Create a custom role. Built-in names are rejected server-side. */
+    static async create(data) {
+        return apiClient.post('/roles', data);
+    }
+    /** Edit description or capabilities. Works on built-ins too. */
+    static async update(name, data) {
+        return apiClient.patch(`/roles/${encodeURIComponent(name)}`, data);
+    }
+    /** Delete a custom role. Built-ins and in-use roles are blocked server-side. */
+    static async remove(name) {
+        return apiClient.delete(`/roles/${encodeURIComponent(name)}`);
+    }
+}
+export const roles = {
+    list: RolesApi.list.bind(RolesApi),
+    create: RolesApi.create.bind(RolesApi),
+    update: RolesApi.update.bind(RolesApi),
+    remove: RolesApi.remove.bind(RolesApi)
+};

package/dist/api/schemas/api-keys.d.ts

@@ -1,16 +1,62 @@
 import { z } from 'zod';
+import { type Capability } from '../../types/capabilities.js';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
 }>;
-export declare const createApiKeyRequest: z.ZodObject<{
+export declare const apiKeyCapabilitySchema: z.ZodEnum<{
+    "document.read": "document.read";
+    "document.create": "document.create";
+    "document.update": "document.update";
+    "document.delete": "document.delete";
+    "document.publish": "document.publish";
+    "document.unpublish": "document.unpublish";
+    "asset.read": "asset.read";
+    "asset.upload": "asset.upload";
+    "asset.delete": "asset.delete";
+    "member.invite": "member.invite";
+    "member.remove": "member.remove";
+    "member.changeRole": "member.changeRole";
+    "apiKey.manage": "apiKey.manage";
+    "role.manage": "role.manage";
+    "org.settings": "org.settings";
+}>;
+export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
-    permissions: z.ZodArray<z.ZodEnum<{
+    permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         read: "read";
         write: "write";
-    }>>;
+    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    permissions: ("read" | "write")[] | undefined;
+    capabilities: Capability[] | undefined;
+    name: string;
+    expiresInDays?: number | undefined;
+}, {
+    name: string;
+    permissions?: ("read" | "write")[] | undefined;
+    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    expiresInDays?: number | undefined;
+}>>;
 export type ApiKeyPermission = z.infer<typeof apiKeyPermissionSchema>;
+export type ApiKeyCapability = z.infer<typeof apiKeyCapabilitySchema>;
 export type CreateApiKeyRequest = z.infer<typeof createApiKeyRequest>;
 //# sourceMappingURL=api-keys.d.ts.map

package/dist/api/schemas/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAIhE,eAAO,MAAM,mBAAmB;;;;;;;iBAI9B,CAAC;AAIH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIpG,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAElC,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/api/schemas/api-keys.js

@@ -1,9 +1,28 @@
 import { z } from 'zod';
+import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
 // ---------- Shared ----------
 export const apiKeyPermissionSchema = z.enum(['read', 'write']);
+export const apiKeyCapabilitySchema = z.enum(ALL_CAPABILITIES);
 // ---------- POST /settings/api-keys ----------
-export const createApiKeyRequest = z.object({
+// Two provisioning modes:
+//   1. Coarse `permissions`: 'read' alone, or 'write' (always implies read).
+//   2. Fine-grained `capabilities`: explicit allowlist; writes auto-include
+//      the matching read cap during normalization.
+// Exactly one of the two should be supplied (neither is invalid).
+export const createApiKeyRequest = z
+    .object({
     name: z.string().min(1),
-    permissions: z.array(apiKeyPermissionSchema).min(1),
+    permissions: z.array(apiKeyPermissionSchema).optional(),
+    capabilities: z.array(apiKeyCapabilitySchema).optional(),
     expiresInDays: z.number().int().positive().optional()
-});
+})
+    .refine((v) => (v.permissions && v.permissions.length > 0) || (v.capabilities && v.capabilities.length > 0), { message: 'Provide at least one of `permissions` or `capabilities`.' })
+    .transform((v) => ({
+    ...v,
+    permissions: v.permissions
+        ? v.permissions.includes('write')
+            ? ['read', 'write']
+            : ['read']
+        : undefined,
+    capabilities: v.capabilities ? normalizeCapabilities(v.capabilities) : undefined
+}));

package/dist/api/schemas/organizations.d.ts

@@ -1,15 +1,6 @@
 import { z } from 'zod';
-export declare const organizationRoleSchema: z.ZodEnum<{
-    admin: "admin";
-    editor: "editor";
-    viewer: "viewer";
-    owner: "owner";
-}>;
-export declare const invitableRoleSchema: z.ZodEnum<{
-    admin: "admin";
-    editor: "editor";
-    viewer: "viewer";
-}>;
+export declare const organizationRoleSchema: z.ZodString;
+export declare const invitableRoleSchema: z.ZodString;
 export declare const createOrganizationRequest: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
@@ -26,11 +17,7 @@ export declare const switchOrganizationRequest: z.ZodObject<{
 }, z.core.$strip>;
 export declare const inviteMemberRequest: z.ZodObject<{
     email: z.ZodString;
-    role: z.ZodEnum<{
-        admin: "admin";
-        editor: "editor";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const cancelInvitationRequest: z.ZodObject<{
     invitationId: z.ZodString;
@@ -40,12 +27,7 @@ export declare const removeMemberRequest: z.ZodObject<{
 }, z.core.$strip>;
 export declare const updateMemberRoleRequest: z.ZodObject<{
     userId: z.ZodString;
-    role: z.ZodEnum<{
-        admin: "admin";
-        editor: "editor";
-        viewer: "viewer";
-        owner: "owner";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export type OrganizationRoleSchema = z.infer<typeof organizationRoleSchema>;
 export type InvitableRoleSchema = z.infer<typeof invitableRoleSchema>;

package/dist/api/schemas/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,sBAAsB;;;;;EAAiD,CAAC;AAGrF,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AAMzE,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAIH,eAAO,MAAM,yBAAyB;;;;iBAQnC,CAAC;AAIJ,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;;;;;;;iBAGlC,CAAC;AAIH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,sBAAsB,aAAiB,CAAC;AAGrD,eAAO,MAAM,mBAAmB,aAE9B,CAAC;AAMH,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAIH,eAAO,MAAM,yBAAyB;;;;iBAQnC,CAAC;AAIJ,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAIH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/api/schemas/organizations.js

@@ -1,8 +1,19 @@
 import { z } from 'zod';
 // ---------- Shared ----------
-export const organizationRoleSchema = z.enum(['owner', 'admin', 'editor', 'viewer']);
+// Role name — any string matching the cms_roles.name format. The actual
+// existence check happens server-side against the roles table, so a
+// nonexistent name yields a 404/400 rather than a Zod error.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/);
+export const organizationRoleSchema = roleNameSchema;
 // Role used for new invitations — owners cannot be invited, only promoted.
-export const invitableRoleSchema = z.enum(['admin', 'editor', 'viewer']);
+export const invitableRoleSchema = roleNameSchema.refine((v) => v !== 'owner', {
+    message: 'owner cannot be assigned via invitation'
+});
 const metadataSchema = z.record(z.string(), z.unknown());
 // ---------- POST /organizations ----------
 export const createOrganizationRequest = z.object({

package/dist/api/schemas/roles.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import { type Capability } from '../../types/capabilities.js';
+export declare const capabilitySchema: z.ZodEnum<{
+    "document.read": "document.read";
+    "document.create": "document.create";
+    "document.update": "document.update";
+    "document.delete": "document.delete";
+    "document.publish": "document.publish";
+    "document.unpublish": "document.unpublish";
+    "asset.read": "asset.read";
+    "asset.upload": "asset.upload";
+    "asset.delete": "asset.delete";
+    "member.invite": "member.invite";
+    "member.remove": "member.remove";
+    "member.changeRole": "member.changeRole";
+    "apiKey.manage": "apiKey.manage";
+    "role.manage": "role.manage";
+    "org.settings": "org.settings";
+}>;
+export declare const createRoleRequest: z.ZodPipe<z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[];
+    name: string;
+    description?: string | null | undefined;
+}, {
+    name: string;
+    capabilities: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[];
+    description?: string | null | undefined;
+}>>;
+export declare const updateRoleRequest: z.ZodPipe<z.ZodObject<{
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[] | undefined;
+    description?: string | null | undefined;
+}, {
+    description?: string | null | undefined;
+    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+}>>;
+export type CreateRoleRequest = z.infer<typeof createRoleRequest>;
+export type UpdateRoleRequest = z.infer<typeof updateRoleRequest>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/api/schemas/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;EAE5B,CAAC;AAmBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/api/schemas/roles.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+// Runtime enum of every known capability. Unknown strings are rejected so a
+// typo in a client request can't silently grant or strip permissions.
+// The cast preserves the literal Capability union in the inferred type — Zod
+// can't see the compile-time widening of the readonly array on its own.
+export const capabilitySchema = z.enum(ALL_CAPABILITIES);
+// Role name: human-readable identifier stored on member rows and referenced
+// in the API as /api/roles/[name]. Spaces are allowed (URL-encoded client
+// side); control characters and slashes are not, to keep routing unambiguous.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/, {
+    message: 'Role name may only contain letters, numbers, spaces, underscores, and hyphens'
+});
+// ---------- POST /roles ----------
+// Capabilities are normalized on intake so any write cap pulls in the matching
+// read — a role with `document.create` but no `document.read` can't
+// realistically edit anything, and leaving that gap trips people up.
+export const createRoleRequest = z
+    .object({
+    name: roleNameSchema,
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).default([])
+})
+    .transform((v) => ({ ...v, capabilities: normalizeCapabilities(v.capabilities) }));
+// ---------- PATCH /roles/[name] ----------
+export const updateRoleRequest = z
+    .object({
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).optional()
+})
+    .refine((v) => v.description !== undefined || v.capabilities !== undefined, {
+    message: 'At least one field (description, capabilities) is required'
+})
+    .transform((v) => ({
+    ...v,
+    capabilities: v.capabilities ? normalizeCapabilities(v.capabilities) : undefined
+}));

package/dist/app-augment.d.ts

@@ -0,0 +1,32 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+import type { RbacPayload } from './types/capabilities.js';
+declare global {
+    namespace App {
+        interface PageData {
+            /**
+             * RBAC snapshot emitted by the admin layout's server load
+             * (`/admin/+layout.server.ts`). Absent on public routes (login,
+             * invitations) that don't pass through the admin layout.
+             */
+            rbac?: RbacPayload;
+        }
+    }
+}
+export {};
+//# sourceMappingURL=app-augment.d.ts.map

package/dist/app-augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-augment.d.ts","sourceRoot":"","sources":["../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,QAAQ;YACjB;;;;eAIG;YACH,IAAI,CAAC,EAAE,WAAW,CAAC;SACnB;KACD;CACD;AAED,OAAO,EAAE,CAAC"}

package/dist/app-augment.js

@@ -0,0 +1,18 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+export {};

package/dist/auth/auth-hooks.d.ts

@@ -1,6 +1,7 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import type { DatabaseAdapter } from '../db/index.js';
 import type { CMSConfig } from '../types/index.js';
+import type { RolesService } from '../services/roles-service.js';
 import type { AuthProvider } from './provider.js';
-export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter): Promise<Response | null>;
+export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter, rolesService: RolesService): Promise<Response | null>;
 //# sourceMappingURL=auth-hooks.d.ts.map

package/dist/auth/auth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8I1B"}
+{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAkB/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,YAAY,GACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAsJ1B"}

package/dist/auth/auth-hooks.js

@@ -1,11 +1,25 @@
 import { redirect } from '@sveltejs/kit';
 import { AuthError } from './auth-errors.js';
-export async function handleAuthHook(event, config, authProvider, db) {
+/**
+ * Populate `auth.capabilities` for session auth via RolesService.
+ * Runs once per request so downstream permission checks stay synchronous.
+ * No-op for API keys and partial sessions — `resolveCapabilities` handles
+ * those shapes directly.
+ */
+async function hydrateCapabilities(auth, rolesService) {
+    if (auth.type !== 'session')
+        return;
+    if (auth.capabilities)
+        return; // Already populated (e.g. by provider).
+    auth.capabilities = await rolesService.getCapabilities(auth.organizationId, auth.organizationRole);
+}
+export async function handleAuthHook(event, config, authProvider, db, rolesService) {
     const path = event.url.pathname;
     // 1. Admin UI routes - require session authentication
     if (path.startsWith('/admin')) {
         try {
             const session = await authProvider.requireSession(event.request, db);
+            await hydrateCapabilities(session, rolesService);
             event.locals.auth = session;
         }
         catch (error) {
@@ -33,6 +47,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available (can be null, route will check for signed token)
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -56,7 +71,9 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Check if GraphQL is enabled (built-in, on by default)
         const graphqlEndpoint = config.graphql !== false
-            ? (typeof config.graphql === 'object' ? config.graphql.path ?? '/api/graphql' : '/api/graphql')
+            ? typeof config.graphql === 'object'
+                ? (config.graphql.path ?? '/api/graphql')
+                : '/api/graphql'
             : undefined;
         // Require authentication for protected API routes
         const protectedApiRoutes = [
@@ -65,6 +82,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
             '/api/schemas',
             '/api/organizations',
             '/api/invitations',
+            '/api/roles',
             '/api/settings',
             '/api/instance-settings'
         ];
@@ -110,6 +128,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available in API routes
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -119,6 +138,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         try {
             const auth = await authProvider.getSession(event.request, db);
             if (auth) {
+                await hydrateCapabilities(auth, rolesService);
                 event.locals.auth = auth;
             }
         }

package/dist/client/index.d.ts

@@ -3,12 +3,14 @@ export type { SidebarUser, SidebarNavItem, SidebarBranding, SidebarData } from '
 export * from '../field-validation/rule.js';
 export * from '../field-validation/utils.js';
 export { createContentHash, hasUnpublishedChanges } from '../utils/content-hash.js';
-export { setSchemaContext, getSchemaContext } from '../schema-context.svelte';
+export { setSchemaContext, getSchemaContext } from '../schema-context.svelte.js';
+export { setPermissionsContext, usePermissions, type PermissionsContext } from '../permissions-context.svelte.js';
 export * from '../schema-utils/index.js';
 export { default as DocumentEditor } from '../components/admin/DocumentEditor.svelte';
 export { default as SchemaField } from '../components/admin/SchemaField.svelte';
 export { default as AdminApp } from '../components/AdminApp.svelte';
 export { default as Sidebar } from '../components/layout/Sidebar.svelte';
+export { default as PermissionsDebug } from '../components/admin/PermissionsDebug.svelte';
 export { default as StringField } from '../components/admin/fields/StringField.svelte';
 export { default as TextareaField } from '../components/admin/fields/TextareaField.svelte';
 export { default as NumberField } from '../components/admin/fields/NumberField.svelte';
@@ -22,6 +24,6 @@ export * from '../utils/index.js';
 export * from '../api/index.js';
 export type { ApiResponse } from '../api/index.js';
 export { toast } from 'svelte-sonner';
-export { confirmDialog, type ConfirmDialogOptions } from '../components/admin/confirm-dialog/confirm-dialog.svelte';
+export { confirmDialog, type ConfirmDialogOptions } from '../components/admin/confirm-dialog/confirm-dialog.svelte.js';
 export { default as ConfirmDialogHost } from '../components/admin/confirm-dialog/ConfirmDialogHost.svelte';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EACN,qBAAqB,EACrB,cAAc,EACd,KAAK,kBAAkB,EACvB,MAAM,+BAA+B,CAAC;AAGvC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAG1F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}

package/dist/client/index.js

@@ -8,7 +8,9 @@ export * from '../field-validation/utils.js';
 // Content hashing utilities (for client-side change detection)
 export { createContentHash, hasUnpublishedChanges } from '../utils/content-hash.js';
 // Schema context (for providing schemas to components)
-export { setSchemaContext, getSchemaContext } from '../schema-context.svelte';
+export { setSchemaContext, getSchemaContext } from '../schema-context.svelte.js';
+// Permissions context (for capability-based UI gating)
+export { setPermissionsContext, usePermissions } from '../permissions-context.svelte.js';
 // Schema utilities (for working with schemas)
 export * from '../schema-utils/index.js';
 // Components (UI components for the admin interface)
@@ -16,6 +18,8 @@ export { default as DocumentEditor } from '../components/admin/DocumentEditor.sv
 export { default as SchemaField } from '../components/admin/SchemaField.svelte';
 export { default as AdminApp } from '../components/AdminApp.svelte';
 export { default as Sidebar } from '../components/layout/Sidebar.svelte';
+// Debug helpers
+export { default as PermissionsDebug } from '../components/admin/PermissionsDebug.svelte';
 // Field components
 export { default as StringField } from '../components/admin/fields/StringField.svelte';
 export { default as TextareaField } from '../components/admin/fields/TextareaField.svelte';
@@ -32,5 +36,5 @@ export * from '../api/index.js';
 // Toast notifications (re-exported from svelte-sonner for convenience)
 export { toast } from 'svelte-sonner';
 // Confirm dialog (imperative API backed by a mounted host)
-export { confirmDialog } from '../components/admin/confirm-dialog/confirm-dialog.svelte';
+export { confirmDialog } from '../components/admin/confirm-dialog/confirm-dialog.svelte.js';
 export { default as ConfirmDialogHost } from '../components/admin/confirm-dialog/ConfirmDialogHost.svelte';