@aphexcms/cms-core 2.0.10 → 2.1.0

package/dist/lib/server/index.js

@@ -22,6 +22,7 @@ export * from '../storage/providers/storage.js';
 // Services (includes sharp for image processing)
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
+export { RolesService } from '../services/roles-service.js';
 // API Route handlers (for re-exporting in your app's API routes)
 // Re-export from routes-exports to avoid .js extension issues in workspace
 export * from '../routes-exports.js';

package/dist/lib/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,+DAA+D;AAE/D,sDAAsD;AACtD,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAsB,MAAM,qBAAqB,CAAC;AAEpE,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAE5D,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC,kCAAkC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAE7C,iDAAiD;AACjD,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,iEAAiE;AACjE,2EAA2E;AAC3E,cAAc,mBAAmB,CAAC;AAElC,mBAAmB;AACnB,cAAc,uBAAuB,CAAC;AAEtC,uCAAuC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,yCAAyC;AACzC,OAAO,EACN,oBAAoB,EAIpB,MAAM,kBAAkB,CAAC;AAE1B,uCAAuC;AACvC,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EAKf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,+DAA+D;AAE/D,sDAAsD;AACtD,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAsB,MAAM,qBAAqB,CAAC;AAEpE,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAE5D,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC,kCAAkC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAE7C,iDAAiD;AACjD,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,iEAAiE;AACjE,2EAA2E;AAC3E,cAAc,mBAAmB,CAAC;AAElC,mBAAmB;AACnB,cAAc,uBAAuB,CAAC;AAEtC,uCAAuC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,yCAAyC;AACzC,OAAO,EACN,oBAAoB,EAIpB,MAAM,kBAAkB,CAAC;AAE1B,uCAAuC;AACvC,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EAKf,MAAM,oBAAoB,CAAC"}

package/dist/lib/services/index.d.ts

@@ -1,5 +1,6 @@
 export { AssetService } from './asset-service.js';
 export type { AssetUploadData, AssetFilters } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
+export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/lib/services/index.js

@@ -3,5 +3,6 @@
 // Re-export services
 export { AssetService } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
+export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,uBAAuB;AAEvB,qBAAqB;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,uBAAuB;AAEvB,qBAAqB;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/lib/services/roles-service.d.ts

@@ -0,0 +1,35 @@
+import type { CacheAdapter } from '../cache/index.js';
+import type { DatabaseAdapter } from '../db/index.js';
+import { type Capability, type Role } from '../types/capabilities.js';
+/**
+ * RolesService — caches per-org role capability lookups.
+ *
+ * Mirrors HierarchyService's shape so both services share cache and
+ * in-flight deduplication patterns.
+ */
+export declare class RolesService {
+    private db;
+    private cache;
+    private ttl;
+    private static DEFAULT_TTL;
+    private inflight;
+    constructor(db: DatabaseAdapter, cache?: CacheAdapter | null, ttl?: number);
+    /**
+     * Resolve the capability list for `(organizationId, roleName)`.
+     *
+     * Fallback order:
+     *   1. Cache hit.
+     *   2. DB lookup for the `(org, name)` row.
+     *   3. Built-in seed if the name matches a built-in.
+     *   4. Empty list — unknown role → no capabilities.
+     */
+    getCapabilities(organizationId: string, roleName: string): Promise<Capability[]>;
+    /** List every role defined for an organization. */
+    listRoles(organizationId: string): Promise<Role[]>;
+    /** Idempotent — safe to call on every request if you want. */
+    ensureBuiltins(organizationId: string): Promise<void>;
+    /** Invalidate cache entries for a single role. Call after mutation. */
+    invalidate(organizationId: string, roleName?: string): Promise<void>;
+    private resolveFromDb;
+}
+//# sourceMappingURL=roles-service.d.ts.map

package/dist/lib/services/roles-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/roles-service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAGN,KAAK,UAAU,EACf,KAAK,IAAI,EACT,MAAM,uBAAuB,CAAC;AAI/B;;;;;GAKG;AACH,qBAAa,YAAY;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,GAAG;IANZ,OAAO,CAAC,MAAM,CAAC,WAAW,CAAM;IAChC,OAAO,CAAC,QAAQ,CAA4C;gBAGnD,EAAE,EAAE,eAAe,EACnB,KAAK,GAAE,YAAY,GAAG,IAAW,EACjC,GAAG,GAAE,MAAiC;IAG/C;;;;;;;;OAQG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAqBtF,mDAAmD;IAC7C,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIxD,8DAA8D;IACxD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,uEAAuE;IACjE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW5D,aAAa;CA2B3B"}

package/dist/lib/services/roles-service.js

@@ -0,0 +1,91 @@
+// services/roles-service.ts
+//
+// Resolves an org + role name to a concrete capability set, with a TTL cache
+// and a built-in fallback so a missing row never locks an org out.
+import { BUILTIN_ROLE_SEED, BUILTIN_ROLE_NAMES } from '../types/capabilities.js';
+import { cmsLogger } from '../utils/logger.js';
+/**
+ * RolesService — caches per-org role capability lookups.
+ *
+ * Mirrors HierarchyService's shape so both services share cache and
+ * in-flight deduplication patterns.
+ */
+export class RolesService {
+    db;
+    cache;
+    ttl;
+    static DEFAULT_TTL = 30; // 30 seconds — roles change infrequently but should pick up edits quickly.
+    inflight = new Map();
+    constructor(db, cache = null, ttl = RolesService.DEFAULT_TTL) {
+        this.db = db;
+        this.cache = cache;
+        this.ttl = ttl;
+    }
+    /**
+     * Resolve the capability list for `(organizationId, roleName)`.
+     *
+     * Fallback order:
+     *   1. Cache hit.
+     *   2. DB lookup for the `(org, name)` row.
+     *   3. Built-in seed if the name matches a built-in.
+     *   4. Empty list — unknown role → no capabilities.
+     */
+    async getCapabilities(organizationId, roleName) {
+        const key = cacheKey(organizationId, roleName);
+        if (this.cache) {
+            const cached = await this.cache.get(key);
+            if (cached)
+                return cached;
+        }
+        const existing = this.inflight.get(key);
+        if (existing)
+            return existing;
+        const promise = this.resolveFromDb(organizationId, roleName).then(async (caps) => {
+            if (this.cache)
+                await this.cache.set(key, caps, this.ttl);
+            this.inflight.delete(key);
+            return caps;
+        });
+        this.inflight.set(key, promise);
+        return promise;
+    }
+    /** List every role defined for an organization. */
+    async listRoles(organizationId) {
+        return this.db.listRoles(organizationId);
+    }
+    /** Idempotent — safe to call on every request if you want. */
+    async ensureBuiltins(organizationId) {
+        await this.db.seedBuiltinRoles(organizationId);
+    }
+    /** Invalidate cache entries for a single role. Call after mutation. */
+    async invalidate(organizationId, roleName) {
+        if (!this.cache)
+            return;
+        if (roleName) {
+            await this.cache.delete(cacheKey(organizationId, roleName));
+            return;
+        }
+        await this.cache.invalidateByPrefix(`roles:${organizationId}:`);
+    }
+    // ---- internals -----------------------------------------------------------
+    async resolveFromDb(organizationId, roleName) {
+        const row = await this.db.findRoleByName(organizationId, roleName);
+        if (row) {
+            cmsLogger.debug('[RBAC]', `Resolved role "${roleName}" in org=${organizationId} via DB (${row.capabilities.length} caps)`);
+            return row.capabilities;
+        }
+        // Defense in depth: if a built-in row went missing (e.g. not yet seeded
+        // on a pre-existing org), fall back to the hard-coded seed so the app
+        // stays functional until `ensureBuiltins` runs.
+        if (BUILTIN_ROLE_NAMES.includes(roleName)) {
+            cmsLogger.warn('[RBAC]', `Role "${roleName}" not found in org=${organizationId} — using BUILTIN_ROLE_SEED fallback. Run ensureBuiltins.`);
+            return [...BUILTIN_ROLE_SEED[roleName].capabilities];
+        }
+        cmsLogger.warn('[RBAC]', `Unknown role "${roleName}" in org=${organizationId} — granting no capabilities`);
+        return [];
+    }
+}
+function cacheKey(organizationId, roleName) {
+    return `roles:${organizationId}:${roleName}`;
+}
+//# sourceMappingURL=roles-service.js.map

package/dist/lib/services/roles-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-service.js","sourceRoot":"","sources":["../../../src/lib/services/roles-service.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,EAAE;AACF,6EAA6E;AAC7E,mEAAmE;AAInE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAGlB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IAKf;IACA;IACA;IAND,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,2EAA2E;IACpG,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE5D,YACS,EAAmB,EACnB,QAA6B,IAAI,EACjC,MAAc,YAAY,CAAC,WAAW;QAFtC,OAAE,GAAF,EAAE,CAAiB;QACnB,UAAK,GAAL,KAAK,CAA4B;QACjC,QAAG,GAAH,GAAG,CAAmC;IAC5C,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB,EAAE,QAAgB;QAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAE/C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAChF,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,SAAS,CAAC,cAAsB;QACrC,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,cAAc,CAAC,cAAsB;QAC1C,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,UAAU,CAAC,cAAsB,EAAE,QAAiB;QACzD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5D,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,cAAc,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,6EAA6E;IAErE,KAAK,CAAC,aAAa,CAAC,cAAsB,EAAE,QAAgB;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,GAAG,EAAE,CAAC;YACT,SAAS,CAAC,KAAK,CACd,QAAQ,EACR,kBAAkB,QAAQ,YAAY,cAAc,YAAY,GAAG,CAAC,YAAY,CAAC,MAAM,QAAQ,CAC/F,CAAC;YACF,OAAO,GAAG,CAAC,YAAY,CAAC;QACzB,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,gDAAgD;QAChD,IAAK,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,SAAS,CAAC,IAAI,CACb,QAAQ,EACR,SAAS,QAAQ,sBAAsB,cAAc,0DAA0D,CAC/G,CAAC;YACF,OAAO,CAAC,GAAG,iBAAiB,CAAC,QAA4B,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1E,CAAC;QAED,SAAS,CAAC,IAAI,CACb,QAAQ,EACR,iBAAiB,QAAQ,YAAY,cAAc,6BAA6B,CAChF,CAAC;QACF,OAAO,EAAE,CAAC;IACX,CAAC;;AAGF,SAAS,QAAQ,CAAC,cAAsB,EAAE,QAAgB;IACzD,OAAO,SAAS,cAAc,IAAI,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/dist/lib/services/version-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,cAAc;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAI9C;;OAEG;IACG,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAelC;;OAEG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA2B3B;;OAEG;IACG,kBAAkB,CACvB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgB3B;;OAEG;IACG,cAAc,CACnB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAqCrB,YAAY,CACjB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC;IAKzB,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAKpB,gBAAgB;CAoB9B"}
+{"version":3,"file":"version-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,cAAc;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAI9C;;OAEG;IACG,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAelC;;OAEG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA2B3B;;OAEG;IACG,kBAAkB,CACvB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgB3B;;OAEG;IACG,cAAc,CACnB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAqCrB,YAAY,CACjB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC;IAKzB,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAKpB,gBAAgB;CAuB9B"}

package/dist/lib/services/version-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-service.js","sourceRoot":"","sources":["../../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IAClB,WAAW,CAAS;IAE5B,YAAY,OAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAClB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,SAA8B,EAC9B,IAAS,EACT,MAAsB;QAEtB,IAAI,CAAC,EAAE,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC;YAC9C,UAAU;YACV,cAAc;YACd,SAAS;YACT,IAAI;YACJ,SAAS,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACpB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,IAAS,EACT,MAAe;QAEf,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACxF,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,qBAAsB,CAAC;wBACtC,UAAU;wBACV,cAAc;wBACd,SAAS,EAAE,OAAO;wBAClB,IAAI;wBACJ,SAAS,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClF,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACvB,EAAmB,EACnB,cAAsB,EACtB,UAAkB;QAElB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,IAAI,CAAC,aAAa,CACvB,EAAE,EACF,cAAc,EACd,UAAU,EACV,SAAS,EACT,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACnB,CAAC;QAEF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CACnB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,aAAqB,EACrB,MAAe;QAEf,IAAI,CAAC,EAAE,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAC5C,cAAc,EACd,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,MAAM,CACN,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,qBAAsB,CAAC;wBACtC,UAAU;wBACV,cAAc;wBACd,SAAS,EAAE,OAAO;wBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,SAAS,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,OAA6C;QAE7C,IAAI,CAAC,EAAE,CAAC,oBAAoB;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,aAAqB;QAErB,IAAI,CAAC,EAAE,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,EAAmB,EACnB,UAAkB,EAClB,cAAsB;QAEtB,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO;QAClC,IAAI,CAAC,EAAE,CAAC,oBAAoB,IAAI,CAAC,EAAE,CAAC,sBAAsB;YAAE,OAAO;QAEnE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE;YACrF,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,CAAC;SACT,CAAC,CAAC;QAEH,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"version-service.js","sourceRoot":"","sources":["../../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IAClB,WAAW,CAAS;IAE5B,YAAY,OAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAClB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,SAA8B,EAC9B,IAAS,EACT,MAAsB;QAEtB,IAAI,CAAC,EAAE,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC;YAC9C,UAAU;YACV,cAAc;YACd,SAAS;YACT,IAAI;YACJ,SAAS,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACpB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,IAAS,EACT,MAAe;QAEf,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACxF,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,qBAAsB,CAAC;wBACtC,UAAU;wBACV,cAAc;wBACd,SAAS,EAAE,OAAO;wBAClB,IAAI;wBACJ,SAAS,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClF,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACvB,EAAmB,EACnB,cAAsB,EACtB,UAAkB;QAElB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,IAAI,CAAC,aAAa,CACvB,EAAE,EACF,cAAc,EACd,UAAU,EACV,SAAS,EACT,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACnB,CAAC;QAEF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CACnB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,aAAqB,EACrB,MAAe;QAEf,IAAI,CAAC,EAAE,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAC5C,cAAc,EACd,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,MAAM,CACN,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,qBAAsB,CAAC;wBACtC,UAAU;wBACV,cAAc;wBACd,SAAS,EAAE,OAAO;wBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,SAAS,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,OAA6C;QAE7C,IAAI,CAAC,EAAE,CAAC,oBAAoB;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,EAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,aAAqB;QAErB,IAAI,CAAC,EAAE,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,EAAmB,EACnB,UAAkB,EAClB,cAAsB;QAEtB,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO;QAClC,IAAI,CAAC,EAAE,CAAC,oBAAoB,IAAI,CAAC,EAAE,CAAC,sBAAsB;YAAE,OAAO;QAEnE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE;YACrF,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,CAAC;SACT,CAAC,CAAC;QAEH,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,sBAAsB,CAC9B,UAAU,EACV,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzB,CAAC;QACH,CAAC;IACF,CAAC;CACD"}

package/dist/lib/types/auth.d.ts

@@ -1,5 +1,6 @@
 import type { CMSUser } from './user.js';
 import type { OrganizationRole } from './organization.js';
+import type { Capability } from './capabilities.js';
 export interface SessionAuth {
     type: 'session';
     user: CMSUser;
@@ -8,12 +9,26 @@ export interface SessionAuth {
         expiresAt: Date;
     };
     organizationId: string;
-    organizationRole: OrganizationRole;
+    /**
+     * Role name for the user in the active organization.
+     *
+     * Built-in roles (`owner`/`admin`/`editor`/`viewer`) are typed as the
+     * `OrganizationRole` union; custom roles defined per-org are plain
+     * strings. Consumers that need to branch on built-ins should use
+     * `effectiveOrganizationRole` from types/capabilities.
+     */
+    organizationRole: OrganizationRole | string;
+    /**
+     * Capabilities resolved for this session by the auth hook (RolesService).
+     * Present for fully-authenticated sessions. When absent, callers fall
+     * back to built-in seed values — see `resolveCapabilities`.
+     */
+    capabilities?: Capability[];
     organizations?: Array<{
         id: string;
         name: string;
         slug: string;
-        role: OrganizationRole;
+        role: OrganizationRole | string;
         isActive: boolean;
         metadata?: any;
     }>;
@@ -34,29 +49,48 @@ export interface ApiKeyAuth {
     type: 'api_key';
     keyId: string;
     name: string;
+    /**
+     * Legacy coarse-grained scopes: `read` (read capabilities) and `write`
+     * (mutating capabilities). Preserved for backwards compatibility with
+     * keys issued before the fine-grained capability model. Still used as
+     * the fallback source when `capabilities` is not populated.
+     */
     permissions: ('read' | 'write')[];
+    /**
+     * Fine-grained capability allowlist for this API key. When present,
+     * overrides the coarse `permissions` mapping — the key can do exactly
+     * what's listed and nothing else. Storage format on the key metadata
+     * matches the Capability union.
+     */
+    capabilities?: Capability[];
     organizationId: string;
     environment?: string;
     lastUsedAt?: Date;
 }
 export type Auth = SessionAuth | PartialSessionAuth | ApiKeyAuth;
 /**
- * Check if a user has write permissions based on their organization role
- * Viewers have read-only access
+ * Does the user have *any* mutating capability?
+ *
+ * Coarse-grained on purpose: this is for UI gating where you just want to
+ * decide whether to show the entire edit/upload surface. Don't use it to
+ * authorise a specific mutation — the server's PermissionChecker does that
+ * per-operation (canCreate vs canUpdate vs canDelete, etc).
  */
 export declare function canWrite(auth: Auth): boolean;
 /**
- * Check if a user can manage organization members
- * Only owners and admins can manage members
+ * Can the user manage organization members (invite / remove / change role)?
  */
 export declare function canManageMembers(auth: Auth): boolean;
 /**
- * Check if a user can manage API keys
- * Only owners and admins can manage API keys
+ * Can the user manage API keys?
  */
 export declare function canManageApiKeys(auth: Auth): boolean;
 /**
- * Check if a user is a viewer (read-only access)
+ * Is this session effectively read-only?
+ *
+ * Inverse of `canWrite`. Named for historical reasons — prefer `canWrite()`
+ * for positive checks; `isViewer()` remains available for call sites that
+ * read more naturally in the negative (e.g. `isReadOnly={isViewer(auth)}`).
  */
 export declare function isViewer(auth: Auth): boolean;
 //# sourceMappingURL=auth.d.ts.map

package/dist/lib/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/types/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,aAAa,CAAC,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,CAAC;QACvB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;KACf,CAAC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;CACF;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAIjE;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAM5C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAGpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAGpD;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAM5C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/types/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;KACf,CAAC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;CACF;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,WAAW,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAYjE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAMpD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAE5C"}

package/dist/lib/types/auth.js

@@ -1,43 +1,48 @@
-// Access control utilities
+// Access control utilities.
+//
+// These are thin wrappers over the capability system. They exist so callers
+// don't need to import `hasCapability` + a specific capability string for the
+// common "can this user do X" branching in server loads and UI gating.
+//
+// Capabilities are resolved once per request by the auth hook and stored on
+// `auth.capabilities`, so these remain synchronous.
+import { hasCapability } from './capabilities.js';
 /**
- * Check if a user has write permissions based on their organization role
- * Viewers have read-only access
+ * Does the user have *any* mutating capability?
+ *
+ * Coarse-grained on purpose: this is for UI gating where you just want to
+ * decide whether to show the entire edit/upload surface. Don't use it to
+ * authorise a specific mutation — the server's PermissionChecker does that
+ * per-operation (canCreate vs canUpdate vs canDelete, etc).
  */
 export function canWrite(auth) {
-    if (auth.type === 'partial_session')
-        return false;
-    if (auth.type === 'api_key') {
-        return auth.permissions.includes('write');
-    }
-    return auth.organizationRole !== 'viewer';
+    return (hasCapability(auth, 'document.create') ||
+        hasCapability(auth, 'document.update') ||
+        hasCapability(auth, 'document.delete') ||
+        hasCapability(auth, 'asset.upload'));
 }
 /**
- * Check if a user can manage organization members
- * Only owners and admins can manage members
+ * Can the user manage organization members (invite / remove / change role)?
  */
 export function canManageMembers(auth) {
-    if (auth.type === 'api_key' || auth.type === 'partial_session')
-        return false;
-    return auth.organizationRole === 'owner' || auth.organizationRole === 'admin';
+    return (hasCapability(auth, 'member.invite') ||
+        hasCapability(auth, 'member.remove') ||
+        hasCapability(auth, 'member.changeRole'));
 }
 /**
- * Check if a user can manage API keys
- * Only owners and admins can manage API keys
+ * Can the user manage API keys?
  */
 export function canManageApiKeys(auth) {
-    if (auth.type === 'api_key' || auth.type === 'partial_session')
-        return false;
-    return auth.organizationRole === 'owner' || auth.organizationRole === 'admin';
+    return hasCapability(auth, 'apiKey.manage');
 }
 /**
- * Check if a user is a viewer (read-only access)
+ * Is this session effectively read-only?
+ *
+ * Inverse of `canWrite`. Named for historical reasons — prefer `canWrite()`
+ * for positive checks; `isViewer()` remains available for call sites that
+ * read more naturally in the negative (e.g. `isReadOnly={isViewer(auth)}`).
  */
 export function isViewer(auth) {
-    if (auth.type === 'partial_session')
-        return true;
-    if (auth.type === 'api_key') {
-        return !auth.permissions.includes('write');
-    }
-    return auth.organizationRole === 'viewer';
+    return !canWrite(auth);
 }
 //# sourceMappingURL=auth.js.map

package/dist/lib/types/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/types/auth.ts"],"names":[],"mappings":"AAgDA,2BAA2B;AAE3B;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAU;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAU;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/types/auth.ts"],"names":[],"mappings":"AA4EA,4BAA4B;AAC5B,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,oDAAoD;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAU;IAClC,OAAO,CACN,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CACnC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,OAAO,CACN,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC;QACpC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC;QACpC,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,CACxC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/lib/types/capabilities.d.ts

@@ -0,0 +1,104 @@
+import type { Auth } from './auth.js';
+import type { OrganizationRole } from './organization.js';
+/**
+ * Flat, serializable permission primitives.
+ *
+ * Append-only: removing or renaming a value silently weakens every call site.
+ * If a capability is no longer needed, leave the string and stop granting it.
+ */
+export type Capability = 'document.read' | 'document.create' | 'document.update' | 'document.delete' | 'document.publish' | 'document.unpublish' | 'asset.read' | 'asset.upload' | 'asset.delete' | 'member.invite' | 'member.remove' | 'member.changeRole' | 'apiKey.manage' | 'role.manage' | 'org.settings';
+/**
+ * Enumerate every capability. Useful for owner seeding and validation.
+ */
+export declare const ALL_CAPABILITIES: readonly Capability[];
+/**
+ * Built-in role names. These are the guaranteed defaults every org receives.
+ * Custom role names are any other string.
+ */
+export declare const BUILTIN_ROLE_NAMES: readonly OrganizationRole[];
+/**
+ * Seed data for the four built-in roles.
+ *
+ * This is the **default floor** — the set of capabilities a freshly-created
+ * org starts with. Once seeded, rows live in `cms_roles` and can be edited by
+ * admins (via future Roles UI). Custom roles live alongside these.
+ *
+ * Also acts as the defense-in-depth fallback: if a role lookup misses (e.g.
+ * a row got deleted out-of-band for a built-in name), the checker falls back
+ * to this map rather than locking the org out.
+ */
+export declare const BUILTIN_ROLE_SEED: Record<OrganizationRole, {
+    description: string;
+    capabilities: readonly Capability[];
+}>;
+/**
+ * Idempotently expand a capability list so that any write cap drags in the
+ * corresponding read. Used by both the role schema and the API-key schema.
+ */
+export declare function normalizeCapabilities(caps: readonly Capability[]): Capability[];
+/**
+ * A persisted role row (per organization).
+ */
+export interface Role {
+    id: string;
+    organizationId: string;
+    name: string;
+    description: string | null;
+    capabilities: Capability[];
+    isBuiltIn: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface NewRole {
+    organizationId: string;
+    name: string;
+    description?: string | null;
+    capabilities: Capability[];
+    isBuiltIn?: boolean;
+}
+/**
+ * Build the four built-in role rows for a newly-created organization.
+ * Used by migration, org-creation, and the runtime seeder.
+ */
+export declare function buildBuiltinRoleRows(organizationId: string): NewRole[];
+/**
+ * Check whether an Auth already has a capability.
+ *
+ * Expects `auth.capabilities` to have been populated by the auth hook via
+ * RolesService. If absent (e.g. legacy call site), falls back to the built-in
+ * seed for the org role so behavior remains safe.
+ */
+export declare function hasCapability(auth: Auth, capability: Capability): boolean;
+/**
+ * Resolve the effective capability set for an Auth.
+ *
+ * Precedence:
+ *   1. `auth.capabilities` (pre-resolved by the auth hook) — authoritative.
+ *   2. Instance-role override (super_admin/admin) → all capabilities.
+ *   3. API keys → derived from `read`/`write` scopes.
+ *   4. Session fallback → built-in seed for the org role.
+ *   5. Partial session → empty set.
+ */
+export declare function resolveCapabilities(auth: Auth): ReadonlySet<Capability>;
+/**
+ * Resolve the effective organization role name for an Auth, honoring
+ * instance-role overrides. Returns the role name as a string — built-in or
+ * custom — or `null` for partial sessions and API keys.
+ *
+ * Used by schema-level access lists: an allowlist like
+ * `['admin','owner','Testing']` is matched literally against this value, so
+ * custom role names participate just like built-ins do.
+ */
+export declare function effectiveOrganizationRole(auth: Auth): string | null;
+/**
+ * Shape of the RBAC payload exposed to the client by the admin layout's
+ * server load. Mirror this in `App.PageData` so Svelte pages can read
+ * `$page.data.rbac` without casting to `any`.
+ */
+export interface RbacPayload {
+    /** Current organization role name (built-in or custom). `null` for none. */
+    role: string | null;
+    /** Capabilities resolved for this session. Safe to treat as read-only. */
+    capabilities: Capability[];
+}
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/lib/types/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAMlB;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAgBxC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA4C5D,CAAC;AAeF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAK/E;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}