@aphexcms/cms-core 2.0.10 → 2.1.0

package/dist/permissions-context.svelte.js

@@ -0,0 +1,79 @@
+// Svelte context for capability-based UI gating.
+//
+// Set once at the root of the admin shell with a reactive capability source;
+// descendants consume via `usePermissions()`. Mirrors the server-side
+// `hasCapability()` API so the same mental model applies on both sides.
+import { getContext, setContext } from 'svelte';
+const KEY = Symbol.for('aphex.permissions');
+/**
+ * Publish a capability context to descendants.
+ *
+ * `getCapabilities` is a getter rather than a static array so reactive
+ * sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
+ * `can()` call re-reads through the closure.
+ *
+ * @example
+ * ```svelte
+ * <script>
+ *   import { page } from '$app/state';
+ *   import { setPermissionsContext } from '@aphexcms/cms-core';
+ *   setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
+ * </script>
+ * ```
+ */
+export function setPermissionsContext(getCapabilities, getRole = () => null) {
+    const ctx = {
+        get capabilities() {
+            return getCapabilities();
+        },
+        get role() {
+            return getRole();
+        },
+        can(cap) {
+            return getCapabilities().includes(cap);
+        },
+        canAny(...caps) {
+            const current = getCapabilities();
+            return caps.some((c) => current.includes(c));
+        },
+        canAll(...caps) {
+            const current = getCapabilities();
+            return caps.every((c) => current.includes(c));
+        }
+    };
+    setContext(KEY, ctx);
+    return ctx;
+}
+/**
+ * Read the capability context set by an ancestor.
+ *
+ * When no provider is present (e.g. a component rendered in isolation during
+ * tests or Storybook), returns a deny-all stub with a one-time dev warning
+ * rather than throwing — that way consumers degrade to "no affordances shown"
+ * instead of crashing the tree.
+ */
+export function usePermissions() {
+    const ctx = getContext(KEY);
+    if (ctx)
+        return ctx;
+    warnOnce();
+    return DENY_ALL;
+}
+const DENY_ALL = Object.freeze({
+    capabilities: Object.freeze([]),
+    role: null,
+    can: () => false,
+    canAny: () => false,
+    canAll: () => false
+});
+let warned = false;
+function warnOnce() {
+    if (warned)
+        return;
+    warned = true;
+    if (typeof window !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn('[aphex] usePermissions() called outside a PermissionsContext provider. ' +
+            'All capability checks will return false. Call setPermissionsContext() in an ancestor.');
+    }
+}

package/dist/plugins/README.md

@@ -124,26 +124,26 @@ Under this system, a plugin becomes a clean, declarative manifest of its parts.
 import AnalyticsDashboard from './AnalyticsDashboard.svelte';
 
 export function createAnalyticsPlugin(config: AnalyticsConfig = {}): CMSPlugin {
-    const endpoint = config.endpoint ?? '/api/analytics';
-
-    return {
-        name: 'my-analytics-plugin',
-        parts: [
-            // Part 1: The API endpoint
-            {
-                implements: 'aphex/server/route',
-                path: endpoint,
-                handler: (event) => handleAnalyticsRequest(event)
-            },
-            // Part 2: The UI tab in the admin interface
-            {
-                implements: 'aphex/admin/tool',
-                id: 'analytics',
-                title: 'Analytics',
-                component: AnalyticsDashboard
-            }
-        ]
-    };
+	const endpoint = config.endpoint ?? '/api/analytics';
+
+	return {
+		name: 'my-analytics-plugin',
+		parts: [
+			// Part 1: The API endpoint
+			{
+				implements: 'aphex/server/route',
+				path: endpoint,
+				handler: (event) => handleAnalyticsRequest(event)
+			},
+			// Part 2: The UI tab in the admin interface
+			{
+				implements: 'aphex/admin/tool',
+				id: 'analytics',
+				title: 'Analytics',
+				component: AnalyticsDashboard
+			}
+		]
+	};
 }
 ```
 

package/dist/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC"}

package/dist/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAyEjB,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,cAuCxB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,cA4C5B,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,cAkCxB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,cA0C5B,CAAC"}

package/dist/routes/organizations-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA4GnB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmFpB,CAAC"}
+{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA8GnB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmFpB,CAAC"}

package/dist/routes/organizations-by-id.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
 import { updateOrganizationRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // GET /api/organizations/[id] - Get organization by ID
 export const GET = async ({ params, locals }) => {
     try {
@@ -72,13 +73,15 @@ export const PATCH = async ({ params, request, locals }) => {
                 message: 'Organization ID is required'
             }, { status: 400 });
         }
-        // Check if user is owner or admin of this organization
+        // Require `org.settings` capability + membership in the target org.
+        // Membership check stands regardless — even a capability holder can only
+        // edit orgs they actually belong to.
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
-        if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
+        if (!membership || !hasCapability(auth, 'org.settings')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can update organization settings'
+                message: 'You do not have permission to update organization settings'
             }, { status: 403 });
         }
         const rawBody = await request.json();

package/dist/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cA+HlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAuEpB,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,IAAI,EAAE,cA6IlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}

package/dist/routes/organizations-invitations.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
 import { inviteMemberRequest, cancelInvitationRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // POST /api/organizations/invitations - Create/send an invitation
 export const POST = async ({ request, locals }) => {
     try {
@@ -14,12 +15,11 @@ export const POST = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can invite members
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.invite')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can invite members'
+                message: 'You do not have permission to invite members'
             }, { status: 403 });
         }
         const rawBody = await request.json();
@@ -28,11 +28,22 @@ export const POST = async ({ request, locals }) => {
             return json({
                 success: false,
                 error: 'Invalid request body',
-                message: 'email and role (admin|editor|viewer) are required',
+                message: 'email and role are required',
                 issues: parsed.error.issues
             }, { status: 400 });
         }
         const body = parsed.data;
+        // Verify the role exists in this organization. Defends against
+        // clients sending a role name that was deleted between page load
+        // and submit, or against typos slipping past the format regex.
+        const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
+        if (!roleRow) {
+            return json({
+                success: false,
+                error: 'Unknown role',
+                message: `No role named "${body.role}" in this organization`
+            }, { status: 400 });
+        }
         // Reject self-invitation
         if (body.email.toLowerCase() === auth.user.email.toLowerCase()) {
             return json({
@@ -103,12 +114,11 @@ export const DELETE = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can cancel invitations
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.invite')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can cancel invitations'
+                message: 'You do not have permission to cancel invitations'
             }, { status: 403 });
         }
         const rawBody = await request.json();

package/dist/routes/organizations-members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-members.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAkCjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAqIpB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cAiHnB,CAAC"}
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-members.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAkCjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAoIpB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA6HnB,CAAC"}

package/dist/routes/organizations-members.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
 import { removeMemberRequest, updateMemberRoleRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // GET /api/organizations/members - List organization members
 export const GET = async ({ locals }) => {
     try {
@@ -42,12 +43,11 @@ export const DELETE = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can remove members
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.remove')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can remove members'
+                message: 'You do not have permission to remove members'
             }, { status: 403 });
         }
         const rawBody = await request.json();
@@ -137,12 +137,11 @@ export const PATCH = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can update roles
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.changeRole')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can update member roles'
+                message: 'You do not have permission to change member roles'
             }, { status: 403 });
         }
         const rawBody = await request.json();
@@ -151,11 +150,20 @@ export const PATCH = async ({ request, locals }) => {
             return json({
                 success: false,
                 error: 'Invalid request body',
-                message: 'userId and role (owner|admin|editor|viewer) are required',
+                message: 'userId and role are required',
                 issues: parsed.error.issues
             }, { status: 400 });
         }
         const body = parsed.data;
+        // Verify the target role exists in this organization.
+        const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
+        if (!roleRow) {
+            return json({
+                success: false,
+                error: 'Unknown role',
+                message: `No role named "${body.role}" in this organization`
+            }, { status: 400 });
+        }
         // Prevent changing your own role
         if (body.userId === auth.user.id) {
             return json({

package/dist/routes/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA6CjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cA8FlB,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA6CjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cAkGlB,CAAC"}

package/dist/routes/organizations.js

@@ -89,6 +89,9 @@ export const POST = async ({ request, locals }) => {
             parentOrganizationId: auth.organizationId, // Current active org becomes parent
             createdBy: auth.user.id
         });
+        // Seed the four built-in roles for this org before assigning membership.
+        // The member row references the role by name, so the rows must exist.
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
         // Add the creator as owner
         await databaseAdapter.addMember({
             organizationId: newOrganization.id,

package/dist/routes/roles-by-name.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const PATCH: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=roles-by-name.d.ts.map

package/dist/routes/roles-by-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-by-name.d.ts","sourceRoot":"","sources":["../../src/lib/routes/roles-by-name.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgBpD,eAAO,MAAM,KAAK,EAAE,cA4DnB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cAoEpB,CAAC"}

package/dist/routes/roles-by-name.js

@@ -0,0 +1,111 @@
+// Aphex CMS Roles API Handlers (by-name)
+//
+// PATCH  /api/roles/[name] — edit description / capabilities
+// DELETE /api/roles/[name] — delete a custom role (built-ins cannot be deleted)
+import { json } from '@sveltejs/kit';
+import { cmsLogger } from '../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../types/capabilities.js';
+import { updateRoleRequest } from '../api/schemas/roles.js';
+function unauthorized() {
+    return json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, { status: 401 });
+}
+function forbidden(message) {
+    return json({ success: false, error: 'Forbidden', message }, { status: 403 });
+}
+export const PATCH = async ({ params, request, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const name = params.name;
+        if (!name) {
+            return json({ success: false, error: 'Invalid request', message: 'Role name is required' }, { status: 400 });
+        }
+        const rawBody = await request.json();
+        const parsed = updateRoleRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const body = parsed.data;
+        const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
+        if (!updated) {
+            return json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, { status: 404 });
+        }
+        // Bust the capability cache so open sessions pick up the change on
+        // their next request instead of waiting for TTL.
+        await rolesService.invalidate(auth.organizationId, name);
+        return json({ success: true, data: updated });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update role:', error);
+        return json({
+            success: false,
+            error: 'Failed to update role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const name = params.name;
+        if (!name) {
+            return json({ success: false, error: 'Invalid request', message: 'Role name is required' }, { status: 400 });
+        }
+        // Built-ins are part of the org's guaranteed floor — deleting one
+        // would let a seed run re-create it with stale capabilities. Force the
+        // user to edit instead.
+        if (BUILTIN_ROLE_NAMES.includes(name)) {
+            return forbidden(`"${name}" is a built-in role and cannot be deleted.`);
+        }
+        // Block deletion while the role is assigned to any member or invitation.
+        // Avoids silently orphaning memberships to an unknown role name.
+        const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
+        const inUseByMember = members.some((m) => m.role === name);
+        const invitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
+        const inUseByInvitation = invitations.some((i) => i.role === name && !i.acceptedAt);
+        if (inUseByMember || inUseByInvitation) {
+            return json({
+                success: false,
+                error: 'Role in use',
+                message: `Cannot delete "${name}": reassign affected members or invitations first.`
+            }, { status: 409 });
+        }
+        const deleted = await databaseAdapter.deleteRole(auth.organizationId, name);
+        if (!deleted) {
+            return json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, { status: 404 });
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return json({ success: true, message: 'Role deleted' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to delete role:', error);
+        return json({
+            success: false,
+            error: 'Failed to delete role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/roles.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const POST: RequestHandler;
+//# sourceMappingURL=roles.d.ts.map

package/dist/routes/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/lib/routes/roles.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgBpD,eAAO,MAAM,GAAG,EAAE,cAoBjB,CAAC;AAEF,eAAO,MAAM,IAAI,EAAE,cA0ElB,CAAC"}

package/dist/routes/roles.js

@@ -0,0 +1,90 @@
+// Aphex CMS Roles API Handlers
+//
+// GET  /api/roles          — list roles for the active org
+// POST /api/roles          — create a custom role (requires role.manage)
+import { json } from '@sveltejs/kit';
+import { cmsLogger } from '../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../types/capabilities.js';
+import { createRoleRequest } from '../api/schemas/roles.js';
+function unauthorized() {
+    return json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, { status: 401 });
+}
+function forbidden(message) {
+    return json({ success: false, error: 'Forbidden', message }, { status: 403 });
+}
+export const GET = async ({ locals }) => {
+    try {
+        const { rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        const roles = await rolesService.listRoles(auth.organizationId);
+        return json({ success: true, data: roles });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list roles:', error);
+        return json({
+            success: false,
+            error: 'Failed to list roles',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const POST = async ({ request, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const rawBody = await request.json();
+        const parsed = createRoleRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                message: 'name and capabilities are required',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const body = parsed.data;
+        // Reject collisions with reserved built-in names — built-ins are seeded
+        // on every org; a matching custom row would never be reachable.
+        if (BUILTIN_ROLE_NAMES.includes(body.name)) {
+            return json({
+                success: false,
+                error: 'Reserved name',
+                message: `"${body.name}" is a built-in role name. Edit the existing role instead.`
+            }, { status: 409 });
+        }
+        const existing = await databaseAdapter.findRoleByName(auth.organizationId, body.name);
+        if (existing) {
+            return json({
+                success: false,
+                error: 'Conflict',
+                message: `A role named "${body.name}" already exists in this organization.`
+            }, { status: 409 });
+        }
+        const role = await databaseAdapter.createRole({
+            organizationId: auth.organizationId,
+            name: body.name,
+            description: body.description ?? null,
+            capabilities: body.capabilities,
+            isBuiltIn: false
+        });
+        // New role can't be in use yet, but invalidate the prefix just in case
+        // a prior lookup populated the cache with an empty fallback entry.
+        await rolesService.invalidate(auth.organizationId, body.name);
+        return json({ success: true, data: role }, { status: 201 });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create role:', error);
+        return json({
+            success: false,
+            error: 'Failed to create role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes-exports.d.ts

@@ -15,4 +15,6 @@ export { GET as getOrganizationById, PATCH as updateOrganization, DELETE as dele
 export { POST as switchOrganization } from './routes/organizations-switch.js';
 export { GET as getOrganizationMembers, DELETE as removeMember, PATCH as updateMemberRole } from './routes/organizations-members.js';
 export { POST as inviteMember, DELETE as cancelInvitation } from './routes/organizations-invitations.js';
+export { GET as getRoles, POST as createRole } from './routes/roles.js';
+export { PATCH as updateRole, DELETE as deleteRole } from './routes/roles-by-name.js';
 //# sourceMappingURL=routes-exports.d.ts.map

package/dist/routes-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes-exports.d.ts","sourceRoot":"","sources":["../src/lib/routes-exports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACN,GAAG,IAAI,eAAe,EACtB,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,UAAU,IAAI,kBAAkB,EAChC,cAAc,IAAI,sBAAsB,EACxC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,GAAG,IAAI,YAAY,EACnB,KAAK,IAAI,WAAW,EACpB,MAAM,IAAI,WAAW,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,GAAG,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,IAAI,IAAI,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGpF,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,KAAK,IAAI,kBAAkB,EAC3B,MAAM,IAAI,kBAAkB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACN,GAAG,IAAI,sBAAsB,EAC7B,MAAM,IAAI,YAAY,EACtB,KAAK,IAAI,gBAAgB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,IAAI,IAAI,YAAY,EACpB,MAAM,IAAI,gBAAgB,EAC1B,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"routes-exports.d.ts","sourceRoot":"","sources":["../src/lib/routes-exports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACN,GAAG,IAAI,eAAe,EACtB,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,UAAU,IAAI,kBAAkB,EAChC,cAAc,IAAI,sBAAsB,EACxC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,GAAG,IAAI,YAAY,EACnB,KAAK,IAAI,WAAW,EACpB,MAAM,IAAI,WAAW,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,GAAG,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,IAAI,IAAI,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGpF,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,KAAK,IAAI,kBAAkB,EAC3B,MAAM,IAAI,kBAAkB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACN,GAAG,IAAI,sBAAsB,EAC7B,MAAM,IAAI,YAAY,EACtB,KAAK,IAAI,gBAAgB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,IAAI,IAAI,YAAY,EACpB,MAAM,IAAI,gBAAgB,EAC1B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/routes-exports.js

@@ -21,3 +21,6 @@ export { GET as getOrganizationById, PATCH as updateOrganization, DELETE as dele
 export { POST as switchOrganization } from './routes/organizations-switch.js';
 export { GET as getOrganizationMembers, DELETE as removeMember, PATCH as updateMemberRole } from './routes/organizations-members.js';
 export { POST as inviteMember, DELETE as cancelInvitation } from './routes/organizations-invitations.js';
+// Role management routes
+export { GET as getRoles, POST as createRole } from './routes/roles.js';
+export { PATCH as updateRole, DELETE as deleteRole } from './routes/roles-by-name.js';

package/dist/save-state-context.svelte.d.ts

@@ -0,0 +1,8 @@
+export interface SaveState {
+    readonly saving: boolean;
+    readonly hasUnsavedChanges: boolean;
+    readonly savedAgoText: string | null;
+}
+export declare function setSaveStateContext(state: SaveState): void;
+export declare function getSaveStateContext(): SaveState | null;
+//# sourceMappingURL=save-state-context.svelte.d.ts.map

package/dist/save-state-context.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-state-context.svelte.d.ts","sourceRoot":"","sources":["../src/lib/save-state-context.svelte.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,QAEnD;AAED,wBAAgB,mBAAmB,IAAI,SAAS,GAAG,IAAI,CAEtD"}

package/dist/save-state-context.svelte.js

@@ -0,0 +1,8 @@
+import { getContext, setContext } from 'svelte';
+const SAVE_STATE_KEY = Symbol('aphex-save-state');
+export function setSaveStateContext(state) {
+    setContext(SAVE_STATE_KEY, state);
+}
+export function getSaveStateContext() {
+    return getContext(SAVE_STATE_KEY) ?? null;
+}

package/dist/schema-utils/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAqMpE"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAqNpE"}

package/dist/schema-utils/validator.js

@@ -103,6 +103,20 @@ export function validateSchemaReferences(schemas) {
                 validateField(field, schema.name);
             }
         }
+        // Validate field.group references against schema.groups
+        if (schema.fields) {
+            const groupNames = new Set((schema.groups ?? []).map((g) => g.name));
+            for (const field of schema.fields) {
+                if (!field.group)
+                    continue;
+                const refs = Array.isArray(field.group) ? field.group : [field.group];
+                for (const ref of refs) {
+                    if (!groupNames.has(ref)) {
+                        errors.push(`Schema "${schema.name}" field "${field.name}" references unknown group "${ref}". Declare it in schema.groups.`);
+                    }
+                }
+            }
+        }
         // Validate preview config references
         if (schema.preview?.select) {
             const fieldNames = new Set(schema.fields?.map((f) => f.name) || []);

package/dist/server/index.d.ts

@@ -12,6 +12,7 @@ export * from '../storage/interfaces/index.js';
 export * from '../storage/providers/storage.js';
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
+export { RolesService } from '../services/roles-service.js';
 export * from '../routes-exports.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}