@aphexcms/cms-core 2.0.10 → 2.1.0

package/dist/db/interfaces/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/organization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,WAAW,EACX,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,mBAAmB;IAEnC,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oBAAoB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,GACjE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjD,SAAS,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,gBAAgB,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAC3C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzE,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAG/E,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7E,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/organization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,WAAW,EACX,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,mBAAmB;IAEnC,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oBAAoB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,GACjE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjD,SAAS,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,gBAAgB,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzE,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAG/E,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7E,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}

package/dist/db/interfaces/role.d.ts

@@ -0,0 +1,25 @@
+import type { Role, NewRole, Capability } from '../../types/capabilities.js';
+export interface RolesAdapter {
+    /** List all roles for an organization (built-in + custom). */
+    listRoles(organizationId: string): Promise<Role[]>;
+    /** Look up a single role by its name within an organization. */
+    findRoleByName(organizationId: string, name: string): Promise<Role | null>;
+    /** Create a new role. Uniqueness is enforced on (organizationId, name). */
+    createRole(data: NewRole): Promise<Role>;
+    /**
+     * Update the capabilities/description of an existing role.
+     * Returns `null` if no row matched.
+     */
+    updateRole(organizationId: string, name: string, data: {
+        description?: string | null;
+        capabilities?: Capability[];
+    }): Promise<Role | null>;
+    /** Delete a role by name. Returns `true` when a row was removed. */
+    deleteRole(organizationId: string, name: string): Promise<boolean>;
+    /**
+     * Ensure the four built-in roles exist for an organization.
+     * Idempotent: inserts missing rows and leaves existing ones untouched.
+     */
+    seedBuiltinRoles(organizationId: string): Promise<void>;
+}
+//# sourceMappingURL=role.d.ts.map

package/dist/db/interfaces/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/role.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnD,gEAAgE;IAChE,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;OAGG;IACH,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,GAChE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAExB,oEAAoE;IACpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnE;;;OAGG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD"}

package/dist/db/interfaces/role.js

@@ -0,0 +1 @@
+export {};

package/dist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CAKlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CASlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}

package/dist/engine.js

@@ -60,6 +60,11 @@ export function createCMS(config, dbAdapter) {
     if (!cmsInstance) {
         cmsInstance = new CMSEngine(config, dbAdapter);
     }
+    else {
+        // Refresh the singleton's config on subsequent calls so schema HMR
+        // doesn't get frozen by the first (possibly broken) config snapshot.
+        cmsInstance.updateConfig(config);
+    }
     return cmsInstance;
 }
 export function getCMS() {

package/dist/field-access.d.ts

@@ -0,0 +1,30 @@
+import type { Field, SchemaType } from './types/schemas.js';
+import type { Auth } from './types/auth.js';
+/**
+ * Return the set of field names the caller may NOT read.
+ * Fields with no `access.read` list are readable by default.
+ */
+export declare function hiddenReadFields(schema: SchemaType, auth: Auth | undefined): Set<string>;
+/**
+ * Return the set of field names the caller may NOT write.
+ * Fields with no `access.update` list are writable by default.
+ */
+export declare function hiddenWriteFields(schema: SchemaType, auth: Auth | undefined): Set<string>;
+/**
+ * Strip read-hidden fields from a document payload shape in place.
+ * Safe to call on undefined / non-object values (returns the input).
+ */
+export declare function stripHiddenFields<T extends Record<string, unknown>>(data: T | null | undefined, hidden: ReadonlySet<string>): T | null | undefined;
+/**
+ * Remove write-locked fields from incoming mutation data. Prevents a caller
+ * with collection-level update from silently overwriting fields the schema
+ * protects at the field level.
+ */
+export declare function dropLockedWrites<T extends Record<string, unknown>>(data: T, locked: ReadonlySet<string>): T;
+/**
+ * Extract the raw field definitions for reading (not mutating).
+ * Kept separate from hiddenReadFields so callers can iterate fields directly
+ * when they need richer context than the name set.
+ */
+export declare function fieldByName(schema: SchemaType, name: string): Field | undefined;
+//# sourceMappingURL=field-access.d.ts.map

package/dist/field-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-access.d.ts","sourceRoot":"","sources":["../src/lib/field-access.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAUxF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAUzF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,CAAC,GAAG,IAAI,GAAG,SAAS,CAKtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,CAAC,CAQH;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAE/E"}

package/dist/field-access.js

@@ -0,0 +1,79 @@
+// Field-level access helpers.
+//
+// Applied on top of document-level SchemaAccess (which already decided whether
+// the caller can touch the collection at all). These helpers are the gate
+// between "has read/update on the collection" and "has read/update on this
+// specific field".
+import { effectiveOrganizationRole } from './types/capabilities.js';
+/**
+ * Return the set of field names the caller may NOT read.
+ * Fields with no `access.read` list are readable by default.
+ */
+export function hiddenReadFields(schema, auth) {
+    const hidden = new Set();
+    if (!auth)
+        return hidden;
+    const role = effectiveOrganizationRole(auth);
+    for (const field of schema.fields) {
+        const list = field.access?.read;
+        if (!list)
+            continue;
+        if (!role || !list.includes(role))
+            hidden.add(field.name);
+    }
+    return hidden;
+}
+/**
+ * Return the set of field names the caller may NOT write.
+ * Fields with no `access.update` list are writable by default.
+ */
+export function hiddenWriteFields(schema, auth) {
+    const hidden = new Set();
+    if (!auth)
+        return hidden;
+    const role = effectiveOrganizationRole(auth);
+    for (const field of schema.fields) {
+        const list = field.access?.update;
+        if (!list)
+            continue;
+        if (!role || !list.includes(role))
+            hidden.add(field.name);
+    }
+    return hidden;
+}
+/**
+ * Strip read-hidden fields from a document payload shape in place.
+ * Safe to call on undefined / non-object values (returns the input).
+ */
+export function stripHiddenFields(data, hidden) {
+    if (!data || typeof data !== 'object' || hidden.size === 0)
+        return data;
+    const copy = { ...data };
+    for (const name of hidden)
+        delete copy[name];
+    return copy;
+}
+/**
+ * Remove write-locked fields from incoming mutation data. Prevents a caller
+ * with collection-level update from silently overwriting fields the schema
+ * protects at the field level.
+ */
+export function dropLockedWrites(data, locked) {
+    if (locked.size === 0)
+        return data;
+    const copy = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (locked.has(key))
+            continue;
+        copy[key] = value;
+    }
+    return copy;
+}
+/**
+ * Extract the raw field definitions for reading (not mutating).
+ * Kept separate from hiddenReadFields so callers can iterate fields directly
+ * when they need richer context than the name set.
+ */
+export function fieldByName(schema, name) {
+    return schema.fields.find((f) => f.name === name);
+}

package/dist/hooks.d.ts

@@ -6,6 +6,7 @@ import type { StorageAdapter } from './storage/interfaces/storage.js';
 import type { EmailAdapter } from './email/index.js';
 import type { AuthProvider } from './auth/provider.js';
 import type { GraphQLSettings } from './graphql/index.js';
+import { RolesService } from './services/roles-service.js';
 import { CMSEngine } from './engine.js';
 import { type LocalAPI } from './local-api/index.js';
 export interface CMSInstances {
@@ -16,6 +17,7 @@ export interface CMSInstances {
     emailAdapter?: EmailAdapter | null;
     cmsEngine: CMSEngine;
     localAPI: LocalAPI;
+    rolesService: RolesService;
     auth?: AuthProvider;
     graphqlSettings?: GraphQLSettings | null;
     pluginRoutes?: Map<string, {

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,GAAG,CACjB,MAAM,EACN;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAC7E,CAAC;CACF;AAiFD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAuLvD"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,GAAG,CACjB,MAAM,EACN;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAC7E,CAAC;CACF;AAiFD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CA8LvD"}

package/dist/hooks.js

@@ -2,6 +2,7 @@ import { handleAuthHook } from './auth/auth-hooks.js';
 import { cmsLogger, setLogLevel } from './utils/logger.js';
 import { createStorageAdapter as createStorageAdapterProvider } from './storage/providers/storage.js';
 import { AssetService as AssetServiceClass } from './services/asset-service.js';
+import { RolesService } from './services/roles-service.js';
 import { createCMS } from './engine.js';
 import { createLocalAPI } from './local-api/index.js';
 let cmsInstances = null;
@@ -82,7 +83,19 @@ export function createCMSHook(config) {
         // Note: In dev mode, /storage/ might be accessible via Vite dev server
         // In production, only /static/ folder is served - /storage/ is private
         // Initialize CMS instances once at application startup
-        // Use a promise lock to prevent concurrent requests from racing initialization
+        // Use a promise lock to prevent concurrent requests from racing initialization.
+        // Also reset before the init check so a schema HMR or a sticky schemaError
+        // falls through into fresh init on THIS request (not next one) — otherwise
+        // locals.aphexCMS would be null for the requesting handler.
+        if (cmsInstances && (checkSchemasDirty() || schemaError)) {
+            cmsLogger.info('[CMS]', 'Schema change detected, re-initializing...');
+            if (cmsInstances.config.cache) {
+                cmsInstances.config.cache.flush();
+            }
+            cmsInstances = null;
+            schemaError = null;
+            initPromise = null;
+        }
         if (initPromise) {
             await initPromise;
         }
@@ -96,6 +109,7 @@ export function createCMSHook(config) {
             const emailAdapter = config.email ?? null;
             const assetService = new AssetServiceClass(storageAdapter, databaseAdapter);
             const cmsEngine = createCMS(config, databaseAdapter);
+            const rolesService = new RolesService(databaseAdapter, config.cache ?? null);
             // Initialize Local API (unified operations layer)
             const localAPI = createLocalAPI(config, databaseAdapter);
             // Initialize schemas with validation
@@ -130,6 +144,7 @@ export function createCMSHook(config) {
                             emailAdapter: emailAdapter,
                             cmsEngine: cmsEngine,
                             localAPI: localAPI,
+                            rolesService,
                             auth: config.auth?.provider,
                             pluginRoutes
                         };
@@ -157,6 +172,7 @@ export function createCMSHook(config) {
                         emailAdapter,
                         cmsEngine,
                         localAPI,
+                        rolesService,
                         auth: config.auth?.provider,
                         pluginRoutes
                     }, config.schemaTypes, graphqlConfig);
@@ -182,23 +198,13 @@ export function createCMSHook(config) {
                 emailAdapter: emailAdapter,
                 cmsEngine: cmsEngine,
                 localAPI: localAPI,
+                rolesService,
                 auth: config.auth?.provider,
                 graphqlSettings,
                 pluginRoutes
             };
             resolveInit();
         }
-        else if (checkSchemasDirty()) {
-            // HMR: Schemas changed - reset instances so full re-initialization
-            // runs on the next request with fresh config from Vite
-            cmsLogger.info('[CMS]', 'Schema change detected, re-initializing...');
-            if (cmsInstances?.config.cache) {
-                cmsInstances.config.cache.flush();
-            }
-            cmsInstances = null;
-            schemaError = null;
-            return resolve(event); // Let the next request trigger full init
-        }
         // Attach schema error to instances so it can be accessed in load functions
         if (cmsInstances) {
             cmsInstances.schemaError = schemaError;
@@ -207,7 +213,7 @@ export function createCMSHook(config) {
         event.locals.aphexCMS = cmsInstances;
         // Auth protection if configured
         if (cmsInstances.auth) {
-            const authResponse = await handleAuthHook(event, config, cmsInstances.auth, cmsInstances.databaseAdapter);
+            const authResponse = await handleAuthHook(event, config, cmsInstances.auth, cmsInstances.databaseAdapter, cmsInstances.rolesService);
             if (authResponse)
                 return authResponse;
         }

package/dist/lib/api/api-keys.d.ts

@@ -1,10 +1,14 @@
 import type { ApiResponse } from './types.js';
 import type { ApiKeyPermission, CreateApiKeyRequest } from './schemas/api-keys.js';
+import type { Capability } from '../types/capabilities.js';
 export interface ApiKey {
     id: string;
     name: string | null;
     key?: string;
+    /** Legacy coarse scopes; preserved for UI compatibility. */
     permissions: ApiKeyPermission[];
+    /** Fine-grained capability allowlist (if this key was issued with one). */
+    capabilities?: Capability[];
     createdAt: Date | null;
     lastRequest: Date | null;
     expiresAt: Date | null;

package/dist/lib/api/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAID,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC;AAED,qBAAa,UAAU;IACtB;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAI1F;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAED,eAAO,MAAM,OAAO;;;CAGnB,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAID,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC;AAED,qBAAa,UAAU;IACtB;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAI1F;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAED,eAAO,MAAM,OAAO;;;CAGnB,CAAC"}

package/dist/lib/api/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAsBrC,MAAM,OAAO,UAAU;IACtB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAyB;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAuB,oBAAoB,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACD;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1C,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;CAC1C,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../src/lib/api/api-keys.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AA0BrC,MAAM,OAAO,UAAU;IACtB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAyB;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAuB,oBAAoB,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACD;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1C,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;CAC1C,CAAC"}

package/dist/lib/api/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/api/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,qBAAa,SAAS;IACrB;;OAEG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAI7D;;;OAGG;WACU,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAIpE;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAItF;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,UAAU,CACtB,GAAG,EAAE,MAAM,EAAE,GACX,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI5D;;OAEG;WACU,aAAa,CACzB,EAAE,EAAE,MAAM,GACR,OAAO,CAAC,WAAW,CAAC;QAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMxE;;OAEG;WACU,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAG5F;AAGD,eAAO,MAAM,MAAM;;;;;;;;;CASlB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/api/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI5F,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,qBAAa,SAAS;IACrB;;OAEG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAI7D;;;OAGG;WACU,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAIpE;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAItF;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI3E;;OAEG;WACU,UAAU,CACtB,GAAG,EAAE,MAAM,EAAE,GACX,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI5D;;OAEG;WACU,aAAa,CACzB,EAAE,EAAE,MAAM,GACR,OAAO,CAAC,WAAW,CAAC;QAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMxE;;OAEG;WACU,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAG5F;AAGD,eAAO,MAAM,MAAM;;;;;;;;;CASlB,CAAC"}

package/dist/lib/api/assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/api/assets.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAerC,MAAM,OAAO,SAAS;IACrB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAyB;QAC1C,OAAO,SAAS,CAAC,GAAG,CAAU,SAAS,EAAE,OAA8C,CAAC,CAAC;IAC1F,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,SAAS,CAAC,GAAG,CAAQ,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAkB;QACrC,OAAO,SAAS,CAAC,IAAI,CAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAwB;QACvD,OAAO,SAAS,CAAC,KAAK,CAAQ,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACtB,GAAa;QAEb,OAAO,SAAS,CAAC,MAAM,CAAsC,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACzB,EAAU;QAEV,OAAO,SAAS,CAAC,GAAG,CACnB,WAAW,EAAE,aAAa,CAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAa;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAyB,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC;CACD;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,MAAM,GAAG;IACrB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACpC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IAC1C,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;IAChD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;IACtD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;CAChE,CAAC"}
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/api/assets.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAWrC,MAAM,OAAO,SAAS;IACrB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAyB;QAC1C,OAAO,SAAS,CAAC,GAAG,CAAU,SAAS,EAAE,OAA8C,CAAC,CAAC;IAC1F,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,SAAS,CAAC,GAAG,CAAQ,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAkB;QACrC,OAAO,SAAS,CAAC,IAAI,CAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAwB;QACvD,OAAO,SAAS,CAAC,KAAK,CAAQ,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACtB,GAAa;QAEb,OAAO,SAAS,CAAC,MAAM,CAAsC,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACzB,EAAU;QAEV,OAAO,SAAS,CAAC,GAAG,CACnB,WAAW,EAAE,aAAa,CAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAa;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAyB,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC;CACD;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,MAAM,GAAG;IACrB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACpC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IAC1C,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;IAChD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;IACtD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;CAChE,CAAC"}

package/dist/lib/api/index.d.ts

@@ -2,6 +2,7 @@ export { type ApiClient, ApiError, apiClient } from './client.js';
 export { type ApiResponse } from './types.js';
 export { documents } from './documents.js';
 export { organizations } from './organizations.js';
+export { roles } from './roles.js';
 export { assets } from './assets.js';
 export { user } from './user.js';
 export { apiKeys } from './api-keys.js';

package/dist/lib/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,mBAAmB,gBAAgB,CAAC;AACpC,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,QAAQ,CAAC;AAC5B,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,mBAAmB,gBAAgB,CAAC;AACpC,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,QAAQ,CAAC;AAC5B,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,eAAe,CAAC"}

package/dist/lib/api/index.js

@@ -2,6 +2,7 @@
 export { ApiError, apiClient } from './client.js';
 export { documents } from './documents.js';
 export { organizations } from './organizations.js';
+export { roles } from './roles.js';
 export { assets } from './assets.js';
 export { user } from './user.js';
 export { apiKeys } from './api-keys.js';

package/dist/lib/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAkB,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAkB,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}

package/dist/lib/api/roles.d.ts

@@ -0,0 +1,22 @@
+import type { ApiResponse } from './types.js';
+import type { Role } from '../types/capabilities.js';
+import type { CreateRoleRequest, UpdateRoleRequest } from './schemas/roles.js';
+export declare class RolesApi {
+    /** List all roles (built-in + custom) for the active organization. */
+    static list(): Promise<ApiResponse<Role[]>>;
+    /** Create a custom role. Built-in names are rejected server-side. */
+    static create(data: CreateRoleRequest): Promise<ApiResponse<Role>>;
+    /** Edit description or capabilities. Works on built-ins too. */
+    static update(name: string, data: UpdateRoleRequest): Promise<ApiResponse<Role>>;
+    /** Delete a custom role. Built-ins and in-use roles are blocked server-side. */
+    static remove(name: string): Promise<ApiResponse<{
+        success: boolean;
+    }>>;
+}
+export declare const roles: {
+    list: typeof RolesApi.list;
+    create: typeof RolesApi.create;
+    update: typeof RolesApi.update;
+    remove: typeof RolesApi.remove;
+};
+//# sourceMappingURL=roles.d.ts.map

package/dist/lib/api/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/lib/api/roles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,qBAAa,QAAQ;IACpB,sEAAsE;WACzD,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAIjD,qEAAqE;WACxD,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAIxE,gEAAgE;WACnD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAItF,gFAAgF;WACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG7E;AAED,eAAO,MAAM,KAAK;;;;;CAKjB,CAAC"}

package/dist/lib/api/roles.js

@@ -0,0 +1,27 @@
+// Roles API client — per-organization role CRUD.
+import { apiClient } from './client.js';
+export class RolesApi {
+    /** List all roles (built-in + custom) for the active organization. */
+    static async list() {
+        return apiClient.get('/roles');
+    }
+    /** Create a custom role. Built-in names are rejected server-side. */
+    static async create(data) {
+        return apiClient.post('/roles', data);
+    }
+    /** Edit description or capabilities. Works on built-ins too. */
+    static async update(name, data) {
+        return apiClient.patch(`/roles/${encodeURIComponent(name)}`, data);
+    }
+    /** Delete a custom role. Built-ins and in-use roles are blocked server-side. */
+    static async remove(name) {
+        return apiClient.delete(`/roles/${encodeURIComponent(name)}`);
+    }
+}
+export const roles = {
+    list: RolesApi.list.bind(RolesApi),
+    create: RolesApi.create.bind(RolesApi),
+    update: RolesApi.update.bind(RolesApi),
+    remove: RolesApi.remove.bind(RolesApi)
+};
+//# sourceMappingURL=roles.js.map

package/dist/lib/api/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/lib/api/roles.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,MAAM,OAAO,QAAQ;IACpB,sEAAsE;IACtE,MAAM,CAAC,KAAK,CAAC,IAAI;QAChB,OAAO,SAAS,CAAC,GAAG,CAAS,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAuB;QAC1C,OAAO,SAAS,CAAC,IAAI,CAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAuB;QACxD,OAAO,SAAS,CAAC,KAAK,CAAO,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAY;QAC/B,OAAO,SAAS,CAAC,MAAM,CAAuB,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;CACD;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;CACtC,CAAC"}

package/dist/lib/api/schemas/api-keys.d.ts

@@ -1,16 +1,62 @@
 import { z } from 'zod';
+import { type Capability } from '../../types/capabilities.js';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
 }>;
-export declare const createApiKeyRequest: z.ZodObject<{
+export declare const apiKeyCapabilitySchema: z.ZodEnum<{
+    "document.read": "document.read";
+    "document.create": "document.create";
+    "document.update": "document.update";
+    "document.delete": "document.delete";
+    "document.publish": "document.publish";
+    "document.unpublish": "document.unpublish";
+    "asset.read": "asset.read";
+    "asset.upload": "asset.upload";
+    "asset.delete": "asset.delete";
+    "member.invite": "member.invite";
+    "member.remove": "member.remove";
+    "member.changeRole": "member.changeRole";
+    "apiKey.manage": "apiKey.manage";
+    "role.manage": "role.manage";
+    "org.settings": "org.settings";
+}>;
+export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
-    permissions: z.ZodArray<z.ZodEnum<{
+    permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         read: "read";
         write: "write";
-    }>>;
+    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    permissions: ("read" | "write")[] | undefined;
+    capabilities: Capability[] | undefined;
+    name: string;
+    expiresInDays?: number | undefined;
+}, {
+    name: string;
+    permissions?: ("read" | "write")[] | undefined;
+    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    expiresInDays?: number | undefined;
+}>>;
 export type ApiKeyPermission = z.infer<typeof apiKeyPermissionSchema>;
+export type ApiKeyCapability = z.infer<typeof apiKeyCapabilitySchema>;
 export type CreateApiKeyRequest = z.infer<typeof createApiKeyRequest>;
 //# sourceMappingURL=api-keys.d.ts.map

package/dist/lib/api/schemas/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAIhE,eAAO,MAAM,mBAAmB;;;;;;;iBAI9B,CAAC;AAIH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIpG,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAElC,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/lib/api/schemas/api-keys.js

@@ -1,10 +1,29 @@
 import { z } from 'zod';
+import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
 // ---------- Shared ----------
 export const apiKeyPermissionSchema = z.enum(['read', 'write']);
+export const apiKeyCapabilitySchema = z.enum(ALL_CAPABILITIES);
 // ---------- POST /settings/api-keys ----------
-export const createApiKeyRequest = z.object({
+// Two provisioning modes:
+//   1. Coarse `permissions`: 'read' alone, or 'write' (always implies read).
+//   2. Fine-grained `capabilities`: explicit allowlist; writes auto-include
+//      the matching read cap during normalization.
+// Exactly one of the two should be supplied (neither is invalid).
+export const createApiKeyRequest = z
+    .object({
     name: z.string().min(1),
-    permissions: z.array(apiKeyPermissionSchema).min(1),
+    permissions: z.array(apiKeyPermissionSchema).optional(),
+    capabilities: z.array(apiKeyCapabilitySchema).optional(),
     expiresInDays: z.number().int().positive().optional()
-});
+})
+    .refine((v) => (v.permissions && v.permissions.length > 0) || (v.capabilities && v.capabilities.length > 0), { message: 'Provide at least one of `permissions` or `capabilities`.' })
+    .transform((v) => ({
+    ...v,
+    permissions: v.permissions
+        ? v.permissions.includes('write')
+            ? ['read', 'write']
+            : ['read']
+        : undefined,
+    capabilities: v.capabilities ? normalizeCapabilities(v.capabilities) : undefined
+}));
 //# sourceMappingURL=api-keys.js.map

package/dist/lib/api/schemas/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+BAA+B;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE,gDAAgD;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAmB,MAAM,0BAA0B,CAAC;AAEpG,+BAA+B;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAC3C,gBAA4D,CAC5D,CAAC;AAEF,gDAAgD;AAEhD,0BAA0B;AAC1B,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAC7F,EAAE,OAAO,EAAE,0DAA0D,EAAE,CACvE;KACA,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,WAAW,EAAE,CAAC,CAAC,WAAW;QACzB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,CAAE,CAAC,MAAM,EAAE,OAAO,CAA6B;YAChD,CAAC,CAAE,CAAC,MAAM,CAA6B;QACxC,CAAC,CAAC,SAAS;IACZ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}

package/dist/lib/api/schemas/organizations.d.ts

@@ -1,15 +1,6 @@
 import { z } from 'zod';
-export declare const organizationRoleSchema: z.ZodEnum<{
-    admin: "admin";
-    editor: "editor";
-    viewer: "viewer";
-    owner: "owner";
-}>;
-export declare const invitableRoleSchema: z.ZodEnum<{
-    admin: "admin";
-    editor: "editor";
-    viewer: "viewer";
-}>;
+export declare const organizationRoleSchema: z.ZodString;
+export declare const invitableRoleSchema: z.ZodString;
 export declare const createOrganizationRequest: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
@@ -26,11 +17,7 @@ export declare const switchOrganizationRequest: z.ZodObject<{
 }, z.core.$strip>;
 export declare const inviteMemberRequest: z.ZodObject<{
     email: z.ZodString;
-    role: z.ZodEnum<{
-        admin: "admin";
-        editor: "editor";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const cancelInvitationRequest: z.ZodObject<{
     invitationId: z.ZodString;
@@ -40,12 +27,7 @@ export declare const removeMemberRequest: z.ZodObject<{
 }, z.core.$strip>;
 export declare const updateMemberRoleRequest: z.ZodObject<{
     userId: z.ZodString;
-    role: z.ZodEnum<{
-        admin: "admin";
-        editor: "editor";
-        viewer: "viewer";
-        owner: "owner";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export type OrganizationRoleSchema = z.infer<typeof organizationRoleSchema>;
 export type InvitableRoleSchema = z.infer<typeof invitableRoleSchema>;

package/dist/lib/api/schemas/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,sBAAsB;;;;;EAAiD,CAAC;AAGrF,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AAMzE,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAIH,eAAO,MAAM,yBAAyB;;;;iBAQnC,CAAC;AAIJ,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;;;;;;;iBAGlC,CAAC;AAIH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,sBAAsB,aAAiB,CAAC;AAGrD,eAAO,MAAM,mBAAmB,aAE9B,CAAC;AAMH,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAIH,eAAO,MAAM,yBAAyB;;;;iBAQnC,CAAC;AAIJ,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAIH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}