@aphexcms/cms-core 2.0.10 → 2.1.0

package/dist/lib/api/schemas/organizations.js

@@ -1,8 +1,19 @@
 import { z } from 'zod';
 // ---------- Shared ----------
-export const organizationRoleSchema = z.enum(['owner', 'admin', 'editor', 'viewer']);
+// Role name — any string matching the cms_roles.name format. The actual
+// existence check happens server-side against the roles table, so a
+// nonexistent name yields a 404/400 rather than a Zod error.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/);
+export const organizationRoleSchema = roleNameSchema;
 // Role used for new invitations — owners cannot be invited, only promoted.
-export const invitableRoleSchema = z.enum(['admin', 'editor', 'viewer']);
+export const invitableRoleSchema = roleNameSchema.refine((v) => v !== 'owner', {
+    message: 'owner cannot be assigned via invitation'
+});
 const metadataSchema = z.record(z.string(), z.unknown());
 // ---------- POST /organizations ----------
 export const createOrganizationRequest = z.object({

package/dist/lib/api/schemas/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+BAA+B;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEzD,4CAA4C;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,kDAAkD;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;IACxF,OAAO,EAAE,uDAAuD;CAChE,CAAC,CAAC;AAEJ,mDAAmD;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,wDAAwD;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,IAAI,EAAE,mBAAmB;CACzB,CAAC,CAAC;AAEH,0DAA0D;AAE1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,qDAAqD;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,sBAAsB;CAC5B,CAAC,CAAC"}
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+BAA+B;AAE/B,wEAAwE;AACxE,oEAAoE;AACpE,6DAA6D;AAC7D,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAErD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,EAAE;IAC9E,OAAO,EAAE,yCAAyC;CAClD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEzD,4CAA4C;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,kDAAkD;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;IACxF,OAAO,EAAE,uDAAuD;CAChE,CAAC,CAAC;AAEJ,mDAAmD;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,wDAAwD;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,IAAI,EAAE,mBAAmB;CACzB,CAAC,CAAC;AAEH,0DAA0D;AAE1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,qDAAqD;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,sBAAsB;CAC5B,CAAC,CAAC"}

package/dist/lib/api/schemas/roles.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import { type Capability } from '../../types/capabilities.js';
+export declare const capabilitySchema: z.ZodEnum<{
+    "document.read": "document.read";
+    "document.create": "document.create";
+    "document.update": "document.update";
+    "document.delete": "document.delete";
+    "document.publish": "document.publish";
+    "document.unpublish": "document.unpublish";
+    "asset.read": "asset.read";
+    "asset.upload": "asset.upload";
+    "asset.delete": "asset.delete";
+    "member.invite": "member.invite";
+    "member.remove": "member.remove";
+    "member.changeRole": "member.changeRole";
+    "apiKey.manage": "apiKey.manage";
+    "role.manage": "role.manage";
+    "org.settings": "org.settings";
+}>;
+export declare const createRoleRequest: z.ZodPipe<z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[];
+    name: string;
+    description?: string | null | undefined;
+}, {
+    name: string;
+    capabilities: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[];
+    description?: string | null | undefined;
+}>>;
+export declare const updateRoleRequest: z.ZodPipe<z.ZodObject<{
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[] | undefined;
+    description?: string | null | undefined;
+}, {
+    description?: string | null | undefined;
+    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+}>>;
+export type CreateRoleRequest = z.infer<typeof createRoleRequest>;
+export type UpdateRoleRequest = z.infer<typeof updateRoleRequest>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/lib/api/schemas/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;EAE5B,CAAC;AAmBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/lib/api/schemas/roles.js

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+// Runtime enum of every known capability. Unknown strings are rejected so a
+// typo in a client request can't silently grant or strip permissions.
+// The cast preserves the literal Capability union in the inferred type — Zod
+// can't see the compile-time widening of the readonly array on its own.
+export const capabilitySchema = z.enum(ALL_CAPABILITIES);
+// Role name: human-readable identifier stored on member rows and referenced
+// in the API as /api/roles/[name]. Spaces are allowed (URL-encoded client
+// side); control characters and slashes are not, to keep routing unambiguous.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/, {
+    message: 'Role name may only contain letters, numbers, spaces, underscores, and hyphens'
+});
+// ---------- POST /roles ----------
+// Capabilities are normalized on intake so any write cap pulls in the matching
+// read — a role with `document.create` but no `document.read` can't
+// realistically edit anything, and leaving that gap trips people up.
+export const createRoleRequest = z
+    .object({
+    name: roleNameSchema,
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).default([])
+})
+    .transform((v) => ({ ...v, capabilities: normalizeCapabilities(v.capabilities) }));
+// ---------- PATCH /roles/[name] ----------
+export const updateRoleRequest = z
+    .object({
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).optional()
+})
+    .refine((v) => v.description !== undefined || v.capabilities !== undefined, {
+    message: 'At least one field (description, capabilities) is required'
+})
+    .transform((v) => ({
+    ...v,
+    capabilities: v.capabilities ? normalizeCapabilities(v.capabilities) : undefined
+}));
+//# sourceMappingURL=roles.js.map

package/dist/lib/api/schemas/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAmB,MAAM,0BAA0B,CAAC;AAEpG,4EAA4E;AAC5E,sEAAsE;AACtE,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CACrC,gBAA4D,CAC5D,CAAC;AAEF,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,mBAAmB,EAAE;IAC3B,OAAO,EAAE,+EAA+E;CACxF,CAAC,CAAC;AAEJ,oCAAoC;AAEpC,+EAA+E;AAC/E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,4CAA4C;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE;IAC3E,OAAO,EAAE,4DAA4D;CACrE,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}

package/dist/lib/app-augment.d.ts

@@ -0,0 +1,32 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+import type { RbacPayload } from './types/capabilities.js';
+declare global {
+    namespace App {
+        interface PageData {
+            /**
+             * RBAC snapshot emitted by the admin layout's server load
+             * (`/admin/+layout.server.ts`). Absent on public routes (login,
+             * invitations) that don't pass through the admin layout.
+             */
+            rbac?: RbacPayload;
+        }
+    }
+}
+export {};
+//# sourceMappingURL=app-augment.d.ts.map

package/dist/lib/app-augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-augment.d.ts","sourceRoot":"","sources":["../../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,QAAQ;YACjB;;;;eAIG;YACH,IAAI,CAAC,EAAE,WAAW,CAAC;SACnB;KACD;CACD;AAED,OAAO,EAAE,CAAC"}

package/dist/lib/app-augment.js

@@ -0,0 +1,19 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+export {};
+//# sourceMappingURL=app-augment.js.map

package/dist/lib/app-augment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-augment.js","sourceRoot":"","sources":["../../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/lib/auth/auth-hooks.d.ts

@@ -1,6 +1,7 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import type { DatabaseAdapter } from '../db/index.js';
 import type { CMSConfig } from '../types/index.js';
+import type { RolesService } from '../services/roles-service.js';
 import type { AuthProvider } from './provider.js';
-export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter): Promise<Response | null>;
+export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter, rolesService: RolesService): Promise<Response | null>;
 //# sourceMappingURL=auth-hooks.d.ts.map

package/dist/lib/auth/auth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8I1B"}
+{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAkB/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,YAAY,GACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAsJ1B"}

package/dist/lib/auth/auth-hooks.js

@@ -1,11 +1,25 @@
 import { redirect } from '@sveltejs/kit';
 import { AuthError } from './auth-errors.js';
-export async function handleAuthHook(event, config, authProvider, db) {
+/**
+ * Populate `auth.capabilities` for session auth via RolesService.
+ * Runs once per request so downstream permission checks stay synchronous.
+ * No-op for API keys and partial sessions — `resolveCapabilities` handles
+ * those shapes directly.
+ */
+async function hydrateCapabilities(auth, rolesService) {
+    if (auth.type !== 'session')
+        return;
+    if (auth.capabilities)
+        return; // Already populated (e.g. by provider).
+    auth.capabilities = await rolesService.getCapabilities(auth.organizationId, auth.organizationRole);
+}
+export async function handleAuthHook(event, config, authProvider, db, rolesService) {
     const path = event.url.pathname;
     // 1. Admin UI routes - require session authentication
     if (path.startsWith('/admin')) {
         try {
             const session = await authProvider.requireSession(event.request, db);
+            await hydrateCapabilities(session, rolesService);
             event.locals.auth = session;
         }
         catch (error) {
@@ -33,6 +47,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available (can be null, route will check for signed token)
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -56,7 +71,9 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Check if GraphQL is enabled (built-in, on by default)
         const graphqlEndpoint = config.graphql !== false
-            ? (typeof config.graphql === 'object' ? config.graphql.path ?? '/api/graphql' : '/api/graphql')
+            ? typeof config.graphql === 'object'
+                ? (config.graphql.path ?? '/api/graphql')
+                : '/api/graphql'
             : undefined;
         // Require authentication for protected API routes
         const protectedApiRoutes = [
@@ -65,6 +82,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
             '/api/schemas',
             '/api/organizations',
             '/api/invitations',
+            '/api/roles',
             '/api/settings',
             '/api/instance-settings'
         ];
@@ -110,6 +128,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available in API routes
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -119,6 +138,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         try {
             const auth = await authProvider.getSession(event.request, db);
             if (auth) {
+                await hydrateCapabilities(auth, rolesService);
                 event.locals.auth = auth;
             }
         }

package/dist/lib/auth/auth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-hooks.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAAmB,EACnB,MAAiB,EACjB,YAA0B,EAC1B,EAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEhC,sDAAsD;IACtD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAChC,+DAA+D;gBAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC1C,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC;gBACnD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,gDAAgD;YAChD,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,mCAAmC;QACnC,IAAI,IAAI,GAAgB,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEzE,6BAA6B;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,uEAAuE;QACvE,IAAI,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,4CAA4C;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,+CAA+C;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,CAAC,6BAA6B;QAC3C,CAAC;QAED,gEAAgE;QAChE,mFAAmF;QACnF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,IAAI,GAAgB,IAAI,CAAC;QAE7B,IAAI,SAAS,EAAE,CAAC;YACf,oDAAoD;YACpD,IAAI,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACP,yDAAyD;YACzD,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,wDAAwD;QACxD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK;YAC/C,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;YAC/F,CAAC,CAAC,SAAS,CAAC;QAEb,kDAAkD;QAClD,MAAM,kBAAkB,GAAG;YAC1B,gBAAgB;YAChB,aAAa;YACb,cAAc;YACd,oBAAoB;YACpB,kBAAkB;YAClB,eAAe;YACf,wBAAwB;SACxB,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACrB,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAEpF,IAAI,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBAC9D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,2FAA2F;YAC3F,MAAM,qBAAqB,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAE7E,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrB,+BAA+B;gBAC/B,IAAI,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACzD,wDAAwD;oBACxD,2EAA2E;oBAC3E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;oBACvD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;oBAE7D,IAAI,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClF,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,EAC/E;4BACC,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAC/C,CACD,CAAC;oBACH,CAAC;gBACF,CAAC;qBAAM,CAAC;oBACP,sCAAsC;oBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,EAAE;4BACtF,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAC/C,CAAC,CAAC;oBACJ,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,qFAAqF;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YAC1B,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iEAAiE;QAClE,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,iCAAiC;AAC/C,CAAC"}
+{"version":3,"file":"auth-hooks.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAU,EAAE,YAA0B;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO;IACpC,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,CAAC,wCAAwC;IACvE,IAAI,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,eAAe,CACrD,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,gBAAgB,CACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAAmB,EACnB,MAAiB,EACjB,YAA0B,EAC1B,EAAmB,EACnB,YAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEhC,sDAAsD;IACtD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrE,MAAM,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAChC,+DAA+D;gBAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC1C,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC;gBACnD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,gDAAgD;YAChD,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,mCAAmC;QACnC,IAAI,IAAI,GAAgB,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEzE,6BAA6B;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,uEAAuE;QACvE,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,4CAA4C;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,+CAA+C;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,CAAC,6BAA6B;QAC3C,CAAC;QAED,gEAAgE;QAChE,mFAAmF;QACnF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,IAAI,GAAgB,IAAI,CAAC;QAE7B,IAAI,SAAS,EAAE,CAAC;YACf,oDAAoD;YACpD,IAAI,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACP,yDAAyD;YACzD,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,wDAAwD;QACxD,MAAM,eAAe,GACpB,MAAM,CAAC,OAAO,KAAK,KAAK;YACvB,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBACnC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC;gBACzC,CAAC,CAAC,cAAc;YACjB,CAAC,CAAC,SAAS,CAAC;QAEd,kDAAkD;QAClD,MAAM,kBAAkB,GAAG;YAC1B,gBAAgB;YAChB,aAAa;YACb,cAAc;YACd,oBAAoB;YACpB,kBAAkB;YAClB,YAAY;YACZ,eAAe;YACf,wBAAwB;SACxB,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACrB,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAEpF,IAAI,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBAC9D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,2FAA2F;YAC3F,MAAM,qBAAqB,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAE7E,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrB,+BAA+B;gBAC/B,IAAI,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACzD,wDAAwD;oBACxD,2EAA2E;oBAC3E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;oBACvD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;oBAE7D,IAAI,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClF,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,EAC/E;4BACC,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAC/C,CACD,CAAC;oBACH,CAAC;gBACF,CAAC;qBAAM,CAAC;oBACP,sCAAsC;oBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,EAAE;4BACtF,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAC/C,CAAC,CAAC;oBACJ,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,qFAAqF;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,EAAE,CAAC;gBACV,MAAM,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC9C,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YAC1B,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iEAAiE;QAClE,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,iCAAiC;AAC/C,CAAC"}

package/dist/lib/client/index.d.ts

@@ -3,12 +3,14 @@ export type { SidebarUser, SidebarNavItem, SidebarBranding, SidebarData } from '
 export * from '../field-validation/rule.js';
 export * from '../field-validation/utils.js';
 export { createContentHash, hasUnpublishedChanges } from '../utils/content-hash.js';
-export { setSchemaContext, getSchemaContext } from '../schema-context.svelte';
+export { setSchemaContext, getSchemaContext } from '../schema-context.svelte.js';
+export { setPermissionsContext, usePermissions, type PermissionsContext } from '../permissions-context.svelte.js';
 export * from '../schema-utils/index.js';
 export { default as DocumentEditor } from '../components/admin/DocumentEditor.svelte';
 export { default as SchemaField } from '../components/admin/SchemaField.svelte';
 export { default as AdminApp } from '../components/AdminApp.svelte';
 export { default as Sidebar } from '../components/layout/Sidebar.svelte';
+export { default as PermissionsDebug } from '../components/admin/PermissionsDebug.svelte';
 export { default as StringField } from '../components/admin/fields/StringField.svelte';
 export { default as TextareaField } from '../components/admin/fields/TextareaField.svelte';
 export { default as NumberField } from '../components/admin/fields/NumberField.svelte';
@@ -22,6 +24,6 @@ export * from '../utils/index.js';
 export * from '../api/index.js';
 export type { ApiResponse } from '../api/index.js';
 export { toast } from 'svelte-sonner';
-export { confirmDialog, type ConfirmDialogOptions } from '../components/admin/confirm-dialog/confirm-dialog.svelte';
+export { confirmDialog, type ConfirmDialogOptions } from '../components/admin/confirm-dialog/confirm-dialog.svelte.js';
 export { default as ConfirmDialogHost } from '../components/admin/confirm-dialog/ConfirmDialogHost.svelte';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EACN,qBAAqB,EACrB,cAAc,EACd,KAAK,kBAAkB,EACvB,MAAM,+BAA+B,CAAC;AAGvC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAG1F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}

package/dist/lib/client/index.js

@@ -8,7 +8,9 @@ export * from '../field-validation/utils.js';
 // Content hashing utilities (for client-side change detection)
 export { createContentHash, hasUnpublishedChanges } from '../utils/content-hash.js';
 // Schema context (for providing schemas to components)
-export { setSchemaContext, getSchemaContext } from '../schema-context.svelte';
+export { setSchemaContext, getSchemaContext } from '../schema-context.svelte.js';
+// Permissions context (for capability-based UI gating)
+export { setPermissionsContext, usePermissions } from '../permissions-context.svelte.js';
 // Schema utilities (for working with schemas)
 export * from '../schema-utils/index.js';
 // Components (UI components for the admin interface)
@@ -16,6 +18,8 @@ export { default as DocumentEditor } from '../components/admin/DocumentEditor.sv
 export { default as SchemaField } from '../components/admin/SchemaField.svelte';
 export { default as AdminApp } from '../components/AdminApp.svelte';
 export { default as Sidebar } from '../components/layout/Sidebar.svelte';
+// Debug helpers
+export { default as PermissionsDebug } from '../components/admin/PermissionsDebug.svelte';
 // Field components
 export { default as StringField } from '../components/admin/fields/StringField.svelte';
 export { default as TextareaField } from '../components/admin/fields/TextareaField.svelte';
@@ -32,6 +36,6 @@ export * from '../api/index.js';
 // Toast notifications (re-exported from svelte-sonner for convenience)
 export { toast } from 'svelte-sonner';
 // Confirm dialog (imperative API backed by a mounted host)
-export { confirmDialog } from '../components/admin/confirm-dialog/confirm-dialog.svelte';
+export { confirmDialog } from '../components/admin/confirm-dialog/confirm-dialog.svelte.js';
 export { default as ConfirmDialogHost } from '../components/admin/confirm-dialog/ConfirmDialogHost.svelte';
 //# sourceMappingURL=index.js.map

package/dist/lib/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/client/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,oEAAoE;AAEpE,gDAAgD;AAChD,cAAc,gBAAgB,CAAC;AAG/B,4CAA4C;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAE1C,+DAA+D;AAC/D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,uDAAuD;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,8CAA8C;AAC9C,cAAc,uBAAuB,CAAC;AAEtC,qDAAqD;AACrD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEzE,mBAAmB;AACnB,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAE7F,mCAAmC;AACnC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAG7B,uEAAuE;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,2DAA2D;AAC3D,OAAO,EACN,aAAa,EAEb,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/client/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,oEAAoE;AAEpE,gDAAgD;AAChD,cAAc,gBAAgB,CAAC;AAG/B,4CAA4C;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAE1C,+DAA+D;AAC/D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,uDAAuD;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,uDAAuD;AACvD,OAAO,EACN,qBAAqB,EACrB,cAAc,EAEd,MAAM,+BAA+B,CAAC;AAEvC,8CAA8C;AAC9C,cAAc,uBAAuB,CAAC;AAEtC,qDAAqD;AACrD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEzE,gBAAgB;AAChB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAE1F,mBAAmB;AACnB,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAE7F,mCAAmC;AACnC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAG7B,uEAAuE;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,2DAA2D;AAC3D,OAAO,EACN,aAAa,EAEb,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}

package/dist/lib/db/interfaces/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAE/B,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,cAAc,CACb,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAG3E,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAG5E;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5B;;;;;;OAMG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/F;;;;;;OAMG;IACH,6BAA6B,CAAC,CAC7B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAE9F;;;;;OAKG;IACH,gCAAgC,CAAC,CAChC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGnC,qBAAqB,CAAC,CAAC,IAAI,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEpC,oBAAoB,CAAC,CACpB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,kBAAkB,CAAC,CAClB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC,sBAAsB,CAAC,CACtB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAE/B,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,cAAc,CACb,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAG3E,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAG5E;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5B;;;;;;OAMG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/F;;;;;;OAMG;IACH,6BAA6B,CAAC,CAC7B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAE9F;;;;;OAKG;IACH,gCAAgC,CAAC,CAChC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGnC,qBAAqB,CAAC,CAAC,IAAI,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEpC,oBAAoB,CAAC,CACpB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,kBAAkB,CAAC,CAClB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC,sBAAsB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF"}

package/dist/lib/db/interfaces/index.d.ts

@@ -4,17 +4,19 @@ import type { UserProfileAdapter } from './user.js';
 import type { SchemaAdapter } from './schema.js';
 import type { OrganizationAdapter } from './organization.js';
 import type { InstanceAdapter } from './instance.js';
+import type { RolesAdapter } from './role.js';
 export type { DocumentAdapter, DocumentFilters, CreateDocumentData, UpdateDocumentData } from './document.js';
 export type { AssetAdapter, CreateAssetData, UpdateAssetData } from './asset.js';
 export type { UserProfileAdapter, NewUserProfileData } from './user.js';
 export type { SchemaAdapter } from './schema.js';
 export type { OrganizationAdapter } from './organization.js';
 export type { InstanceAdapter, InstanceSettings } from './instance.js';
+export type { RolesAdapter } from './role.js';
 /**
  * Combined database adapter interface
  * Extends all entity-specific adapters for full database functionality
  */
-export interface DatabaseAdapter extends DocumentAdapter, AssetAdapter, UserProfileAdapter, SchemaAdapter, OrganizationAdapter, InstanceAdapter {
+export interface DatabaseAdapter extends DocumentAdapter, AssetAdapter, UserProfileAdapter, SchemaAdapter, OrganizationAdapter, InstanceAdapter, RolesAdapter {
     connect?(): Promise<void>;
     disconnect?(): Promise<void>;
     isHealthy(): Promise<boolean>;

package/dist/lib/db/interfaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,eAChB,SAAQ,eAAe,EACtB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe;IAEhB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;OAIG;IACH,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY;IAEb,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;OAIG;IACH,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}

package/dist/lib/db/interfaces/organization.d.ts

@@ -9,7 +9,7 @@ export interface OrganizationAdapter {
     addMember(data: NewOrganizationMember): Promise<OrganizationMember>;
     removeMember(organizationId: string, userId: string): Promise<boolean>;
     removeAllMembers(organizationId: string): Promise<boolean>;
-    updateMemberRole(organizationId: string, userId: string, role: 'owner' | 'admin' | 'editor' | 'viewer'): Promise<OrganizationMember | null>;
+    updateMemberRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember | null>;
     findUserMembership(userId: string, organizationId: string): Promise<OrganizationMember | null>;
     findUserOrganizations(userId: string): Promise<OrganizationMembership[]>;
     findOrganizationMembers(organizationId: string): Promise<OrganizationMember[]>;

package/dist/lib/db/interfaces/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/organization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,WAAW,EACX,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,mBAAmB;IAEnC,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oBAAoB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,GACjE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjD,SAAS,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,gBAAgB,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAC3C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzE,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAG/E,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7E,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/organization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,WAAW,EACX,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,mBAAmB;IAEnC,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oBAAoB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,GACjE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjD,SAAS,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,gBAAgB,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzE,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAG/E,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7E,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}

package/dist/lib/db/interfaces/role.d.ts

@@ -0,0 +1,25 @@
+import type { Role, NewRole, Capability } from '../../types/capabilities.js';
+export interface RolesAdapter {
+    /** List all roles for an organization (built-in + custom). */
+    listRoles(organizationId: string): Promise<Role[]>;
+    /** Look up a single role by its name within an organization. */
+    findRoleByName(organizationId: string, name: string): Promise<Role | null>;
+    /** Create a new role. Uniqueness is enforced on (organizationId, name). */
+    createRole(data: NewRole): Promise<Role>;
+    /**
+     * Update the capabilities/description of an existing role.
+     * Returns `null` if no row matched.
+     */
+    updateRole(organizationId: string, name: string, data: {
+        description?: string | null;
+        capabilities?: Capability[];
+    }): Promise<Role | null>;
+    /** Delete a role by name. Returns `true` when a row was removed. */
+    deleteRole(organizationId: string, name: string): Promise<boolean>;
+    /**
+     * Ensure the four built-in roles exist for an organization.
+     * Idempotent: inserts missing rows and leaves existing ones untouched.
+     */
+    seedBuiltinRoles(organizationId: string): Promise<void>;
+}
+//# sourceMappingURL=role.d.ts.map

package/dist/lib/db/interfaces/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/role.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnD,gEAAgE;IAChE,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;OAGG;IACH,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,GAChE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAExB,oEAAoE;IACpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnE;;;OAGG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD"}

package/dist/lib/db/interfaces/role.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=role.js.map

package/dist/lib/db/interfaces/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/role.ts"],"names":[],"mappings":""}

package/dist/lib/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CAKlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CASlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}

package/dist/lib/engine.js

@@ -60,6 +60,11 @@ export function createCMS(config, dbAdapter) {
     if (!cmsInstance) {
         cmsInstance = new CMSEngine(config, dbAdapter);
     }
+    else {
+        // Refresh the singleton's config on subsequent calls so schema HMR
+        // doesn't get frozen by the first (possibly broken) config snapshot.
+        cmsInstance.updateConfig(config);
+    }
     return cmsInstance;
 }
 export function getCMS() {

package/dist/lib/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/lib/engine.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,OAAO,SAAS;IACb,EAAE,CAAkB;IACrB,MAAM,CAAY;IAEzB,YAAY,MAAiB,EAAE,SAA0B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,uDAAuD;IACvD,YAAY,CAAC,SAAoB;QAChC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE;YAC1C,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM;YACzC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM;YAC5E,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;SACxE,CAAC,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,UAAU;QACf,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAE3C,8CAA8C;QAC9C,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAElD,qCAAqC;QACrC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,8CAA8C;QAC9C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;QAED,gEAAgE;QAChE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrD,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,OAAO,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC;IAClC,CAAC;CACD;AAED,sBAAsB;AACtB,IAAI,WAAW,GAAqB,IAAI,CAAC;AAEzC,MAAM,UAAU,SAAS,CAAC,MAAiB,EAAE,SAA0B;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,WAAW,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,MAAM;IACrB,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/lib/engine.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,OAAO,SAAS;IACb,EAAE,CAAkB;IACrB,MAAM,CAAY;IAEzB,YAAY,MAAiB,EAAE,SAA0B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,uDAAuD;IACvD,YAAY,CAAC,SAAoB;QAChC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE;YAC1C,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM;YACzC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM;YAC5E,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;SACxE,CAAC,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,UAAU;QACf,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAE3C,8CAA8C;QAC9C,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAElD,qCAAqC;QACrC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,8CAA8C;QAC9C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;QAED,gEAAgE;QAChE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrD,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,OAAO,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC;IAClC,CAAC;CACD;AAED,sBAAsB;AACtB,IAAI,WAAW,GAAqB,IAAI,CAAC;AAEzC,MAAM,UAAU,SAAS,CAAC,MAAiB,EAAE,SAA0B;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,WAAW,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACP,mEAAmE;QACnE,qEAAqE;QACrE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,MAAM;IACrB,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC"}

package/dist/lib/field-access.d.ts

@@ -0,0 +1,30 @@
+import type { Field, SchemaType } from './types/schemas.js';
+import type { Auth } from './types/auth.js';
+/**
+ * Return the set of field names the caller may NOT read.
+ * Fields with no `access.read` list are readable by default.
+ */
+export declare function hiddenReadFields(schema: SchemaType, auth: Auth | undefined): Set<string>;
+/**
+ * Return the set of field names the caller may NOT write.
+ * Fields with no `access.update` list are writable by default.
+ */
+export declare function hiddenWriteFields(schema: SchemaType, auth: Auth | undefined): Set<string>;
+/**
+ * Strip read-hidden fields from a document payload shape in place.
+ * Safe to call on undefined / non-object values (returns the input).
+ */
+export declare function stripHiddenFields<T extends Record<string, unknown>>(data: T | null | undefined, hidden: ReadonlySet<string>): T | null | undefined;
+/**
+ * Remove write-locked fields from incoming mutation data. Prevents a caller
+ * with collection-level update from silently overwriting fields the schema
+ * protects at the field level.
+ */
+export declare function dropLockedWrites<T extends Record<string, unknown>>(data: T, locked: ReadonlySet<string>): T;
+/**
+ * Extract the raw field definitions for reading (not mutating).
+ * Kept separate from hiddenReadFields so callers can iterate fields directly
+ * when they need richer context than the name set.
+ */
+export declare function fieldByName(schema: SchemaType, name: string): Field | undefined;
+//# sourceMappingURL=field-access.d.ts.map

package/dist/lib/field-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-access.d.ts","sourceRoot":"","sources":["../../src/lib/field-access.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAUxF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAUzF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,CAAC,GAAG,IAAI,GAAG,SAAS,CAKtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,CAAC,CAQH;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAE/E"}