@aphexcms/cms-core 2.0.3 → 2.0.5

package/dist/local-api/collection-api.js

@@ -35,11 +35,15 @@ export class CollectionAPI {
     databaseAdapter;
     _schema;
     permissions;
-    constructor(collectionName, databaseAdapter, _schema, permissions) {
+    documentCache;
+    hierarchyService;
+    constructor(collectionName, databaseAdapter, _schema, permissions, documentCache, hierarchyService) {
         this.collectionName = collectionName;
         this.databaseAdapter = databaseAdapter;
         this._schema = _schema;
         this.permissions = permissions;
+        this.documentCache = documentCache;
+        this.hierarchyService = hierarchyService;
         // Validate collection exists
         this.permissions.validateCollection(collectionName);
     }
@@ -70,15 +74,32 @@ export class CollectionAPI {
     async find(context, options = {}) {
         // Permission check (unless overrideAccess)
         await this.permissions.canRead(context, this.collectionName);
-        // Call adapter's advanced find method
-        const result = await this.databaseAdapter.findManyDocAdvanced(context.organizationId, this.collectionName, options);
-        // Transform documents to extract data based on perspective
         const perspective = options.perspective || 'draft';
+        // Check cache for published queries
+        if (perspective === 'published' && this.documentCache) {
+            const cached = await this.documentCache.getQuery(context.organizationId, this.collectionName, options);
+            if (cached)
+                return cached;
+        }
+        // Resolve org IDs via hierarchy service (cached) and pass directly —
+        // this avoids the adapter opening a transaction just to set RLS context
+        const findOptions = { ...options };
+        if (this.hierarchyService && !findOptions.filterOrganizationIds) {
+            const orgIds = await this.hierarchyService.getOrgIdsWithChildren(context.organizationId);
+            findOptions.filterOrganizationIds = orgIds;
+        }
+        const result = await this.databaseAdapter.findManyDocAdvanced(context.organizationId, this.collectionName, findOptions);
+        // Transform documents to extract data based on perspective
         const transformedDocs = result.docs.map((doc) => transformDocument(doc, perspective));
-        return {
+        const findResult = {
             ...result,
             docs: transformedDocs
         };
+        // Populate cache for published queries
+        if (perspective === 'published' && this.documentCache) {
+            await this.documentCache.setQuery(context.organizationId, this.collectionName, options, findResult);
+        }
+        return findResult;
     }
     /**
      * Find a single document by ID
@@ -95,13 +116,29 @@ export class CollectionAPI {
     async findByID(context, id, options) {
         // Permission check (unless overrideAccess)
         await this.permissions.canRead(context, this.collectionName);
-        const result = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, id, options);
+        const perspective = options?.perspective || 'draft';
+        // Check cache for published lookups
+        if (perspective === 'published' && this.documentCache) {
+            const cached = await this.documentCache.getDocument(context.organizationId, id);
+            if (cached)
+                return cached;
+        }
+        // Resolve org IDs via hierarchy service (cached) — avoids RLS transaction
+        const findOptions = { ...options };
+        if (this.hierarchyService && !findOptions.filterOrganizationIds) {
+            const orgIds = await this.hierarchyService.getOrgIdsWithChildren(context.organizationId);
+            findOptions.filterOrganizationIds = orgIds;
+        }
+        const result = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, id, findOptions);
         if (!result) {
             return null;
         }
-        // Transform document to extract data based on perspective
-        const perspective = options?.perspective || 'draft';
-        return transformDocument(result, perspective);
+        const transformed = transformDocument(result, perspective);
+        // Populate cache for published lookups
+        if (perspective === 'published' && this.documentCache) {
+            await this.documentCache.setDocument(context.organizationId, id, transformed);
+        }
+        return transformed;
     }
     /**
      * Count documents matching a where clause
@@ -251,7 +288,13 @@ export class CollectionAPI {
     async delete(context, id) {
         // Permission check (unless overrideAccess)
         await this.permissions.canDelete(context, this.collectionName);
-        return this.databaseAdapter.deleteDocById(context.organizationId, id);
+        const result = await this.databaseAdapter.deleteDocById(context.organizationId, id);
+        // Invalidate cache for deleted document
+        if (result && this.documentCache) {
+            await this.documentCache.invalidateDocument(context.organizationId, id);
+            await this.documentCache.invalidateCollection(context.organizationId, this.collectionName);
+        }
+        return result;
     }
     /**
      * Publish a document
@@ -285,6 +328,11 @@ export class CollectionAPI {
         if (!publishedDocument) {
             return null;
         }
+        // Invalidate cache for this document and all collection queries
+        if (this.documentCache) {
+            await this.documentCache.invalidateDocument(context.organizationId, id);
+            await this.documentCache.invalidateCollection(context.organizationId, this.collectionName);
+        }
         return transformDocument(publishedDocument, 'published');
     }
     /**
@@ -305,6 +353,11 @@ export class CollectionAPI {
         if (!document) {
             return null;
         }
+        // Invalidate cache — document is no longer published
+        if (this.documentCache) {
+            await this.documentCache.invalidateDocument(context.organizationId, id);
+            await this.documentCache.invalidateCollection(context.organizationId, this.collectionName);
+        }
         return transformDocument(document, 'draft');
     }
 }

package/dist/local-api/index.d.ts

@@ -1,7 +1,9 @@
 import type { CMSConfig } from '../types/config.js';
 import type { DatabaseAdapter } from '../db/index.js';
+import type { FindOptions } from '../types/filters.js';
 import type { SchemaType } from '../types/schemas.js';
 import { CollectionAPI } from './collection-api.js';
+import type { LocalAPIContext } from './types.js';
 /**
  * Collections map - provides type-safe access to all collections
  * This interface is meant to be augmented by generated types
@@ -44,6 +46,8 @@ export declare class LocalAPI {
     collections: Collections;
     private userAdapter;
     private systemAdapter;
+    private documentCache;
+    private hierarchyService;
     private permissions;
     private schemas;
     constructor(config: CMSConfig, userAdapter: DatabaseAdapter, systemAdapter?: DatabaseAdapter);
@@ -68,6 +72,15 @@ export declare class LocalAPI {
      * Get schema for a collection
      */
     getCollectionSchema(name: string): SchemaType | undefined;
+    /**
+     * Find a document by ID without knowing its collection type.
+     * Resolves org hierarchy and passes filterOrganizationIds to avoid RLS transactions.
+     * Returns the raw document with its type, or null if not found.
+     */
+    findDocumentById(context: LocalAPIContext, id: string, options?: Partial<FindOptions<unknown>>): Promise<{
+        type: string;
+        document: unknown;
+    } | null>;
 }
 /**
  * Create and initialize the Local API

package/dist/local-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAQnB,OAAO,CAAC,MAAM;IAPR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAmBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;CAGzD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAUnB,OAAO,CAAC,MAAM;IATR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAqBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzD;;;;OAIG;IACG,gBAAgB,CACrB,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAetD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/local-api/index.js

@@ -1,6 +1,8 @@
 // local-api/index.ts
 //
 // Main Local API singleton and factory function
+import { DocumentCache } from '../cache/index.js';
+import { HierarchyService } from '../services/hierarchy-service.js';
 import { CollectionAPI } from './collection-api.js';
 import { PermissionChecker } from './permissions.js';
 /**
@@ -38,12 +40,16 @@ export class LocalAPI {
     collections = {};
     userAdapter;
     systemAdapter;
+    documentCache;
+    hierarchyService;
     permissions;
     schemas;
     constructor(config, userAdapter, systemAdapter) {
         this.config = config;
         this.userAdapter = userAdapter;
         this.systemAdapter = systemAdapter || null;
+        this.documentCache = config.cache ? new DocumentCache(config.cache) : null;
+        this.hierarchyService = new HierarchyService(userAdapter, config.cache);
         // Build schema map for quick lookups
         this.schemas = new Map(config.schemaTypes
             .filter((schema) => schema.type === 'document')
@@ -60,7 +66,7 @@ export class LocalAPI {
         const documentSchemas = this.config.schemaTypes.filter((s) => s.type === 'document');
         for (const schema of documentSchemas) {
             // Create a proxy that selects the correct adapter based on context
-            const collectionAPI = new Proxy(new CollectionAPI(schema.name, this.userAdapter, schema, this.permissions), {
+            const collectionAPI = new Proxy(new CollectionAPI(schema.name, this.userAdapter, schema, this.permissions, this.documentCache, this.hierarchyService), {
                 get: (target, prop) => {
                     const method = target[prop];
                     if (typeof method === 'function') {
@@ -69,7 +75,7 @@ export class LocalAPI {
                             const context = args[0];
                             const adapter = this.getAdapter(context);
                             // Create new CollectionAPI with the correct adapter
-                            const api = new CollectionAPI(schema.name, adapter, schema, this.permissions);
+                            const api = new CollectionAPI(schema.name, adapter, schema, this.permissions, this.documentCache, this.hierarchyService);
                             // Call the method on the new instance
                             return api[prop].apply(api, args);
                         };
@@ -108,6 +114,24 @@ export class LocalAPI {
     getCollectionSchema(name) {
         return this.schemas.get(name);
     }
+    /**
+     * Find a document by ID without knowing its collection type.
+     * Resolves org hierarchy and passes filterOrganizationIds to avoid RLS transactions.
+     * Returns the raw document with its type, or null if not found.
+     */
+    async findDocumentById(context, id, options) {
+        const adapter = this.getAdapter(context);
+        const findOptions = { ...options };
+        // Resolve org IDs via hierarchy service to avoid withOrgContext transaction
+        if (this.hierarchyService) {
+            const orgIds = await this.hierarchyService.getOrgIdsWithChildren(context.organizationId);
+            findOptions.filterOrganizationIds = orgIds;
+        }
+        const rawDoc = await adapter.findByDocIdAdvanced(context.organizationId, id, findOptions);
+        if (!rawDoc)
+            return null;
+        return { type: rawDoc.type, document: rawDoc };
+    }
 }
 // Global Local API instance
 let localAPIInstance = null;

package/dist/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,IAAI,EAAE,cAuElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAiEjB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAiEjB,CAAC"}

package/dist/routes/assets.js

@@ -1,6 +1,7 @@
 // Aphex CMS Asset API Handlers
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { validateFile } from '../utils/mime-detect.js';
 export const POST = async ({ request, locals }) => {
     try {
         const { assetService } = locals.aphexCMS;
@@ -16,6 +17,19 @@ export const POST = async ({ request, locals }) => {
         // Convert file to buffer
         const arrayBuffer = await file.arrayBuffer();
         const buffer = Buffer.from(arrayBuffer);
+        // Get allowed MIME types and max size from form data (set by FileField component)
+        const allowedMimeTypesRaw = formData.get('allowedMimeTypes');
+        const maxSizeRaw = formData.get('maxSize');
+        const allowedMimeTypes = allowedMimeTypesRaw ? JSON.parse(allowedMimeTypesRaw) : undefined;
+        const maxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        // Validate file content (magic bytes, blocked types, allowed types)
+        const validation = validateFile(buffer, file.name, file.type, {
+            allowedMimeTypes,
+            maxSize
+        });
+        if (!validation.valid) {
+            return json({ success: false, error: validation.error }, { status: 400 });
+        }
         // Get optional metadata from form data
         const title = formData.get('title') || undefined;
         const description = formData.get('description') || undefined;

package/dist/routes/documents-by-id.js

@@ -7,7 +7,7 @@ import { cmsLogger } from '../utils/logger.js';
 // TODO ENABLE CHILDREN ORG ACCESS BY DEFAULT - BECAUSE IF A PARENT ORG IS TRYING TO ACCESS A CHILD ORG. It should already have access to said id.
 export const GET = async ({ params, url, locals }) => {
     try {
-        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
         if (!id) {
@@ -17,18 +17,18 @@ export const GET = async ({ params, url, locals }) => {
         const depthParam = url.searchParams.get('depth');
         const depth = depthParam ? Math.max(0, Math.min(parseInt(depthParam), 5)) : 0;
         const perspective = url.searchParams.get('perspective') || 'draft';
-        // First, fetch document to get its type (need this for collection-specific API)
-        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
-        if (!rawDoc) {
+        // First, fetch document to get its type (uses hierarchy-aware lookup, no RLS transaction)
+        const result = await localAPI.findDocumentById(context, id);
+        if (!result) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
         // Get collection API (TypeScript-safe)
-        const collection = localAPI.collections[rawDoc.type];
+        const collection = localAPI.collections[result.type];
         if (!collection) {
             return json({
                 success: false,
                 error: 'Invalid document type',
-                message: `Collection '${rawDoc.type}' not found`
+                message: `Collection '${result.type}' not found`
             }, { status: 400 });
         }
         // Now use LocalAPI for permission-checked retrieval
@@ -64,7 +64,7 @@ export const GET = async ({ params, url, locals }) => {
 // TODO ENABLE CHILDREN ORG ACCESS BY DEFAULT - BECAUSE IF A PARENT ORG IS TRYING TO ACCESS A CHILD ORG. It should already have access to said id.
 export const PUT = async ({ params, request, locals }) => {
     try {
-        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
         const body = await request.json();
@@ -73,18 +73,18 @@ export const PUT = async ({ params, request, locals }) => {
         }
         const documentData = body.draftData || body.data;
         const shouldPublish = body.publish || false;
-        // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
-        if (!rawDoc) {
+        // Fetch document to get its type (hierarchy-aware, no RLS transaction)
+        const found = await localAPI.findDocumentById(context, id);
+        if (!found) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
         // Get collection API (TypeScript-safe)
-        const collection = localAPI.collections[rawDoc.type];
+        const collection = localAPI.collections[found.type];
         if (!collection) {
             return json({
                 success: false,
                 error: 'Invalid document type',
-                message: `Collection '${rawDoc.type}' not found`
+                message: `Collection '${found.type}' not found`
             }, { status: 400 });
         }
         // Update via LocalAPI (permission checks and validation happen inside)
@@ -127,24 +127,24 @@ export const PUT = async ({ params, request, locals }) => {
 // DELETE /api/documents/[id] - Delete document
 export const DELETE = async ({ params, locals }) => {
     try {
-        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
         if (!id) {
             return json({ success: false, error: 'Document ID is required' }, { status: 400 });
         }
-        // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
-        if (!rawDoc) {
+        // Fetch document to get its type (hierarchy-aware, no RLS transaction)
+        const result = await localAPI.findDocumentById(context, id);
+        if (!result) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
         // Get collection API (TypeScript-safe)
-        const collection = localAPI.collections[rawDoc.type];
+        const collection = localAPI.collections[result.type];
         if (!collection) {
             return json({
                 success: false,
                 error: 'Invalid document type',
-                message: `Collection '${rawDoc.type}' not found`
+                message: `Collection '${result.type}' not found`
             }, { status: 400 });
         }
         // Delete via LocalAPI (permission checks happen inside)

package/dist/routes/documents-publish.js

@@ -6,7 +6,7 @@ import { cmsLogger } from '../utils/logger.js';
 // POST /api/documents/[id]/publish - Publish document
 export const POST = async ({ params, locals }) => {
     try {
-        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
         if (!id) {
@@ -16,9 +16,9 @@ export const POST = async ({ params, locals }) => {
                 message: 'Document ID is required'
             }, { status: 400 });
         }
-        // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
-        if (!rawDoc) {
+        // Fetch document to get its type (hierarchy-aware, no RLS transaction)
+        const found = await localAPI.findDocumentById(context, id);
+        if (!found) {
             return json({
                 success: false,
                 error: 'Document not found',
@@ -26,12 +26,12 @@ export const POST = async ({ params, locals }) => {
             }, { status: 404 });
         }
         // Get collection API (TypeScript-safe)
-        const collection = localAPI.collections[rawDoc.type];
+        const collection = localAPI.collections[found.type];
         if (!collection) {
             return json({
                 success: false,
                 error: 'Invalid document type',
-                message: `Collection '${rawDoc.type}' not found`
+                message: `Collection '${found.type}' not found`
             }, { status: 400 });
         }
         // Publish via LocalAPI (permission checks and validation happen inside)
@@ -76,7 +76,7 @@ export const POST = async ({ params, locals }) => {
 // DELETE /api/documents/[id]/publish - Unpublish document
 export const DELETE = async ({ params, locals }) => {
     try {
-        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
         if (!id) {
@@ -86,9 +86,9 @@ export const DELETE = async ({ params, locals }) => {
                 message: 'Document ID is required'
             }, { status: 400 });
         }
-        // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
-        if (!rawDoc) {
+        // Fetch document to get its type (hierarchy-aware, no RLS transaction)
+        const found = await localAPI.findDocumentById(context, id);
+        if (!found) {
             return json({
                 success: false,
                 error: 'Document not found',
@@ -96,12 +96,12 @@ export const DELETE = async ({ params, locals }) => {
             }, { status: 404 });
         }
         // Get collection API (TypeScript-safe)
-        const collection = localAPI.collections[rawDoc.type];
+        const collection = localAPI.collections[found.type];
         if (!collection) {
             return json({
                 success: false,
                 error: 'Invalid document type',
-                message: `Collection '${rawDoc.type}' not found`
+                message: `Collection '${found.type}' not found`
             }, { status: 400 });
         }
         // Unpublish via LocalAPI (permission checks happen inside)

package/dist/schema-utils/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAoMpE"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAqMpE"}

package/dist/schema-utils/validator.js

@@ -35,6 +35,7 @@ export function validateSchemaReferences(schemas) {
         'slug',
         'url',
         'image',
+        'file',
         'date',
         'datetime',
         'reference'

package/dist/server/index.d.ts

@@ -1,5 +1,6 @@
 export * from '../types/index.js';
 export * from '../auth/provider.js';
+export * from '../cache/index.js';
 export * from '../email/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
 export { createCMSConfig } from '../config.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -3,6 +3,7 @@
 // Export all core types from the new central location
 export * from '../types/index.js';
 export * from '../auth/provider.js';
+export * from '../cache/index.js';
 export * from '../email/index.js';
 // Authentication errors
 export { AuthError } from '../auth/auth-errors.js';

package/dist/services/hierarchy-service.d.ts

@@ -0,0 +1,26 @@
+import type { CacheAdapter } from '../cache/index.js';
+import type { DatabaseAdapter } from '../db/index.js';
+/**
+ * HierarchyService — caches organization parent→child lookups
+ * using the shared CacheAdapter.
+ *
+ * Lives in cms-core so every adapter (PostgreSQL, SQLite, MongoDB)
+ * benefits from the same caching without reimplementing it.
+ */
+export declare class HierarchyService {
+    private db;
+    private cache;
+    private ttl;
+    private static DEFAULT_TTL;
+    private inflight;
+    constructor(db: DatabaseAdapter, cache?: CacheAdapter | null, ttl?: number);
+    getChildOrganizations(parentOrganizationId: string): Promise<string[]>;
+    /**
+     * Get the parent org ID plus all its child org IDs.
+     * Convenience for building filterOrganizationIds arrays.
+     */
+    getOrgIdsWithChildren(organizationId: string): Promise<string[]>;
+    invalidate(parentOrganizationId: string): Promise<void>;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=hierarchy-service.d.ts.map

package/dist/services/hierarchy-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hierarchy-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/hierarchy-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAK3B,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,GAAG;IANZ,OAAO,CAAC,MAAM,CAAC,WAAW,CAAM;IAChC,OAAO,CAAC,QAAQ,CAAwC;gBAG/C,EAAE,EAAE,eAAe,EACnB,KAAK,GAAE,YAAY,GAAG,IAAW,EACjC,GAAG,GAAE,MAAqC;IAG7C,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA8B5E;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKhE,UAAU,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK5B"}

package/dist/services/hierarchy-service.js

@@ -0,0 +1,63 @@
+/**
+ * HierarchyService — caches organization parent→child lookups
+ * using the shared CacheAdapter.
+ *
+ * Lives in cms-core so every adapter (PostgreSQL, SQLite, MongoDB)
+ * benefits from the same caching without reimplementing it.
+ */
+export class HierarchyService {
+    db;
+    cache;
+    ttl;
+    static DEFAULT_TTL = 60; // 60 seconds
+    inflight = new Map();
+    constructor(db, cache = null, ttl = HierarchyService.DEFAULT_TTL) {
+        this.db = db;
+        this.cache = cache;
+        this.ttl = ttl;
+    }
+    async getChildOrganizations(parentOrganizationId) {
+        if (!this.db.hierarchyEnabled) {
+            return [];
+        }
+        const key = `hierarchy:${parentOrganizationId}`;
+        // Check cache first
+        if (this.cache) {
+            const cached = await this.cache.get(key);
+            if (cached)
+                return cached;
+        }
+        // Deduplicate concurrent requests — if a fetch is already in flight
+        // for this org, wait for that instead of hitting the DB again
+        const existing = this.inflight.get(key);
+        if (existing)
+            return existing;
+        const promise = this.db.getChildOrganizations(parentOrganizationId).then(async (ids) => {
+            if (this.cache) {
+                await this.cache.set(key, ids, this.ttl);
+            }
+            this.inflight.delete(key);
+            return ids;
+        });
+        this.inflight.set(key, promise);
+        return promise;
+    }
+    /**
+     * Get the parent org ID plus all its child org IDs.
+     * Convenience for building filterOrganizationIds arrays.
+     */
+    async getOrgIdsWithChildren(organizationId) {
+        const childIds = await this.getChildOrganizations(organizationId);
+        return childIds.length > 0 ? [organizationId, ...childIds] : [organizationId];
+    }
+    async invalidate(parentOrganizationId) {
+        if (this.cache) {
+            await this.cache.delete(`hierarchy:${parentOrganizationId}`);
+        }
+    }
+    async flush() {
+        if (this.cache) {
+            await this.cache.invalidateByPrefix('hierarchy:');
+        }
+    }
+}

package/dist/services/index.d.ts

@@ -1,3 +1,4 @@
 export { AssetService } from './asset-service.js';
 export type { AssetUploadData, AssetFilters } from './asset-service.js';
+export { HierarchyService } from './hierarchy-service.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/services/index.js

@@ -2,3 +2,4 @@
 // Business logic layer
 // Re-export services
 export { AssetService } from './asset-service.js';
+export { HierarchyService } from './hierarchy-service.js';

package/dist/storage/adapters/local-storage-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAc/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IAUjC;;OAEG;YACW,sBAAsB;IAcpC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IA2CvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}
+{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAK/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IASjC;;OAEG;YACW,sBAAsB;IAcpC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAoCvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}

package/dist/storage/adapters/local-storage-adapter.js

@@ -3,15 +3,6 @@ import { writeFile, mkdir, unlink, stat, readdir } from 'fs/promises';
 import { join, dirname } from 'path';
 import { cmsLogger } from '../../utils/logger.js';
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
-const DEFAULT_ALLOWED_TYPES = [
-    'image/jpeg',
-    'image/png',
-    'image/webp',
-    'image/gif',
-    'image/avif',
-    'application/pdf',
-    'text/plain'
-];
 /**
  * Pure local file system storage adapter - only handles files
  */
@@ -23,7 +14,6 @@ export class LocalStorageAdapter {
             basePath: config.basePath,
             baseUrl: config.baseUrl || '',
             maxFileSize: config.maxFileSize || DEFAULT_MAX_FILE_SIZE,
-            allowedTypes: config.allowedTypes || DEFAULT_ALLOWED_TYPES,
             options: config.options || {}
         };
     }
@@ -71,10 +61,6 @@ export class LocalStorageAdapter {
      * Store a file and return storage info
      */
     async store(data) {
-        // Validate file type
-        if (!this.config.allowedTypes.includes(data.mimeType)) {
-            throw new Error(`Invalid file type: ${data.mimeType}. Allowed types: ${this.config.allowedTypes.join(', ')}`);
-        }
         // Validate file size
         if (data.size > this.config.maxFileSize) {
             throw new Error(`File too large: ${data.size} bytes. Maximum size: ${this.config.maxFileSize} bytes`);

package/dist/storage/interfaces/storage.d.ts

@@ -13,7 +13,6 @@ export interface StorageConfig {
     basePath: string;
     baseUrl?: string;
     maxFileSize?: number;
-    allowedTypes?: string[];
     options?: {
         [key: string]: any;
     };