@aphexcms/cms-core 2.0.9 → 2.0.11

package/dist/lib/local-api/permissions.js

@@ -1,9 +1,16 @@
 // local-api/permissions.ts
 //
-// Permission checking for the Local API layer
-/**
- * Permission error thrown when access is denied
- */
+// Permission checking for the Local API layer.
+//
+// Every operation resolves to a capability. A check passes when either:
+//   1. The collection schema declares `access[operation]` and the caller's
+//      effective organization role appears in the list, OR
+//   2. `auth.capabilities` (hydrated by the auth hook via RolesService)
+//      contains the capability.
+//
+// `overrideAccess` short-circuits everything for system operations.
+import { hasCapability, effectiveOrganizationRole } from '../types/capabilities.js';
+import { cmsLogger } from '../utils/logger.js';
 export class PermissionError extends Error {
     operation;
     resource;
@@ -14,9 +21,33 @@ export class PermissionError extends Error {
         this.name = 'PermissionError';
     }
 }
-/**
- * Checks permissions for Local API operations
- */
+const OPERATION_CAPABILITY = {
+    read: 'document.read',
+    create: 'document.create',
+    update: 'document.update',
+    delete: 'document.delete',
+    publish: 'document.publish',
+    unpublish: 'document.unpublish'
+};
+// Human-readable action phrasing for error messages. Keep in sync with
+// OPERATION_CAPABILITY and any new Operation keys.
+const OPERATION_LABEL = {
+    read: 'view',
+    create: 'create',
+    update: 'edit',
+    delete: 'delete',
+    publish: 'publish',
+    unpublish: 'unpublish'
+};
+function denialMessage(operations, collectionName) {
+    const actions = operations.map((op) => OPERATION_LABEL[op]);
+    const action = actions.length === 1
+        ? actions[0]
+        : actions.length === 2
+            ? `${actions[0]} or ${actions[1]}`
+            : `${actions.slice(0, -1).join(', ')}, or ${actions[actions.length - 1]}`;
+    return `You don't have permission to ${action} ${collectionName} documents. Ask an admin if you need access.`;
+}
 export class PermissionChecker {
     _config;
     schemas;
@@ -24,94 +55,105 @@ export class PermissionChecker {
         this._config = _config;
         this.schemas = schemas;
     }
-    /**
-     * Get the CMS config
-     * Available for future per-collection permission logic
-     */
     get config() {
         return this._config;
     }
-    /**
-     * Check if the current context has read permissions for a collection
-     */
-    async canRead(context, collectionName) {
-        // Always allow if overrideAccess is true (system operations)
-        if (context.overrideAccess) {
-            return;
-        }
-        // Require authentication for read operations
-        if (!context.user) {
-            throw new PermissionError('Authentication required for read operations', 'read', collectionName);
-        }
-        // All authenticated users can read (role-based restrictions handled by RLS)
-        // Additional per-collection permission logic can be added here in the future
-        return;
+    async canRead(context, collectionName, doc) {
+        await this.assert(context, collectionName, 'read', doc);
     }
-    /**
-     * Check if the current context has write permissions (create/update)
-     */
-    async canWrite(context, collectionName) {
-        // Always allow if overrideAccess is true (system operations)
-        if (context.overrideAccess) {
-            return;
-        }
-        // Require authentication for write operations
-        if (!context.user) {
-            throw new PermissionError('Authentication required for write operations', 'write', collectionName);
-        }
-        // Check if user has write role (not a viewer)
-        // Viewers have read-only access
-        if (context.user.role === 'viewer') {
-            throw new PermissionError('Write permission denied. Viewers have read-only access.', 'write', collectionName);
-        }
-        // Additional per-collection permission logic can be added here in the future
-        return;
+    async canCreate(context, collectionName) {
+        // `create` has no target doc by definition.
+        await this.assert(context, collectionName, 'create');
+    }
+    async canUpdate(context, collectionName, doc) {
+        await this.assert(context, collectionName, 'update', doc);
     }
     /**
-     * Check if the current context has delete permissions
+     * @deprecated Prefer `canCreate` or `canUpdate` — this method conflates the
+     * two and was only kept for legacy call sites. It now aliases `canUpdate`
+     * for safety (update is the more restrictive default for mutation).
      */
-    async canDelete(context, collectionName) {
-        // Always allow if overrideAccess is true (system operations)
-        if (context.overrideAccess) {
-            return;
-        }
-        // Require authentication for delete operations
-        if (!context.user) {
-            throw new PermissionError('Authentication required for delete operations', 'delete', collectionName);
-        }
-        // Viewers have read-only access
-        if (context.user.role === 'viewer') {
-            throw new PermissionError('Delete permission denied. Viewers have read-only access.', 'delete', collectionName);
+    async canWrite(context, collectionName, doc) {
+        await this.canUpdate(context, collectionName, doc);
+    }
+    async canDelete(context, collectionName, doc) {
+        await this.assert(context, collectionName, 'delete', doc);
+    }
+    async canPublish(context, collectionName, doc) {
+        await this.assert(context, collectionName, 'publish', doc);
+    }
+    async canUnpublish(context, collectionName, doc) {
+        await this.assert(context, collectionName, 'unpublish', doc);
+    }
+    validateCollection(collectionName) {
+        if (!this.schemas.has(collectionName)) {
+            throw new Error(`Collection "${collectionName}" not found in schema. Available collections: ${Array.from(this.schemas.keys()).join(', ')}`);
         }
-        // Additional per-collection permission logic can be added here in the future
-        return;
     }
-    /**
-     * Check if the current context has publish permissions
-     */
-    async canPublish(context, collectionName) {
-        // Always allow if overrideAccess is true (system operations)
-        if (context.overrideAccess) {
+    // ---- internals -----------------------------------------------------------
+    async assert(context, collectionName, operation, doc) {
+        if (context.overrideAccess)
             return;
+        const auth = this.requireAuth(context, operation, collectionName);
+        if (this.isAllowed(auth, collectionName, operation, doc))
+            return;
+        this.logDenial(auth, operation, collectionName, [OPERATION_CAPABILITY[operation]]);
+        throw new PermissionError(denialMessage([operation], collectionName), operation, collectionName);
+    }
+    logDenial(auth, operation, collectionName, missingCapabilities) {
+        const who = auth.type === 'session'
+            ? `user=${auth.user.id} role="${auth.organizationRole}"`
+            : auth.type === 'api_key'
+                ? `apiKey=${auth.keyId}`
+                : auth.type;
+        const caps = 'capabilities' in auth && Array.isArray(auth.capabilities)
+            ? auth.capabilities.join(',')
+            : '(none)';
+        cmsLogger.warn('[RBAC]', `DENY ${operation} on "${collectionName}" — ${who} has=[${caps}] needs=[${missingCapabilities.join('|')}]`);
+    }
+    requireAuth(context, operation, collectionName) {
+        if (!context.auth) {
+            throw new PermissionError(`You must be signed in to ${OPERATION_LABEL[operation]} ${collectionName} documents.`, operation, collectionName);
         }
-        // Require authentication for publish operations
-        if (!context.user) {
-            throw new PermissionError('Authentication required for publish operations', 'publish', collectionName);
-        }
-        // Check if user has write role (not a viewer)
-        if (context.user.role === 'viewer') {
-            throw new PermissionError('Publish permission denied. Viewers have read-only access.', 'publish', collectionName);
-        }
-        // Additional per-collection permission logic can be added here in the future
-        return;
+        return context.auth;
     }
     /**
-     * Validate that a collection exists in the schema
+     * Evaluate an access rule for a given operation.
+     *
+     * Three kinds of declared rules:
+     *   - `OrganizationRole[]` — role allowlist (as before).
+     *   - `(ctx) => boolean` — arbitrary policy, receives auth + optional doc.
+     *     Use for ownership rules like `doc.createdBy === auth.user.id`.
+     *   - `undefined` — fall back to capability check.
+     *
+     * A declared-but-excluded role/policy for a session caller is an explicit
+     * deny; the capability map does not re-grant access.
      */
-    validateCollection(collectionName) {
-        if (!this.schemas.has(collectionName)) {
-            throw new Error(`Collection "${collectionName}" not found in schema. Available collections: ${Array.from(this.schemas.keys()).join(', ')}`);
+    isAllowed(auth, collectionName, operation, doc) {
+        const schema = this.schemas.get(collectionName);
+        const declared = schema?.access?.[operation];
+        if (declared) {
+            if (typeof declared === 'function') {
+                try {
+                    return declared({ auth, doc });
+                }
+                catch (err) {
+                    // A throwing policy is a bug, not a grant — log and deny.
+                    cmsLogger.error('[RBAC]', `access policy for "${collectionName}.${operation}" threw:`, err);
+                    return false;
+                }
+            }
+            // Array-shaped rule (role allowlist)
+            const role = effectiveOrganizationRole(auth);
+            if (role && declared.includes(role))
+                return true;
+            if (auth.type === 'session' && role) {
+                return false;
+            }
+            // Unrecognized role (custom roles, API keys) → fall through to
+            // capability check so they can still gain access via capabilities.
         }
+        return hasCapability(auth, OPERATION_CAPABILITY[operation]);
     }
 }
 //# sourceMappingURL=permissions.js.map

package/dist/lib/local-api/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,8CAA8C;AAM9C;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGxB;IACA;IAHjB,YACC,OAAe,EACC,SAAiB,EACjB,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IAEpB;IACA;IAFT,YACS,OAAkB,EAClB,OAAgC;QADhC,YAAO,GAAP,OAAO,CAAW;QAClB,YAAO,GAAP,OAAO,CAAyB;IACtC,CAAC;IAEJ;;;OAGG;IACH,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,cAAsB;QAC7D,6DAA6D;QAC7D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,6CAA6C,EAC7C,MAAM,EACN,cAAc,CACd,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO;IACR,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB,EAAE,cAAsB;QAC9D,6DAA6D;QAC7D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,8CAA8C,EAC9C,OAAO,EACP,cAAc,CACd,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,gCAAgC;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CACxB,yDAAyD,EACzD,OAAO,EACP,cAAc,CACd,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO;IACR,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB;QAC/D,6DAA6D;QAC7D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,+CAA+C,EAC/C,QAAQ,EACR,cAAc,CACd,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CACxB,0DAA0D,EAC1D,QAAQ,EACR,cAAc,CACd,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO;IACR,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAwB,EAAE,cAAsB;QAChE,6DAA6D;QAC7D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,gDAAgD,EAChD,SAAS,EACT,cAAc,CACd,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CACxB,2DAA2D,EAC3D,SAAS,EACT,cAAc,CACd,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO;IACR,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,cAAsB;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,eAAe,cAAc,iDAAiD,KAAK,CAAC,IAAI,CACvF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAC;QACH,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,wEAAwE;AACxE,gCAAgC;AAChC,EAAE;AACF,oEAAoE;AAOpE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAmB,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGxB;IACA;IAHjB,YACC,OAAe,EACC,SAAiB,EACjB,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAID,MAAM,oBAAoB,GAAkC;IAC3D,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,oBAAoB;CAC/B,CAAC;AAEF,uEAAuE;AACvE,mDAAmD;AACnD,MAAM,eAAe,GAA8B;IAClD,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;CACtB,CAAC;AAEF,SAAS,aAAa,CAAC,UAAuB,EAAE,cAAsB;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GACX,OAAO,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE;YAClC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,gCAAgC,MAAM,IAAI,cAAc,8CAA8C,CAAC;AAC/G,CAAC;AAED,MAAM,OAAO,iBAAiB;IAEpB;IACA;IAFT,YACS,OAAkB,EAClB,OAAgC;QADhC,YAAO,GAAP,OAAO,CAAW;QAClB,YAAO,GAAP,OAAO,CAAyB;IACtC,CAAC;IAEJ,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB;QAC/D,4CAA4C;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC/E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC9E,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC/E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU,CACf,OAAwB,EACxB,cAAsB,EACtB,GAAc;QAEd,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,OAAwB,EACxB,cAAsB,EACtB,GAAc;QAEd,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,kBAAkB,CAAC,cAAsB;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,eAAe,cAAc,iDAAiD,KAAK,CAAC,IAAI,CACvF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAC;QACH,CAAC;IACF,CAAC;IAED,6EAA6E;IAErE,KAAK,CAAC,MAAM,CACnB,OAAwB,EACxB,cAAsB,EACtB,SAAoB,EACpB,GAAc;QAEd,IAAI,OAAO,CAAC,cAAc;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO;QAEjE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,IAAI,eAAe,CACxB,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,EAC1C,SAAS,EACT,cAAc,CACd,CAAC;IACH,CAAC;IAEO,SAAS,CAChB,IAAU,EACV,SAAiB,EACjB,cAAsB,EACtB,mBAAiC;QAEjC,MAAM,GAAG,GACR,IAAI,CAAC,IAAI,KAAK,SAAS;YACtB,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,CAAC,gBAAgB,GAAG;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE;gBACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACf,MAAM,IAAI,GACT,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YACzD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,CAAC,CAAC,QAAQ,CAAC;QACb,SAAS,CAAC,IAAI,CACb,QAAQ,EACR,QAAQ,SAAS,QAAQ,cAAc,OAAO,GAAG,SAAS,IAAI,YAAY,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC1G,CAAC;IACH,CAAC;IAEO,WAAW,CAClB,OAAwB,EACxB,SAAoB,EACpB,cAAsB;QAEtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,4BAA4B,eAAe,CAAC,SAAS,CAAC,IAAI,cAAc,aAAa,EACrF,SAAS,EACT,cAAc,CACd,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,SAAS,CAChB,IAAU,EACV,cAAsB,EACtB,SAAoB,EACpB,GAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;QAE7C,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACJ,OAAO,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,0DAA0D;oBAC1D,SAAS,CAAC,KAAK,CACd,QAAQ,EACR,sBAAsB,cAAc,IAAI,SAAS,UAAU,EAC3D,GAAG,CACH,CAAC;oBACF,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;YACD,qCAAqC;YACrC,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,+DAA+D;YAC/D,mEAAmE;QACpE,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC;CACD"}

package/dist/lib/permissions-context.svelte.d.ts

@@ -0,0 +1,44 @@
+import type { Capability } from './types/capabilities.js';
+export interface PermissionsContext {
+    /** Current capability list (reactive). */
+    readonly capabilities: readonly string[];
+    /**
+     * Effective organization role name (reactive). `null` when the caller has
+     * no role (API key, unauthenticated). Used for role-name-based checks
+     * such as field-level access lists.
+     */
+    readonly role: string | null;
+    /** True if the session has the named capability. */
+    can(cap: Capability): boolean;
+    /** True if the session has at least one of the capabilities. */
+    canAny(...caps: Capability[]): boolean;
+    /** True if the session has every one of the capabilities. */
+    canAll(...caps: Capability[]): boolean;
+}
+/**
+ * Publish a capability context to descendants.
+ *
+ * `getCapabilities` is a getter rather than a static array so reactive
+ * sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
+ * `can()` call re-reads through the closure.
+ *
+ * @example
+ * ```svelte
+ * <script>
+ *   import { page } from '$app/state';
+ *   import { setPermissionsContext } from '@aphexcms/cms-core';
+ *   setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
+ * </script>
+ * ```
+ */
+export declare function setPermissionsContext(getCapabilities: () => readonly string[], getRole?: () => string | null): PermissionsContext;
+/**
+ * Read the capability context set by an ancestor.
+ *
+ * When no provider is present (e.g. a component rendered in isolation during
+ * tests or Storybook), returns a deny-all stub with a one-time dev warning
+ * rather than throwing — that way consumers degrade to "no affordances shown"
+ * instead of crashing the tree.
+ */
+export declare function usePermissions(): PermissionsContext;
+//# sourceMappingURL=permissions-context.svelte.d.ts.map

package/dist/lib/permissions-context.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-context.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/permissions-context.svelte.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAIvD,MAAM,WAAW,kBAAkB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oDAAoD;IACpD,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,gEAAgE;IAChE,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACvC,6DAA6D;IAC7D,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,MAAM,SAAS,MAAM,EAAE,EACxC,OAAO,GAAE,MAAM,MAAM,GAAG,IAAiB,GACvC,kBAAkB,CAsBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,CAKnD"}

package/dist/lib/permissions-context.svelte.js

@@ -0,0 +1,80 @@
+// Svelte context for capability-based UI gating.
+//
+// Set once at the root of the admin shell with a reactive capability source;
+// descendants consume via `usePermissions()`. Mirrors the server-side
+// `hasCapability()` API so the same mental model applies on both sides.
+import { getContext, setContext } from 'svelte';
+const KEY = Symbol.for('aphex.permissions');
+/**
+ * Publish a capability context to descendants.
+ *
+ * `getCapabilities` is a getter rather than a static array so reactive
+ * sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
+ * `can()` call re-reads through the closure.
+ *
+ * @example
+ * ```svelte
+ * <script>
+ *   import { page } from '$app/state';
+ *   import { setPermissionsContext } from '@aphexcms/cms-core';
+ *   setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
+ * </script>
+ * ```
+ */
+export function setPermissionsContext(getCapabilities, getRole = () => null) {
+    const ctx = {
+        get capabilities() {
+            return getCapabilities();
+        },
+        get role() {
+            return getRole();
+        },
+        can(cap) {
+            return getCapabilities().includes(cap);
+        },
+        canAny(...caps) {
+            const current = getCapabilities();
+            return caps.some((c) => current.includes(c));
+        },
+        canAll(...caps) {
+            const current = getCapabilities();
+            return caps.every((c) => current.includes(c));
+        }
+    };
+    setContext(KEY, ctx);
+    return ctx;
+}
+/**
+ * Read the capability context set by an ancestor.
+ *
+ * When no provider is present (e.g. a component rendered in isolation during
+ * tests or Storybook), returns a deny-all stub with a one-time dev warning
+ * rather than throwing — that way consumers degrade to "no affordances shown"
+ * instead of crashing the tree.
+ */
+export function usePermissions() {
+    const ctx = getContext(KEY);
+    if (ctx)
+        return ctx;
+    warnOnce();
+    return DENY_ALL;
+}
+const DENY_ALL = Object.freeze({
+    capabilities: Object.freeze([]),
+    role: null,
+    can: () => false,
+    canAny: () => false,
+    canAll: () => false
+});
+let warned = false;
+function warnOnce() {
+    if (warned)
+        return;
+    warned = true;
+    if (typeof window !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn('[aphex] usePermissions() called outside a PermissionsContext provider. ' +
+            'All capability checks will return false. Call setPermissionsContext() in an ancestor.');
+    }
+}
+//# sourceMappingURL=permissions-context.svelte.js.map

package/dist/lib/permissions-context.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-context.svelte.js","sourceRoot":"","sources":["../../src/lib/permissions-context.svelte.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AACtE,wEAAwE;AAExE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGhD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAmB5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,eAAwC,EACxC,UAA+B,GAAG,EAAE,CAAC,IAAI;IAEzC,MAAM,GAAG,GAAuB;QAC/B,IAAI,YAAY;YACf,OAAO,eAAe,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI;YACP,OAAO,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,GAAG;YACN,OAAO,eAAe,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,GAAG,IAAI;YACb,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,CAAC,GAAG,IAAI;YACb,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;KACD,CAAC;IACF,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAiC,GAAG,CAAC,CAAC;IAC5D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,QAAQ,EAAE,CAAC;IACX,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;IACpD,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;IAChB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;CACnB,CAAC,CAAC;AAEH,IAAI,MAAM,GAAG,KAAK,CAAC;AACnB,SAAS,QAAQ;IAChB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACX,yEAAyE;YACxE,uFAAuF,CACxF,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/lib/routes/assets-bulk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,MAAM,EAAE,cAwDpB,CAAC"}
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,MAAM,EAAE,cAgEpB,CAAC"}

package/dist/lib/routes/assets-bulk.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { bulkDeleteAssetsRequest } from '../api/schemas/assets.js';
 export const DELETE = async ({ request, locals }) => {
     try {
         const { assetService, databaseAdapter } = locals.aphexCMS;
@@ -7,10 +8,16 @@ export const DELETE = async ({ request, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        const { ids } = await request.json();
-        if (!Array.isArray(ids) || ids.length === 0) {
-            return json({ success: false, error: 'No asset IDs provided' }, { status: 400 });
+        const rawBody = await request.json();
+        const parsed = bulkDeleteAssetsRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'No asset IDs provided',
+                issues: parsed.error.issues
+            }, { status: 400 });
         }
+        const { ids } = parsed.data;
         // Check for references before deleting
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {

package/dist/lib/routes/assets-bulk.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets-bulk.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,MAAM,MAAM,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACnE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,uCAAuC;QACvC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CACpE,IAAI,CAAC,cAAc,EACnB,GAAG,CACH,CAAC;YACF,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB,aAAa,CAAC,MAAM,SAAS,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,gCAAgC;gBACnL,aAAa;aACb,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAE1C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"assets-bulk.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,CAAC,MAAM,MAAM,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACnE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE5B,uCAAuC;QACvC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CACpE,IAAI,CAAC,cAAc,EACnB,GAAG,CACH,CAAC;YACF,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB,aAAa,CAAC,MAAM,SAAS,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,gCAAgC;gBACnL,aAAa;aACb,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAE1C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC,CAAC"}

package/dist/lib/routes/assets-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,GAAG,EAAE,cA6BjB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,cAiDnB,CAAC"}
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA6BjB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,cA6DnB,CAAC"}

package/dist/lib/routes/assets-by-id.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { updateAssetRequest } from '../api/schemas/assets.js';
 export const GET = async ({ params, locals }) => {
     try {
         const { assetService } = locals.aphexCMS;
@@ -69,7 +70,16 @@ export const PATCH = async ({ params, locals, request }) => {
         if (!id) {
             return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
         }
-        const { title, description, alt, creditLine } = await request.json();
+        const rawBody = await request.json();
+        const parsed = updateAssetRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const { title, description, alt, creditLine } = parsed.data;
         let updatedAsset;
         if (auth.type == 'session') {
             updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {

package/dist/lib/routes/assets-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets-by-id.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,kDAAkD;QAClD,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAClE,IAAI,CAAC;QACJ,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QACtB,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,gDAAgD;QAChD,IAAI,eAAe,CAAC,6BAA6B,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CACV;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6CAA6C,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;iBACvG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAI,CACV,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;IAC1E,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErE,IAAI,YAA0B,CAAC;QAE/B,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YAC5B,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,0DAA0D;QAC1D,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,YAAY;SAClB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"assets-by-id.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,kDAAkD;QAClD,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAClE,IAAI,CAAC;QACJ,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QACtB,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,gDAAgD;QAChD,IAAI,eAAe,CAAC,6BAA6B,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CACV;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6CAA6C,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;iBACvG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAI,CACV,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;IAC1E,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE5D,IAAI,YAA0B,CAAC;QAE/B,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YAC5B,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,0DAA0D;QAC1D,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,YAAY;SAClB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACF,CAAC,CAAC"}

package/dist/lib/routes/assets-references-counts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-references-counts.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD;;;GAGG;AACH,eAAO,MAAM,IAAI,EAAE,cA4BlB,CAAC"}
+{"version":3,"file":"assets-references-counts.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD;;;GAGG;AACH,eAAO,MAAM,IAAI,EAAE,cAwClB,CAAC"}

package/dist/lib/routes/assets-references-counts.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { assetReferenceCountsRequest } from '../api/schemas/assets.js';
 /**
  * POST /api/assets/references/counts
  * Get reference counts for multiple asset IDs in batch
@@ -11,8 +12,17 @@ export const POST = async ({ request, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        const { ids } = await request.json();
-        if (!Array.isArray(ids) || ids.length === 0) {
+        const rawBody = await request.json();
+        const parsed = assetReferenceCountsRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const { ids } = parsed.data;
+        if (ids.length === 0) {
             return json({ success: true, data: {} });
         }
         if (!databaseAdapter.countDocumentReferencesForAssets) {

package/dist/lib/routes/assets-references-counts.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets-references-counts.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACvD,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEhG,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"assets-references-counts.js","sourceRoot":"","sources":["../../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACvD,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEhG,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;AACF,CAAC,CAAC"}

package/dist/lib/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAiEjB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC"}

package/dist/lib/routes/assets.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
 import { validateFile } from '../utils/mime-detect.js';
+import { listAssetsQuery } from '../api/schemas/assets.js';
 export const POST = async ({ request, locals }) => {
     try {
         const { assetService } = locals.aphexCMS;
@@ -82,20 +83,20 @@ export const GET = async ({ url, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        // Parse query parameters
-        const assetType = url.searchParams.get('assetType');
-        const mimeType = url.searchParams.get('mimeType') || undefined;
-        const search = url.searchParams.get('search') || undefined;
-        const limitParam = url.searchParams.get('limit');
-        const offsetParam = url.searchParams.get('offset');
-        const limit = limitParam ? parseInt(limitParam) : 20;
-        const offset = offsetParam ? parseInt(offsetParam) : 0;
+        const parsedQuery = listAssetsQuery.safeParse(Object.fromEntries(url.searchParams.entries()));
+        if (!parsedQuery.success) {
+            return json({
+                success: false,
+                error: 'Invalid query parameters',
+                issues: parsedQuery.error.issues
+            }, { status: 400 });
+        }
         const filters = {
-            assetType,
-            mimeType,
-            search,
-            limit: isNaN(limit) ? 20 : limit,
-            offset: isNaN(offset) ? 0 : offset
+            assetType: parsedQuery.data.assetType,
+            mimeType: parsedQuery.data.mimeType,
+            search: parsedQuery.data.search,
+            limit: parsedQuery.data.limit ?? 20,
+            offset: parsedQuery.data.offset ?? 0
         };
         // Fetch assets and total count in parallel
         const [fetchedAssets, totalAssets] = await Promise.all([

package/dist/lib/routes/assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAS,CAAC;QAE1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,kFAAkF;QAClF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAkB,CAAC;QAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAC;QAC5D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,oEAAoE;QACpE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAC7D,gBAAgB;YAChB,OAAO;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,uCAAuC;QACvC,MAAM,KAAK,GAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAY,IAAI,SAAS,CAAC;QAC7D,MAAM,WAAW,GAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAY,IAAI,SAAS,CAAC;QACzE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAY,IAAI,SAAS,CAAC;QACzD,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QACvE,MAAM,SAAS,GAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAY,IAAI,SAAS,CAAC;QAErE,4DAA4D;QAC5D,6EAA6E;QAC7E,MAAM,oBAAoB,GAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAY,IAAI,IAAI,CAAC,cAAc,CAAC;QAE/F,2BAA2B;QAC3B,MAAM,UAAU,GAAG;YAClB,cAAc,EAAE,oBAAoB,EAAE,kCAAkC;YACxE,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,IAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,WAAW;YACX,GAAG;YACH,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,QAAQ,EAAE;gBACT,UAAU;gBACV,SAAS;aACT;SACD,CAAC;QAEF,iCAAiC;QACjC,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;QACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG;YACf,SAAS;YACT,QAAQ;YACR,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC;QAEF,2CAA2C;QAC3C,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YACrD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC5C,GAAG,OAAO;gBACV,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,CAAC;aACT,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE;gBACX,KAAK;gBACL,IAAI,EAAE,WAAW;gBACjB,QAAQ;gBACR,UAAU;gBACV,WAAW,EAAE,WAAW,GAAG,UAAU;gBACrC,WAAW,EAAE,WAAW,GAAG,CAAC;aAC5B;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAS,CAAC;QAE1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,kFAAkF;QAClF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAkB,CAAC;QAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAC;QAC5D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,oEAAoE;QACpE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAC7D,gBAAgB;YAChB,OAAO;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,uCAAuC;QACvC,MAAM,KAAK,GAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAY,IAAI,SAAS,CAAC;QAC7D,MAAM,WAAW,GAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAY,IAAI,SAAS,CAAC;QACzE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAY,IAAI,SAAS,CAAC;QACzD,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QACvE,MAAM,SAAS,GAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAY,IAAI,SAAS,CAAC;QAErE,4DAA4D;QAC5D,6EAA6E;QAC7E,MAAM,oBAAoB,GAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAY,IAAI,IAAI,CAAC,cAAc,CAAC;QAE/F,2BAA2B;QAC3B,MAAM,UAAU,GAAG;YAClB,cAAc,EAAE,oBAAoB,EAAE,kCAAkC;YACxE,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,IAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,WAAW;YACX,GAAG;YACH,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,QAAQ,EAAE;gBACT,UAAU;gBACV,SAAS;aACT;SACD,CAAC;QAEF,iCAAiC;QACjC,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;aAChC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG;YACf,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS;YACrC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ;YACnC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM;YAC/B,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC;SACpC,CAAC;QAEF,2CAA2C;QAC3C,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YACrD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC5C,GAAG,OAAO;gBACV,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,CAAC;aACT,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE;gBACX,KAAK;gBACL,IAAI,EAAE,WAAW;gBACjB,QAAQ;gBACR,UAAU;gBACV,WAAW,EAAE,WAAW,GAAG,UAAU;gBACrC,WAAW,EAAE,WAAW,GAAG,CAAC;aAC5B;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}