@aphexcms/cms-core 2.0.9 → 2.0.11

package/dist/permissions-context.svelte.js

@@ -0,0 +1,79 @@
+// Svelte context for capability-based UI gating.
+//
+// Set once at the root of the admin shell with a reactive capability source;
+// descendants consume via `usePermissions()`. Mirrors the server-side
+// `hasCapability()` API so the same mental model applies on both sides.
+import { getContext, setContext } from 'svelte';
+const KEY = Symbol.for('aphex.permissions');
+/**
+ * Publish a capability context to descendants.
+ *
+ * `getCapabilities` is a getter rather than a static array so reactive
+ * sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
+ * `can()` call re-reads through the closure.
+ *
+ * @example
+ * ```svelte
+ * <script>
+ *   import { page } from '$app/state';
+ *   import { setPermissionsContext } from '@aphexcms/cms-core';
+ *   setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
+ * </script>
+ * ```
+ */
+export function setPermissionsContext(getCapabilities, getRole = () => null) {
+    const ctx = {
+        get capabilities() {
+            return getCapabilities();
+        },
+        get role() {
+            return getRole();
+        },
+        can(cap) {
+            return getCapabilities().includes(cap);
+        },
+        canAny(...caps) {
+            const current = getCapabilities();
+            return caps.some((c) => current.includes(c));
+        },
+        canAll(...caps) {
+            const current = getCapabilities();
+            return caps.every((c) => current.includes(c));
+        }
+    };
+    setContext(KEY, ctx);
+    return ctx;
+}
+/**
+ * Read the capability context set by an ancestor.
+ *
+ * When no provider is present (e.g. a component rendered in isolation during
+ * tests or Storybook), returns a deny-all stub with a one-time dev warning
+ * rather than throwing — that way consumers degrade to "no affordances shown"
+ * instead of crashing the tree.
+ */
+export function usePermissions() {
+    const ctx = getContext(KEY);
+    if (ctx)
+        return ctx;
+    warnOnce();
+    return DENY_ALL;
+}
+const DENY_ALL = Object.freeze({
+    capabilities: Object.freeze([]),
+    role: null,
+    can: () => false,
+    canAny: () => false,
+    canAll: () => false
+});
+let warned = false;
+function warnOnce() {
+    if (warned)
+        return;
+    warned = true;
+    if (typeof window !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn('[aphex] usePermissions() called outside a PermissionsContext provider. ' +
+            'All capability checks will return false. Call setPermissionsContext() in an ancestor.');
+    }
+}

package/dist/plugins/README.md

@@ -124,26 +124,26 @@ Under this system, a plugin becomes a clean, declarative manifest of its parts.
 import AnalyticsDashboard from './AnalyticsDashboard.svelte';
 
 export function createAnalyticsPlugin(config: AnalyticsConfig = {}): CMSPlugin {
-    const endpoint = config.endpoint ?? '/api/analytics';
-
-    return {
-        name: 'my-analytics-plugin',
-        parts: [
-            // Part 1: The API endpoint
-            {
-                implements: 'aphex/server/route',
-                path: endpoint,
-                handler: (event) => handleAnalyticsRequest(event)
-            },
-            // Part 2: The UI tab in the admin interface
-            {
-                implements: 'aphex/admin/tool',
-                id: 'analytics',
-                title: 'Analytics',
-                component: AnalyticsDashboard
-            }
-        ]
-    };
+	const endpoint = config.endpoint ?? '/api/analytics';
+
+	return {
+		name: 'my-analytics-plugin',
+		parts: [
+			// Part 1: The API endpoint
+			{
+				implements: 'aphex/server/route',
+				path: endpoint,
+				handler: (event) => handleAnalyticsRequest(event)
+			},
+			// Part 2: The UI tab in the admin interface
+			{
+				implements: 'aphex/admin/tool',
+				id: 'analytics',
+				title: 'Analytics',
+				component: AnalyticsDashboard
+			}
+		]
+	};
 }
 ```
 

package/dist/routes/assets-bulk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,MAAM,EAAE,cAwDpB,CAAC"}
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-bulk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,MAAM,EAAE,cAgEpB,CAAC"}

package/dist/routes/assets-bulk.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { bulkDeleteAssetsRequest } from '../api/schemas/assets.js';
 export const DELETE = async ({ request, locals }) => {
     try {
         const { assetService, databaseAdapter } = locals.aphexCMS;
@@ -7,10 +8,16 @@ export const DELETE = async ({ request, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        const { ids } = await request.json();
-        if (!Array.isArray(ids) || ids.length === 0) {
-            return json({ success: false, error: 'No asset IDs provided' }, { status: 400 });
+        const rawBody = await request.json();
+        const parsed = bulkDeleteAssetsRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'No asset IDs provided',
+                issues: parsed.error.issues
+            }, { status: 400 });
         }
+        const { ids } = parsed.data;
         // Check for references before deleting
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {

package/dist/routes/assets-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,GAAG,EAAE,cA6BjB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,cAiDnB,CAAC"}
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA6BjB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,cA6DnB,CAAC"}

package/dist/routes/assets-by-id.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { updateAssetRequest } from '../api/schemas/assets.js';
 export const GET = async ({ params, locals }) => {
     try {
         const { assetService } = locals.aphexCMS;
@@ -69,7 +70,16 @@ export const PATCH = async ({ params, locals, request }) => {
         if (!id) {
             return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
         }
-        const { title, description, alt, creditLine } = await request.json();
+        const rawBody = await request.json();
+        const parsed = updateAssetRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const { title, description, alt, creditLine } = parsed.data;
         let updatedAsset;
         if (auth.type == 'session') {
             updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {

package/dist/routes/assets-references-counts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-references-counts.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD;;;GAGG;AACH,eAAO,MAAM,IAAI,EAAE,cA4BlB,CAAC"}
+{"version":3,"file":"assets-references-counts.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-references-counts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD;;;GAGG;AACH,eAAO,MAAM,IAAI,EAAE,cAwClB,CAAC"}

package/dist/routes/assets-references-counts.js

@@ -1,5 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { assetReferenceCountsRequest } from '../api/schemas/assets.js';
 /**
  * POST /api/assets/references/counts
  * Get reference counts for multiple asset IDs in batch
@@ -11,8 +12,17 @@ export const POST = async ({ request, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        const { ids } = await request.json();
-        if (!Array.isArray(ids) || ids.length === 0) {
+        const rawBody = await request.json();
+        const parsed = assetReferenceCountsRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const { ids } = parsed.data;
+        if (ids.length === 0) {
             return json({ success: true, data: {} });
         }
         if (!databaseAdapter.countDocumentReferencesForAssets) {

package/dist/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAiEjB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC"}

package/dist/routes/assets.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
 import { validateFile } from '../utils/mime-detect.js';
+import { listAssetsQuery } from '../api/schemas/assets.js';
 export const POST = async ({ request, locals }) => {
     try {
         const { assetService } = locals.aphexCMS;
@@ -82,20 +83,20 @@ export const GET = async ({ url, locals }) => {
         if (!auth || auth.type === 'partial_session') {
             return json({ success: false, error: 'Unauthorized' }, { status: 401 });
         }
-        // Parse query parameters
-        const assetType = url.searchParams.get('assetType');
-        const mimeType = url.searchParams.get('mimeType') || undefined;
-        const search = url.searchParams.get('search') || undefined;
-        const limitParam = url.searchParams.get('limit');
-        const offsetParam = url.searchParams.get('offset');
-        const limit = limitParam ? parseInt(limitParam) : 20;
-        const offset = offsetParam ? parseInt(offsetParam) : 0;
+        const parsedQuery = listAssetsQuery.safeParse(Object.fromEntries(url.searchParams.entries()));
+        if (!parsedQuery.success) {
+            return json({
+                success: false,
+                error: 'Invalid query parameters',
+                issues: parsedQuery.error.issues
+            }, { status: 400 });
+        }
         const filters = {
-            assetType,
-            mimeType,
-            search,
-            limit: isNaN(limit) ? 20 : limit,
-            offset: isNaN(offset) ? 0 : offset
+            assetType: parsedQuery.data.assetType,
+            mimeType: parsedQuery.data.mimeType,
+            search: parsedQuery.data.search,
+            limit: parsedQuery.data.limit ?? 20,
+            offset: parsedQuery.data.offset ?? 0
         };
         // Fetch assets and total count in parallel
         const [fetchedAssets, totalAssets] = await Promise.all([

package/dist/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAuDjB,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,cAuCxB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,cA4C5B,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,cAkCxB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,cA0C5B,CAAC"}

package/dist/routes/document-versions.js

@@ -2,6 +2,7 @@
 import { json } from '@sveltejs/kit';
 import { authToContext } from '../local-api/auth-helpers.js';
 import { cmsLogger } from '../utils/logger.js';
+import { listVersionsQuery } from '../api/schemas/documents.js';
 // GET /api/documents/[id]/versions - List version history
 export const GET = async ({ params, url, locals }) => {
     try {
@@ -11,14 +12,27 @@ export const GET = async ({ params, url, locals }) => {
         if (!id) {
             return json({ success: false, error: 'Document ID is required' }, { status: 400 });
         }
-        const limit = parseInt(url.searchParams.get('limit') || '25');
-        const offset = parseInt(url.searchParams.get('offset') || '0');
+        const parsedQuery = listVersionsQuery.safeParse(Object.fromEntries(url.searchParams.entries()));
+        if (!parsedQuery.success) {
+            return json({
+                success: false,
+                error: 'Invalid query parameters',
+                issues: parsedQuery.error.issues
+            }, { status: 400 });
+        }
+        const limit = parsedQuery.data.limit ?? 25;
+        const offset = parsedQuery.data.offset ?? 0;
         const result = await localAPI.versionService.listVersions(databaseAdapter, context.organizationId, id, { limit, offset });
         // Resolve user names for createdBy IDs
         const userIds = [...new Set(result.versions.map((v) => v.createdBy).filter(Boolean))];
         const userMap = new Map();
         if (userIds.length > 0 && locals.aphexCMS.auth) {
             await Promise.all(userIds.map(async (userId) => {
+                // API key actions are stored as "apikey:<id>" — resolve to a friendly label
+                if (userId.startsWith('apikey:')) {
+                    userMap.set(userId, 'API Key');
+                    return;
+                }
                 try {
                     const user = await locals.aphexCMS.auth.getUserById(userId);
                     if (user) {

package/dist/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAOpD,eAAO,MAAM,GAAG,EAAE,cAuEjB,CAAC;AAIF,eAAO,MAAM,GAAG,EAAE,cAkFjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+DpB,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQpD,eAAO,MAAM,GAAG,EAAE,cAuEjB,CAAC;AAIF,eAAO,MAAM,GAAG,EAAE,cAiGjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+DpB,CAAC"}

package/dist/routes/documents-by-id.js

@@ -3,6 +3,7 @@ import { json } from '@sveltejs/kit';
 import { authToContext } from '../local-api/auth-helpers.js';
 import { PermissionError } from '../local-api/permissions.js';
 import { cmsLogger } from '../utils/logger.js';
+import { updateDocumentRequest } from '../api/schemas/documents.js';
 // GET /api/documents/[id] - Get document by ID
 // TODO ENABLE CHILDREN ORG ACCESS BY DEFAULT - BECAUSE IF A PARENT ORG IS TRYING TO ACCESS A CHILD ORG. It should already have access to said id.
 export const GET = async ({ params, url, locals }) => {
@@ -67,12 +68,23 @@ export const PUT = async ({ params, request, locals }) => {
         const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
         const { id } = params;
-        const body = await request.json();
         if (!id) {
             return json({ success: false, error: 'Document ID is required' }, { status: 400 });
         }
-        const documentData = body.draftData || body.data;
-        const shouldPublish = body.publish || false;
+        const rawBody = await request.json();
+        const parsed = updateDocumentRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const documentData = parsed.data.draftData ?? parsed.data.data;
+        if (!documentData) {
+            return json({ success: false, error: 'Document data is required' }, { status: 400 });
+        }
+        const shouldPublish = parsed.data.publish ?? false;
         // Fetch document to get its type (hierarchy-aware, no RLS transaction)
         const found = await localAPI.findDocumentById(context, id);
         if (!found) {

package/dist/routes/documents-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-query.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAUpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC"}
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-query.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAWpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,EAAE,cAyFlB,CAAC"}

package/dist/routes/documents-query.js

@@ -3,6 +3,7 @@ import { json } from '@sveltejs/kit';
 import { authToContext } from '../local-api/auth-helpers.js';
 import { PermissionError } from '../local-api/permissions.js';
 import { cmsLogger } from '../utils/logger.js';
+import { queryDocumentsRequest } from '../api/schemas/documents.js';
 // Default values
 const DEFAULT_PAGE_SIZE = 20;
 const DEFAULT_PAGE = 1;
@@ -33,16 +34,18 @@ export const POST = async ({ request, locals }) => {
     try {
         const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
-        const body = await request.json();
-        // Extract document type
-        const documentType = body.type;
-        if (!documentType) {
+        const rawBody = await request.json();
+        const parsed = queryDocumentsRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
                 error: 'Bad Request',
-                message: 'Document type is required in request body'
+                message: 'Document type is required in request body',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
+        const documentType = body.type;
         // Check if collection exists
         if (!localAPI.hasCollection(documentType)) {
             return json({
@@ -52,18 +55,18 @@ export const POST = async ({ request, locals }) => {
             }, { status: 400 });
         }
         // Parse pagination - support both page-based and offset-based
-        const page = body.page ? Math.max(1, parseInt(body.page)) : DEFAULT_PAGE;
-        const pageSize = body.pageSize || body.limit || DEFAULT_PAGE_SIZE;
+        const page = body.page ?? DEFAULT_PAGE;
+        const pageSize = body.pageSize ?? body.limit ?? DEFAULT_PAGE_SIZE;
         const offset = body.offset !== undefined ? body.offset : (page - 1) * pageSize;
         // Build FindOptions from request body
         const findOptions = {
             where: body.where,
             limit: pageSize,
-            offset: offset,
+            offset,
             sort: body.sort,
-            depth: body.depth !== undefined ? Math.max(0, Math.min(body.depth, 5)) : 0,
+            depth: body.depth ?? 0,
             select: body.select,
-            perspective: body.perspective || 'draft',
+            perspective: body.perspective ?? 'draft',
             includeChildOrganizations: body.includeChildOrganizations,
             filterOrganizationIds: body.filterOrganizationIds
         };

package/dist/routes/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAUpD,eAAO,MAAM,GAAG,EAAE,cAwGjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cAmFlB,CAAC"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAWpD,eAAO,MAAM,GAAG,EAAE,cA6GjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cAkFlB,CAAC"}

package/dist/routes/documents.js

@@ -3,6 +3,7 @@ import { json } from '@sveltejs/kit';
 import { authToContext } from '../local-api/auth-helpers.js';
 import { PermissionError } from '../local-api/permissions.js';
 import { cmsLogger } from '../utils/logger.js';
+import { createDocumentRequest, listDocumentsQuery } from '../api/schemas/documents.js';
 // Default values for API
 const DEFAULT_PAGE_SIZE = 20;
 const DEFAULT_PAGE = 1;
@@ -11,25 +12,27 @@ export const GET = async ({ url, locals }) => {
     try {
         const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
-        // Parse query params
-        const docType = url.searchParams.get('type') || url.searchParams.get('docType');
-        const status = url.searchParams.get('status');
-        const pageParam = url.searchParams.get('page');
-        const pageSizeParam = url.searchParams.get('pageSize') || url.searchParams.get('limit');
-        const depthParam = url.searchParams.get('depth');
-        const sortParam = url.searchParams.get('sort');
-        const perspective = url.searchParams.get('perspective') || 'draft';
-        const includeChildOrganizations = url.searchParams.get('includeChildOrganizations') === 'true';
-        const filterOrganizationIds = url.searchParams
-            .get('filterOrganizationIds')
-            ?.split(',')
-            .filter(Boolean);
-        // Parse pagination
-        const page = pageParam ? Math.max(1, parseInt(pageParam)) : DEFAULT_PAGE;
-        const pageSize = pageSizeParam ? parseInt(pageSizeParam) : DEFAULT_PAGE_SIZE;
+        // Parse + validate query params with zod
+        const rawQuery = Object.fromEntries(url.searchParams.entries());
+        const parsedQuery = listDocumentsQuery.safeParse(rawQuery);
+        if (!parsedQuery.success) {
+            return json({
+                success: false,
+                error: 'Invalid query parameters',
+                issues: parsedQuery.error.issues
+            }, { status: 400 });
+        }
+        const q = parsedQuery.data;
+        const docType = q.type ?? q.docType;
+        const status = q.status;
+        const sortParam = Array.isArray(q.sort) ? q.sort.join(',') : q.sort;
+        const perspective = q.perspective ?? 'draft';
+        const includeChildOrganizations = q.includeChildOrganizations;
+        const filterOrganizationIds = q.filterOrganizationIds;
+        const page = q.page ?? DEFAULT_PAGE;
+        const pageSize = q.pageSize ?? q.limit ?? DEFAULT_PAGE_SIZE;
         const offset = (page - 1) * pageSize;
-        // Parse depth (clamp between 0-5)
-        const depth = depthParam ? Math.max(0, Math.min(parseInt(depthParam), 5)) : 0;
+        const depth = q.depth ?? 0;
         if (!docType) {
             return json({
                 success: false,
@@ -96,18 +99,18 @@ export const POST = async ({ request, locals }) => {
     try {
         const { localAPI } = locals.aphexCMS;
         const context = authToContext(locals.auth);
-        const body = await request.json();
-        // Validate required fields (support both old and new format)
-        const documentType = body.type;
-        const documentData = body.draftData || body.data;
-        const shouldPublish = body.publish || false;
-        if (!documentType || !documentData) {
+        const rawBody = await request.json();
+        const parsed = createDocumentRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
-                error: 'Missing required fields',
-                message: 'Document type and data are required'
+                error: 'Invalid request body',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const documentType = parsed.data.type;
+        const documentData = (parsed.data.draftData ?? parsed.data.data);
+        const shouldPublish = parsed.data.publish ?? false;
         // Get collection API (TypeScript-safe)
         const collection = localAPI.collections[documentType];
         if (!collection) {

package/dist/routes/organizations-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cAgGnB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmFpB,CAAC"}
+{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA8GnB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmFpB,CAAC"}

package/dist/routes/organizations-by-id.js

@@ -1,6 +1,8 @@
 // Aphex CMS Organization by ID API Handlers
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { updateOrganizationRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // GET /api/organizations/[id] - Get organization by ID
 export const GET = async ({ params, locals }) => {
     try {
@@ -71,16 +73,27 @@ export const PATCH = async ({ params, request, locals }) => {
                 message: 'Organization ID is required'
             }, { status: 400 });
         }
-        // Check if user is owner or admin of this organization
+        // Require `org.settings` capability + membership in the target org.
+        // Membership check stands regardless — even a capability holder can only
+        // edit orgs they actually belong to.
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
-        if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
+        if (!membership || !hasCapability(auth, 'org.settings')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can update organization settings'
+                message: 'You do not have permission to update organization settings'
             }, { status: 403 });
         }
-        const body = await request.json();
+        const rawBody = await request.json();
+        const parsed = updateOrganizationRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const body = parsed.data;
         // Validate: if slug is being changed, check it's not already taken
         if (body.slug) {
             const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);

package/dist/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,IAAI,EAAE,cAyGlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAqEpB,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,IAAI,EAAE,cA6IlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}