@aphexcms/cms-core 2.0.9 → 2.0.11

package/dist/routes/organizations-invitations.js

@@ -1,6 +1,8 @@
 // Aphex CMS Organization Invitations API Handlers
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { inviteMemberRequest, cancelInvitationRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // POST /api/organizations/invitations - Create/send an invitation
 export const POST = async ({ request, locals }) => {
     try {
@@ -13,31 +15,57 @@ export const POST = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can invite members
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.invite')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can invite members'
+                message: 'You do not have permission to invite members'
             }, { status: 403 });
         }
-        const body = await request.json();
-        if (!body.email || !body.role) {
+        const rawBody = await request.json();
+        const parsed = inviteMemberRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
-                error: 'Missing required fields',
-                message: 'email and role are required'
+                error: 'Invalid request body',
+                message: 'email and role are required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
-        // Validate role
-        const validRoles = ['admin', 'editor', 'viewer'];
-        if (!validRoles.includes(body.role)) {
+        const body = parsed.data;
+        // Verify the role exists in this organization. Defends against
+        // clients sending a role name that was deleted between page load
+        // and submit, or against typos slipping past the format regex.
+        const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
+        if (!roleRow) {
             return json({
                 success: false,
-                error: 'Invalid role',
-                message: 'Role must be one of: admin, editor, viewer'
+                error: 'Unknown role',
+                message: `No role named "${body.role}" in this organization`
             }, { status: 400 });
         }
+        // Reject self-invitation
+        if (body.email.toLowerCase() === auth.user.email.toLowerCase()) {
+            return json({
+                success: false,
+                error: 'Invalid invitation',
+                message: 'You cannot invite yourself'
+            }, { status: 400 });
+        }
+        // Reject if the invitee is already a member of the organization
+        if (locals.aphexCMS.auth) {
+            const existingUser = await locals.aphexCMS.auth.getUserByEmail(body.email);
+            if (existingUser) {
+                const existingMembership = await databaseAdapter.findUserMembership(existingUser.id, auth.organizationId);
+                if (existingMembership) {
+                    return json({
+                        success: false,
+                        error: 'Already a member',
+                        message: 'This user is already a member of the organization'
+                    }, { status: 400 });
+                }
+            }
+        }
         // Check if there's already a pending invitation for this email
         const existingInvitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
         const pendingInvitation = existingInvitations.find((inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null);
@@ -86,22 +114,24 @@ export const DELETE = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can cancel invitations
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.invite')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can cancel invitations'
+                message: 'You do not have permission to cancel invitations'
             }, { status: 403 });
         }
-        const body = await request.json();
-        if (!body.invitationId) {
+        const rawBody = await request.json();
+        const parsed = cancelInvitationRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
                 error: 'Missing required field',
-                message: 'invitationId is required'
+                message: 'invitationId is required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
         // Delete the invitation
         const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
         if (!deleted) {

package/dist/routes/organizations-members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-members.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,GAAG,EAAE,cAkCjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmIpB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA4HnB,CAAC"}
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-members.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAkCjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAoIpB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA6HnB,CAAC"}

package/dist/routes/organizations-members.js

@@ -1,6 +1,8 @@
 // Aphex CMS Organization Members API Handlers
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { removeMemberRequest, updateMemberRoleRequest } from '../api/schemas/organizations.js';
+import { hasCapability } from '../types/capabilities.js';
 // GET /api/organizations/members - List organization members
 export const GET = async ({ locals }) => {
     try {
@@ -41,22 +43,24 @@ export const DELETE = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can remove members
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.remove')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can remove members'
+                message: 'You do not have permission to remove members'
             }, { status: 403 });
         }
-        const body = await request.json();
-        if (!body.userId) {
+        const rawBody = await request.json();
+        const parsed = removeMemberRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
                 error: 'Missing required field',
-                message: 'userId is required'
+                message: 'userId is required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
         // Prevent removing yourself
         if (body.userId === auth.user.id) {
             return json({
@@ -133,29 +137,31 @@ export const PATCH = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        // Only owners and admins can update roles
-        if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+        if (!hasCapability(auth, 'member.changeRole')) {
             return json({
                 success: false,
                 error: 'Forbidden',
-                message: 'Only owners and admins can update member roles'
+                message: 'You do not have permission to change member roles'
             }, { status: 403 });
         }
-        const body = await request.json();
-        if (!body.userId || !body.role) {
+        const rawBody = await request.json();
+        const parsed = updateMemberRoleRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
-                error: 'Missing required fields',
-                message: 'userId and role are required'
+                error: 'Invalid request body',
+                message: 'userId and role are required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
-        // Validate role
-        const validRoles = ['owner', 'admin', 'editor', 'viewer'];
-        if (!validRoles.includes(body.role)) {
+        const body = parsed.data;
+        // Verify the target role exists in this organization.
+        const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
+        if (!roleRow) {
             return json({
                 success: false,
-                error: 'Invalid role',
-                message: 'Role must be one of: owner, admin, editor, viewer'
+                error: 'Unknown role',
+                message: `No role named "${body.role}" in this organization`
             }, { status: 400 });
         }
         // Prevent changing your own role

package/dist/routes/organizations-switch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-switch.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-switch.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,IAAI,EAAE,cAoElB,CAAC"}
+{"version":3,"file":"organizations-switch.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations-switch.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAsElB,CAAC"}

package/dist/routes/organizations-switch.js

@@ -1,6 +1,7 @@
 // Aphex CMS Organization Switch API Handler
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { switchOrganizationRequest } from '../api/schemas/organizations.js';
 // POST /api/organizations/switch - Switch active organization
 export const POST = async ({ request, locals }) => {
     try {
@@ -13,14 +14,17 @@ export const POST = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        const body = await request.json();
-        if (!body.organizationId) {
+        const rawBody = await request.json();
+        const parsed = switchOrganizationRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
                 error: 'Missing required field',
-                message: 'organizationId is required'
+                message: 'organizationId is required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
         // Verify user is a member of the target organization
         const membership = await databaseAdapter.findUserMembership(auth.user.id, body.organizationId);
         if (!membership) {

package/dist/routes/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,eAAO,MAAM,GAAG,EAAE,cA6CjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cA6FlB,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/lib/routes/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA6CjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cAkGlB,CAAC"}

package/dist/routes/organizations.js

@@ -1,6 +1,7 @@
 // Aphex CMS Organization API Handlers
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { createOrganizationRequest } from '../api/schemas/organizations.js';
 // GET /api/organizations - List user's organizations
 export const GET = async ({ locals }) => {
     try {
@@ -59,15 +60,17 @@ export const POST = async ({ request, locals }) => {
                 message: 'Only super admins can create organizations'
             }, { status: 403 });
         }
-        const body = await request.json();
-        // Validate required fields
-        if (!body.name || !body.slug) {
+        const rawBody = await request.json();
+        const parsed = createOrganizationRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
-                error: 'Missing required fields',
-                message: 'Organization name and slug are required'
+                error: 'Invalid request body',
+                message: 'Organization name and slug are required',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
         // Check if slug is already taken
         const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
         if (existingOrg) {
@@ -86,6 +89,9 @@ export const POST = async ({ request, locals }) => {
             parentOrganizationId: auth.organizationId, // Current active org becomes parent
             createdBy: auth.user.id
         });
+        // Seed the four built-in roles for this org before assigning membership.
+        // The member row references the role by name, so the rows must exist.
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
         // Add the creator as owner
         await databaseAdapter.addMember({
             organizationId: newOrganization.id,

package/dist/routes/roles-by-name.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const PATCH: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=roles-by-name.d.ts.map

package/dist/routes/roles-by-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-by-name.d.ts","sourceRoot":"","sources":["../../src/lib/routes/roles-by-name.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgBpD,eAAO,MAAM,KAAK,EAAE,cA4DnB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cAoEpB,CAAC"}

package/dist/routes/roles-by-name.js

@@ -0,0 +1,111 @@
+// Aphex CMS Roles API Handlers (by-name)
+//
+// PATCH  /api/roles/[name] — edit description / capabilities
+// DELETE /api/roles/[name] — delete a custom role (built-ins cannot be deleted)
+import { json } from '@sveltejs/kit';
+import { cmsLogger } from '../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../types/capabilities.js';
+import { updateRoleRequest } from '../api/schemas/roles.js';
+function unauthorized() {
+    return json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, { status: 401 });
+}
+function forbidden(message) {
+    return json({ success: false, error: 'Forbidden', message }, { status: 403 });
+}
+export const PATCH = async ({ params, request, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const name = params.name;
+        if (!name) {
+            return json({ success: false, error: 'Invalid request', message: 'Role name is required' }, { status: 400 });
+        }
+        const rawBody = await request.json();
+        const parsed = updateRoleRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const body = parsed.data;
+        const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
+        if (!updated) {
+            return json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, { status: 404 });
+        }
+        // Bust the capability cache so open sessions pick up the change on
+        // their next request instead of waiting for TTL.
+        await rolesService.invalidate(auth.organizationId, name);
+        return json({ success: true, data: updated });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update role:', error);
+        return json({
+            success: false,
+            error: 'Failed to update role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const name = params.name;
+        if (!name) {
+            return json({ success: false, error: 'Invalid request', message: 'Role name is required' }, { status: 400 });
+        }
+        // Built-ins are part of the org's guaranteed floor — deleting one
+        // would let a seed run re-create it with stale capabilities. Force the
+        // user to edit instead.
+        if (BUILTIN_ROLE_NAMES.includes(name)) {
+            return forbidden(`"${name}" is a built-in role and cannot be deleted.`);
+        }
+        // Block deletion while the role is assigned to any member or invitation.
+        // Avoids silently orphaning memberships to an unknown role name.
+        const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
+        const inUseByMember = members.some((m) => m.role === name);
+        const invitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
+        const inUseByInvitation = invitations.some((i) => i.role === name && !i.acceptedAt);
+        if (inUseByMember || inUseByInvitation) {
+            return json({
+                success: false,
+                error: 'Role in use',
+                message: `Cannot delete "${name}": reassign affected members or invitations first.`
+            }, { status: 409 });
+        }
+        const deleted = await databaseAdapter.deleteRole(auth.organizationId, name);
+        if (!deleted) {
+            return json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, { status: 404 });
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return json({ success: true, message: 'Role deleted' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to delete role:', error);
+        return json({
+            success: false,
+            error: 'Failed to delete role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/roles.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const POST: RequestHandler;
+//# sourceMappingURL=roles.d.ts.map

package/dist/routes/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/lib/routes/roles.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgBpD,eAAO,MAAM,GAAG,EAAE,cAoBjB,CAAC;AAEF,eAAO,MAAM,IAAI,EAAE,cA0ElB,CAAC"}

package/dist/routes/roles.js

@@ -0,0 +1,90 @@
+// Aphex CMS Roles API Handlers
+//
+// GET  /api/roles          — list roles for the active org
+// POST /api/roles          — create a custom role (requires role.manage)
+import { json } from '@sveltejs/kit';
+import { cmsLogger } from '../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../types/capabilities.js';
+import { createRoleRequest } from '../api/schemas/roles.js';
+function unauthorized() {
+    return json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, { status: 401 });
+}
+function forbidden(message) {
+    return json({ success: false, error: 'Forbidden', message }, { status: 403 });
+}
+export const GET = async ({ locals }) => {
+    try {
+        const { rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        const roles = await rolesService.listRoles(auth.organizationId);
+        return json({ success: true, data: roles });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list roles:', error);
+        return json({
+            success: false,
+            error: 'Failed to list roles',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const POST = async ({ request, locals }) => {
+    try {
+        const { databaseAdapter, rolesService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth || auth.type !== 'session')
+            return unauthorized();
+        if (!hasCapability(auth, 'role.manage')) {
+            return forbidden('You do not have permission to manage roles');
+        }
+        const rawBody = await request.json();
+        const parsed = createRoleRequest.safeParse(rawBody);
+        if (!parsed.success) {
+            return json({
+                success: false,
+                error: 'Invalid request body',
+                message: 'name and capabilities are required',
+                issues: parsed.error.issues
+            }, { status: 400 });
+        }
+        const body = parsed.data;
+        // Reject collisions with reserved built-in names — built-ins are seeded
+        // on every org; a matching custom row would never be reachable.
+        if (BUILTIN_ROLE_NAMES.includes(body.name)) {
+            return json({
+                success: false,
+                error: 'Reserved name',
+                message: `"${body.name}" is a built-in role name. Edit the existing role instead.`
+            }, { status: 409 });
+        }
+        const existing = await databaseAdapter.findRoleByName(auth.organizationId, body.name);
+        if (existing) {
+            return json({
+                success: false,
+                error: 'Conflict',
+                message: `A role named "${body.name}" already exists in this organization.`
+            }, { status: 409 });
+        }
+        const role = await databaseAdapter.createRole({
+            organizationId: auth.organizationId,
+            name: body.name,
+            description: body.description ?? null,
+            capabilities: body.capabilities,
+            isBuiltIn: false
+        });
+        // New role can't be in use yet, but invalidate the prefix just in case
+        // a prior lookup populated the cache with an empty fallback entry.
+        await rolesService.invalidate(auth.organizationId, body.name);
+        return json({ success: true, data: role }, { status: 201 });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create role:', error);
+        return json({
+            success: false,
+            error: 'Failed to create role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/user-preferences.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences.d.ts","sourceRoot":"","sources":["../../src/lib/routes/user-preferences.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAiCjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cAkEnB,CAAC"}
+{"version":3,"file":"user-preferences.d.ts","sourceRoot":"","sources":["../../src/lib/routes/user-preferences.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAiCjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cAoDnB,CAAC"}

package/dist/routes/user-preferences.js

@@ -1,6 +1,7 @@
 // Aphex CMS User Preferences API Handler
 import { json } from '@sveltejs/kit';
 import { cmsLogger } from '../utils/logger.js';
+import { updateUserPreferencesRequest } from '../api/schemas/user.js';
 // GET /api/user/preferences - Get user preferences
 export const GET = async ({ locals }) => {
     try {
@@ -40,24 +41,17 @@ export const PATCH = async ({ request, locals }) => {
                 message: 'Session authentication required'
             }, { status: 401 });
         }
-        const body = (await request.json());
-        // Validate the preferences object
-        if (typeof body !== 'object' || body === null) {
+        const rawBody = await request.json();
+        const parsed = updateUserPreferencesRequest.safeParse(rawBody);
+        if (!parsed.success) {
             return json({
                 success: false,
                 error: 'Invalid request body',
-                message: 'Expected an object with preference values'
-            }, { status: 400 });
-        }
-        // Validate individual preference types
-        if (body.includeChildOrganizations !== undefined &&
-            typeof body.includeChildOrganizations !== 'boolean') {
-            return json({
-                success: false,
-                error: 'Invalid preference value',
-                message: 'includeChildOrganizations must be a boolean'
+                message: 'Invalid preference values',
+                issues: parsed.error.issues
             }, { status: 400 });
         }
+        const body = parsed.data;
         // Update preferences
         await databaseAdapter.updateUserPreferences(auth.user.id, body);
         // Get updated profile

package/dist/routes-exports.d.ts

@@ -15,4 +15,6 @@ export { GET as getOrganizationById, PATCH as updateOrganization, DELETE as dele
 export { POST as switchOrganization } from './routes/organizations-switch.js';
 export { GET as getOrganizationMembers, DELETE as removeMember, PATCH as updateMemberRole } from './routes/organizations-members.js';
 export { POST as inviteMember, DELETE as cancelInvitation } from './routes/organizations-invitations.js';
+export { GET as getRoles, POST as createRole } from './routes/roles.js';
+export { PATCH as updateRole, DELETE as deleteRole } from './routes/roles-by-name.js';
 //# sourceMappingURL=routes-exports.d.ts.map

package/dist/routes-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes-exports.d.ts","sourceRoot":"","sources":["../src/lib/routes-exports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACN,GAAG,IAAI,eAAe,EACtB,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,UAAU,IAAI,kBAAkB,EAChC,cAAc,IAAI,sBAAsB,EACxC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,GAAG,IAAI,YAAY,EACnB,KAAK,IAAI,WAAW,EACpB,MAAM,IAAI,WAAW,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,GAAG,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,IAAI,IAAI,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGpF,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,KAAK,IAAI,kBAAkB,EAC3B,MAAM,IAAI,kBAAkB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACN,GAAG,IAAI,sBAAsB,EAC7B,MAAM,IAAI,YAAY,EACtB,KAAK,IAAI,gBAAgB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,IAAI,IAAI,YAAY,EACpB,MAAM,IAAI,gBAAgB,EAC1B,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"routes-exports.d.ts","sourceRoot":"","sources":["../src/lib/routes-exports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACN,GAAG,IAAI,eAAe,EACtB,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,UAAU,IAAI,kBAAkB,EAChC,cAAc,IAAI,sBAAsB,EACxC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,GAAG,IAAI,YAAY,EACnB,KAAK,IAAI,WAAW,EACpB,MAAM,IAAI,WAAW,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,GAAG,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,IAAI,IAAI,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGpF,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACN,GAAG,IAAI,mBAAmB,EAC1B,KAAK,IAAI,kBAAkB,EAC3B,MAAM,IAAI,kBAAkB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACN,GAAG,IAAI,sBAAsB,EAC7B,MAAM,IAAI,YAAY,EACtB,KAAK,IAAI,gBAAgB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,IAAI,IAAI,YAAY,EACpB,MAAM,IAAI,gBAAgB,EAC1B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/routes-exports.js

@@ -21,3 +21,6 @@ export { GET as getOrganizationById, PATCH as updateOrganization, DELETE as dele
 export { POST as switchOrganization } from './routes/organizations-switch.js';
 export { GET as getOrganizationMembers, DELETE as removeMember, PATCH as updateMemberRole } from './routes/organizations-members.js';
 export { POST as inviteMember, DELETE as cancelInvitation } from './routes/organizations-invitations.js';
+// Role management routes
+export { GET as getRoles, POST as createRole } from './routes/roles.js';
+export { PATCH as updateRole, DELETE as deleteRole } from './routes/roles-by-name.js';

package/dist/save-state-context.svelte.d.ts

@@ -0,0 +1,8 @@
+export interface SaveState {
+    readonly saving: boolean;
+    readonly hasUnsavedChanges: boolean;
+    readonly savedAgoText: string | null;
+}
+export declare function setSaveStateContext(state: SaveState): void;
+export declare function getSaveStateContext(): SaveState | null;
+//# sourceMappingURL=save-state-context.svelte.d.ts.map

package/dist/save-state-context.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-state-context.svelte.d.ts","sourceRoot":"","sources":["../src/lib/save-state-context.svelte.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,QAEnD;AAED,wBAAgB,mBAAmB,IAAI,SAAS,GAAG,IAAI,CAEtD"}

package/dist/save-state-context.svelte.js

@@ -0,0 +1,8 @@
+import { getContext, setContext } from 'svelte';
+const SAVE_STATE_KEY = Symbol('aphex-save-state');
+export function setSaveStateContext(state) {
+    setContext(SAVE_STATE_KEY, state);
+}
+export function getSaveStateContext() {
+    return getContext(SAVE_STATE_KEY) ?? null;
+}

package/dist/schema-utils/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAqMpE"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAqNpE"}

package/dist/schema-utils/validator.js

@@ -103,6 +103,20 @@ export function validateSchemaReferences(schemas) {
                 validateField(field, schema.name);
             }
         }
+        // Validate field.group references against schema.groups
+        if (schema.fields) {
+            const groupNames = new Set((schema.groups ?? []).map((g) => g.name));
+            for (const field of schema.fields) {
+                if (!field.group)
+                    continue;
+                const refs = Array.isArray(field.group) ? field.group : [field.group];
+                for (const ref of refs) {
+                    if (!groupNames.has(ref)) {
+                        errors.push(`Schema "${schema.name}" field "${field.name}" references unknown group "${ref}". Declare it in schema.groups.`);
+                    }
+                }
+            }
+        }
         // Validate preview config references
         if (schema.preview?.select) {
             const fieldNames = new Set(schema.fields?.map((f) => f.name) || []);

package/dist/server/index.d.ts

@@ -12,6 +12,7 @@ export * from '../storage/interfaces/index.js';
 export * from '../storage/providers/storage.js';
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
+export { RolesService } from '../services/roles-service.js';
 export * from '../routes-exports.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';