@aphexcms/cms-core 2.0.9 → 2.0.11

package/dist/api/schemas/documents.js

@@ -0,0 +1,161 @@
+import { z } from 'zod';
+const jsonRecord = z.record(z.string(), z.unknown());
+// ---------- Shared shapes ----------
+export const documentMetaSchema = z
+    .object({
+    status: z.enum(['draft', 'published', 'unpublished']),
+    publishedAt: z.string().nullable().optional(),
+    updatedAt: z.string().optional(),
+    createdAt: z.string().optional(),
+    publishedHash: z.string().nullable().optional(),
+    draftHash: z.string().nullable().optional()
+})
+    .passthrough();
+export const documentSchema = z
+    .object({
+    id: z.string(),
+    type: z.string(),
+    draftData: jsonRecord.nullable().optional(),
+    publishedData: jsonRecord.nullable().optional(),
+    _meta: documentMetaSchema.optional()
+})
+    .passthrough();
+export const paginationMetaSchema = z.object({
+    total: z.number(),
+    page: z.number(),
+    pageSize: z.number(),
+    totalPages: z.number(),
+    hasNextPage: z.boolean(),
+    hasPrevPage: z.boolean()
+});
+// ---------- GET /documents (list) ----------
+const csvString = z
+    .string()
+    .optional()
+    .transform((v) => (v ? v.split(',').filter(Boolean) : undefined));
+export const listDocumentsQuery = z.object({
+    type: z.string().optional(),
+    docType: z.string().optional(), // legacy alias
+    status: z.string().optional(),
+    page: z.coerce.number().int().min(1).optional(),
+    pageSize: z.coerce.number().int().min(1).max(200).optional(),
+    limit: z.coerce.number().int().min(1).max(200).optional(), // legacy alias for pageSize
+    depth: z.coerce.number().int().min(0).max(5).optional(),
+    sort: z.union([z.string(), z.array(z.string())]).optional(),
+    perspective: z.enum(['draft', 'published']).optional(),
+    includeChildOrganizations: z
+        .union([z.boolean(), z.enum(['true', 'false'])])
+        .optional()
+        .transform((v) => v === true || v === 'true'),
+    filterOrganizationIds: csvString
+});
+export const listDocumentsResponse = z.object({
+    success: z.literal(true),
+    data: z.array(documentSchema),
+    pagination: paginationMetaSchema
+});
+// ---------- POST /documents (create) ----------
+export const createDocumentRequest = z
+    .object({
+    type: z.string().min(1),
+    draftData: jsonRecord.optional(),
+    data: jsonRecord.optional(),
+    publish: z.boolean().optional()
+})
+    .refine((v) => v.draftData !== undefined || v.data !== undefined, {
+    message: 'Either draftData or data is required'
+});
+export const createDocumentResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema,
+    validation: z.unknown().optional()
+});
+// ---------- GET /documents/[id] ----------
+export const getDocumentResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema
+});
+// ---------- PUT /documents/[id] (update) ----------
+export const updateDocumentRequest = z
+    .object({
+    draftData: jsonRecord.optional(),
+    data: jsonRecord.optional(),
+    publish: z.boolean().optional()
+})
+    .refine((v) => v.draftData !== undefined || v.data !== undefined, {
+    message: 'Either draftData or data is required'
+});
+export const updateDocumentResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema,
+    validation: z.unknown().optional()
+});
+// ---------- DELETE /documents/[id] ----------
+export const deleteDocumentResponse = z.object({
+    success: z.literal(true),
+    message: z.string().optional()
+});
+// ---------- POST /documents/[id]/publish ----------
+export const publishDocumentResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema,
+    message: z.string().optional()
+});
+// ---------- DELETE /documents/[id]/publish (unpublish) ----------
+export const unpublishDocumentResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema,
+    message: z.string().optional()
+});
+// ---------- POST /documents/query ----------
+// `where` and `select` are intentionally loose — the filter DSL is complex
+// and already validated by LocalAPI.find(). Zod's job here is to catch shape
+// errors on the scalar fields (type, pagination, perspective, etc).
+export const queryDocumentsRequest = z.object({
+    type: z.string().min(1),
+    where: z.unknown().optional(),
+    select: z.unknown().optional(),
+    sort: z.union([z.string(), z.array(z.string())]).optional(),
+    page: z.coerce.number().int().min(1).optional(),
+    pageSize: z.coerce.number().int().min(1).max(500).optional(),
+    limit: z.coerce.number().int().min(1).max(500).optional(),
+    offset: z.coerce.number().int().min(0).optional(),
+    depth: z.coerce.number().int().min(0).max(5).optional(),
+    perspective: z.enum(['draft', 'published']).optional(),
+    includeChildOrganizations: z.boolean().optional(),
+    filterOrganizationIds: z.array(z.string()).optional()
+});
+// ---------- GET /documents/[id]/versions (list) ----------
+export const listVersionsQuery = z.object({
+    limit: z.coerce.number().int().min(1).max(200).optional(),
+    offset: z.coerce.number().int().min(0).optional()
+});
+export const documentVersionSchema = z
+    .object({
+    id: z.string(),
+    documentId: z.string(),
+    organizationId: z.string(),
+    versionNumber: z.number(),
+    eventType: z.enum(['draft', 'publish', 'restore']),
+    data: jsonRecord.nullable(),
+    createdBy: z.string().nullable(),
+    createdByName: z.string().nullable().optional(),
+    createdAt: z.union([z.string(), z.date()]).nullable()
+})
+    .passthrough();
+export const listVersionsResponse = z.object({
+    success: z.literal(true),
+    data: z.array(documentVersionSchema),
+    total: z.number()
+});
+// ---------- GET /documents/[id]/versions/[version] ----------
+export const getVersionResponse = z.object({
+    success: z.literal(true),
+    data: documentVersionSchema
+});
+// ---------- POST /documents/[id]/versions/[version]/restore ----------
+export const restoreVersionResponse = z.object({
+    success: z.literal(true),
+    data: documentSchema,
+    message: z.string().optional()
+});

package/dist/api/schemas/organizations.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+export declare const organizationRoleSchema: z.ZodString;
+export declare const invitableRoleSchema: z.ZodString;
+export declare const createOrganizationRequest: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    parentOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const updateOrganizationRequest: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    slug: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, z.core.$strip>;
+export declare const switchOrganizationRequest: z.ZodObject<{
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export declare const inviteMemberRequest: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodString;
+}, z.core.$strip>;
+export declare const cancelInvitationRequest: z.ZodObject<{
+    invitationId: z.ZodString;
+}, z.core.$strip>;
+export declare const removeMemberRequest: z.ZodObject<{
+    userId: z.ZodString;
+}, z.core.$strip>;
+export declare const updateMemberRoleRequest: z.ZodObject<{
+    userId: z.ZodString;
+    role: z.ZodString;
+}, z.core.$strip>;
+export type OrganizationRoleSchema = z.infer<typeof organizationRoleSchema>;
+export type InvitableRoleSchema = z.infer<typeof invitableRoleSchema>;
+export type CreateOrganizationRequest = z.infer<typeof createOrganizationRequest>;
+export type UpdateOrganizationRequest = z.infer<typeof updateOrganizationRequest>;
+export type SwitchOrganizationRequest = z.infer<typeof switchOrganizationRequest>;
+export type InviteMemberRequest = z.infer<typeof inviteMemberRequest>;
+export type CancelInvitationRequest = z.infer<typeof cancelInvitationRequest>;
+export type RemoveMemberRequest = z.infer<typeof removeMemberRequest>;
+export type UpdateMemberRoleRequest = z.infer<typeof updateMemberRoleRequest>;
+//# sourceMappingURL=organizations.d.ts.map

package/dist/api/schemas/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,sBAAsB,aAAiB,CAAC;AAGrD,eAAO,MAAM,mBAAmB,aAE9B,CAAC;AAMH,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAIH,eAAO,MAAM,yBAAyB;;;;iBAQnC,CAAC;AAIJ,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAIH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/api/schemas/organizations.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+// ---------- Shared ----------
+// Role name — any string matching the cms_roles.name format. The actual
+// existence check happens server-side against the roles table, so a
+// nonexistent name yields a 404/400 rather than a Zod error.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/);
+export const organizationRoleSchema = roleNameSchema;
+// Role used for new invitations — owners cannot be invited, only promoted.
+export const invitableRoleSchema = roleNameSchema.refine((v) => v !== 'owner', {
+    message: 'owner cannot be assigned via invitation'
+});
+const metadataSchema = z.record(z.string(), z.unknown());
+// ---------- POST /organizations ----------
+export const createOrganizationRequest = z.object({
+    name: z.string().min(1),
+    slug: z.string().min(1),
+    metadata: metadataSchema.nullable().optional(),
+    parentOrganizationId: z.string().optional()
+});
+// ---------- PATCH /organizations/[id] ----------
+export const updateOrganizationRequest = z
+    .object({
+    name: z.string().min(1).optional(),
+    slug: z.string().min(1).optional(),
+    metadata: metadataSchema.nullable().optional()
+})
+    .refine((v) => v.name !== undefined || v.slug !== undefined || v.metadata !== undefined, {
+    message: 'At least one field (name, slug, metadata) is required'
+});
+// ---------- POST /organizations/switch ----------
+export const switchOrganizationRequest = z.object({
+    organizationId: z.string().min(1)
+});
+// ---------- POST /organizations/invitations ----------
+export const inviteMemberRequest = z.object({
+    email: z.string().email(),
+    role: invitableRoleSchema
+});
+// ---------- DELETE /organizations/invitations ----------
+export const cancelInvitationRequest = z.object({
+    invitationId: z.string().min(1)
+});
+// ---------- DELETE /organizations/members ----------
+export const removeMemberRequest = z.object({
+    userId: z.string().min(1)
+});
+// ---------- PATCH /organizations/members ----------
+export const updateMemberRoleRequest = z.object({
+    userId: z.string().min(1),
+    role: organizationRoleSchema
+});

package/dist/api/schemas/roles.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import { type Capability } from '../../types/capabilities.js';
+export declare const capabilitySchema: z.ZodEnum<{
+    "document.read": "document.read";
+    "document.create": "document.create";
+    "document.update": "document.update";
+    "document.delete": "document.delete";
+    "document.publish": "document.publish";
+    "document.unpublish": "document.unpublish";
+    "asset.read": "asset.read";
+    "asset.upload": "asset.upload";
+    "asset.delete": "asset.delete";
+    "member.invite": "member.invite";
+    "member.remove": "member.remove";
+    "member.changeRole": "member.changeRole";
+    "apiKey.manage": "apiKey.manage";
+    "role.manage": "role.manage";
+    "org.settings": "org.settings";
+}>;
+export declare const createRoleRequest: z.ZodPipe<z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[];
+    name: string;
+    description?: string | null | undefined;
+}, {
+    name: string;
+    capabilities: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[];
+    description?: string | null | undefined;
+}>>;
+export declare const updateRoleRequest: z.ZodPipe<z.ZodObject<{
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "document.read": "document.read";
+        "document.create": "document.create";
+        "document.update": "document.update";
+        "document.delete": "document.delete";
+        "document.publish": "document.publish";
+        "document.unpublish": "document.unpublish";
+        "asset.read": "asset.read";
+        "asset.upload": "asset.upload";
+        "asset.delete": "asset.delete";
+        "member.invite": "member.invite";
+        "member.remove": "member.remove";
+        "member.changeRole": "member.changeRole";
+        "apiKey.manage": "apiKey.manage";
+        "role.manage": "role.manage";
+        "org.settings": "org.settings";
+    }>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    capabilities: Capability[] | undefined;
+    description?: string | null | undefined;
+}, {
+    description?: string | null | undefined;
+    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+}>>;
+export type CreateRoleRequest = z.infer<typeof createRoleRequest>;
+export type UpdateRoleRequest = z.infer<typeof updateRoleRequest>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/api/schemas/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;EAE5B,CAAC;AAmBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/api/schemas/roles.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+// Runtime enum of every known capability. Unknown strings are rejected so a
+// typo in a client request can't silently grant or strip permissions.
+// The cast preserves the literal Capability union in the inferred type — Zod
+// can't see the compile-time widening of the readonly array on its own.
+export const capabilitySchema = z.enum(ALL_CAPABILITIES);
+// Role name: human-readable identifier stored on member rows and referenced
+// in the API as /api/roles/[name]. Spaces are allowed (URL-encoded client
+// side); control characters and slashes are not, to keep routing unambiguous.
+const roleNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9 _-]+$/, {
+    message: 'Role name may only contain letters, numbers, spaces, underscores, and hyphens'
+});
+// ---------- POST /roles ----------
+// Capabilities are normalized on intake so any write cap pulls in the matching
+// read — a role with `document.create` but no `document.read` can't
+// realistically edit anything, and leaving that gap trips people up.
+export const createRoleRequest = z
+    .object({
+    name: roleNameSchema,
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).default([])
+})
+    .transform((v) => ({ ...v, capabilities: normalizeCapabilities(v.capabilities) }));
+// ---------- PATCH /roles/[name] ----------
+export const updateRoleRequest = z
+    .object({
+    description: z.string().max(500).nullable().optional(),
+    capabilities: z.array(capabilitySchema).optional()
+})
+    .refine((v) => v.description !== undefined || v.capabilities !== undefined, {
+    message: 'At least one field (description, capabilities) is required'
+})
+    .transform((v) => ({
+    ...v,
+    capabilities: v.capabilities ? normalizeCapabilities(v.capabilities) : undefined
+}));

package/dist/api/schemas/user.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export declare const updateUserRequest: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const updateUserPreferencesRequest: z.ZodObject<{
+    includeChildOrganizations: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type UpdateUserRequest = z.infer<typeof updateUserRequest>;
+export type UpdateUserPreferencesRequest = z.infer<typeof updateUserPreferencesRequest>;
+//# sourceMappingURL=user.d.ts.map

package/dist/api/schemas/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/api/schemas/user.js

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+// ---------- PATCH /user ----------
+export const updateUserRequest = z.object({
+    name: z.string().min(1)
+});
+// ---------- PATCH /user/cms-preference ----------
+export const updateUserPreferencesRequest = z
+    .object({
+    includeChildOrganizations: z.boolean().optional()
+})
+    .strict();

package/dist/api/user.d.ts

@@ -1,18 +1,16 @@
 import type { CMSUser } from '../types/user.js';
-import type { UserSessionPreferences } from '../types/organization.js';
 import type { ApiResponse } from './types.js';
-export interface UpdateProfileData {
-    name?: string;
-}
+import type { UpdateUserRequest, UpdateUserPreferencesRequest } from './schemas/user.js';
+export type UpdateProfileData = UpdateUserRequest;
 export declare class UserApi {
     /**
      * Update user profile
      */
-    static updateProfile(data: UpdateProfileData): Promise<ApiResponse<CMSUser>>;
+    static updateProfile(data: UpdateUserRequest): Promise<ApiResponse<CMSUser>>;
     /**
      * Update CMS preferences (e.g. includeChildOrganizations)
      */
-    static updatePreferences(prefs: Partial<UserSessionPreferences>): Promise<ApiResponse<{
+    static updatePreferences(prefs: UpdateUserPreferencesRequest): Promise<ApiResponse<{
         success: boolean;
     }>>;
 }

package/dist/api/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/lib/api/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,OAAO;IACnB;;OAEG;WACU,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAIlF;;OAEG;WACU,iBAAiB,CAC7B,KAAK,EAAE,OAAO,CAAC,sBAAsB,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG7C;AAED,eAAO,MAAM,IAAI;;;CAGhB,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/lib/api/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAItF,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAElD,qBAAa,OAAO;IACnB;;OAEG;WACU,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAIlF;;OAEG;WACU,iBAAiB,CAC7B,KAAK,EAAE,4BAA4B,GACjC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG7C;AAED,eAAO,MAAM,IAAI;;;CAGhB,CAAC"}

package/dist/app-augment.d.ts

@@ -0,0 +1,32 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+import type { RbacPayload } from './types/capabilities.js';
+declare global {
+    namespace App {
+        interface PageData {
+            /**
+             * RBAC snapshot emitted by the admin layout's server load
+             * (`/admin/+layout.server.ts`). Absent on public routes (login,
+             * invitations) that don't pass through the admin layout.
+             */
+            rbac?: RbacPayload;
+        }
+    }
+}
+export {};
+//# sourceMappingURL=app-augment.d.ts.map

package/dist/app-augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-augment.d.ts","sourceRoot":"","sources":["../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,QAAQ;YACjB;;;;eAIG;YACH,IAAI,CAAC,EAAE,WAAW,CAAC;SACnB;KACD;CACD;AAED,OAAO,EAAE,CAAC"}

package/dist/app-augment.js

@@ -0,0 +1,18 @@
+/**
+ * SvelteKit ambient type augmentations emitted by Aphex CMS.
+ *
+ * Side-effect import only — activates the global `App.PageData` shape so
+ * `$page.data.rbac` is typed inside any project that uses cms-core, without
+ * requiring each app to hand-maintain the `App.PageData` interface.
+ *
+ * Import once from `src/app.d.ts`:
+ *
+ * ```ts
+ * import '@aphexcms/cms-core/app-augment';
+ * ```
+ *
+ * The module has no runtime — it's purely a type-augmentation carrier. Kept
+ * as a `.ts` file (not `.d.ts`) so Vite/SvelteKit can resolve the import path
+ * via the package's `./*` export map.
+ */
+export {};

package/dist/auth/auth-hooks.d.ts

@@ -1,6 +1,7 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import type { DatabaseAdapter } from '../db/index.js';
 import type { CMSConfig } from '../types/index.js';
+import type { RolesService } from '../services/roles-service.js';
 import type { AuthProvider } from './provider.js';
-export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter): Promise<Response | null>;
+export declare function handleAuthHook(event: RequestEvent, config: CMSConfig, authProvider: AuthProvider, db: DatabaseAdapter, rolesService: RolesService): Promise<Response | null>;
 //# sourceMappingURL=auth-hooks.d.ts.map

package/dist/auth/auth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8I1B"}
+{"version":3,"file":"auth-hooks.d.ts","sourceRoot":"","sources":["../../src/lib/auth/auth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAkB/C,wBAAsB,cAAc,CACnC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,YAAY,GACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAsJ1B"}

package/dist/auth/auth-hooks.js

@@ -1,11 +1,25 @@
 import { redirect } from '@sveltejs/kit';
 import { AuthError } from './auth-errors.js';
-export async function handleAuthHook(event, config, authProvider, db) {
+/**
+ * Populate `auth.capabilities` for session auth via RolesService.
+ * Runs once per request so downstream permission checks stay synchronous.
+ * No-op for API keys and partial sessions — `resolveCapabilities` handles
+ * those shapes directly.
+ */
+async function hydrateCapabilities(auth, rolesService) {
+    if (auth.type !== 'session')
+        return;
+    if (auth.capabilities)
+        return; // Already populated (e.g. by provider).
+    auth.capabilities = await rolesService.getCapabilities(auth.organizationId, auth.organizationRole);
+}
+export async function handleAuthHook(event, config, authProvider, db, rolesService) {
     const path = event.url.pathname;
     // 1. Admin UI routes - require session authentication
     if (path.startsWith('/admin')) {
         try {
             const session = await authProvider.requireSession(event.request, db);
+            await hydrateCapabilities(session, rolesService);
             event.locals.auth = session;
         }
         catch (error) {
@@ -33,6 +47,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available (can be null, route will check for signed token)
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -56,7 +71,9 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Check if GraphQL is enabled (built-in, on by default)
         const graphqlEndpoint = config.graphql !== false
-            ? (typeof config.graphql === 'object' ? config.graphql.path ?? '/api/graphql' : '/api/graphql')
+            ? typeof config.graphql === 'object'
+                ? (config.graphql.path ?? '/api/graphql')
+                : '/api/graphql'
             : undefined;
         // Require authentication for protected API routes
         const protectedApiRoutes = [
@@ -65,6 +82,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
             '/api/schemas',
             '/api/organizations',
             '/api/invitations',
+            '/api/roles',
             '/api/settings',
             '/api/instance-settings'
         ];
@@ -110,6 +128,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         }
         // Make auth available in API routes
         if (auth) {
+            await hydrateCapabilities(auth, rolesService);
             event.locals.auth = auth;
         }
     }
@@ -119,6 +138,7 @@ export async function handleAuthHook(event, config, authProvider, db) {
         try {
             const auth = await authProvider.getSession(event.request, db);
             if (auth) {
+                await hydrateCapabilities(auth, rolesService);
                 event.locals.auth = auth;
             }
         }

package/dist/auth/provider.d.ts

@@ -10,6 +10,11 @@ export interface AuthProvider {
         name?: string;
         email: string;
     } | null>;
+    getUserByEmail(email: string): Promise<{
+        id: string;
+        name?: string;
+        email: string;
+    } | null>;
     changeUserName(userId: string, name: string): Promise<void>;
     requestPasswordReset(email: string, redirectTo?: string): Promise<void>;
     resetPassword(token: string, newPassword: string): Promise<void>;

package/dist/auth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,WAAW,YAAY;IAE5B,UAAU,CACT,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,WAAW,GAAG,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG5E,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClF,aAAa,CACZ,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,eAAe,EACnB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IAGvB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,WAAW,YAAY;IAE5B,UAAU,CACT,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,WAAW,GAAG,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAG5E,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClF,aAAa,CACZ,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,eAAe,EACnB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IAGvB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1F,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC5F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE"}

package/dist/client/index.d.ts

@@ -4,11 +4,13 @@ export * from '../field-validation/rule.js';
 export * from '../field-validation/utils.js';
 export { createContentHash, hasUnpublishedChanges } from '../utils/content-hash.js';
 export { setSchemaContext, getSchemaContext } from '../schema-context.svelte';
+export { setPermissionsContext, usePermissions, type PermissionsContext } from '../permissions-context.svelte';
 export * from '../schema-utils/index.js';
 export { default as DocumentEditor } from '../components/admin/DocumentEditor.svelte';
 export { default as SchemaField } from '../components/admin/SchemaField.svelte';
 export { default as AdminApp } from '../components/AdminApp.svelte';
 export { default as Sidebar } from '../components/layout/Sidebar.svelte';
+export { default as PermissionsDebug } from '../components/admin/PermissionsDebug.svelte';
 export { default as StringField } from '../components/admin/fields/StringField.svelte';
 export { default as TextareaField } from '../components/admin/fields/TextareaField.svelte';
 export { default as NumberField } from '../components/admin/fields/NumberField.svelte';
@@ -22,4 +24,6 @@ export * from '../utils/index.js';
 export * from '../api/index.js';
 export type { ApiResponse } from '../api/index.js';
 export { toast } from 'svelte-sonner';
+export { confirmDialog, type ConfirmDialogOptions } from '../components/admin/confirm-dialog/confirm-dialog.svelte';
+export { default as ConfirmDialogHost } from '../components/admin/confirm-dialog/ConfirmDialogHost.svelte';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/client/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGlG,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EACN,qBAAqB,EACrB,cAAc,EACd,KAAK,kBAAkB,EACvB,MAAM,+BAA+B,CAAC;AAGvC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAG1F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAG7F,cAAc,gBAAgB,CAAC;AAE/B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6DAA6D,CAAC"}