@aphexcms/cms-core 8.0.0 → 9.0.0

package/dist/local-api/collection-api.js

@@ -162,7 +162,10 @@ export class CollectionAPI {
         // callers always get one document back. Filters are intentionally
         // ignored — there is at most one row by definition.
         if (this._schema.singleton) {
-            const doc = await this.get(context, { perspective: options.perspective, depth: options.depth });
+            const doc = await this.get(context, {
+                perspective: options.perspective,
+                depth: options.depth
+            });
             return {
                 docs: [doc],
                 totalDocs: 1,
@@ -459,8 +462,7 @@ export class CollectionAPI {
         // Protect the canonical singleton row. In-limbo random-uuid docs of
         // the same type (left over from before the schema was flipped to
         // singleton) remain deletable — only the deterministic id is locked.
-        if (this._schema.singleton &&
-            id === singletonId(this._schema.name, context.organizationId)) {
+        if (this._schema.singleton && id === singletonId(this._schema.name, context.organizationId)) {
             throw new SingletonOperationError(`Cannot delete the singleton document for '${this._schema.name}'. Remove the singleton flag from the schema first.`);
         }
         // Fetch the target so ownership policies have a doc to inspect. For
@@ -513,16 +515,12 @@ export class CollectionAPI {
                 const refDoc = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, refId);
                 if (refDoc && !refDoc.publishedData) {
                     const data = refDoc.draftData;
-                    const title = data?.title ||
-                        data?.name ||
-                        refDoc.id;
+                    const title = data?.title || data?.name || refDoc.id;
                     unpublished.push({ id: refDoc.id, type: refDoc.type, title });
                 }
             }
             if (unpublished.length > 0) {
-                const names = unpublished
-                    .map((d) => `"${d.title}" (${d.type})`)
-                    .join(', ');
+                const names = unpublished.map((d) => `"${d.title}" (${d.type})`).join(', ');
                 throw new Error(`Cannot publish — ${unpublished.length} referenced document(s) are not published: ${names}`);
             }
         }

package/dist/local-api/index.d.ts

@@ -11,7 +11,6 @@ import type { LocalAPIContext } from './types.js';
  * This interface is meant to be augmented by generated types
  */
 export interface Collections {
-    [collectionName: string]: CollectionAPI<unknown>;
 }
 /**
  * Local API - provides a unified, type-safe interface for all CMS operations
@@ -46,6 +45,7 @@ export interface Collections {
 export declare class LocalAPI {
     private config;
     collections: Collections;
+    private _collections;
     private userAdapter;
     private systemAdapter;
     private documentCache;
@@ -72,6 +72,10 @@ export declare class LocalAPI {
      * Check if a collection exists
      */
     hasCollection(name: string): boolean;
+    /**
+     * Get a collection by name (for dynamic access in route handlers and resolvers)
+     */
+    getCollection(name: string): CollectionAPI<unknown> | undefined;
     /**
      * Get schema for a collection
      */

package/dist/local-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAYnB,OAAO,CAAC,MAAM;IAXR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAmB;IACpC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IAC5C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAyBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8D7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzD;;;;OAIG;IACG,gBAAgB,CACrB,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAgBtD;;;;OAIG;IACG,iBAAiB,CACtB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAKtE;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,CAAC,GAAG,OAAO,EACnC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA6Cf;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;;GAGG;AAEH,MAAM,WAAW,WAAW;CAAG;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAanB,OAAO,CAAC,MAAM;IAZR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,YAAY,CAA6C;IACjE,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAmB;IACpC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IAC5C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAyBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS;IAI/D;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzD;;;;OAIG;IACG,gBAAgB,CACrB,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAgBtD;;;;OAIG;IACG,iBAAiB,CACtB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAKtE;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,CAAC,GAAG,OAAO,EACnC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA6Cf;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/local-api/index.js

@@ -49,6 +49,7 @@ import { PermissionChecker } from './permissions.js';
 export class LocalAPI {
     config;
     collections = {};
+    _collections = new Map();
     userAdapter;
     systemAdapter;
     documentCache;
@@ -90,8 +91,7 @@ export class LocalAPI {
                     // wrapper. They don't touch the database, so wrapping
                     // would force callers to `await` what is actually a
                     // synchronous compute (and break their return types).
-                    if (typeof method === 'function' &&
-                        SYNC_COLLECTION_METHODS.has(prop)) {
+                    if (typeof method === 'function' && SYNC_COLLECTION_METHODS.has(prop)) {
                         return method.bind(target);
                     }
                     if (typeof method === 'function') {
@@ -108,7 +108,9 @@ export class LocalAPI {
                     return method;
                 }
             });
-            this.collections[schema.name] = collectionAPI;
+            this._collections.set(schema.name, collectionAPI);
+            this.collections[schema.name] =
+                collectionAPI;
         }
     }
     /**
@@ -133,6 +135,12 @@ export class LocalAPI {
     hasCollection(name) {
         return this.schemas.has(name);
     }
+    /**
+     * Get a collection by name (for dynamic access in route handlers and resolvers)
+     */
+    getCollection(name) {
+        return this._collections.get(name);
+    }
     /**
      * Get schema for a collection
      */
@@ -202,7 +210,7 @@ export class LocalAPI {
         const docs = await Promise.all(typeLookups.map(async (lookup) => {
             if (!lookup)
                 return null;
-            const collection = this.collections[lookup.type];
+            const collection = this.getCollection(lookup.type);
             if (!collection)
                 return null;
             try {

package/dist/routes/assets-cdn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,GAAG,EAAE,cAkKjB,CAAC"}
+{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,GAAG,EAAE,cAyKjB,CAAC"}

package/dist/routes/assets-cdn.js

@@ -116,12 +116,17 @@ export const GET = async ({ params, locals, setHeaders, request }) => {
             .replace(/[^\x20-\x7E]/g, '_') // strip anything outside printable ASCII
             .replace(/["\\]/g, ''); // drop quotes and backslashes that'd break the quoted-string
         const utf8Encoded = encodeURIComponent(rawFilename);
-        // Set appropriate headers for the asset
+        const safeInlineTypes = ['image/', 'application/pdf', 'video/', 'audio/'];
+        const canInline = asset.mimeType &&
+            asset.mimeType !== 'image/svg+xml' &&
+            safeInlineTypes.some((t) => asset.mimeType.startsWith(t));
+        const disposition = canInline ? 'inline' : 'attachment';
         setHeaders({
             'Content-Type': asset.mimeType || 'application/octet-stream',
             'Content-Length': fileBuffer.length.toString(),
-            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
-            'Content-Disposition': `inline; filename="${asciiFallback}"; filename*=UTF-8''${utf8Encoded}`,
+            'Cache-Control': 'public, max-age=31536000, immutable',
+            'Content-Disposition': `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${utf8Encoded}`,
+            'X-Content-Type-Options': 'nosniff',
             ...(asset.mimeType?.startsWith('image/') && {
                 'Accept-Ranges': 'bytes'
             })

package/dist/server/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAY7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAsCrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAEzC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAqB7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAkDrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IACtE,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}

package/dist/server/api/index.js

@@ -1,4 +1,5 @@
 import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
 import { schemasRouter } from './routes/schemas.js';
 import { documentsRouter } from './routes/documents.js';
 import { documentsByIdRouter } from './routes/documents-by-id.js';
@@ -27,6 +28,11 @@ import { userRouter } from './routes/user.js';
  */
 export function createAphexApi() {
     const app = new Hono().basePath('/api');
+    // Reject oversized request bodies before they're fully buffered.
+    app.use('*', bodyLimit({
+        maxSize: 10 * 1024 * 1024, // 10MB for JSON endpoints
+        onError: (c) => c.json({ success: false, error: 'Request body too large (max 10MB)' }, 413)
+    }));
     // Bridge: lift values passed via app.fetch(req, env) onto c.var so
     // handlers can read c.var.aphexCMS / c.var.auth directly.
     app.use('*', async (c, next) => {
@@ -77,6 +83,18 @@ export function mountAphexBuiltins(app) {
     // Hono would try to match them under the wrong handler chain.
     app.route('/user', userPreferencesRouter);
     app.route('/user', userRouter);
+    // Health check — unauthenticated, used by load balancers and uptime monitors.
+    app.get('/aphex-health', async (c) => {
+        try {
+            const { databaseAdapter } = c.var.aphexCMS;
+            const dbHealthy = await databaseAdapter.isHealthy();
+            const status = dbHealthy ? 'healthy' : 'degraded';
+            return c.json({ status, database: dbHealthy }, dbHealthy ? 200 : 503);
+        }
+        catch {
+            return c.json({ status: 'unhealthy', database: false }, 503);
+        }
+    });
 }
 /**
  * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted

package/dist/server/api/routes/assets-bulk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAkE3C,CAAC"}
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAyE3C,CAAC"}

package/dist/server/api/routes/assets-bulk.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { bulkDeleteAssetsRequest } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bulkDeleteAssetsRequest, (result, c) => {
     if (!result.success) {
         return c.json({
@@ -17,6 +18,9 @@ export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bu
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.delete')) {
+            return c.json({ success: false, error: 'Forbidden: asset.delete capability required' }, 403);
+        }
         const { ids } = c.req.valid('json');
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {

package/dist/server/api/routes/assets-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CA8HzC,CAAC"}
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CA0I1C,CAAC"}

package/dist/server/api/routes/assets-by-id.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateAssetRequest } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsByIdRouter = new Hono()
     .get('/:id', async (c) => {
     try {
@@ -33,6 +34,9 @@ export const assetsByIdRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.delete')) {
+            return c.json({ success: false, error: 'Forbidden: asset.delete capability required' }, 403);
+        }
         if (!id) {
             return c.json({ success: false, error: 'Asset ID is required' }, 400);
         }
@@ -72,6 +76,9 @@ export const assetsByIdRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.upload')) {
+            return c.json({ success: false, error: 'Forbidden: asset.upload capability required' }, 403);
+        }
         if (!id) {
             return c.json({ success: false, error: 'Asset ID is required' }, 400);
         }

package/dist/server/api/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA+IrC,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA8JrC,CAAC"}

package/dist/server/api/routes/assets.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { validateFile } from '../../../utils/mime-detect.js';
 import { listAssetsQuery } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsRouter = new Hono()
     .get('/', zValidator('query', listAssetsQuery, (result, c) => {
     if (!result.success) {
@@ -27,15 +28,15 @@ export const assetsRouter = new Hono()
             limit: q.limit ?? 20,
             offset: q.offset ?? 0
         };
-        const [fetchedAssets, totalAssets] = await Promise.all([
+        const { databaseAdapter } = c.var.aphexCMS;
+        const [fetchedAssets, total] = await Promise.all([
             assetService.findAssets(auth.organizationId, filters),
-            assetService.findAssets(auth.organizationId, {
-                ...filters,
-                limit: 999999,
-                offset: 0
+            databaseAdapter.countAssets(auth.organizationId, {
+                assetType: filters.assetType,
+                mimeType: filters.mimeType,
+                search: filters.search
             })
         ]);
-        const total = totalAssets.length;
         const pageSize = filters.limit || 20;
         const currentPage = Math.floor(filters.offset / pageSize) + 1;
         const totalPages = Math.ceil(total / pageSize);
@@ -68,6 +69,9 @@ export const assetsRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.upload')) {
+            return c.json({ success: false, error: 'Forbidden: asset.upload capability required' }, 403);
+        }
         const formData = await c.req.formData();
         const file = formData.get('file');
         if (!file) {
@@ -75,10 +79,14 @@ export const assetsRouter = new Hono()
         }
         const arrayBuffer = await file.arrayBuffer();
         const buffer = Buffer.from(arrayBuffer);
+        const SERVER_MAX_FILE_SIZE = 50 * 1024 * 1024; // 50MB hard limit
         const allowedMimeTypesRaw = formData.get('allowedMimeTypes');
         const maxSizeRaw = formData.get('maxSize');
         const allowedMimeTypes = allowedMimeTypesRaw ? JSON.parse(allowedMimeTypesRaw) : undefined;
-        const maxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const clientMaxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const maxSize = clientMaxSize
+            ? Math.min(clientMaxSize, SERVER_MAX_FILE_SIZE)
+            : SERVER_MAX_FILE_SIZE;
         const validation = validateFile(buffer, file.name, file.type, {
             allowedMimeTypes,
             maxSize
@@ -86,18 +94,19 @@ export const assetsRouter = new Hono()
         if (!validation.valid) {
             return c.json({ success: false, error: validation.error }, 400);
         }
+        const safeMimeType = validation.detectedMimeType || 'application/octet-stream';
         const title = formData.get('title') || undefined;
         const description = formData.get('description') || undefined;
         const alt = formData.get('alt') || undefined;
         const creditLine = formData.get('creditLine') || undefined;
         const schemaType = formData.get('schemaType') || undefined;
         const fieldPath = formData.get('fieldPath') || undefined;
-        const targetOrganizationId = formData.get('organizationId') || auth.organizationId;
+        const targetOrganizationId = auth.organizationId;
         const uploadData = {
             organizationId: targetOrganizationId,
             buffer,
             originalFilename: file.name,
-            mimeType: file.type,
+            mimeType: safeMimeType,
             size: file.size,
             title,
             description,

package/dist/server/api/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAqJ/C,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAiK/C,CAAC"}

package/dist/server/api/routes/document-versions.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability } from '../../../types/capabilities.js';
 import { listVersionsQuery } from '../../../api/schemas/documents.js';
 export const documentVersionsRouter = new Hono()
     .get('/:id/versions', zValidator('query', listVersionsQuery, (result, c) => {
@@ -84,6 +85,13 @@ export const documentVersionsRouter = new Hono()
 })
     .post('/:id/versions/:version/restore', async (c) => {
     try {
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!hasCapability(auth, 'document.update')) {
+            return c.json({ success: false, error: 'Forbidden: document.update capability required' }, 403);
+        }
         const { localAPI, databaseAdapter } = c.var.aphexCMS;
         const context = authToContext(c.var.auth);
         const id = c.req.param('id');

package/dist/server/api/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA6N5C,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAqN5C,CAAC"}

package/dist/server/api/routes/documents-by-id.js

@@ -21,7 +21,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -73,7 +73,7 @@ export const documentsByIdRouter = new Hono()
         if (!found) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -120,7 +120,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkK/C,CAAC"}
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CA4J/C,CAAC"}

package/dist/server/api/routes/documents-publish.js

@@ -23,7 +23,7 @@ export const documentsPublishRouter = new Hono()
                 message: 'Document may not exist'
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -84,7 +84,7 @@ export const documentsPublishRouter = new Hono()
                 message: `No document found with ID: ${id}`
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAiF/C,CAAC"}
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CA6E/C,CAAC"}

package/dist/server/api/routes/documents-query.js

@@ -43,10 +43,9 @@ export const documentsQueryRouter = new Hono().post('/query', zValidator('json',
             depth: body.depth ?? 0,
             select: body.select,
             perspective: body.perspective ?? 'draft',
-            includeChildOrganizations: body.includeChildOrganizations,
-            filterOrganizationIds: body.filterOrganizationIds
+            includeChildOrganizations: body.includeChildOrganizations
         };
-        const result = await localAPI.collections[documentType].find(context, findOptions);
+        const result = await localAPI.getCollection(documentType).find(context, findOptions);
         return c.json({
             success: true,
             data: result.docs,

package/dist/server/api/routes/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CAyMxC,CAAC"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CA6MzC,CAAC"}

package/dist/server/api/routes/documents.js

@@ -25,7 +25,6 @@ export const documentsRouter = new Hono()
         const sortParam = Array.isArray(q.sort) ? q.sort.join(',') : q.sort;
         const perspective = q.perspective ?? 'draft';
         const includeChildOrganizations = q.includeChildOrganizations;
-        const filterOrganizationIds = q.filterOrganizationIds;
         const page = q.page ?? DEFAULT_PAGE;
         const pageSize = q.pageSize ?? q.limit ?? DEFAULT_PAGE_SIZE;
         const offset = (page - 1) * pageSize;
@@ -37,7 +36,7 @@ export const documentsRouter = new Hono()
                 message: 'Document type is required. Use ?type=page or ?docType=page'
             }, 400);
         }
-        const collection = localAPI.collections[docType];
+        const collection = localAPI.getCollection(docType);
         if (!collection) {
             return c.json({
                 success: false,
@@ -56,8 +55,7 @@ export const documentsRouter = new Hono()
             depth,
             sort: sortParam || undefined,
             perspective,
-            includeChildOrganizations,
-            filterOrganizationIds
+            includeChildOrganizations
         });
         return c.json({
             success: true,
@@ -128,7 +126,7 @@ export const documentsRouter = new Hono()
         const documentType = parsed.type;
         const documentData = (parsed.draftData ?? parsed.data);
         const shouldPublish = parsed.publish ?? false;
-        const collection = localAPI.collections[documentType];
+        const collection = localAPI.getCollection(documentType);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA0MxD,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4MxD,CAAC"}

package/dist/server/api/routes/organizations-invitations.js

@@ -127,7 +127,7 @@ export const organizationsInvitationsRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
-        const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
+        const deleted = await databaseAdapter.deleteInvitation(body.invitationId, auth.organizationId);
         if (!deleted) {
             return c.json({ success: false, error: 'Invitation not found' }, 404);
         }

package/dist/server/api/routes/organizations-members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CA+RpD,CAAC"}
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CA4RpD,CAAC"}

package/dist/server/index.d.ts

@@ -4,6 +4,7 @@ export * from '../cache/index.js';
 export * from '../email/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
 export { createCMSConfig } from '../config.js';
+export { cmsLogger, setLogger, type Logger } from '../utils/logger.js';
 export { CMSEngine } from '../engine.js';
 export { createCMSHook, __notifyAphexConfigChanged, type CMSInstances } from '../hooks.js';
 export * from '../db/interfaces/index.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EACN,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,KAAK,QAAQ,EACb,MAAM,aAAa,CAAC;AAGrB,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -9,6 +9,8 @@ export * from '../email/index.js';
 export { AuthError } from '../auth/auth-errors.js';
 // Configuration system
 export { createCMSConfig } from '../config.js';
+// Logger
+export { cmsLogger, setLogger } from '../utils/logger.js';
 // CMS Engine
 export { CMSEngine } from '../engine.js';
 // Hooks integration (SvelteKit server hooks)

package/dist/services/asset-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAoFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}
+{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}

package/dist/services/asset-service.js

@@ -27,7 +27,9 @@ export class AssetService {
         };
         if (assetType === 'image') {
             try {
-                const imageMetadata = await sharp(data.buffer).metadata();
+                const imageMetadata = await sharp(data.buffer, {
+                    limitInputPixels: 100_000_000
+                }).metadata();
                 width = imageMetadata.width;
                 height = imageMetadata.height;
                 // Merge image metadata with field metadata
@@ -41,7 +43,7 @@ export class AssetService {
                     hasAlpha: imageMetadata.hasAlpha
                 };
                 // Add dominant color
-                const stats = await sharp(data.buffer).stats();
+                const stats = await sharp(data.buffer, { limitInputPixels: 100_000_000 }).stats();
                 metadata.dominantColor = stats.dominant;
             }
             catch (error) {

package/dist/services/references-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAClD,GACC,OAAO,CAAC,IAAI,CAAC;CAwBhB"}
+{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}

package/dist/storage/adapters/local-storage-adapter.d.ts

@@ -6,6 +6,10 @@ export declare class LocalStorageAdapter implements StorageAdapter {
     readonly name = "local";
     private config;
     constructor(config: StorageConfig);
+    /**
+     * Strip path traversal sequences, keeping only the base filename.
+     */
+    private sanitizeFilename;
     /**
      * Generate unique filename preserving original name
      */

package/dist/storage/adapters/local-storage-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAK/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IASjC;;OAEG;YACW,sBAAsB;IAcpC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAoCvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}
+{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAK/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IASjC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;OAEG;YACW,sBAAsB;IAepC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAoCvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}