@aphexcms/cms-core 8.1.0 → 9.0.0

package/dist/server/api/routes/assets.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { validateFile } from '../../../utils/mime-detect.js';
 import { listAssetsQuery } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsRouter = new Hono()
     .get('/', zValidator('query', listAssetsQuery, (result, c) => {
     if (!result.success) {
@@ -27,15 +28,15 @@ export const assetsRouter = new Hono()
             limit: q.limit ?? 20,
             offset: q.offset ?? 0
         };
-        const [fetchedAssets, totalAssets] = await Promise.all([
+        const { databaseAdapter } = c.var.aphexCMS;
+        const [fetchedAssets, total] = await Promise.all([
             assetService.findAssets(auth.organizationId, filters),
-            assetService.findAssets(auth.organizationId, {
-                ...filters,
-                limit: 999999,
-                offset: 0
+            databaseAdapter.countAssets(auth.organizationId, {
+                assetType: filters.assetType,
+                mimeType: filters.mimeType,
+                search: filters.search
             })
         ]);
-        const total = totalAssets.length;
         const pageSize = filters.limit || 20;
         const currentPage = Math.floor(filters.offset / pageSize) + 1;
         const totalPages = Math.ceil(total / pageSize);
@@ -68,6 +69,9 @@ export const assetsRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.upload')) {
+            return c.json({ success: false, error: 'Forbidden: asset.upload capability required' }, 403);
+        }
         const formData = await c.req.formData();
         const file = formData.get('file');
         if (!file) {
@@ -75,10 +79,14 @@ export const assetsRouter = new Hono()
         }
         const arrayBuffer = await file.arrayBuffer();
         const buffer = Buffer.from(arrayBuffer);
+        const SERVER_MAX_FILE_SIZE = 50 * 1024 * 1024; // 50MB hard limit
         const allowedMimeTypesRaw = formData.get('allowedMimeTypes');
         const maxSizeRaw = formData.get('maxSize');
         const allowedMimeTypes = allowedMimeTypesRaw ? JSON.parse(allowedMimeTypesRaw) : undefined;
-        const maxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const clientMaxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const maxSize = clientMaxSize
+            ? Math.min(clientMaxSize, SERVER_MAX_FILE_SIZE)
+            : SERVER_MAX_FILE_SIZE;
         const validation = validateFile(buffer, file.name, file.type, {
             allowedMimeTypes,
             maxSize
@@ -86,18 +94,19 @@ export const assetsRouter = new Hono()
         if (!validation.valid) {
             return c.json({ success: false, error: validation.error }, 400);
         }
+        const safeMimeType = validation.detectedMimeType || 'application/octet-stream';
         const title = formData.get('title') || undefined;
         const description = formData.get('description') || undefined;
         const alt = formData.get('alt') || undefined;
         const creditLine = formData.get('creditLine') || undefined;
         const schemaType = formData.get('schemaType') || undefined;
         const fieldPath = formData.get('fieldPath') || undefined;
-        const targetOrganizationId = formData.get('organizationId') || auth.organizationId;
+        const targetOrganizationId = auth.organizationId;
         const uploadData = {
             organizationId: targetOrganizationId,
             buffer,
             originalFilename: file.name,
-            mimeType: file.type,
+            mimeType: safeMimeType,
             size: file.size,
             title,
             description,

package/dist/server/api/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAqJ/C,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAiK/C,CAAC"}

package/dist/server/api/routes/document-versions.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability } from '../../../types/capabilities.js';
 import { listVersionsQuery } from '../../../api/schemas/documents.js';
 export const documentVersionsRouter = new Hono()
     .get('/:id/versions', zValidator('query', listVersionsQuery, (result, c) => {
@@ -84,6 +85,13 @@ export const documentVersionsRouter = new Hono()
 })
     .post('/:id/versions/:version/restore', async (c) => {
     try {
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!hasCapability(auth, 'document.update')) {
+            return c.json({ success: false, error: 'Forbidden: document.update capability required' }, 403);
+        }
         const { localAPI, databaseAdapter } = c.var.aphexCMS;
         const context = authToContext(c.var.auth);
         const id = c.req.param('id');

package/dist/server/api/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA6N5C,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAqN5C,CAAC"}

package/dist/server/api/routes/documents-by-id.js

@@ -21,7 +21,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -73,7 +73,7 @@ export const documentsByIdRouter = new Hono()
         if (!found) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -120,7 +120,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkK/C,CAAC"}
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CA4J/C,CAAC"}

package/dist/server/api/routes/documents-publish.js

@@ -23,7 +23,7 @@ export const documentsPublishRouter = new Hono()
                 message: 'Document may not exist'
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -84,7 +84,7 @@ export const documentsPublishRouter = new Hono()
                 message: `No document found with ID: ${id}`
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAiF/C,CAAC"}
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CA6E/C,CAAC"}

package/dist/server/api/routes/documents-query.js

@@ -43,10 +43,9 @@ export const documentsQueryRouter = new Hono().post('/query', zValidator('json',
             depth: body.depth ?? 0,
             select: body.select,
             perspective: body.perspective ?? 'draft',
-            includeChildOrganizations: body.includeChildOrganizations,
-            filterOrganizationIds: body.filterOrganizationIds
+            includeChildOrganizations: body.includeChildOrganizations
         };
-        const result = await localAPI.collections[documentType].find(context, findOptions);
+        const result = await localAPI.getCollection(documentType).find(context, findOptions);
         return c.json({
             success: true,
             data: result.docs,

package/dist/server/api/routes/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CAyMxC,CAAC"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CA6MzC,CAAC"}

package/dist/server/api/routes/documents.js

@@ -25,7 +25,6 @@ export const documentsRouter = new Hono()
         const sortParam = Array.isArray(q.sort) ? q.sort.join(',') : q.sort;
         const perspective = q.perspective ?? 'draft';
         const includeChildOrganizations = q.includeChildOrganizations;
-        const filterOrganizationIds = q.filterOrganizationIds;
         const page = q.page ?? DEFAULT_PAGE;
         const pageSize = q.pageSize ?? q.limit ?? DEFAULT_PAGE_SIZE;
         const offset = (page - 1) * pageSize;
@@ -37,7 +36,7 @@ export const documentsRouter = new Hono()
                 message: 'Document type is required. Use ?type=page or ?docType=page'
             }, 400);
         }
-        const collection = localAPI.collections[docType];
+        const collection = localAPI.getCollection(docType);
         if (!collection) {
             return c.json({
                 success: false,
@@ -56,8 +55,7 @@ export const documentsRouter = new Hono()
             depth,
             sort: sortParam || undefined,
             perspective,
-            includeChildOrganizations,
-            filterOrganizationIds
+            includeChildOrganizations
         });
         return c.json({
             success: true,
@@ -128,7 +126,7 @@ export const documentsRouter = new Hono()
         const documentType = parsed.type;
         const documentData = (parsed.draftData ?? parsed.data);
         const shouldPublish = parsed.publish ?? false;
-        const collection = localAPI.collections[documentType];
+        const collection = localAPI.getCollection(documentType);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA0MxD,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4MxD,CAAC"}

package/dist/server/api/routes/organizations-invitations.js

@@ -127,7 +127,7 @@ export const organizationsInvitationsRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
-        const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
+        const deleted = await databaseAdapter.deleteInvitation(body.invitationId, auth.organizationId);
         if (!deleted) {
             return c.json({ success: false, error: 'Invitation not found' }, 404);
         }

package/dist/server/api/routes/organizations-members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CA+RpD,CAAC"}
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CA4RpD,CAAC"}

package/dist/server/index.d.ts

@@ -4,6 +4,7 @@ export * from '../cache/index.js';
 export * from '../email/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
 export { createCMSConfig } from '../config.js';
+export { cmsLogger, setLogger, type Logger } from '../utils/logger.js';
 export { CMSEngine } from '../engine.js';
 export { createCMSHook, __notifyAphexConfigChanged, type CMSInstances } from '../hooks.js';
 export * from '../db/interfaces/index.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EACN,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,KAAK,QAAQ,EACb,MAAM,aAAa,CAAC;AAGrB,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -9,6 +9,8 @@ export * from '../email/index.js';
 export { AuthError } from '../auth/auth-errors.js';
 // Configuration system
 export { createCMSConfig } from '../config.js';
+// Logger
+export { cmsLogger, setLogger } from '../utils/logger.js';
 // CMS Engine
 export { CMSEngine } from '../engine.js';
 // Hooks integration (SvelteKit server hooks)

package/dist/services/asset-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAoFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}
+{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}

package/dist/services/asset-service.js

@@ -27,7 +27,9 @@ export class AssetService {
         };
         if (assetType === 'image') {
             try {
-                const imageMetadata = await sharp(data.buffer).metadata();
+                const imageMetadata = await sharp(data.buffer, {
+                    limitInputPixels: 100_000_000
+                }).metadata();
                 width = imageMetadata.width;
                 height = imageMetadata.height;
                 // Merge image metadata with field metadata
@@ -41,7 +43,7 @@ export class AssetService {
                     hasAlpha: imageMetadata.hasAlpha
                 };
                 // Add dominant color
-                const stats = await sharp(data.buffer).stats();
+                const stats = await sharp(data.buffer, { limitInputPixels: 100_000_000 }).stats();
                 metadata.dominantColor = stats.dominant;
             }
             catch (error) {

package/dist/services/references-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAClD,GACC,OAAO,CAAC,IAAI,CAAC;CAwBhB"}
+{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}

package/dist/storage/adapters/local-storage-adapter.d.ts

@@ -6,6 +6,10 @@ export declare class LocalStorageAdapter implements StorageAdapter {
     readonly name = "local";
     private config;
     constructor(config: StorageConfig);
+    /**
+     * Strip path traversal sequences, keeping only the base filename.
+     */
+    private sanitizeFilename;
     /**
      * Generate unique filename preserving original name
      */

package/dist/storage/adapters/local-storage-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAK/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IASjC;;OAEG;YACW,sBAAsB;IAcpC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAoCvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}
+{"version":3,"file":"local-storage-adapter.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/adapters/local-storage-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,uBAAuB,CAAC;AAK/B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,aAAa;IASjC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;OAEG;YACW,sBAAsB;IAepC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACG,KAAK,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAoCvD;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU9C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe5C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB/E;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;CAYnC"}

package/dist/storage/adapters/local-storage-adapter.js

@@ -1,6 +1,6 @@
 // Pure local file system storage adapter - no database operations
 import { writeFile, mkdir, unlink, stat, readdir } from 'fs/promises';
-import { join, dirname } from 'path';
+import { join, dirname, resolve, basename } from 'path';
 import { cmsLogger } from '../../utils/logger.js';
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 /**
@@ -17,12 +17,19 @@ export class LocalStorageAdapter {
             options: config.options || {}
         };
     }
+    /**
+     * Strip path traversal sequences, keeping only the base filename.
+     */
+    sanitizeFilename(filename) {
+        return basename(filename).replace(/^\.+/, '_');
+    }
     /**
      * Generate unique filename preserving original name
      */
     async generateUniqueFilename(originalFilename) {
-        const { name, ext } = this.parseFilename(originalFilename);
-        let filename = originalFilename;
+        const safe = this.sanitizeFilename(originalFilename);
+        const { name, ext } = this.parseFilename(safe);
+        let filename = safe;
         let counter = 1;
         // Check if file exists on disk
         while (await this.fileExistsOnDisk(filename)) {
@@ -92,15 +99,25 @@ export class LocalStorageAdapter {
      * Used by API endpoint to serve files
      */
     async getObject(path) {
+        const resolved = resolve(path);
+        const base = resolve(this.config.basePath);
+        if (!resolved.startsWith(base + '/') && resolved !== base) {
+            throw new Error('Access denied: path outside storage directory');
+        }
         const { readFile } = await import('fs/promises');
-        return await readFile(path);
+        return await readFile(resolved);
     }
     /**
      * Delete a file from storage
      */
     async delete(path) {
         try {
-            await unlink(path);
+            const resolved = resolve(path);
+            const base = resolve(this.config.basePath);
+            if (!resolved.startsWith(base + '/') && resolved !== base) {
+                throw new Error('Access denied: path outside storage directory');
+            }
+            await unlink(resolved);
             return true;
         }
         catch (error) {
@@ -113,7 +130,12 @@ export class LocalStorageAdapter {
      */
     async exists(path) {
         try {
-            await stat(path);
+            const resolved = resolve(path);
+            const base = resolve(this.config.basePath);
+            if (!resolved.startsWith(base + '/') && resolved !== base) {
+                return false;
+            }
+            await stat(resolved);
             return true;
         }
         catch {

package/dist/types/capabilities.d.ts

@@ -61,6 +61,7 @@ export interface NewRole {
  * Used by migration, org-creation, and the runtime seeder.
  */
 export declare function buildBuiltinRoleRows(organizationId: string): NewRole[];
+export declare function isInstanceRole(auth: Auth): boolean;
 /**
  * Check whether an Auth already has a capability.
  *

package/dist/types/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAMlB;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAgBxC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA4C5D,CAAC;AAeF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAK/E;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAMlB;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAgBxC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA4C5D,CAAC;AAeF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAK/E;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}

package/dist/types/capabilities.js

@@ -143,6 +143,9 @@ export function buildBuiltinRoleRows(organizationId) {
  * even if an admin accidentally locks their own role down.
  */
 const INSTANCE_ROLE_OVERRIDES = new Set(['super_admin', 'admin']);
+export function isInstanceRole(auth) {
+    return auth.type === 'session' && INSTANCE_ROLE_OVERRIDES.has(auth.user.role);
+}
 /**
  * Check whether an Auth already has a capability.
  *

package/dist/types/config.d.ts

@@ -7,6 +7,7 @@ import type { EmailAdapter } from '../email/index.js';
 import type { GraphQLConfig } from '../graphql/index.js';
 import type { AphexEnv } from '../server/api/index.js';
 import type { SchemaType } from './schemas.js';
+import type { Logger } from '../utils/logger.js';
 export type { GraphQLConfig };
 export interface CMSConfig {
     schemaTypes: SchemaType[];
@@ -32,9 +33,23 @@ export interface CMSConfig {
      */
     graphql?: boolean | GraphQLConfig;
     /**
-     * Log level for CMS output. Defaults to 'debug' in dev, 'warn' in production.
+     * Log level for the built-in console logger. Defaults to 'debug' in dev, 'warn' in production.
+     * Ignored when a custom `logger` is provided.
      */
     logLevel?: 'debug' | 'info' | 'warn' | 'error' | 'none';
+    /**
+     * Custom logger instance (e.g. pino). Must implement debug/info/warn/error.
+     * When provided, replaces the built-in console logger entirely.
+     *
+     * @example
+     * ```ts
+     * import pino from 'pino';
+     * export default createCMSConfig({
+     *   logger: pino({ level: 'info' }),
+     * });
+     * ```
+     */
+    logger?: Logger;
     auth?: {
         provider: AuthProvider;
         loginUrl?: string;

package/dist/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}

package/dist/utils/logger.d.ts

@@ -1,9 +1,11 @@
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'none';
+export interface Logger {
+    debug(...args: any[]): void;
+    info(...args: any[]): void;
+    warn(...args: any[]): void;
+    error(...args: any[]): void;
+}
 export declare function setLogLevel(level: LogLevel): void;
-export declare const cmsLogger: {
-    debug: (...args: any[]) => void;
-    info: (...args: any[]) => void;
-    warn: (...args: any[]) => void;
-    error: (...args: any[]) => void;
-};
+export declare function setLogger(logger: Logger): void;
+export declare const cmsLogger: Logger;
 //# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAQpE,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,QAE1C;AAoBD,eAAO,MAAM,SAAS;qBAjBJ,GAAG,EAAE;oBAAL,GAAG,EAAE;oBAAL,GAAG,EAAE;qBAAL,GAAG,EAAE;CAsBtB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAEpE,MAAM,WAAW,MAAM;IACtB,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;CAC5B;AAOD,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,QAE1C;AA6BD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,QAEvC;AAED,eAAO,MAAM,SAAS,EAAE,MAKvB,CAAC"}

package/dist/utils/logger.js

@@ -1,5 +1,4 @@
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3, none: 4 };
-// Default based on environment; overridden by CMSConfig.logLevel via setLogLevel()
 let currentLevel = typeof process !== 'undefined' && process.env?.NODE_ENV === 'production' ? 'warn' : 'debug';
 export function setLogLevel(level) {
     currentLevel = level;
@@ -21,9 +20,19 @@ function createMethod(level, consoleFn) {
         }
     };
 }
-export const cmsLogger = {
+const defaultLogger = {
     debug: createMethod('debug', console.log),
     info: createMethod('info', console.log),
     warn: createMethod('warn', console.warn),
     error: createMethod('error', console.error)
 };
+let activeLogger = defaultLogger;
+export function setLogger(logger) {
+    activeLogger = logger;
+}
+export const cmsLogger = {
+    debug: (...args) => activeLogger.debug(...args),
+    info: (...args) => activeLogger.info(...args),
+    warn: (...args) => activeLogger.warn(...args),
+    error: (...args) => activeLogger.error(...args)
+};

package/dist/utils/mime-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AAgED,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CA8EtB"}
+{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AA2ED,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CAkFtB"}

package/dist/utils/mime-detect.js

@@ -110,7 +110,11 @@ const BLOCKED_MIME_TYPES = new Set([
     'application/x-shellscript',
     'application/wasm',
     'application/x-msdos-program',
-    'application/x-msdownload'
+    'application/x-msdownload',
+    'text/html',
+    'application/xhtml+xml',
+    'text/xml',
+    'application/xml'
 ]);
 /**
  * Blocked file extensions (regardless of MIME type).
@@ -144,18 +148,29 @@ const BLOCKED_EXTENSIONS = new Set([
     '.reg',
     '.inf',
     '.hta',
-    '.wasm'
+    '.wasm',
+    '.html',
+    '.htm',
+    '.xhtml',
+    '.shtml',
+    '.xml',
+    '.xsl',
+    '.mhtml'
 ]);
 /**
  * Validate an uploaded file's actual content against allowed types.
  * Checks magic bytes, not just the client-provided MIME type.
  */
 export function validateFile(buffer, filename, clientMimeType, options = {}) {
-    const ext = filename.toLowerCase().substring(filename.lastIndexOf('.'));
+    const lowerName = filename.toLowerCase();
+    const ext = lowerName.substring(lowerName.lastIndexOf('.'));
     const detectedMimeType = detectMimeType(buffer);
-    // 1. Block dangerous extensions
-    if (BLOCKED_EXTENSIONS.has(ext)) {
-        return { valid: false, error: `File type "${ext}" is not allowed`, detectedMimeType };
+    // 1. Block dangerous extensions (check all extensions to prevent double-extension bypass)
+    const allExts = lowerName.match(/\.[^.]+/g) || [];
+    for (const e of allExts) {
+        if (BLOCKED_EXTENSIONS.has(e)) {
+            return { valid: false, error: `File type "${e}" is not allowed`, detectedMimeType };
+        }
     }
     // 2. Block dangerous MIME types (detected from actual content)
     if (detectedMimeType && BLOCKED_MIME_TYPES.has(detectedMimeType)) {

package/dist/vite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/vite/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAElD,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,GAAG,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAiF9D;AAiJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,MAAM,EAAE,CAoB1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/vite/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAElD,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,GAAG,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAiF9D;AAgJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,MAAM,EAAE,CAoB1D"}

package/dist/vite/index.js

@@ -105,7 +105,9 @@ function aphexDayjsAlias() {
         name: 'aphex:dayjs-alias',
         config() {
             const dayjsEsm = require.resolve('dayjs/esm/index.js');
-            const dayjsEsmPluginDir = dayjsEsm.replace(/\/index\.js$/, '/plugin');
+            const dayjsEsmPluginDir = dayjsEsm
+                .replace(/\\index\.js$/, '\\plugin')
+                .replace(/\/index\.js$/, '/plugin');
             return {
                 resolve: {
                     alias: [
@@ -219,10 +221,7 @@ function aphexWatchUnfilter() {
             return {
                 server: {
                     watch: {
-                        ignored: [
-                            '!**/node_modules/@aphexcms/cms-core/**',
-                            '!**/node_modules/@aphexcms/ui/**'
-                        ]
+                        ignored: ['!**/node_modules/@aphexcms/cms-core/**', '!**/node_modules/@aphexcms/ui/**']
                     }
                 }
             };