@aphexcms/cms-core 8.1.0 → 9.1.0

package/dist/local-api/collection-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/collection-api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAwB,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAShG;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC;IACZ,UAAU,EAAE,wBAAwB,CAAC;CACrC;AA6DD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,CACnD,aAAa,CAAC,CAAC,CAAC,EAChB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CACxE,CAAC;AAEF;;;GAGG;AACH,qBAAa,aAAa,CAAC,CAAC,GAAG,QAAQ;IAErC,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,gBAAgB,CAAC;IACzB,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAC;gBARf,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,iBAAiB,EAC9B,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EACpC,gBAAgB,CAAC,EAAE,gBAAgB,YAAA,EACnC,cAAc,CAAC,EAAE,cAAc,YAAA,EAC/B,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,cAAc,CAAC,EAAE,UAAU,EAAE,YAAA;IAMtC;;;;OAIG;YACW,cAAc;IAe5B;;OAEG;IACH,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAM5D;;;;OAIG;IACG,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAalF;;;;;;;;;;;;;;;;;OAiBG;IACG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IA0E1F,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,wBAAwB;IAKhC;;;;;;;;;;;OAWG;IACG,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IA2CpB;;;;;;;;;;OAUG;IACG,KAAK,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAgG7B;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,EACtC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GACvD,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAoGpC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCpE;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAyEtE;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAoBxE"}
+{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/collection-api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAwB,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAShG;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC;IACZ,UAAU,EAAE,wBAAwB,CAAC;CACrC;AA6DD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,CACnD,aAAa,CAAC,CAAC,CAAC,EAChB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CACxE,CAAC;AAEF;;;GAGG;AACH,qBAAa,aAAa,CAAC,CAAC,GAAG,QAAQ;IAErC,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,gBAAgB,CAAC;IACzB,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAC;gBARf,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,iBAAiB,EAC9B,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EACpC,gBAAgB,CAAC,EAAE,gBAAgB,YAAA,EACnC,cAAc,CAAC,EAAE,cAAc,YAAA,EAC/B,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,cAAc,CAAC,EAAE,UAAU,EAAE,YAAA;IAMtC;;;;OAIG;YACW,cAAc;IAe5B;;OAEG;IACH,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAM5D;;;;OAIG;IACG,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAalF;;;;;;;;;;;;;;;;;OAiBG;IACG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IA6E1F,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,wBAAwB;IAKhC;;;;;;;;;;;OAWG;IACG,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IA2CpB;;;;;;;;;;OAUG;IACG,KAAK,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IA2G7B;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,EACtC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GACvD,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAoGpC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BpE;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAoEtE;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAoBxE"}

package/dist/local-api/collection-api.js

@@ -162,7 +162,10 @@ export class CollectionAPI {
         // callers always get one document back. Filters are intentionally
         // ignored — there is at most one row by definition.
         if (this._schema.singleton) {
-            const doc = await this.get(context, { perspective: options.perspective, depth: options.depth });
+            const doc = await this.get(context, {
+                perspective: options.perspective,
+                depth: options.depth
+            });
             return {
                 docs: [doc],
                 totalDocs: 1,
@@ -352,12 +355,19 @@ export class CollectionAPI {
                 ? await this.versionService.publishWithVersion(this.databaseAdapter, context.organizationId, document.id)
                 : await this.databaseAdapter.publishDoc(context.organizationId, document.id);
             if (published) {
+                if (this.documentCache) {
+                    await this.documentCache.invalidateDocument(context.organizationId, document.id);
+                    await this.documentCache.invalidateCollection(context.organizationId, this.collectionName);
+                }
                 return {
                     document: transformDocument(published, 'published'),
                     validation: validationResult
                 };
             }
         }
+        if (this.documentCache) {
+            await this.documentCache.invalidateCollection(context.organizationId, this.collectionName);
+        }
         return {
             document: transformDocument(document, 'draft'),
             validation: validationResult
@@ -459,8 +469,7 @@ export class CollectionAPI {
         // Protect the canonical singleton row. In-limbo random-uuid docs of
         // the same type (left over from before the schema was flipped to
         // singleton) remain deletable — only the deterministic id is locked.
-        if (this._schema.singleton &&
-            id === singletonId(this._schema.name, context.organizationId)) {
+        if (this._schema.singleton && id === singletonId(this._schema.name, context.organizationId)) {
             throw new SingletonOperationError(`Cannot delete the singleton document for '${this._schema.name}'. Remove the singleton flag from the schema first.`);
         }
         // Fetch the target so ownership policies have a doc to inspect. For
@@ -513,16 +522,12 @@ export class CollectionAPI {
                 const refDoc = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, refId);
                 if (refDoc && !refDoc.publishedData) {
                     const data = refDoc.draftData;
-                    const title = data?.title ||
-                        data?.name ||
-                        refDoc.id;
+                    const title = data?.title || data?.name || refDoc.id;
                     unpublished.push({ id: refDoc.id, type: refDoc.type, title });
                 }
             }
             if (unpublished.length > 0) {
-                const names = unpublished
-                    .map((d) => `"${d.title}" (${d.type})`)
-                    .join(', ');
+                const names = unpublished.map((d) => `"${d.title}" (${d.type})`).join(', ');
                 throw new Error(`Cannot publish — ${unpublished.length} referenced document(s) are not published: ${names}`);
             }
         }

package/dist/local-api/index.d.ts

@@ -11,7 +11,6 @@ import type { LocalAPIContext } from './types.js';
  * This interface is meant to be augmented by generated types
  */
 export interface Collections {
-    [collectionName: string]: CollectionAPI<unknown>;
 }
 /**
  * Local API - provides a unified, type-safe interface for all CMS operations
@@ -46,6 +45,7 @@ export interface Collections {
 export declare class LocalAPI {
     private config;
     collections: Collections;
+    private _collections;
     private userAdapter;
     private systemAdapter;
     private documentCache;
@@ -72,6 +72,10 @@ export declare class LocalAPI {
      * Check if a collection exists
      */
     hasCollection(name: string): boolean;
+    /**
+     * Get a collection by name (for dynamic access in route handlers and resolvers)
+     */
+    getCollection(name: string): CollectionAPI<unknown> | undefined;
     /**
      * Get schema for a collection
      */

package/dist/local-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAYnB,OAAO,CAAC,MAAM;IAXR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAmB;IACpC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IAC5C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAyBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8D7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzD;;;;OAIG;IACG,gBAAgB,CACrB,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAgBtD;;;;OAIG;IACG,iBAAiB,CACtB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAKtE;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,CAAC,GAAG,OAAO,EACnC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA6Cf;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;;GAGG;AAEH,MAAM,WAAW,WAAW;CAAG;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAanB,OAAO,CAAC,MAAM;IAZR,WAAW,EAAE,WAAW,CAAqB;IACpD,OAAO,CAAC,YAAY,CAA6C;IACjE,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAmB;IACpC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IAC5C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAyBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS;IAI/D;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzD;;;;OAIG;IACG,gBAAgB,CACrB,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAgBtD;;;;OAIG;IACG,iBAAiB,CACtB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAKtE;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,CAAC,GAAG,OAAO,EACnC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA6Cf;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/local-api/index.js

@@ -49,6 +49,7 @@ import { PermissionChecker } from './permissions.js';
 export class LocalAPI {
     config;
     collections = {};
+    _collections = new Map();
     userAdapter;
     systemAdapter;
     documentCache;
@@ -90,8 +91,7 @@ export class LocalAPI {
                     // wrapper. They don't touch the database, so wrapping
                     // would force callers to `await` what is actually a
                     // synchronous compute (and break their return types).
-                    if (typeof method === 'function' &&
-                        SYNC_COLLECTION_METHODS.has(prop)) {
+                    if (typeof method === 'function' && SYNC_COLLECTION_METHODS.has(prop)) {
                         return method.bind(target);
                     }
                     if (typeof method === 'function') {
@@ -108,7 +108,9 @@ export class LocalAPI {
                     return method;
                 }
             });
-            this.collections[schema.name] = collectionAPI;
+            this._collections.set(schema.name, collectionAPI);
+            this.collections[schema.name] =
+                collectionAPI;
         }
     }
     /**
@@ -133,6 +135,12 @@ export class LocalAPI {
     hasCollection(name) {
         return this.schemas.has(name);
     }
+    /**
+     * Get a collection by name (for dynamic access in route handlers and resolvers)
+     */
+    getCollection(name) {
+        return this._collections.get(name);
+    }
     /**
      * Get schema for a collection
      */
@@ -202,7 +210,7 @@ export class LocalAPI {
         const docs = await Promise.all(typeLookups.map(async (lookup) => {
             if (!lookup)
                 return null;
-            const collection = this.collections[lookup.type];
+            const collection = this.getCollection(lookup.type);
             if (!collection)
                 return null;
             try {

package/dist/routes/assets-cdn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,GAAG,EAAE,cAkKjB,CAAC"}
+{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,GAAG,EAAE,cAyKjB,CAAC"}

package/dist/routes/assets-cdn.js

@@ -116,12 +116,17 @@ export const GET = async ({ params, locals, setHeaders, request }) => {
             .replace(/[^\x20-\x7E]/g, '_') // strip anything outside printable ASCII
             .replace(/["\\]/g, ''); // drop quotes and backslashes that'd break the quoted-string
         const utf8Encoded = encodeURIComponent(rawFilename);
-        // Set appropriate headers for the asset
+        const safeInlineTypes = ['image/', 'application/pdf', 'video/', 'audio/'];
+        const canInline = asset.mimeType &&
+            asset.mimeType !== 'image/svg+xml' &&
+            safeInlineTypes.some((t) => asset.mimeType.startsWith(t));
+        const disposition = canInline ? 'inline' : 'attachment';
         setHeaders({
             'Content-Type': asset.mimeType || 'application/octet-stream',
             'Content-Length': fileBuffer.length.toString(),
-            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
-            'Content-Disposition': `inline; filename="${asciiFallback}"; filename*=UTF-8''${utf8Encoded}`,
+            'Cache-Control': 'public, max-age=31536000, immutable',
+            'Content-Disposition': `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${utf8Encoded}`,
+            'X-Content-Type-Options': 'nosniff',
             ...(asset.mimeType?.startsWith('image/') && {
                 'Accept-Ranges': 'bytes'
             })

package/dist/schema-utils/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CA8NpE"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/lib/schema-utils/validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AAmB1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAkOpE"}

package/dist/schema-utils/validator.js

@@ -76,8 +76,12 @@ export function validateSchemaReferences(schemas) {
                 if (primitiveTypes.includes(arrayType.type)) {
                     continue;
                 }
+                // Block type is a built-in for Portable Text block content
+                if (arrayType.type === 'block') {
+                    continue;
+                }
                 // Skip inline object definitions (has fields property)
-                if (arrayType.type === 'object' && arrayType.fields) {
+                if (arrayType.fields) {
                     continue;
                 }
                 // Only validate if it's a reference to another schema

package/dist/server/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAY7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAsCrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAEzC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAqB7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAkDrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IACtE,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}

package/dist/server/api/index.js

@@ -1,4 +1,5 @@
 import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
 import { schemasRouter } from './routes/schemas.js';
 import { documentsRouter } from './routes/documents.js';
 import { documentsByIdRouter } from './routes/documents-by-id.js';
@@ -27,6 +28,11 @@ import { userRouter } from './routes/user.js';
  */
 export function createAphexApi() {
     const app = new Hono().basePath('/api');
+    // Reject oversized request bodies before they're fully buffered.
+    app.use('*', bodyLimit({
+        maxSize: 10 * 1024 * 1024, // 10MB for JSON endpoints
+        onError: (c) => c.json({ success: false, error: 'Request body too large (max 10MB)' }, 413)
+    }));
     // Bridge: lift values passed via app.fetch(req, env) onto c.var so
     // handlers can read c.var.aphexCMS / c.var.auth directly.
     app.use('*', async (c, next) => {
@@ -77,6 +83,18 @@ export function mountAphexBuiltins(app) {
     // Hono would try to match them under the wrong handler chain.
     app.route('/user', userPreferencesRouter);
     app.route('/user', userRouter);
+    // Health check — unauthenticated, used by load balancers and uptime monitors.
+    app.get('/aphex-health', async (c) => {
+        try {
+            const { databaseAdapter } = c.var.aphexCMS;
+            const dbHealthy = await databaseAdapter.isHealthy();
+            const status = dbHealthy ? 'healthy' : 'degraded';
+            return c.json({ status, database: dbHealthy }, dbHealthy ? 200 : 503);
+        }
+        catch {
+            return c.json({ status: 'unhealthy', database: false }, 503);
+        }
+    });
 }
 /**
  * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted

package/dist/server/api/routes/assets-bulk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAkE3C,CAAC"}
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAyE3C,CAAC"}

package/dist/server/api/routes/assets-bulk.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { bulkDeleteAssetsRequest } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bulkDeleteAssetsRequest, (result, c) => {
     if (!result.success) {
         return c.json({
@@ -17,6 +18,9 @@ export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bu
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.delete')) {
+            return c.json({ success: false, error: 'Forbidden: asset.delete capability required' }, 403);
+        }
         const { ids } = c.req.valid('json');
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {

package/dist/server/api/routes/assets-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CA8HzC,CAAC"}
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAsJ1C,CAAC"}

package/dist/server/api/routes/assets-by-id.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateAssetRequest } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsByIdRouter = new Hono()
     .get('/:id', async (c) => {
     try {
@@ -28,16 +29,20 @@ export const assetsByIdRouter = new Hono()
     .delete('/:id', async (c) => {
     try {
         const id = c.req.param('id');
-        const { assetService, databaseAdapter } = c.var.aphexCMS;
+        const { assetService, databaseAdapter, localAPI } = c.var.aphexCMS;
         const auth = c.var.auth;
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.delete')) {
+            return c.json({ success: false, error: 'Forbidden: asset.delete capability required' }, 403);
+        }
         if (!id) {
             return c.json({ success: false, error: 'Asset ID is required' }, 400);
         }
         if (databaseAdapter.findDocumentsReferencingAsset) {
-            const refs = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+            const knownTypes = localAPI.getCollectionNames();
+            const refs = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id, knownTypes);
             if (refs.length > 0) {
                 return c.json({
                     success: false,
@@ -49,6 +54,13 @@ export const assetsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Asset not found or could not be deleted' }, 404);
         }
+        if (databaseAdapter.clearAssetFromPublishedData) {
+            const cleared = await databaseAdapter.clearAssetFromPublishedData(auth.organizationId, id);
+            console.log(`[Asset Delete] Cleared asset ${id} from ${cleared} document(s) publishedData`);
+        }
+        else {
+            console.log(`[Asset Delete] clearAssetFromPublishedData not available on adapter`);
+        }
         return c.json({ success: true });
     }
     catch (error) {
@@ -72,6 +84,9 @@ export const assetsByIdRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.upload')) {
+            return c.json({ success: false, error: 'Forbidden: asset.upload capability required' }, 403);
+        }
         if (!id) {
             return c.json({ success: false, error: 'Asset ID is required' }, 400);
         }

package/dist/server/api/routes/assets-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-references.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkFhD,CAAC"}
+{"version":3,"file":"assets-references.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAsFhD,CAAC"}

package/dist/server/api/routes/assets-references.js

@@ -16,7 +16,7 @@ import { assetReferenceCountsRequest } from '../../../api/schemas/assets.js';
 export const assetsReferencesRouter = new Hono()
     .get('/:id/references', async (c) => {
     try {
-        const { databaseAdapter } = c.var.aphexCMS;
+        const { databaseAdapter, localAPI } = c.var.aphexCMS;
         const auth = c.var.auth;
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
@@ -28,7 +28,8 @@ export const assetsReferencesRouter = new Hono()
         if (!databaseAdapter.findDocumentsReferencingAsset) {
             return c.json({ success: true, data: { references: [], total: 0 } });
         }
-        const references = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+        const knownTypes = localAPI.getCollectionNames();
+        const references = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id, knownTypes);
         return c.json({
             success: true,
             data: {
@@ -52,7 +53,7 @@ export const assetsReferencesRouter = new Hono()
     }
 }), async (c) => {
     try {
-        const { databaseAdapter } = c.var.aphexCMS;
+        const { databaseAdapter, localAPI } = c.var.aphexCMS;
         const auth = c.var.auth;
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
@@ -67,7 +68,8 @@ export const assetsReferencesRouter = new Hono()
                 counts[id] = 0;
             return c.json({ success: true, data: counts });
         }
-        const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids);
+        const knownTypes = localAPI.getCollectionNames();
+        const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids, knownTypes);
         return c.json({ success: true, data: counts });
     }
     catch (error) {

package/dist/server/api/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA+IrC,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA8JrC,CAAC"}

package/dist/server/api/routes/assets.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { validateFile } from '../../../utils/mime-detect.js';
 import { listAssetsQuery } from '../../../api/schemas/assets.js';
+import { hasCapability } from '../../../types/capabilities.js';
 export const assetsRouter = new Hono()
     .get('/', zValidator('query', listAssetsQuery, (result, c) => {
     if (!result.success) {
@@ -27,15 +28,15 @@ export const assetsRouter = new Hono()
             limit: q.limit ?? 20,
             offset: q.offset ?? 0
         };
-        const [fetchedAssets, totalAssets] = await Promise.all([
+        const { databaseAdapter } = c.var.aphexCMS;
+        const [fetchedAssets, total] = await Promise.all([
             assetService.findAssets(auth.organizationId, filters),
-            assetService.findAssets(auth.organizationId, {
-                ...filters,
-                limit: 999999,
-                offset: 0
+            databaseAdapter.countAssets(auth.organizationId, {
+                assetType: filters.assetType,
+                mimeType: filters.mimeType,
+                search: filters.search
             })
         ]);
-        const total = totalAssets.length;
         const pageSize = filters.limit || 20;
         const currentPage = Math.floor(filters.offset / pageSize) + 1;
         const totalPages = Math.ceil(total / pageSize);
@@ -68,6 +69,9 @@ export const assetsRouter = new Hono()
         if (!auth || auth.type === 'partial_session') {
             return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
+        if (!hasCapability(auth, 'asset.upload')) {
+            return c.json({ success: false, error: 'Forbidden: asset.upload capability required' }, 403);
+        }
         const formData = await c.req.formData();
         const file = formData.get('file');
         if (!file) {
@@ -75,10 +79,14 @@ export const assetsRouter = new Hono()
         }
         const arrayBuffer = await file.arrayBuffer();
         const buffer = Buffer.from(arrayBuffer);
+        const SERVER_MAX_FILE_SIZE = 50 * 1024 * 1024; // 50MB hard limit
         const allowedMimeTypesRaw = formData.get('allowedMimeTypes');
         const maxSizeRaw = formData.get('maxSize');
         const allowedMimeTypes = allowedMimeTypesRaw ? JSON.parse(allowedMimeTypesRaw) : undefined;
-        const maxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const clientMaxSize = maxSizeRaw ? parseInt(maxSizeRaw, 10) : undefined;
+        const maxSize = clientMaxSize
+            ? Math.min(clientMaxSize, SERVER_MAX_FILE_SIZE)
+            : SERVER_MAX_FILE_SIZE;
         const validation = validateFile(buffer, file.name, file.type, {
             allowedMimeTypes,
             maxSize
@@ -86,18 +94,19 @@ export const assetsRouter = new Hono()
         if (!validation.valid) {
             return c.json({ success: false, error: validation.error }, 400);
         }
+        const safeMimeType = validation.detectedMimeType || 'application/octet-stream';
         const title = formData.get('title') || undefined;
         const description = formData.get('description') || undefined;
         const alt = formData.get('alt') || undefined;
         const creditLine = formData.get('creditLine') || undefined;
         const schemaType = formData.get('schemaType') || undefined;
         const fieldPath = formData.get('fieldPath') || undefined;
-        const targetOrganizationId = formData.get('organizationId') || auth.organizationId;
+        const targetOrganizationId = auth.organizationId;
         const uploadData = {
             organizationId: targetOrganizationId,
             buffer,
             originalFilename: file.name,
-            mimeType: file.type,
+            mimeType: safeMimeType,
             size: file.size,
             title,
             description,

package/dist/server/api/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAqJ/C,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAiK/C,CAAC"}

package/dist/server/api/routes/document-versions.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability } from '../../../types/capabilities.js';
 import { listVersionsQuery } from '../../../api/schemas/documents.js';
 export const documentVersionsRouter = new Hono()
     .get('/:id/versions', zValidator('query', listVersionsQuery, (result, c) => {
@@ -84,6 +85,13 @@ export const documentVersionsRouter = new Hono()
 })
     .post('/:id/versions/:version/restore', async (c) => {
     try {
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!hasCapability(auth, 'document.update')) {
+            return c.json({ success: false, error: 'Forbidden: document.update capability required' }, 403);
+        }
         const { localAPI, databaseAdapter } = c.var.aphexCMS;
         const context = authToContext(c.var.auth);
         const id = c.req.param('id');

package/dist/server/api/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA6N5C,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAqN5C,CAAC"}

package/dist/server/api/routes/documents-by-id.js

@@ -21,7 +21,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -73,7 +73,7 @@ export const documentsByIdRouter = new Hono()
         if (!found) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -120,7 +120,7 @@ export const documentsByIdRouter = new Hono()
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
         }
-        const collection = localAPI.collections[result.type];
+        const collection = localAPI.getCollection(result.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkK/C,CAAC"}
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CA4J/C,CAAC"}

package/dist/server/api/routes/documents-publish.js

@@ -23,7 +23,7 @@ export const documentsPublishRouter = new Hono()
                 message: 'Document may not exist'
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,
@@ -84,7 +84,7 @@ export const documentsPublishRouter = new Hono()
                 message: `No document found with ID: ${id}`
             }, 404);
         }
-        const collection = localAPI.collections[found.type];
+        const collection = localAPI.getCollection(found.type);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAiF/C,CAAC"}
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CA6E/C,CAAC"}

package/dist/server/api/routes/documents-query.js

@@ -43,10 +43,9 @@ export const documentsQueryRouter = new Hono().post('/query', zValidator('json',
             depth: body.depth ?? 0,
             select: body.select,
             perspective: body.perspective ?? 'draft',
-            includeChildOrganizations: body.includeChildOrganizations,
-            filterOrganizationIds: body.filterOrganizationIds
+            includeChildOrganizations: body.includeChildOrganizations
         };
-        const result = await localAPI.collections[documentType].find(context, findOptions);
+        const result = await localAPI.getCollection(documentType).find(context, findOptions);
         return c.json({
             success: true,
             data: result.docs,

package/dist/server/api/routes/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CAyMxC,CAAC"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CA6MzC,CAAC"}

package/dist/server/api/routes/documents.js

@@ -25,7 +25,6 @@ export const documentsRouter = new Hono()
         const sortParam = Array.isArray(q.sort) ? q.sort.join(',') : q.sort;
         const perspective = q.perspective ?? 'draft';
         const includeChildOrganizations = q.includeChildOrganizations;
-        const filterOrganizationIds = q.filterOrganizationIds;
         const page = q.page ?? DEFAULT_PAGE;
         const pageSize = q.pageSize ?? q.limit ?? DEFAULT_PAGE_SIZE;
         const offset = (page - 1) * pageSize;
@@ -37,7 +36,7 @@ export const documentsRouter = new Hono()
                 message: 'Document type is required. Use ?type=page or ?docType=page'
             }, 400);
         }
-        const collection = localAPI.collections[docType];
+        const collection = localAPI.getCollection(docType);
         if (!collection) {
             return c.json({
                 success: false,
@@ -56,8 +55,7 @@ export const documentsRouter = new Hono()
             depth,
             sort: sortParam || undefined,
             perspective,
-            includeChildOrganizations,
-            filterOrganizationIds
+            includeChildOrganizations
         });
         return c.json({
             success: true,
@@ -128,7 +126,7 @@ export const documentsRouter = new Hono()
         const documentType = parsed.type;
         const documentData = (parsed.draftData ?? parsed.data);
         const shouldPublish = parsed.publish ?? false;
-        const collection = localAPI.collections[documentType];
+        const collection = localAPI.getCollection(documentType);
         if (!collection) {
             return c.json({
                 success: false,

package/dist/server/api/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA0MxD,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4MxD,CAAC"}