@aphexcms/cms-core 9.3.0 → 9.5.0

package/dist/admin/block-previews.svelte.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Rich-text block preview registry (client-side context).
+ *
+ * By default a custom Portable Text block renders in the editor as a generic card
+ * (title/subtitle from its `preview` config). That's fine for data-ish blocks, but for
+ * visual ones — an embed, a gallery, a button — authors expect to see the real thing
+ * inline while writing (the Ghost/Sanity "what you see is what you get" editor).
+ *
+ * An app registers a preview per block `_type`; RichtextField resolves it and the
+ * ProseMirror node view mounts it INSTEAD of the generic card. The preview still gets
+ * `onEdit`/`onDelete` so the block stays editable and removable.
+ *
+ * Deliberately separate from the field-component registry: that one supplies *inputs*
+ * (`field`/`value`/`onUpdate`); this one supplies *renderers* (`data`/`onEdit`). Same
+ * idea, different contract.
+ */
+import { type Component } from 'svelte';
+import type { PreviewSource } from '../utils/preview.js';
+/**
+ * The stable props a block preview component receives.
+ *
+ * Also the contract for core's own built-in views (the generic card and the image
+ * view), so all three are mountable by the node view through one type.
+ */
+export interface BlockPreviewProps {
+    /** The block's `_type`. */
+    type: string;
+    /** The block's `_key` — its stable identity within the field's array. */
+    nodeKey: string;
+    /** The block's stored data (its fields). */
+    data: Record<string, unknown>;
+    /** The block type's schema, for reading its `preview` config if useful. */
+    schema?: PreviewSource;
+    /** True while the block is selected in the editor. */
+    selected?: boolean;
+    /** Open the block's edit modal — wire this to a click/edit affordance. */
+    onEdit: () => void;
+    /** Remove the block. */
+    onDelete: () => void;
+}
+export type BlockPreviewLookup = (type: string) => Component<BlockPreviewProps> | undefined;
+/** Publish the block-preview lookup to descendants (call in the admin shell). */
+export declare function setBlockPreviews(lookup: BlockPreviewLookup): void;
+/** Resolve the lookup. Returns a no-op lookup outside the admin shell. */
+export declare function useBlockPreviews(): BlockPreviewLookup;
+//# sourceMappingURL=block-previews.svelte.d.ts.map

package/dist/admin/block-previews.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"block-previews.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/admin/block-previews.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IACjC,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;AAI5F,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAEjE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,kBAAkB,CAErD"}

package/dist/admin/block-previews.svelte.js

@@ -0,0 +1,26 @@
+/**
+ * Rich-text block preview registry (client-side context).
+ *
+ * By default a custom Portable Text block renders in the editor as a generic card
+ * (title/subtitle from its `preview` config). That's fine for data-ish blocks, but for
+ * visual ones — an embed, a gallery, a button — authors expect to see the real thing
+ * inline while writing (the Ghost/Sanity "what you see is what you get" editor).
+ *
+ * An app registers a preview per block `_type`; RichtextField resolves it and the
+ * ProseMirror node view mounts it INSTEAD of the generic card. The preview still gets
+ * `onEdit`/`onDelete` so the block stays editable and removable.
+ *
+ * Deliberately separate from the field-component registry: that one supplies *inputs*
+ * (`field`/`value`/`onUpdate`); this one supplies *renderers* (`data`/`onEdit`). Same
+ * idea, different contract.
+ */
+import { getContext, setContext } from 'svelte';
+const BLOCK_PREVIEWS_KEY = Symbol.for('aphex.admin.block-previews');
+/** Publish the block-preview lookup to descendants (call in the admin shell). */
+export function setBlockPreviews(lookup) {
+    setContext(BLOCK_PREVIEWS_KEY, lookup);
+}
+/** Resolve the lookup. Returns a no-op lookup outside the admin shell. */
+export function useBlockPreviews() {
+    return getContext(BLOCK_PREVIEWS_KEY) ?? (() => undefined);
+}

package/dist/admin/field-components.svelte.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Field-input widget registry (client-side context).
+ *
+ * Plugins contribute custom input widgets via `aphex/field/component` parts, keyed
+ * by an `input` string. A field opts into one with `{ …, input: 'color' }`.
+ * The admin shell publishes a lookup here; SchemaField (however deeply nested)
+ * resolves the widget and renders it in place of the built-in for that field type.
+ */
+import { type Component } from 'svelte';
+import type { FieldComponentProps } from '../plugins/types.js';
+export type FieldComponentLookup = (input: string) => Component<FieldComponentProps> | undefined;
+/** Publish the widget lookup to descendants (call in the admin shell). */
+export declare function setFieldComponents(lookup: FieldComponentLookup): void;
+/** Resolve the widget lookup. Returns a no-op lookup outside the admin shell. */
+export declare function useFieldComponents(): FieldComponentLookup;
+//# sourceMappingURL=field-components.svelte.d.ts.map

package/dist/admin/field-components.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-components.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/admin/field-components.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;AAIjG,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAErE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,IAAI,oBAAoB,CAEzD"}

package/dist/admin/field-components.svelte.js

@@ -0,0 +1,18 @@
+/**
+ * Field-input widget registry (client-side context).
+ *
+ * Plugins contribute custom input widgets via `aphex/field/component` parts, keyed
+ * by an `input` string. A field opts into one with `{ …, input: 'color' }`.
+ * The admin shell publishes a lookup here; SchemaField (however deeply nested)
+ * resolves the widget and renders it in place of the built-in for that field type.
+ */
+import { getContext, setContext } from 'svelte';
+const FIELD_COMPONENTS_KEY = Symbol.for('aphex.admin.field-components');
+/** Publish the widget lookup to descendants (call in the admin shell). */
+export function setFieldComponents(lookup) {
+    setContext(FIELD_COMPONENTS_KEY, lookup);
+}
+/** Resolve the widget lookup. Returns a no-op lookup outside the admin shell. */
+export function useFieldComponents() {
+    return getContext(FIELD_COMPONENTS_KEY) ?? (() => undefined);
+}

package/dist/admin/nav.svelte.d.ts

@@ -0,0 +1,34 @@
+import type { AdminArea } from './types.js';
+/** The known admin URL params. Central list so intents never typo a key. */
+export type AdminParam = 'view' | 'docType' | 'docId' | 'action' | 'stack' | 'history' | 'focus' | 'orgId' | 'fromDocId' | 'fromDocType';
+/** A set of param changes: a value sets the key, `null` clears it. */
+export type ParamPatch = Partial<Record<AdminParam, string | null>>;
+export interface AdminNav {
+    /** Apply a param patch and navigate. `replace` defaults to true. */
+    patch(changes: ParamPatch, opts?: {
+        replace?: boolean;
+    }): Promise<void>;
+    /** Switch the top-level area/tab. `structure` clears `?view`; others set it. */
+    openArea(area: AdminArea): Promise<void>;
+    /** Show a document type's list (structure area). */
+    openType(docType: string): Promise<void>;
+    /**
+     * Open a document in the editor (structure area). `docType` is optional — when
+     * omitted the existing `?docType` is preserved (the URL effect resolves it).
+     */
+    openDocument(docId: string, docType?: string, opts?: {
+        replace?: boolean;
+    }): Promise<void>;
+    /** Start creating a new document of a type. */
+    createDocument(docType: string): Promise<void>;
+    /** Close the current document, back to its type's list. */
+    closeToType(docType: string): Promise<void>;
+    /** Back to the dashboard (no type, no doc). */
+    goHome(): Promise<void>;
+}
+/** Create an admin nav and publish it to descendants (call once in the shell). */
+export declare function setAdminNav(basePath?: string): AdminNav;
+/** Read the admin nav. `undefined` outside the admin shell (safe to guard). */
+export declare function useAdminNav(): AdminNav | undefined;
+export declare function createAdminNav(basePath?: string): AdminNav;
+//# sourceMappingURL=nav.svelte.d.ts.map

package/dist/admin/nav.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/admin/nav.svelte.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GACnB,MAAM,GACN,SAAS,GACT,OAAO,GACP,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,aAAa,CAAC;AAEjB,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,QAAQ;IACxB,oEAAoE;IACpE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,+CAA+C;IAC/C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,+CAA+C;IAC/C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,QAAQ,SAAW,GAAG,QAAQ,CAIzD;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,IAAI,QAAQ,GAAG,SAAS,CAElD;AAED,wBAAgB,cAAc,CAAC,QAAQ,SAAW,GAAG,QAAQ,CAgE5D"}

package/dist/admin/nav.svelte.js

@@ -0,0 +1,78 @@
+/**
+ * Admin URL navigation — the single place that knows the admin's query-param
+ * vocabulary and how each navigation intent maps onto it.
+ *
+ * The admin encodes its whole view state in the URL (`?view`, `?docType`, `?docId`,
+ * `?action`, `?stack`, …) and a URL-watching effect derives component state from it.
+ * That's good (shareable, back-button-friendly) but the writes were scattered as
+ * ad-hoc `SvelteURLSearchParams` + `goto` blocks, each hand-clearing the params it
+ * happened to remember — which is how "opening a doc left a stale ?view" slipped in.
+ *
+ * This module replaces those with named intents. Each intent declares the FULL set
+ * of params it touches (setting some, clearing others), so no caller has to
+ * remember the interactions. `patch()` remains for the rare bespoke case.
+ */
+import { getContext, setContext } from 'svelte';
+import { goto } from '$app/navigation';
+import { page } from '$app/state';
+import { SvelteURLSearchParams } from 'svelte/reactivity';
+const ADMIN_NAV_KEY = Symbol.for('aphex.admin.nav');
+/** Create an admin nav and publish it to descendants (call once in the shell). */
+export function setAdminNav(basePath = '/admin') {
+    const nav = createAdminNav(basePath);
+    setContext(ADMIN_NAV_KEY, nav);
+    return nav;
+}
+/** Read the admin nav. `undefined` outside the admin shell (safe to guard). */
+export function useAdminNav() {
+    return getContext(ADMIN_NAV_KEY);
+}
+export function createAdminNav(basePath = '/admin') {
+    async function patch(changes, { replace = true } = {}) {
+        const params = new SvelteURLSearchParams(page.url.searchParams);
+        for (const [key, value] of Object.entries(changes)) {
+            if (value == null)
+                params.delete(key);
+            else
+                params.set(key, value);
+        }
+        const query = params.toString();
+        await goto(`${basePath}${query ? `?${query}` : ''}`, {
+            replaceState: replace,
+            keepFocus: true
+        });
+    }
+    return {
+        patch,
+        openArea: (area) => 
+        // A plugin/other area is addressable via ?view; structure is the default (no ?view).
+        // Leaving an area always drops any open document.
+        patch({
+            view: area === 'structure' ? null : area,
+            docId: null,
+            docType: null,
+            stack: null,
+            action: null
+        }),
+        openType: (docType) => patch({ docType, docId: null, action: null, stack: null, history: null, view: null }, { replace: false }),
+        openDocument: (docId, docType, opts) => patch({
+            docId,
+            ...(docType ? { docType } : {}),
+            action: null,
+            fromDocId: null,
+            fromDocType: null,
+            view: null
+        }, { replace: opts?.replace ?? false }),
+        createDocument: (docType) => patch({ docType, action: 'create', docId: null, stack: null, view: null }, { replace: false }),
+        closeToType: (docType) => patch({ docType, docId: null, action: null, stack: null, focus: null, history: null, view: null }, { replace: false }),
+        goHome: () => patch({
+            view: null,
+            docType: null,
+            docId: null,
+            action: null,
+            stack: null,
+            focus: null,
+            history: null
+        })
+    };
+}

package/dist/admin/slots.svelte.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { type Snippet } from 'svelte';
+/** Well-known slot names. Plain strings are allowed too (e.g. plugin-defined). */
+export type AdminSlotName = 'navbar-start' | 'navbar-end' | 'document-actions' | 'admin-tabs' | (string & {});
+export interface AdminSlotEntry {
+    /** Stable id — re-registering with the same id replaces the prior entry. */
+    id: string;
+    snippet: Snippet;
+    /** Ascending sort within the slot. Defaults to 0. */
+    order?: number;
+}
+export declare class AdminSlots {
+    #private;
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name: AdminSlotName, entry: AdminSlotEntry): () => void;
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name: AdminSlotName): AdminSlotEntry[];
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name: AdminSlotName): boolean;
+}
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export declare function setAdminSlots(): AdminSlots;
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export declare function useAdminSlots(): AdminSlots | undefined;
+//# sourceMappingURL=slots.svelte.d.ts.map

package/dist/admin/slots.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/admin/slots.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAmC,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGvE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,YAAY,GACZ,kBAAkB,GAClB,YAAY,GACZ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjB,MAAM,WAAW,cAAc;IAC9B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,IAAI;IAgBhE,wEAAwE;IACxE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,EAAE;IAI1C,qEAAqE;IACrE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO;CAGjC;AAID,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,CAI1C;AAED,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,GAAG,SAAS,CAEtD"}

package/dist/admin/slots.svelte.js

@@ -0,0 +1,67 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { getContext, setContext, untrack } from 'svelte';
+import { SvelteMap } from 'svelte/reactivity';
+export class AdminSlots {
+    // Reactive so outlets re-render as entries come and go.
+    #slots = new SvelteMap();
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name, entry) {
+        const current = untrack(() => this.#slots.get(name) ?? []);
+        const next = [...current.filter((e) => e.id !== entry.id), entry].sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+        this.#slots.set(name, next);
+        return () => {
+            const list = untrack(() => this.#slots.get(name));
+            if (!list)
+                return;
+            const filtered = list.filter((e) => e.id !== entry.id);
+            if (filtered.length > 0)
+                this.#slots.set(name, filtered);
+            else
+                this.#slots.delete(name);
+        };
+    }
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name) {
+        return this.#slots.get(name) ?? [];
+    }
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name) {
+        return this.get(name).length > 0;
+    }
+}
+const ADMIN_SLOTS_KEY = Symbol.for('aphex.admin.slots');
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export function setAdminSlots() {
+    const slots = new AdminSlots();
+    setContext(ADMIN_SLOTS_KEY, slots);
+    return slots;
+}
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export function useAdminSlots() {
+    return getContext(ADMIN_SLOTS_KEY);
+}

package/dist/admin/types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The active admin area (tab). Built-in tools are named literals; plugin admin
+ * tools are addressed as `plugin:<tool-id>`, so the tab system is open-ended
+ * without the shell hardcoding plugin knowledge.
+ */
+export type AdminArea = 'structure' | 'vision' | 'media' | `plugin:${string}`;
+//# sourceMappingURL=types.d.ts.map

package/dist/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/admin/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,MAAM,EAAE,CAAC"}

package/dist/admin/types.js

@@ -0,0 +1 @@
+export {};

package/dist/api/schemas/api-keys.d.ts

@@ -1,59 +1,26 @@
 import { z } from 'zod';
-import { type Capability } from '../../types/capabilities.js';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
 }>;
-export declare const apiKeyCapabilitySchema: z.ZodEnum<{
-    "document.read": "document.read";
-    "document.create": "document.create";
-    "document.update": "document.update";
-    "document.delete": "document.delete";
-    "document.publish": "document.publish";
-    "document.unpublish": "document.unpublish";
-    "asset.read": "asset.read";
-    "asset.upload": "asset.upload";
-    "asset.delete": "asset.delete";
-    "member.invite": "member.invite";
-    "member.remove": "member.remove";
-    "member.changeRole": "member.changeRole";
-    "apiKey.manage": "apiKey.manage";
-    "role.manage": "role.manage";
-    "org.settings": "org.settings";
-}>;
+export declare const apiKeyCapabilitySchema: z.ZodString;
 export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         read: "read";
         write: "write";
     }>>>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodTransform<{
     permissions: ("read" | "write")[] | undefined;
-    capabilities: Capability[] | undefined;
+    capabilities: string[] | undefined;
     name: string;
     expiresInDays?: number | undefined;
 }, {
     name: string;
     permissions?: ("read" | "write")[] | undefined;
-    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    capabilities?: string[] | undefined;
     expiresInDays?: number | undefined;
 }>>;
 export type ApiKeyPermission = z.infer<typeof apiKeyPermissionSchema>;

package/dist/api/schemas/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIpG,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAElC,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAIhE,eAAO,MAAM,sBAAsB,aAAmB,CAAC;AASvD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/api/schemas/api-keys.js

@@ -1,8 +1,11 @@
 import { z } from 'zod';
-import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+import { normalizeCapabilities } from '../../types/capabilities.js';
+import { capabilitySchema } from './roles.js';
 // ---------- Shared ----------
 export const apiKeyPermissionSchema = z.enum(['read', 'write']);
-export const apiKeyCapabilitySchema = z.enum(ALL_CAPABILITIES);
+// Same capability-id format guard as roles; the authoritative validity check
+// (against the runtime registry) happens in the route handler.
+export const apiKeyCapabilitySchema = capabilitySchema;
 // ---------- POST /settings/api-keys ----------
 // Two provisioning modes:
 //   1. Coarse `permissions`: 'read' alone, or 'write' (always implies read).

package/dist/api/schemas/assets.d.ts

@@ -34,6 +34,10 @@ export declare const listAssetsQuery: z.ZodObject<{
     }>>;
     mimeType: z.ZodOptional<z.ZodString>;
     search: z.ZodOptional<z.ZodString>;
+    includeSystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>]>>;
     limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
 }, z.core.$strip>;

package/dist/api/schemas/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;iBAuBT,CAAC;AAEhB,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAIH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7B,CAAC;AAIH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAG3B,CAAC;AAIH,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAMrC,CAAC;AAIH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAIH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;iBAuBT,CAAC;AAEhB,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAIH,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAS1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7B,CAAC;AAIH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAG3B,CAAC;AAIH,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAMrC,CAAC;AAIH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAIH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/api/schemas/assets.js

@@ -35,6 +35,9 @@ export const listAssetsQuery = z.object({
     assetType: z.enum(['image', 'file']).optional(),
     mimeType: z.string().optional(),
     search: z.string().optional(),
+    includeSystem: z
+        .union([z.boolean(), z.enum(['true', 'false']).transform((value) => value === 'true')])
+        .optional(),
     limit: z.coerce.number().int().min(1).max(500).optional(),
     offset: z.coerce.number().int().min(0).optional()
 });

package/dist/api/schemas/plugin-settings.d.ts

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+export declare const savePluginSettingsRequest: z.ZodObject<{
+    values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type SavePluginSettingsRequest = z.infer<typeof savePluginSettingsRequest>;
+//# sourceMappingURL=plugin-settings.d.ts.map

package/dist/api/schemas/plugin-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/plugin-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/api/schemas/plugin-settings.js

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+// Save a plugin's settings — a partial patch of field-name → value. Values are
+// deliberately loose (`unknown`): the field types are plugin-declared, so the
+// authoritative shape check is the declaration, enforced in the service (which
+// whitelists to declared field names). This guard only ensures a well-formed body.
+export const savePluginSettingsRequest = z.object({
+    values: z.record(z.string(), z.unknown())
+});

package/dist/api/schemas/roles.d.ts

@@ -1,76 +1,27 @@
 import { z } from 'zod';
-import { type Capability } from '../../types/capabilities.js';
-export declare const capabilitySchema: z.ZodEnum<{
-    "document.read": "document.read";
-    "document.create": "document.create";
-    "document.update": "document.update";
-    "document.delete": "document.delete";
-    "document.publish": "document.publish";
-    "document.unpublish": "document.unpublish";
-    "asset.read": "asset.read";
-    "asset.upload": "asset.upload";
-    "asset.delete": "asset.delete";
-    "member.invite": "member.invite";
-    "member.remove": "member.remove";
-    "member.changeRole": "member.changeRole";
-    "apiKey.manage": "apiKey.manage";
-    "role.manage": "role.manage";
-    "org.settings": "org.settings";
-}>;
+export declare const capabilitySchema: z.ZodString;
 export declare const createRoleRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodTransform<{
-    capabilities: Capability[];
+    capabilities: string[];
     name: string;
     description?: string | null | undefined;
 }, {
     name: string;
-    capabilities: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[];
+    capabilities: string[];
     description?: string | null | undefined;
 }>>;
 export declare const updateRoleRequest: z.ZodPipe<z.ZodObject<{
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodTransform<{
-    capabilities: Capability[] | undefined;
+    capabilities: string[] | undefined;
     description?: string | null | undefined;
 }, {
     description?: string | null | undefined;
-    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    capabilities?: string[] | undefined;
 }>>;
 export type CreateRoleRequest = z.infer<typeof createRoleRequest>;
 export type UpdateRoleRequest = z.infer<typeof updateRoleRequest>;

package/dist/api/schemas/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;EAE5B,CAAC;AAmBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,gBAAgB,aAI4D,CAAC;AAmB1F,eAAO,MAAM,iBAAiB;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/api/schemas/roles.js

@@ -1,10 +1,15 @@
 import { z } from 'zod';
-import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
-// Runtime enum of every known capability. Unknown strings are rejected so a
-// typo in a client request can't silently grant or strip permissions.
-// The cast preserves the literal Capability union in the inferred type — Zod
-// can't see the compile-time widening of the readonly array on its own.
-export const capabilitySchema = z.enum(ALL_CAPABILITIES);
+import { normalizeCapabilities } from '../../types/capabilities.js';
+// Capability id: a shape/format guard only — dotted or colon segments, e.g.
+// `document.publish` or `forms.export`. It deliberately does NOT enumerate the
+// valid set, because plugin-declared capabilities aren't known at module-eval time.
+// The route handler does the authoritative check against the runtime registry
+// (`partResolver.capabilityCatalog()`), rejecting ids that don't actually exist.
+export const capabilitySchema = z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9]+([.:][a-zA-Z0-9]+)+$/, { message: 'Invalid capability id format' });
 // Role name: human-readable identifier stored on member rows and referenced
 // in the API as /api/roles/[name]. Spaces are allowed (URL-encoded client
 // side); control characters and slashes are not, to keep routing unambiguous.