@aphexcms/cms-core 9.3.0 → 9.5.0

package/dist/lib/admin/nav.svelte.js

@@ -0,0 +1,79 @@
+/**
+ * Admin URL navigation — the single place that knows the admin's query-param
+ * vocabulary and how each navigation intent maps onto it.
+ *
+ * The admin encodes its whole view state in the URL (`?view`, `?docType`, `?docId`,
+ * `?action`, `?stack`, …) and a URL-watching effect derives component state from it.
+ * That's good (shareable, back-button-friendly) but the writes were scattered as
+ * ad-hoc `SvelteURLSearchParams` + `goto` blocks, each hand-clearing the params it
+ * happened to remember — which is how "opening a doc left a stale ?view" slipped in.
+ *
+ * This module replaces those with named intents. Each intent declares the FULL set
+ * of params it touches (setting some, clearing others), so no caller has to
+ * remember the interactions. `patch()` remains for the rare bespoke case.
+ */
+import { getContext, setContext } from 'svelte';
+import { goto } from '$app/navigation';
+import { page } from '$app/state';
+import { SvelteURLSearchParams } from 'svelte/reactivity';
+const ADMIN_NAV_KEY = Symbol.for('aphex.admin.nav');
+/** Create an admin nav and publish it to descendants (call once in the shell). */
+export function setAdminNav(basePath = '/admin') {
+    const nav = createAdminNav(basePath);
+    setContext(ADMIN_NAV_KEY, nav);
+    return nav;
+}
+/** Read the admin nav. `undefined` outside the admin shell (safe to guard). */
+export function useAdminNav() {
+    return getContext(ADMIN_NAV_KEY);
+}
+export function createAdminNav(basePath = '/admin') {
+    async function patch(changes, { replace = true } = {}) {
+        const params = new SvelteURLSearchParams(page.url.searchParams);
+        for (const [key, value] of Object.entries(changes)) {
+            if (value == null)
+                params.delete(key);
+            else
+                params.set(key, value);
+        }
+        const query = params.toString();
+        await goto(`${basePath}${query ? `?${query}` : ''}`, {
+            replaceState: replace,
+            keepFocus: true
+        });
+    }
+    return {
+        patch,
+        openArea: (area) => 
+        // A plugin/other area is addressable via ?view; structure is the default (no ?view).
+        // Leaving an area always drops any open document.
+        patch({
+            view: area === 'structure' ? null : area,
+            docId: null,
+            docType: null,
+            stack: null,
+            action: null
+        }),
+        openType: (docType) => patch({ docType, docId: null, action: null, stack: null, history: null, view: null }, { replace: false }),
+        openDocument: (docId, docType, opts) => patch({
+            docId,
+            ...(docType ? { docType } : {}),
+            action: null,
+            fromDocId: null,
+            fromDocType: null,
+            view: null
+        }, { replace: opts?.replace ?? false }),
+        createDocument: (docType) => patch({ docType, action: 'create', docId: null, stack: null, view: null }, { replace: false }),
+        closeToType: (docType) => patch({ docType, docId: null, action: null, stack: null, focus: null, history: null, view: null }, { replace: false }),
+        goHome: () => patch({
+            view: null,
+            docType: null,
+            docId: null,
+            action: null,
+            stack: null,
+            focus: null,
+            history: null
+        })
+    };
+}
+//# sourceMappingURL=nav.svelte.js.map

package/dist/lib/admin/nav.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/nav.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAwC1D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEpD,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,QAAQ,GAAG,QAAQ;IAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW;IAC1B,OAAO,UAAU,CAAuB,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAG,QAAQ;IACjD,KAAK,UAAU,KAAK,CAAC,OAAmB,EAAE,EAAE,OAAO,GAAG,IAAI,KAA4B,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACpD,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,KAAK;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAClB,qFAAqF;QACrF,kDAAkD;QAClD,KAAK,CAAC;YACL,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACxC,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;SACZ,CAAC;QACH,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,KAAK,CACJ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC9E,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACtC,KAAK,CACJ;YACC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,IAAI,EAAE,IAAI;SACV,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CACnC;QACF,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,KAAK,CACJ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnE,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CACxB,KAAK,CACJ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC3F,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,MAAM,EAAE,GAAG,EAAE,CACZ,KAAK,CAAC;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,IAAI;SACb,CAAC;KACH,CAAC;AACH,CAAC"}

package/dist/lib/admin/slots.svelte.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { type Snippet } from 'svelte';
+/** Well-known slot names. Plain strings are allowed too (e.g. plugin-defined). */
+export type AdminSlotName = 'navbar-start' | 'navbar-end' | 'document-actions' | 'admin-tabs' | (string & {});
+export interface AdminSlotEntry {
+    /** Stable id — re-registering with the same id replaces the prior entry. */
+    id: string;
+    snippet: Snippet;
+    /** Ascending sort within the slot. Defaults to 0. */
+    order?: number;
+}
+export declare class AdminSlots {
+    #private;
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name: AdminSlotName, entry: AdminSlotEntry): () => void;
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name: AdminSlotName): AdminSlotEntry[];
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name: AdminSlotName): boolean;
+}
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export declare function setAdminSlots(): AdminSlots;
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export declare function useAdminSlots(): AdminSlots | undefined;
+//# sourceMappingURL=slots.svelte.d.ts.map

package/dist/lib/admin/slots.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/slots.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAmC,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGvE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,YAAY,GACZ,kBAAkB,GAClB,YAAY,GACZ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjB,MAAM,WAAW,cAAc;IAC9B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,IAAI;IAgBhE,wEAAwE;IACxE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,EAAE;IAI1C,qEAAqE;IACrE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO;CAGjC;AAID,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,CAI1C;AAED,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,GAAG,SAAS,CAEtD"}

package/dist/lib/admin/slots.svelte.js

@@ -0,0 +1,68 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { getContext, setContext, untrack } from 'svelte';
+import { SvelteMap } from 'svelte/reactivity';
+export class AdminSlots {
+    // Reactive so outlets re-render as entries come and go.
+    #slots = new SvelteMap();
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name, entry) {
+        const current = untrack(() => this.#slots.get(name) ?? []);
+        const next = [...current.filter((e) => e.id !== entry.id), entry].sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+        this.#slots.set(name, next);
+        return () => {
+            const list = untrack(() => this.#slots.get(name));
+            if (!list)
+                return;
+            const filtered = list.filter((e) => e.id !== entry.id);
+            if (filtered.length > 0)
+                this.#slots.set(name, filtered);
+            else
+                this.#slots.delete(name);
+        };
+    }
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name) {
+        return this.#slots.get(name) ?? [];
+    }
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name) {
+        return this.get(name).length > 0;
+    }
+}
+const ADMIN_SLOTS_KEY = Symbol.for('aphex.admin.slots');
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export function setAdminSlots() {
+    const slots = new AdminSlots();
+    setContext(ADMIN_SLOTS_KEY, slots);
+    return slots;
+}
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export function useAdminSlots() {
+    return getContext(ADMIN_SLOTS_KEY);
+}
+//# sourceMappingURL=slots.svelte.js.map

package/dist/lib/admin/slots.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/slots.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAgB,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkB9C,MAAM,OAAO,UAAU;IACtB,wDAAwD;IACxD,MAAM,GAAG,IAAI,SAAS,EAA4B,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,IAAmB,EAAE,KAAqB;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACrE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CACzC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5B,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;;gBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,GAAG,CAAC,IAAmB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,qEAAqE;IACrE,GAAG,CAAC,IAAmB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;CACD;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAExD,qFAAqF;AACrF,MAAM,UAAU,aAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAyB,eAAe,CAAC,CAAC;AAC5D,CAAC"}

package/dist/lib/admin/types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The active admin area (tab). Built-in tools are named literals; plugin admin
+ * tools are addressed as `plugin:<tool-id>`, so the tab system is open-ended
+ * without the shell hardcoding plugin knowledge.
+ */
+export type AdminArea = 'structure' | 'vision' | 'media' | `plugin:${string}`;
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,MAAM,EAAE,CAAC"}

package/dist/lib/admin/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lib/admin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/admin/types.ts"],"names":[],"mappings":""}

package/dist/lib/api/schemas/api-keys.d.ts

@@ -1,59 +1,26 @@
 import { z } from 'zod';
-import { type Capability } from '../../types/capabilities.js';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
 }>;
-export declare const apiKeyCapabilitySchema: z.ZodEnum<{
-    "document.read": "document.read";
-    "document.create": "document.create";
-    "document.update": "document.update";
-    "document.delete": "document.delete";
-    "document.publish": "document.publish";
-    "document.unpublish": "document.unpublish";
-    "asset.read": "asset.read";
-    "asset.upload": "asset.upload";
-    "asset.delete": "asset.delete";
-    "member.invite": "member.invite";
-    "member.remove": "member.remove";
-    "member.changeRole": "member.changeRole";
-    "apiKey.manage": "apiKey.manage";
-    "role.manage": "role.manage";
-    "org.settings": "org.settings";
-}>;
+export declare const apiKeyCapabilitySchema: z.ZodString;
 export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         read: "read";
         write: "write";
     }>>>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodTransform<{
     permissions: ("read" | "write")[] | undefined;
-    capabilities: Capability[] | undefined;
+    capabilities: string[] | undefined;
     name: string;
     expiresInDays?: number | undefined;
 }, {
     name: string;
     permissions?: ("read" | "write")[] | undefined;
-    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    capabilities?: string[] | undefined;
     expiresInDays?: number | undefined;
 }>>;
 export type ApiKeyPermission = z.infer<typeof apiKeyPermissionSchema>;

package/dist/lib/api/schemas/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIpG,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAElC,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAIhE,eAAO,MAAM,sBAAsB,aAAmB,CAAC;AASvD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/lib/api/schemas/api-keys.js

@@ -1,8 +1,11 @@
 import { z } from 'zod';
-import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+import { normalizeCapabilities } from '../../types/capabilities.js';
+import { capabilitySchema } from './roles.js';
 // ---------- Shared ----------
 export const apiKeyPermissionSchema = z.enum(['read', 'write']);
-export const apiKeyCapabilitySchema = z.enum(ALL_CAPABILITIES);
+// Same capability-id format guard as roles; the authoritative validity check
+// (against the runtime registry) happens in the route handler.
+export const apiKeyCapabilitySchema = capabilitySchema;
 // ---------- POST /settings/api-keys ----------
 // Two provisioning modes:
 //   1. Coarse `permissions`: 'read' alone, or 'write' (always implies read).

package/dist/lib/api/schemas/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAmB,MAAM,0BAA0B,CAAC;AAEpG,+BAA+B;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAC3C,gBAA4D,CAC5D,CAAC;AAEF,gDAAgD;AAEhD,0BAA0B;AAC1B,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAC7F,EAAE,OAAO,EAAE,0DAA0D,EAAE,CACvE;KACA,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,WAAW,EAAE,CAAC,CAAC,WAAW;QACzB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,CAAE,CAAC,MAAM,EAAE,OAAO,CAA6B;YAChD,CAAC,CAAE,CAAC,MAAM,CAA6B;QACxC,CAAC,CAAC,SAAS;IACZ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,+BAA+B;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,gDAAgD;AAEhD,0BAA0B;AAC1B,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAC7F,EAAE,OAAO,EAAE,0DAA0D,EAAE,CACvE;KACA,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,WAAW,EAAE,CAAC,CAAC,WAAW;QACzB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,CAAE,CAAC,MAAM,EAAE,OAAO,CAA6B;YAChD,CAAC,CAAE,CAAC,MAAM,CAA6B;QACxC,CAAC,CAAC,SAAS;IACZ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}

package/dist/lib/api/schemas/assets.d.ts

@@ -34,6 +34,10 @@ export declare const listAssetsQuery: z.ZodObject<{
     }>>;
     mimeType: z.ZodOptional<z.ZodString>;
     search: z.ZodOptional<z.ZodString>;
+    includeSystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>]>>;
     limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
 }, z.core.$strip>;

package/dist/lib/api/schemas/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;iBAuBT,CAAC;AAEhB,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAIH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7B,CAAC;AAIH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAG3B,CAAC;AAIH,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAMrC,CAAC;AAIH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAIH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;iBAuBT,CAAC;AAEhB,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAIH,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAS1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7B,CAAC;AAIH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAG3B,CAAC;AAIH,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAMrC,CAAC;AAIH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAIH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/lib/api/schemas/assets.js

@@ -35,6 +35,9 @@ export const listAssetsQuery = z.object({
     assetType: z.enum(['image', 'file']).optional(),
     mimeType: z.string().optional(),
     search: z.string().optional(),
+    includeSystem: z
+        .union([z.boolean(), z.enum(['true', 'false']).transform((value) => value === 'true')])
+        .optional(),
     limit: z.coerce.number().int().min(1).max(500).optional(),
     offset: z.coerce.number().int().min(0).optional()
 });

package/dist/lib/api/schemas/assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sCAAsC;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KAC1B,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,WAAW,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;KACxB,CAAC;CACF,CAAC,CAAC;AAEH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,WAAW;CACjB,CAAC,CAAC;AAEH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,WAAW;CACjB,CAAC,CAAC;AAEH,4CAA4C;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACxB,CAAC,CAAC;AAEH,4CAA4C;AAE5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;CACF,CAAC,CAAC;AAEH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,uDAAuD;AAEvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC"}
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sCAAsC;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KAC1B,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,WAAW,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC;SACtF,QAAQ,EAAE;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;KACxB,CAAC;CACF,CAAC,CAAC;AAEH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,WAAW;CACjB,CAAC,CAAC;AAEH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,WAAW;CACjB,CAAC,CAAC;AAEH,4CAA4C;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACxB,CAAC,CAAC;AAEH,4CAA4C;AAE5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;CACF,CAAC,CAAC;AAEH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,uDAAuD;AAEvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC"}

package/dist/lib/api/schemas/plugin-settings.d.ts

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+export declare const savePluginSettingsRequest: z.ZodObject<{
+    values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type SavePluginSettingsRequest = z.infer<typeof savePluginSettingsRequest>;
+//# sourceMappingURL=plugin-settings.d.ts.map

package/dist/lib/api/schemas/plugin-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/plugin-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/lib/api/schemas/plugin-settings.js

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+// Save a plugin's settings — a partial patch of field-name → value. Values are
+// deliberately loose (`unknown`): the field types are plugin-declared, so the
+// authoritative shape check is the declaration, enforced in the service (which
+// whitelists to declared field names). This guard only ensures a well-formed body.
+export const savePluginSettingsRequest = z.object({
+    values: z.record(z.string(), z.unknown())
+});
+//# sourceMappingURL=plugin-settings.js.map

package/dist/lib/api/schemas/plugin-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/plugin-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CACzC,CAAC,CAAC"}

package/dist/lib/api/schemas/roles.d.ts

@@ -1,76 +1,27 @@
 import { z } from 'zod';
-import { type Capability } from '../../types/capabilities.js';
-export declare const capabilitySchema: z.ZodEnum<{
-    "document.read": "document.read";
-    "document.create": "document.create";
-    "document.update": "document.update";
-    "document.delete": "document.delete";
-    "document.publish": "document.publish";
-    "document.unpublish": "document.unpublish";
-    "asset.read": "asset.read";
-    "asset.upload": "asset.upload";
-    "asset.delete": "asset.delete";
-    "member.invite": "member.invite";
-    "member.remove": "member.remove";
-    "member.changeRole": "member.changeRole";
-    "apiKey.manage": "apiKey.manage";
-    "role.manage": "role.manage";
-    "org.settings": "org.settings";
-}>;
+export declare const capabilitySchema: z.ZodString;
 export declare const createRoleRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodTransform<{
-    capabilities: Capability[];
+    capabilities: string[];
     name: string;
     description?: string | null | undefined;
 }, {
     name: string;
-    capabilities: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[];
+    capabilities: string[];
     description?: string | null | undefined;
 }>>;
 export declare const updateRoleRequest: z.ZodPipe<z.ZodObject<{
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodTransform<{
-    capabilities: Capability[] | undefined;
+    capabilities: string[] | undefined;
     description?: string | null | undefined;
 }, {
     description?: string | null | undefined;
-    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    capabilities?: string[] | undefined;
 }>>;
 export type CreateRoleRequest = z.infer<typeof createRoleRequest>;
 export type UpdateRoleRequest = z.infer<typeof updateRoleRequest>;

package/dist/lib/api/schemas/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;EAE5B,CAAC;AAmBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,gBAAgB,aAI4D,CAAC;AAmB1F,eAAO,MAAM,iBAAiB;;;;;;;;;;;;GAMqD,CAAC;AAIpF,eAAO,MAAM,iBAAiB;;;;;;;;;GAW1B,CAAC;AAIL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/lib/api/schemas/roles.js

@@ -1,10 +1,15 @@
 import { z } from 'zod';
-import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
-// Runtime enum of every known capability. Unknown strings are rejected so a
-// typo in a client request can't silently grant or strip permissions.
-// The cast preserves the literal Capability union in the inferred type — Zod
-// can't see the compile-time widening of the readonly array on its own.
-export const capabilitySchema = z.enum(ALL_CAPABILITIES);
+import { normalizeCapabilities } from '../../types/capabilities.js';
+// Capability id: a shape/format guard only — dotted or colon segments, e.g.
+// `document.publish` or `forms.export`. It deliberately does NOT enumerate the
+// valid set, because plugin-declared capabilities aren't known at module-eval time.
+// The route handler does the authoritative check against the runtime registry
+// (`partResolver.capabilityCatalog()`), rejecting ids that don't actually exist.
+export const capabilitySchema = z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9]+([.:][a-zA-Z0-9]+)+$/, { message: 'Invalid capability id format' });
 // Role name: human-readable identifier stored on member rows and referenced
 // in the API as /api/roles/[name]. Spaces are allowed (URL-encoded client
 // side); control characters and slashes are not, to keep routing unambiguous.

package/dist/lib/api/schemas/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAmB,MAAM,0BAA0B,CAAC;AAEpG,4EAA4E;AAC5E,sEAAsE;AACtE,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CACrC,gBAA4D,CAC5D,CAAC;AAEF,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,mBAAmB,EAAE;IAC3B,OAAO,EAAE,+EAA+E;CACxF,CAAC,CAAC;AAEJ,oCAAoC;AAEpC,+EAA+E;AAC/E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,4CAA4C;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE;IAC3E,OAAO,EAAE,4DAA4D;CACrE,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,4EAA4E;AAC5E,+EAA+E;AAC/E,oFAAoF;AACpF,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAE1F,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,mBAAmB,EAAE;IAC3B,OAAO,EAAE,+EAA+E;CACxF,CAAC,CAAC;AAEJ,oCAAoC;AAEpC,+EAA+E;AAC/E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,4CAA4C;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE;IAC3E,OAAO,EAAE,4DAA4D;CACrE,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC;IACJ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,CAAC,CAAC,CAAC"}

package/dist/lib/api/schemas/user.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 export declare const updateUserRequest: z.ZodObject<{
-    name: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export declare const updateUserPreferencesRequest: z.ZodObject<{
     includeChildOrganizations: z.ZodOptional<z.ZodBoolean>;

package/dist/lib/api/schemas/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAIH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;iBAO3B,CAAC;AAIJ,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAIH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/lib/api/schemas/user.js

@@ -1,7 +1,12 @@
 import { z } from 'zod';
 // ---------- PATCH /user ----------
-export const updateUserRequest = z.object({
-    name: z.string().min(1)
+export const updateUserRequest = z
+    .object({
+    name: z.string().min(1).optional(),
+    image: z.string().min(1).nullable().optional()
+})
+    .refine((v) => v.name !== undefined || v.image !== undefined, {
+    message: 'At least one field (name, image) is required'
 });
 // ---------- PATCH /user/cms-preference ----------
 export const updateUserPreferencesRequest = z

package/dist/lib/api/schemas/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oCAAoC;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAEH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,0DAA0D;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,kDAAkD;AAElD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oCAAoC;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAChC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE;IAC7D,OAAO,EAAE,8CAA8C;CACvD,CAAC,CAAC;AAEJ,mDAAmD;AAEnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,0DAA0D;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,kDAAkD;AAElD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC"}

package/dist/lib/app-augment.d.ts

@@ -16,8 +16,19 @@
  * via the package's `./*` export map.
  */
 import type { RbacPayload } from './types/capabilities.js';
+import type { PreviewPerspective } from './preview/perspective.js';
 declare global {
     namespace App {
+        interface Locals {
+            /**
+             * Read perspective resolved once per request by the CMS hook —
+             * `'published'` normally, `'draft'` for an authenticated `?aphex-preview`
+             * session. Site loads inherit it via a preview-aware context (see
+             * `siteContext`). Override the policy with `preview.resolvePerspective`
+             * in the CMS config.
+             */
+            previewPerspective?: PreviewPerspective;
+        }
         interface PageData {
             /**
              * RBAC snapshot emitted by the admin layout's server load

package/dist/lib/app-augment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-augment.d.ts","sourceRoot":"","sources":["../../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,QAAQ;YACjB;;;;eAIG;YACH,IAAI,CAAC,EAAE,WAAW,CAAC;SACnB;KACD;CACD;AAED,OAAO,EAAE,CAAC"}
+{"version":3,"file":"app-augment.d.ts","sourceRoot":"","sources":["../../src/lib/app-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf;;;;;;eAMG;YACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;SACxC;QACD,UAAU,QAAQ;YACjB;;;;eAIG;YACH,IAAI,CAAC,EAAE,WAAW,CAAC;SACnB;KACD;CACD;AAED,OAAO,EAAE,CAAC"}