@aphexcms/cms-core 9.3.0 → 9.5.0

package/dist/theme/css.js

@@ -0,0 +1,53 @@
+/**
+ * Emit theme tokens as a scoped `<style>` body.
+ *
+ * Two hard rules, both learned the expensive way:
+ *  1. NEVER emit site tokens at `:root` — they'd bleed into the admin chrome.
+ *     Always scope to the site shell selector.
+ *  2. Theme values are user-authored, so sanitize before interpolating. Any value
+ *     that could break out of the `--var: value;` declaration (contains `;`, `{`,
+ *     `}`, `<`, `>`, or a CSS `url(`/`expression(`) is dropped, and the token's
+ *     CSS fallback in the layout applies instead.
+ */
+const UNSAFE = /[;{}<>]|url\s*\(|expression\s*\(/i;
+/** Return the value if safe to interpolate into a CSS declaration, else null. */
+export function sanitizeTokenValue(value) {
+    const trimmed = value.trim();
+    if (trimmed === '')
+        return null;
+    if (UNSAFE.test(trimmed))
+        return null;
+    return trimmed;
+}
+/**
+ * Build a sanitized `--var: value; …` declaration list from a `cssVar → value`
+ * map (see deriveThemeVars). Suitable for an inline `style` attribute on the site
+ * shell element — the simplest way to scope tokens to the site subtree while
+ * beating component-CSS specificity, with no `<style>` injection to guard. Returns
+ * `''` when nothing survives sanitization.
+ */
+export function emitThemeVars(vars) {
+    const declarations = [];
+    for (const [cssVar, rawValue] of Object.entries(vars)) {
+        if (!cssVar.startsWith('--'))
+            continue;
+        const value = sanitizeTokenValue(rawValue);
+        if (value === null)
+            continue;
+        declarations.push(`${cssVar}: ${value};`);
+    }
+    return declarations.join(' ');
+}
+/**
+ * Build a scoped style *rule* from a `cssVar → value` map, for callers that
+ * prefer injecting a `<style>` block over an inline attribute. Returns `''` when
+ * nothing survives sanitization, so callers can skip rendering an empty `<style>`.
+ *
+ * @param selector CSS selector to scope the custom properties to, e.g. `.blog-shell`.
+ */
+export function emitThemeStyle(selector, vars) {
+    const body = emitThemeVars(vars);
+    if (body === '')
+        return '';
+    return `${selector} { ${body} }`;
+}

package/dist/theme/derive.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Derive the admin schema and the runtime CSS-var map from a token list.
+ *
+ * `deriveThemeFields()` feeds the `theme` singleton schema; `deriveThemeVars()`
+ * turns a saved theme document into `{ '--accent': '#…', … }`. Both walk the same
+ * token list, so the form and the rendered CSS can never drift. The app supplies
+ * the tokens (see the app's `theme/tokens.ts`).
+ */
+import type { Field, FieldGroup } from '../types/schemas.js';
+import type { ThemeToken } from './tokens.js';
+/**
+ * Build the field-group list for a theme singleton, one group per distinct
+ * `token.group` in first-seen order. The first group is marked `default`.
+ */
+export declare function deriveThemeFieldGroups(tokens: ThemeToken[]): FieldGroup[];
+/** Build the field list for the `theme` singleton schema from the token set. */
+export declare function deriveThemeFields(tokens: ThemeToken[]): Field[];
+/**
+ * Resolve a theme document into a `cssVar → value` map, falling back to each
+ * token's default when the document omits or blanks a value. Font values are
+ * resolved to their full CSS stack; colors pass through (sanitized in ./css.ts).
+ *
+ * Accepts `unknown` so callers can pass a concrete generated document type (which
+ * lacks a string index signature) without casting; keys are read dynamically.
+ */
+export declare function deriveThemeVars(values: unknown, tokens: ThemeToken[]): Record<string, string>;
+//# sourceMappingURL=derive.d.ts.map

package/dist/theme/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../src/lib/theme/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAWzE;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,CA0C/D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuC7F"}

package/dist/theme/derive.js

@@ -0,0 +1,107 @@
+/**
+ * Build the field-group list for a theme singleton, one group per distinct
+ * `token.group` in first-seen order. The first group is marked `default`.
+ */
+export function deriveThemeFieldGroups(tokens) {
+    const seen = new Map();
+    for (const token of tokens) {
+        if (seen.has(token.group))
+            continue;
+        seen.set(token.group, {
+            name: token.group,
+            title: token.group.charAt(0).toUpperCase() + token.group.slice(1),
+            default: seen.size === 0
+        });
+    }
+    return [...seen.values()];
+}
+/** Build the field list for the `theme` singleton schema from the token set. */
+export function deriveThemeFields(tokens) {
+    return tokens.map((token) => {
+        const base = {
+            name: token.name,
+            title: token.title,
+            description: token.description,
+            group: token.group
+        };
+        switch (token.kind) {
+            case 'color':
+                // Color is a plugin field widget, not a built-in type. Emit a string
+                // field wired to the color-picker input; without the plugin installed it
+                // degrades to a plain text input (still a valid CSS color string).
+                return { ...base, type: 'string', input: 'color', initialValue: token.default };
+            case 'range':
+                return {
+                    ...base,
+                    type: 'number',
+                    min: token.min,
+                    max: token.max,
+                    step: token.step,
+                    initialValue: token.default,
+                    options: { layout: 'slider', unit: token.unit }
+                };
+            case 'select':
+                return {
+                    ...base,
+                    type: 'string',
+                    initialValue: token.default,
+                    list: token.options.map((o) => ({ title: o.title, value: o.value })),
+                    options: { layout: 'dropdown' }
+                };
+            case 'font':
+                return {
+                    ...base,
+                    type: 'string',
+                    initialValue: token.default,
+                    list: token.options.map((o) => ({ title: o.title, value: o.value })),
+                    options: { layout: 'dropdown' }
+                };
+        }
+    });
+}
+/**
+ * Resolve a theme document into a `cssVar → value` map, falling back to each
+ * token's default when the document omits or blanks a value. Font values are
+ * resolved to their full CSS stack; colors pass through (sanitized in ./css.ts).
+ *
+ * Accepts `unknown` so callers can pass a concrete generated document type (which
+ * lacks a string index signature) without casting; keys are read dynamically.
+ */
+export function deriveThemeVars(values, tokens) {
+    const vars = {};
+    const doc = {};
+    if (values && typeof values === 'object')
+        Object.assign(doc, values);
+    for (const token of tokens) {
+        const raw = doc[token.name];
+        switch (token.kind) {
+            case 'color': {
+                vars[token.cssVar] =
+                    typeof raw === 'string' && raw.trim() !== '' ? raw.trim() : token.default;
+                break;
+            }
+            case 'select': {
+                const selected = typeof raw === 'string' && raw.trim() !== '' ? raw.trim() : token.default;
+                const known = token.options.some((o) => o.value === selected);
+                vars[token.cssVar] = known ? selected : token.default;
+                break;
+            }
+            case 'range': {
+                const n = typeof raw === 'number' && Number.isFinite(raw) ? raw : token.default;
+                vars[token.cssVar] = `${n}${token.unit ?? ''}`;
+                break;
+            }
+            case 'font': {
+                // Map the stored value to its stack; unknown/blank → default option.
+                const selected = typeof raw === 'string' && raw.trim() !== '' ? raw.trim() : token.default;
+                const option = token.options.find((o) => o.value === selected) ??
+                    token.options.find((o) => o.value === token.default) ??
+                    token.options[0];
+                if (option)
+                    vars[token.cssVar] = option.stack;
+                break;
+            }
+        }
+    }
+    return vars;
+}

package/dist/theme/index.d.ts

@@ -0,0 +1,5 @@
+export * from './tokens.js';
+export * from './derive.js';
+export * from './css.js';
+export * from './schemes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/theme/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/theme/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC"}

package/dist/theme/index.js

@@ -0,0 +1,4 @@
+export * from './tokens.js';
+export * from './derive.js';
+export * from './css.js';
+export * from './schemes.js';

package/dist/theme/schemes.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Color schemes — the reusable palette unit.
+ *
+ * A scheme is seeded with THREE colors (surface, text, primary). Everything else —
+ * the on-primary contrast color, muted/faint text, hairline borders, raised
+ * surfaces, the hover-ink of the accent — is DERIVED, so every scheme is
+ * internally consistent and the editor tunes three dials instead of eight.
+ *
+ * Each scheme is emitted as a scoped class (`.scheme-<name>`) that remaps the same
+ * CSS custom properties the site components already consume (`--paper`, `--ink`,
+ * `--accent`, …). The site shell wears the default scheme; any section can wear a
+ * different one by adding its class — that's the page-builder primitive.
+ *
+ * Typography and layout are deliberately NOT part of a scheme: they're global,
+ * the same way Shopify keeps type/layout out of its color schemes.
+ */
+import type { ArrayField } from '../types/schemas.js';
+/** The three seed colors an editor sets per scheme. */
+export interface ColorScheme {
+    /** Human label; also slugified into the scheme's CSS class. */
+    name: string;
+    /** Background. */
+    surface: string;
+    /** Foreground text. */
+    text: string;
+    /** Accent — links, buttons, highlights. */
+    primary: string;
+}
+/** Slugify a scheme name into a stable, safe CSS class fragment. */
+export declare function schemeSlug(name: string): string;
+/** The CSS class that carries a scheme's tokens, e.g. `scheme-dark`. */
+export declare function schemeClass(name: string): string;
+/**
+ * Pick a readable on-color (near-black or white) for text/icons that sit on top
+ * of `background`. Falls back to white when the color can't be parsed.
+ */
+export declare function contrastColor(background: string): string;
+/**
+ * Resolve a scheme's three seeds into the full CSS-var role map. Seeds are
+ * sanitized; anything invalid falls back to a sensible default so a scheme always
+ * emits a complete, coherent palette. The derived roles are `color-mix`
+ * expressions over `var(--ink)`/`var(--paper)`, so they recompute correctly for
+ * whichever scheme is in scope — no per-shade user input, no drift.
+ */
+export declare function resolveSchemeVars(scheme: ColorScheme): Record<string, string>;
+/**
+ * Emit one scoped rule per scheme, prefixed so it only styles the site subtree
+ * (never `:root`/admin chrome). Returns `''` when there are no schemes.
+ *
+ * @param scopeSelector Ancestor selector the scheme classes live under, e.g. `.blog-shell`.
+ */
+export declare function emitSchemeStyles(schemes: ColorScheme[], scopeSelector: string): string;
+/** Read a theme document's `schemes` array, falling back to `defaults` when absent. */
+export declare function readSchemes(values: unknown, defaults: ColorScheme[]): ColorScheme[];
+/**
+ * Build the `schemes` array field for the theme singleton — a repeatable object
+ * of { name, surface, text, primary }. The first scheme is the site default.
+ */
+export declare function deriveSchemesField(defaults: ColorScheme[], group: string): ArrayField;
+//# sourceMappingURL=schemes.d.ts.map

package/dist/theme/schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemes.d.ts","sourceRoot":"","sources":["../../src/lib/theme/schemes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC3B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;CAChB;AAQD,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AA0BD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB7E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAYtF;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAmBnF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAwBrF"}

package/dist/theme/schemes.js

@@ -0,0 +1,149 @@
+import { sanitizeTokenValue } from './css.js';
+const FALLBACK = {
+    surface: '#ffffff',
+    text: '#15171a',
+    primary: '#3eb0ef'
+};
+/** Slugify a scheme name into a stable, safe CSS class fragment. */
+export function schemeSlug(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug || 'scheme';
+}
+/** The CSS class that carries a scheme's tokens, e.g. `scheme-dark`. */
+export function schemeClass(name) {
+    return `scheme-${schemeSlug(name)}`;
+}
+/** Parse a 3/6-digit hex to [r,g,b] in 0–255, or null if not a plain hex. */
+function parseHex(hex) {
+    const m = hex.trim().match(/^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/);
+    const group = m?.[1];
+    if (!group)
+        return null;
+    const h = group.length === 3
+        ? group
+            .split('')
+            .map((c) => c + c)
+            .join('')
+        : group;
+    return [parseInt(h.slice(0, 2), 16), parseInt(h.slice(2, 4), 16), parseInt(h.slice(4, 6), 16)];
+}
+/** WCAG relative luminance (0 black → 1 white) of an sRGB triple. */
+function luminance([r, g, b]) {
+    const lin = (c) => {
+        const s = c / 255;
+        return s <= 0.03928 ? s / 12.92 : Math.pow((s + 0.055) / 1.055, 2.4);
+    };
+    return 0.2126 * lin(r) + 0.7152 * lin(g) + 0.0722 * lin(b);
+}
+/**
+ * Pick a readable on-color (near-black or white) for text/icons that sit on top
+ * of `background`. Falls back to white when the color can't be parsed.
+ */
+export function contrastColor(background) {
+    const rgb = parseHex(background);
+    if (!rgb)
+        return '#ffffff';
+    // Compare contrast against white vs near-black; whichever is higher wins.
+    const L = luminance(rgb);
+    const contrastWhite = 1.05 / (L + 0.05);
+    const contrastBlack = (L + 0.05) / 0.05;
+    return contrastWhite >= contrastBlack ? '#ffffff' : '#0b0b0c';
+}
+/**
+ * Resolve a scheme's three seeds into the full CSS-var role map. Seeds are
+ * sanitized; anything invalid falls back to a sensible default so a scheme always
+ * emits a complete, coherent palette. The derived roles are `color-mix`
+ * expressions over `var(--ink)`/`var(--paper)`, so they recompute correctly for
+ * whichever scheme is in scope — no per-shade user input, no drift.
+ */
+export function resolveSchemeVars(scheme) {
+    const surface = sanitizeTokenValue(scheme.surface) ?? FALLBACK.surface;
+    const text = sanitizeTokenValue(scheme.text) ?? FALLBACK.text;
+    const primary = sanitizeTokenValue(scheme.primary) ?? FALLBACK.primary;
+    return {
+        '--paper': surface,
+        '--ink': text,
+        '--accent': primary,
+        '--accent-contrast': contrastColor(primary),
+        // Derived — relative to this scheme's ink/paper.
+        '--paper-raised': 'color-mix(in srgb, var(--ink) 2%, var(--paper))',
+        '--ink-soft': 'color-mix(in srgb, var(--ink) 58%, var(--paper))',
+        '--ink-faint': 'color-mix(in srgb, var(--ink) 38%, var(--paper))',
+        '--rule': 'color-mix(in srgb, var(--ink) 12%, transparent)',
+        '--rule-soft': 'color-mix(in srgb, var(--ink) 7%, transparent)',
+        '--accent-ink': 'color-mix(in srgb, var(--accent) 82%, var(--ink))'
+    };
+}
+/**
+ * Emit one scoped rule per scheme, prefixed so it only styles the site subtree
+ * (never `:root`/admin chrome). Returns `''` when there are no schemes.
+ *
+ * @param scopeSelector Ancestor selector the scheme classes live under, e.g. `.blog-shell`.
+ */
+export function emitSchemeStyles(schemes, scopeSelector) {
+    const rules = [];
+    for (const scheme of schemes) {
+        const vars = resolveSchemeVars(scheme);
+        const decls = Object.entries(vars)
+            .map(([k, v]) => `${k}: ${v};`)
+            .join(' ');
+        const cls = schemeClass(scheme.name);
+        // Match the shell itself when it wears the scheme, and any descendant that does.
+        rules.push(`${scopeSelector}.${cls}, ${scopeSelector} .${cls} { ${decls} }`);
+    }
+    return rules.join('\n');
+}
+/** Read a theme document's `schemes` array, falling back to `defaults` when absent. */
+export function readSchemes(values, defaults) {
+    const doc = {};
+    if (values && typeof values === 'object')
+        Object.assign(doc, values);
+    const raw = doc.schemes;
+    if (!Array.isArray(raw) || raw.length === 0)
+        return defaults;
+    const parsed = [];
+    for (const item of raw) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const rec = item;
+        const name = typeof rec.name === 'string' && rec.name.trim() !== '' ? rec.name : 'Scheme';
+        parsed.push({
+            name,
+            surface: typeof rec.surface === 'string' ? rec.surface : FALLBACK.surface,
+            text: typeof rec.text === 'string' ? rec.text : FALLBACK.text,
+            primary: typeof rec.primary === 'string' ? rec.primary : FALLBACK.primary
+        });
+    }
+    return parsed.length > 0 ? parsed : defaults;
+}
+/**
+ * Build the `schemes` array field for the theme singleton — a repeatable object
+ * of { name, surface, text, primary }. The first scheme is the site default.
+ */
+export function deriveSchemesField(defaults, group) {
+    return {
+        name: 'schemes',
+        type: 'array',
+        title: 'Color schemes',
+        description: 'Reusable palettes. The first is the site default; sections can opt into any other. Set the background, text, and accent — the rest is derived.',
+        group,
+        initialValue: defaults,
+        of: [
+            {
+                type: 'object',
+                name: 'colorScheme',
+                title: 'Scheme',
+                preview: { select: { title: 'name', subtitle: 'primary' } },
+                fields: [
+                    { name: 'name', type: 'string', title: 'Name' },
+                    { name: 'surface', type: 'string', input: 'color', title: 'Background' },
+                    { name: 'text', type: 'string', input: 'color', title: 'Text' },
+                    { name: 'primary', type: 'string', input: 'color', title: 'Accent' }
+                ]
+            }
+        ]
+    };
+}

package/dist/theme/tokens.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Theme token *types* — the shape of a design-system token.
+ *
+ * cms-core owns the machinery (turn a token list into a schema + scoped CSS); the
+ * consuming app owns the concrete token list, its default colors, and font choices
+ * (that's design opinion, not engine concern). See ./derive.ts and ./css.ts for
+ * the functions that operate on these, and the app's own `theme/tokens.ts` for a
+ * concrete set.
+ */
+/** A curated font choice — the stored `value` resolves to a full CSS `stack`. */
+export interface FontOption {
+    title: string;
+    value: string;
+    stack: string;
+}
+interface BaseToken {
+    /** Field name in the theme schema and the token's identity. */
+    name: string;
+    title: string;
+    description?: string;
+    /** The CSS custom property this token drives, e.g. `--accent`. */
+    cssVar: string;
+    /** Field group in the admin form. */
+    group: string;
+}
+export interface ColorToken extends BaseToken {
+    kind: 'color';
+    default: string;
+}
+export interface FontToken extends BaseToken {
+    kind: 'font';
+    /** The stored `value` of the default option. */
+    default: string;
+    options: FontOption[];
+}
+/** A numeric slider — widths, radii, sizes. Emitted as `${value}${unit}`. */
+export interface RangeToken extends BaseToken {
+    kind: 'range';
+    default: number;
+    min: number;
+    max: number;
+    step?: number;
+    /** CSS unit appended to the value, e.g. `'px'`, `'rem'`. Defaults to `''`. */
+    unit?: string;
+}
+/** A fixed-choice dropdown — weights, styles. The stored value is emitted verbatim. */
+export interface SelectToken extends BaseToken {
+    kind: 'select';
+    default: string;
+    options: Array<{
+        title: string;
+        value: string;
+    }>;
+}
+export type ThemeToken = ColorToken | FontToken | RangeToken | SelectToken;
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/theme/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/lib/theme/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED,UAAU,SAAS;IAClB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC"}

package/dist/theme/tokens.js

@@ -0,0 +1,10 @@
+/**
+ * Theme token *types* — the shape of a design-system token.
+ *
+ * cms-core owns the machinery (turn a token list into a schema + scoped CSS); the
+ * consuming app owns the concrete token list, its default colors, and font choices
+ * (that's design opinion, not engine concern). See ./derive.ts and ./css.ts for
+ * the functions that operate on these, and the app's own `theme/tokens.ts` for a
+ * concrete set.
+ */
+export {};

package/dist/types/auth.d.ts

@@ -1,6 +1,5 @@
 import type { CMSUser } from './user.js';
 import type { OrganizationRole } from './organization.js';
-import type { Capability } from './capabilities.js';
 export interface SessionAuth {
     type: 'session';
     user: CMSUser;
@@ -19,11 +18,13 @@ export interface SessionAuth {
      */
     organizationRole: OrganizationRole | string;
     /**
-     * Capabilities resolved for this session by the auth hook (RolesService).
-     * Present for fully-authenticated sessions. When absent, callers fall
-     * back to built-in seed values — see `resolveCapabilities`.
+     * Capability ids granted to this session, resolved by the auth hook (RolesService).
+     * `string[]`, not `Capability[]`: a role can grant plugin-declared capabilities that
+     * aren't in the built-in `Capability` union. Present for fully-authenticated
+     * sessions; when absent, callers fall back to built-in seed values — see
+     * `resolveCapabilities`.
      */
-    capabilities?: Capability[];
+    capabilities?: string[];
     organizations?: Array<{
         id: string;
         name: string;
@@ -57,12 +58,11 @@ export interface ApiKeyAuth {
      */
     permissions: ('read' | 'write')[];
     /**
-     * Fine-grained capability allowlist for this API key. When present,
-     * overrides the coarse `permissions` mapping — the key can do exactly
-     * what's listed and nothing else. Storage format on the key metadata
-     * matches the Capability union.
+     * Fine-grained capability-id allowlist for this API key. When present, overrides
+     * the coarse `permissions` mapping — the key can do exactly what's listed and
+     * nothing else. `string[]` so keys can be scoped to plugin capabilities too.
      */
-    capabilities?: Capability[];
+    capabilities?: string[];
     organizationId: string;
     environment?: string;
     lastUsedAt?: Date;

package/dist/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/types/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;KACf,CAAC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;CACF;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,WAAW,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAYjE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAMpD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAE5C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/types/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC5C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;KACf,CAAC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC;KAChB,CAAC;CACF;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,WAAW,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAClC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAYjE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAMpD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAE5C"}