@aphexcms/cms-core 9.3.0 → 9.5.0

package/dist/components/layout/Sidebar.svelte

@@ -10,14 +10,24 @@
 	import type { SidebarData } from '../../types/sidebar';
 	import AppSidebar from './sidebar/AppSidebar.svelte';
 	import { usePermissions } from '../../permissions-context.svelte';
+	import { setAdminSlots } from '../../admin/slots.svelte';
+	import type { AdminArea } from '../../admin/types';
+	import type { CMSPlugin, AdminToolPart } from '../../plugins/types';
+
+	// Admin extension-slot registry, published to the whole admin subtree. The
+	// navbar renders `navbar-start` / `navbar-end` outlets; the document editor (and
+	// later, plugins) register controls into them so everything lives in one bar.
+	const slots = setAdminSlots();
 
 	type Props = {
 		data: SidebarData;
 		onSignOut?: () => void | Promise<void>;
 		children: any;
 		enableGraphiQL?: boolean;
-		activeTab?: { value: 'structure' | 'vision' | 'media' };
+		activeTab?: { value: AdminArea };
 		onTabChange?: (value: string) => void;
+		/** Plugin registry — used to render sidebar-placed admin tools as persistent nav. */
+		plugins?: CMSPlugin[];
 	};
 
 	let {
@@ -26,10 +36,11 @@
 		children,
 		enableGraphiQL = false,
 		activeTab,
-		onTabChange
+		onTabChange,
+		plugins = []
 	}: Props = $props();
 
-	function switchTab(value: 'structure' | 'vision' | 'media') {
+	function switchTab(value: AdminArea) {
 		if (onTabChange) {
 			onTabChange(value);
 		} else if (activeTab) {
@@ -37,6 +48,24 @@
 		}
 	}
 
+	// Sidebar-placed admin tools (`placement: 'sidebar'`). Rendered here at the
+	// persistent layout level — not via AdminApp's slot — so the Tools nav stays
+	// visible on every admin page (settings included), where AdminApp isn't mounted.
+	// Capability-filtered with the same rule the part resolver uses.
+	const perms = usePermissions();
+	const sidebarTools = $derived(
+		(plugins ?? [])
+			.flatMap((p) => p.parts ?? [])
+			.filter(
+				(part): part is AdminToolPart =>
+					part.implements === 'aphex/admin/tool' && part.placement === 'sidebar'
+			)
+			.filter(
+				(t) => !t.requiredCapabilities?.length || t.requiredCapabilities.every((c) => perms.can(c))
+			)
+			.sort((a, b) => (a.order ?? 0) - (b.order ?? 0))
+	);
+
 	// Only show tabs on the main /admin page
 	const showTabs = $derived(page.url.pathname === '/admin');
 
@@ -44,23 +73,25 @@
 	// document list — a user without `document.read` won't be on /admin at
 	// all). Media needs asset.read; Vision is dev-only so we leave it to
 	// `enableGraphiQL` alone.
-	const perms = usePermissions();
 	const canSeeMedia = $derived(perms.can('asset.read'));
 </script>
 
 <ModeWatcher />
 <Toaster closeButton />
 <SidebarProvider class="h-screen">
-	<AppSidebar {data} {onSignOut} />
+	<AppSidebar {data} {onSignOut} {sidebarTools} onSelectTool={(id) => switchTab(`plugin:${id}`)} />
 	<SidebarInset class="flex h-full min-w-0 flex-col">
 		<header
 			class="border-rule flex h-16 shrink-0 items-center gap-2 border-b transition-[width,height] ease-linear group-has-[[data-collapsible=icon]]/sidebar-wrapper:h-12"
 		>
-			<div class="flex w-full items-center px-4" class:justify-between={showTabs}>
-				<!-- Left: Trigger and Separator -->
-				<div class="flex items-center gap-2">
+			<div class="flex w-full items-center gap-2 px-4">
+				<!-- Left: Trigger, Separator, and navbar-start slot (e.g. editor breadcrumb) -->
+				<div class="flex min-w-0 items-center gap-2">
 					<SidebarTrigger class="-ml-1" />
-					<Separator orientation="vertical" class="mr-2 h-4" />
+					<Separator orientation="vertical" class="h-4" />
+					{#each slots.get('navbar-start') as entry (entry.id)}
+						{@render entry.snippet()}
+					{/each}
 				</div>
 
 				<!-- Center: Structure/Vision/Media Tabs (only on /admin page) -->
@@ -96,11 +127,18 @@
 								Media
 							</button>
 						{/if}
+						<!-- Plugin admin-tool tabs register here (see AdminApp). -->
+						{#each slots.get('admin-tabs') as entry (entry.id)}
+							{@render entry.snippet()}
+						{/each}
 					</div>
 				{/if}
 
-				<!-- Right: Theme Toggle -->
-				<div class:ml-auto={!showTabs}>
+				<!-- Right: navbar-end slot (e.g. editor actions) + Theme Toggle -->
+				<div class="flex items-center gap-2 {showTabs ? '' : 'ml-auto'}">
+					{#each slots.get('navbar-end') as entry (entry.id)}
+						{@render entry.snippet()}
+					{/each}
 					<Button onclick={toggleMode} variant="outline" size="icon" class="cursor-pointer">
 						<Sun
 							class="h-[1.2rem] w-[1.2rem] scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90"

package/dist/components/layout/Sidebar.svelte.d.ts

@@ -1,13 +1,17 @@
 import type { SidebarData } from '../../types/sidebar.js';
+import type { AdminArea } from '../../admin/types.js';
+import type { CMSPlugin } from '../../plugins/types.js';
 type Props = {
     data: SidebarData;
     onSignOut?: () => void | Promise<void>;
     children: any;
     enableGraphiQL?: boolean;
     activeTab?: {
-        value: 'structure' | 'vision' | 'media';
+        value: AdminArea;
     };
     onTabChange?: (value: string) => void;
+    /** Plugin registry — used to render sidebar-placed admin tools as persistent nav. */
+    plugins?: CMSPlugin[];
 };
 declare const Sidebar: import("svelte").Component<Props, {}, "">;
 type Sidebar = ReturnType<typeof Sidebar>;

package/dist/components/layout/Sidebar.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Sidebar.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/layout/Sidebar.svelte.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKtD,KAAK,KAAK,GAAG;IACZ,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,EAAE,GAAG,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAmGH,QAAA,MAAM,OAAO,2CAAwC,CAAC;AACtD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAC1C,eAAe,OAAO,CAAC"}
+{"version":3,"file":"Sidebar.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/layout/Sidebar.svelte.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAGnE,KAAK,KAAK,GAAG;IACZ,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,EAAE,GAAG,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACjC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,qFAAqF;IACrF,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;CACtB,CAAC;AAuIH,QAAA,MAAM,OAAO,2CAAwC,CAAC;AACtD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAC1C,eAAe,OAAO,CAAC"}

package/dist/components/layout/sidebar/AppSidebar.svelte

@@ -3,7 +3,12 @@
 		Sidebar,
 		SidebarContent,
 		SidebarFooter,
+		SidebarGroup,
+		SidebarGroupLabel,
 		SidebarHeader,
+		SidebarMenu,
+		SidebarMenuItem,
+		SidebarMenuButton,
 		SidebarRail
 	} from '@aphexcms/ui/shadcn/sidebar';
 	import OrganizationSwitcher from '../OrganizationSwitcher.svelte';
@@ -11,20 +16,51 @@
 	import NavUser from './NavUser.svelte';
 	import type { SidebarData } from '../../../types/sidebar';
 	import type { ComponentProps } from 'svelte';
+	import { page } from '$app/state';
+	import type { AdminToolPart } from '../../../plugins/types';
+
+	// A sidebar-placed plugin tool lives on /admin with `?view=plugin:<id>`. The
+	// active view only counts on /admin — on settings (and other admin pages) no
+	// tool is "current", so clicking one navigates back to /admin?view=plugin:<id>.
+	const activeView = $derived(
+		page.url.pathname === '/admin' ? (page.url.searchParams.get('view') ?? '') : ''
+	);
+	// Its own nav item lights up; the parent /admin ("Studio") item shouldn't also
+	// — the more-specific tool wins, like nested nav. Suppress it in that case.
+	const pluginToolActive = $derived(activeView.startsWith('plugin:'));
+	const isToolActive = (id: string) => activeView === `plugin:${id}`;
+
+	function isNavActive(path: string, item: { url: string; exact?: boolean }): boolean {
+		if (pluginToolActive && item.url === '/admin') return false;
+		if (item.exact) return path === item.url;
+		const matches = path === item.url || path.startsWith(item.url + '/');
+		if (!matches) return false;
+		// Longest-match wins when items nest (mirrors NavMain's default tiebreak).
+		return !navMainItems.some(
+			(other) =>
+				other !== item &&
+				other.url.length > item.url.length &&
+				(path === other.url || path.startsWith(other.url + '/'))
+		);
+	}
 
 	type Props = ComponentProps<typeof Sidebar> & {
 		data: SidebarData;
 		onSignOut?: () => void | Promise<void>;
+		/** Sidebar-placed plugin admin tools, already capability-filtered. */
+		sidebarTools?: AdminToolPart[];
+		/** Open a tool's `plugin:<id>` area (navigates to /admin if elsewhere). */
+		onSelectTool?: (id: string) => void;
 	};
 
-	let { data, onSignOut, ...restProps }: Props = $props();
+	let { data, onSignOut, sidebarTools = [], onSelectTool, ...restProps }: Props = $props();
 
 	// Convert navItems to the format expected by NavMain
 	const navMainItems = $derived(
 		data?.navItems?.map((item) => ({
 			title: item.label,
 			url: item.href,
-			icon: undefined, // We'll keep icons simple for now
+			icon: item.icon,
 			isActive: false
 		})) || [
 			{
@@ -51,7 +87,34 @@
 	</SidebarHeader>
 
 	<SidebarContent>
-		<NavMain items={navMainItems} />
+		<NavMain items={navMainItems} isActive={isNavActive} />
+
+		<!-- Plugin admin tools placed in the sidebar (placement: 'sidebar'). Rendered
+		     from the plugin list at this persistent layout level, so the Tools nav
+		     stays visible across every admin page (settings included). -->
+		{#if sidebarTools.length > 0}
+			<SidebarGroup>
+				<SidebarGroupLabel>Tools</SidebarGroupLabel>
+				<SidebarMenu>
+					{#each sidebarTools as tool (tool.id)}
+						<SidebarMenuItem>
+							<SidebarMenuButton
+								onclick={() => onSelectTool?.(tool.id)}
+								isActive={isToolActive(tool.id)}
+								tooltipContent={tool.title}
+								class="cursor-pointer"
+							>
+								{#if tool.icon}
+									{@const Icon = tool.icon}
+									<Icon class="h-4 w-4" />
+								{/if}
+								<span>{tool.title}</span>
+							</SidebarMenuButton>
+						</SidebarMenuItem>
+					{/each}
+				</SidebarMenu>
+			</SidebarGroup>
+		{/if}
 	</SidebarContent>
 
 	<SidebarFooter>

package/dist/components/layout/sidebar/AppSidebar.svelte.d.ts

@@ -1,9 +1,14 @@
 import { Sidebar } from '@aphexcms/ui/shadcn/sidebar';
 import type { SidebarData } from '../../../types/sidebar.js';
 import type { ComponentProps } from 'svelte';
+import type { AdminToolPart } from '../../../plugins/types.js';
 type Props = ComponentProps<typeof Sidebar> & {
     data: SidebarData;
     onSignOut?: () => void | Promise<void>;
+    /** Sidebar-placed plugin admin tools, already capability-filtered. */
+    sidebarTools?: AdminToolPart[];
+    /** Open a tool's `plugin:<id>` area (navigates to /admin if elsewhere). */
+    onSelectTool?: (id: string) => void;
 };
 declare const AppSidebar: import("svelte").Component<Props, {}, "">;
 type AppSidebar = ReturnType<typeof AppSidebar>;

package/dist/components/layout/sidebar/AppSidebar.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppSidebar.svelte.d.ts","sourceRoot":"","sources":["../../../../src/lib/components/layout/sidebar/AppSidebar.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,OAAO,EAKP,MAAM,6BAA6B,CAAC;AAItC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAG5C,KAAK,KAAK,GAAG,cAAc,CAAC,OAAO,OAAO,CAAC,GAAG;IAC7C,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC;AAsDH,QAAA,MAAM,UAAU,2CAAwC,CAAC;AACzD,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAChD,eAAe,UAAU,CAAC"}
+{"version":3,"file":"AppSidebar.svelte.d.ts","sourceRoot":"","sources":["../../../../src/lib/components/layout/sidebar/AppSidebar.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,OAAO,EAUP,MAAM,6BAA6B,CAAC;AAItC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG3D,KAAK,KAAK,GAAG,cAAc,CAAC,OAAO,OAAO,CAAC,GAAG;IAC7C,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sEAAsE;IACtE,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,CAAC;AAqGH,QAAA,MAAM,UAAU,2CAAwC,CAAC;AACzD,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAChD,eAAe,UAAU,CAAC"}

package/dist/components/layout/sidebar/NavMain.svelte

@@ -12,12 +12,13 @@
 		SidebarMenuSubItem,
 		SidebarMenuSubButton
 	} from '@aphexcms/ui/shadcn/sidebar';
-	import { ChevronRight, type Icon as IconType } from '@lucide/svelte';
+	import { ChevronRight, type IconProps } from '@lucide/svelte';
+	import type { Component } from 'svelte';
 
 	type NavItem = {
 		title: string;
 		url: string;
-		icon?: typeof IconType;
+		icon?: Component<IconProps>;
 		isActive?: boolean;
 		exact?: boolean;
 		items?: {

package/dist/components/layout/sidebar/NavMain.svelte.d.ts

@@ -1,8 +1,9 @@
-import { type Icon as IconType } from '@lucide/svelte';
+import { type IconProps } from '@lucide/svelte';
+import type { Component } from 'svelte';
 type NavItem = {
     title: string;
     url: string;
-    icon?: typeof IconType;
+    icon?: Component<IconProps>;
     isActive?: boolean;
     exact?: boolean;
     items?: {
@@ -15,7 +16,7 @@ type Props = {
     label?: string;
     isActive?: (path: string, item: NavItem) => boolean;
 };
-declare const NavMain: import("svelte").Component<Props, {}, "">;
+declare const NavMain: Component<Props, {}, "">;
 type NavMain = ReturnType<typeof NavMain>;
 export default NavMain;
 //# sourceMappingURL=NavMain.svelte.d.ts.map

package/dist/components/layout/sidebar/NavMain.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NavMain.svelte.d.ts","sourceRoot":"","sources":["../../../../src/lib/components/layout/sidebar/NavMain.svelte.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,KAAK,IAAI,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAGpE,KAAK,OAAO,GAAG;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACZ,EAAE,CAAC;CACJ,CAAC;AAEF,KAAK,KAAK,GAAG;IACZ,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CACpD,CAAC;AAmFH,QAAA,MAAM,OAAO,2CAAwC,CAAC;AACtD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAC1C,eAAe,OAAO,CAAC"}
+{"version":3,"file":"NavMain.svelte.d.ts","sourceRoot":"","sources":["../../../../src/lib/components/layout/sidebar/NavMain.svelte.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGvC,KAAK,OAAO,GAAG;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACZ,EAAE,CAAC;CACJ,CAAC;AAEF,KAAK,KAAK,GAAG;IACZ,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CACpD,CAAC;AAoFH,QAAA,MAAM,OAAO,0BAAwC,CAAC;AACtD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAC1C,eAAe,OAAO,CAAC"}

package/dist/components/layout/sidebar/NavUser.svelte

@@ -43,7 +43,11 @@
 						class="data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground"
 					>
 						{#if user.image}
-							<img src={user.image} alt={user.name || user.email} class="h-8 w-8 rounded-lg" />
+							<img
+								src={user.image}
+								alt={user.name || user.email}
+								class="h-8 w-8 rounded-lg object-cover"
+							/>
 						{:else}
 							<div
 								class="bg-sidebar-primary text-sidebar-primary-foreground flex h-8 w-8 items-center justify-center rounded-lg text-sm font-semibold"

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAa5D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAwB5D"}

package/dist/config.js

@@ -1,7 +1,18 @@
+import { createPartResolver } from './plugins/resolver.js';
 export function createCMSConfig(config) {
+    // Resolve plugin parts once (also runs duplicate-part-id validation) and fold
+    // schema contributions into `schemaTypes` so the engine, GraphQL, and typegen
+    // treat plugin schemas identically to app schemas. Non-schema parts are indexed
+    // by a resolver rebuilt at hook-init and exposed on locals.aphexCMS.partResolver.
+    const resolver = createPartResolver(config.plugins ?? []);
+    const pluginSchemas = resolver.schemaTypes();
+    // Merge plugin schemas, then let schema-transform parts decorate the full list
+    // (e.g. inject an SEO field group into chosen collections).
+    const mergedSchemas = resolver.applySchemaTransforms([...config.schemaTypes, ...pluginSchemas]);
     return {
         // Start with the user's config and apply defaults for missing properties
         ...config,
+        schemaTypes: mergedSchemas,
         storage: config.storage ?? null, // Default to null if not provided
         customization: {
             branding: {

package/dist/db/interfaces/asset.d.ts

@@ -4,6 +4,7 @@ export interface AssetFilters {
     assetType?: 'image' | 'file';
     mimeType?: string;
     search?: string;
+    includeSystem?: boolean;
     limit?: number;
     offset?: number;
 }

package/dist/db/interfaces/asset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/asset.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAE5B,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC9F,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGlE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG5D;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAElG;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"asset.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/asset.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAE5B,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC9F,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGlE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG5D;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAElG;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E"}

package/dist/db/interfaces/index.d.ts

@@ -6,6 +6,7 @@ import type { OrganizationAdapter } from './organization.js';
 import type { InstanceAdapter } from './instance.js';
 import type { RolesAdapter } from './role.js';
 import type { ReferenceAdapter } from './reference.js';
+import type { PluginSettingsAdapter } from './plugin-settings.js';
 export type { DocumentAdapter, DocumentFilters, CreateDocumentData, UpdateDocumentData } from './document.js';
 export type { AssetAdapter, CreateAssetData, UpdateAssetData } from './asset.js';
 export type { UserProfileAdapter, NewUserProfileData } from './user.js';
@@ -14,11 +15,12 @@ export type { OrganizationAdapter } from './organization.js';
 export type { InstanceAdapter, InstanceSettings } from './instance.js';
 export type { RolesAdapter } from './role.js';
 export type { ReferenceAdapter, BackReferenceRow, BackReferenceLookup } from './reference.js';
+export type { PluginSettingsAdapter, PluginSettingsRow } from './plugin-settings.js';
 /**
  * Combined database adapter interface
  * Extends all entity-specific adapters for full database functionality
  */
-export interface DatabaseAdapter extends DocumentAdapter, AssetAdapter, UserProfileAdapter, SchemaAdapter, OrganizationAdapter, InstanceAdapter, RolesAdapter, ReferenceAdapter {
+export interface DatabaseAdapter extends DocumentAdapter, AssetAdapter, UserProfileAdapter, SchemaAdapter, OrganizationAdapter, InstanceAdapter, RolesAdapter, ReferenceAdapter, PluginSettingsAdapter {
     connect?(): Promise<void>;
     disconnect?(): Promise<void>;
     isHealthy(): Promise<boolean>;

package/dist/db/interfaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE3F;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB;IAEjB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;OAIG;IACH,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG/D,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElF;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB;IAEtB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;OAIG;IACH,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}

package/dist/db/interfaces/plugin-settings.d.ts

@@ -0,0 +1,23 @@
+/** A stored settings row: the raw persisted values for one (org, plugin) pair. */
+export interface PluginSettingsRow {
+    organizationId: string;
+    pluginId: string;
+    /** Opaque JSON blob of the plugin's settings values (secrets stored encrypted). */
+    values: Record<string, unknown>;
+    updatedAt: Date;
+}
+export interface PluginSettingsAdapter {
+    /**
+     * Read the stored values for a plugin in an org. Returns `null` when the plugin
+     * has never been configured for that org (no row yet) — callers treat that as
+     * "use declared defaults".
+     */
+    getPluginSettings(organizationId: string, pluginId: string): Promise<Record<string, unknown> | null>;
+    /**
+     * Upsert the full values object for a plugin in an org (one row per pair). The
+     * passed object replaces the stored one — callers merge partial edits before
+     * calling. Secret values must already be encrypted by core.
+     */
+    setPluginSettings(organizationId: string, pluginId: string, values: Record<string, unknown>): Promise<void>;
+}
+//# sourceMappingURL=plugin-settings.d.ts.map

package/dist/db/interfaces/plugin-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/plugin-settings.ts"],"names":[],"mappings":"AAaA,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,iBAAiB,CAChB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAE3C;;;;OAIG;IACH,iBAAiB,CAChB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB"}

package/dist/db/interfaces/plugin-settings.js

@@ -0,0 +1,13 @@
+// Plugin-settings adapter interface — the generic per-(org, plugin) config store.
+//
+// This is the storage primitive behind the plugin settings & secrets feature
+// (references/plugin-settings-and-secrets-scope.md). It is deliberately generic:
+// ONE table serves every plugin, keyed by (organizationId, pluginId), one row per
+// pair (a config singleton). Values are an opaque JSON object — the store neither
+// knows nor cares which values are content vs config vs encrypted secrets. Core
+// handles encryption/decryption of secret fields above this layer; the adapter only
+// persists the resulting strings.
+//
+// NOT part of the content model: no drafts, versions, references, or RLS-as-content.
+// Org isolation is by the `organizationId` key (and RLS on the pglite path).
+export {};

package/dist/db/interfaces/role.d.ts

@@ -1,4 +1,4 @@
-import type { Role, NewRole, Capability } from '../../types/capabilities.js';
+import type { Role, NewRole } from '../../types/capabilities.js';
 export interface RolesAdapter {
     /** List all roles for an organization (built-in + custom). */
     listRoles(organizationId: string): Promise<Role[]>;
@@ -12,14 +12,23 @@ export interface RolesAdapter {
      */
     updateRole(organizationId: string, name: string, data: {
         description?: string | null;
-        capabilities?: Capability[];
+        capabilities?: string[];
     }): Promise<Role | null>;
     /** Delete a role by name. Returns `true` when a row was removed. */
     deleteRole(organizationId: string, name: string): Promise<boolean>;
     /**
-     * Ensure the four built-in roles exist for an organization.
-     * Idempotent: inserts missing rows and leaves existing ones untouched.
+     * Ensure the four built-in roles exist for an organization, and that `owner`
+     * still holds every capability.
+     *
+     * Idempotent: inserts missing rows, leaves existing admin/editor/viewer rows
+     * untouched (they are editable), and reconciles `owner` to the full set so a
+     * capability added by a core upgrade reaches orgs seeded before it existed.
+     *
+     * `ownerCapabilities` is what "every capability" means for this install. Callers
+     * that know the plugin registry pass the merged catalog, so plugin-declared
+     * capabilities reach owners; omitting it falls back to core's built-ins, which
+     * would leave an owner unable to hold a capability its own plugins declared.
      */
-    seedBuiltinRoles(organizationId: string): Promise<void>;
+    seedBuiltinRoles(organizationId: string, ownerCapabilities?: string[]): Promise<void>;
 }
 //# sourceMappingURL=role.d.ts.map

package/dist/db/interfaces/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/role.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnD,gEAAgE;IAChE,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;OAGG;IACH,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,GAChE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAExB,oEAAoE;IACpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnE;;;OAGG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/role.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnD,gEAAgE;IAChE,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;OAGG;IACH,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAExB,oEAAoE;IACpE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnE;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF"}

package/dist/engine.d.ts

@@ -7,6 +7,34 @@ export declare class CMSEngine {
     constructor(config: CMSConfig, dbAdapter: DatabaseAdapter);
     updateConfig(newConfig: CMSConfig): void;
     initialize(): Promise<void>;
+    /**
+     * Every capability this install recognises: core's built-ins plus whatever the
+     * registered plugins declare.
+     *
+     * `ALL_CAPABILITIES` is core-only and static, so on its own it would leave an
+     * owner unable to hold a capability its own plugins declared — owner would end up
+     * with strictly fewer permissions than admin, who can be granted plugin
+     * capabilities through the roles UI.
+     */
+    ownerCapabilities(): string[];
+    /**
+     * Re-seed built-in roles for every existing organization.
+     *
+     * Org creation seeds roles once, which means an org created before a
+     * capability existed never learns about it — that is why an owner could be
+     * missing `plugin.settings.manage` after upgrading core. Re-seeding on boot
+     * closes that gap: it inserts any missing built-in row and reconciles `owner`
+     * back to the full capability set, which now includes plugin-declared
+     * capabilities. Editable roles (admin/editor/viewer) are left as the operator
+     * configured them.
+     *
+     * Because this runs on every boot, installing or removing a plugin is enough to
+     * bring owners in line with the capabilities that plugin declares.
+     *
+     * Idempotent and cheap — orgs are few and this is four rows each — so it runs
+     * unconditionally rather than behind a schema-version check.
+     */
+    private reconcileBuiltinRoles;
     getSchemaType(name: string): Promise<SchemaType | null>;
     listSchemas(): Promise<SchemaType[]>;
     getSchemaTypeByName(name: string): SchemaType | null;

package/dist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CASlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/lib/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D,qBAAa,SAAS;IACrB,OAAO,CAAC,EAAE,CAAkB;IACrB,MAAM,EAAE,SAAS,CAAC;gBAEb,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe;IAMzD,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjC;;;;;;;;OAQG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAM7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IAe7B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvD,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI9C,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI1F,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAG9F;AAKD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CASlF;AAED,wBAAgB,MAAM,IAAI,SAAS,CAKlC"}

package/dist/engine.js

@@ -1,4 +1,6 @@
+import { createPartResolver } from './plugins/resolver.js';
 import { validateSchemaReferences } from './schema-utils/validator.js';
+import { ALL_CAPABILITIES } from './types/capabilities.js';
 import { cmsLogger } from './utils/logger.js';
 export class CMSEngine {
     db;
@@ -35,8 +37,50 @@ export class CMSEngine {
         for (const schemaType of this.config.schemaTypes) {
             await this.db.registerSchemaType(schemaType);
         }
+        await this.reconcileBuiltinRoles();
         cmsLogger.info('[CMS]', 'Initialized successfully');
     }
+    /**
+     * Every capability this install recognises: core's built-ins plus whatever the
+     * registered plugins declare.
+     *
+     * `ALL_CAPABILITIES` is core-only and static, so on its own it would leave an
+     * owner unable to hold a capability its own plugins declared — owner would end up
+     * with strictly fewer permissions than admin, who can be granted plugin
+     * capabilities through the roles UI.
+     */
+    ownerCapabilities() {
+        const resolver = createPartResolver(this.config.plugins ?? []);
+        const declared = resolver.capabilityCatalog().map((def) => def.id);
+        return Array.from(new Set([...ALL_CAPABILITIES, ...declared]));
+    }
+    /**
+     * Re-seed built-in roles for every existing organization.
+     *
+     * Org creation seeds roles once, which means an org created before a
+     * capability existed never learns about it — that is why an owner could be
+     * missing `plugin.settings.manage` after upgrading core. Re-seeding on boot
+     * closes that gap: it inserts any missing built-in row and reconciles `owner`
+     * back to the full capability set, which now includes plugin-declared
+     * capabilities. Editable roles (admin/editor/viewer) are left as the operator
+     * configured them.
+     *
+     * Because this runs on every boot, installing or removing a plugin is enough to
+     * bring owners in line with the capabilities that plugin declares.
+     *
+     * Idempotent and cheap — orgs are few and this is four rows each — so it runs
+     * unconditionally rather than behind a schema-version check.
+     */
+    async reconcileBuiltinRoles() {
+        const organizations = await this.db.findAllOrganizations();
+        const ownerCaps = this.ownerCapabilities();
+        for (const org of organizations) {
+            await this.db.seedBuiltinRoles(org.id, ownerCaps);
+        }
+        if (organizations.length > 0) {
+            cmsLogger.info('[CMS]', `Reconciled built-in roles for ${organizations.length} org(s) (owner: ${ownerCaps.length} capabilities)`);
+        }
+    }
     // Schema Type utility methods
     async getSchemaType(name) {
         return this.db.getSchemaType(name);

package/dist/field-validation/utils.d.ts

@@ -15,6 +15,21 @@ export interface DocumentValidationResult {
  * Check if a field is required based on its validation rules
  */
 export declare function isFieldRequired(field: Field): boolean;
+/**
+ * Structural (shape) validation for a field's stored value — the depth=0 write
+ * shape. This catches a caller (notably an AI agent over MCP) sending the wrong
+ * JSON shape that presence/required checks would miss: a slug as `{ current }`
+ * (Sanity's convention — AphexCMS stores slugs as plain strings), or a
+ * reference/image missing its `_ref`. Runs before the user's Rule validation
+ * and only when a value is meaningfully present (absent/empty is a required-ness
+ * concern, handled separately), so optional and half-filled fields are left
+ * alone. Returns an error message, or null when the shape is acceptable.
+ *
+ * Intentionally conservative: only unambiguous mismatches error, and empty
+ * placeholders (`''`, an image with no `asset`) are treated as absent so the
+ * admin's in-progress edit states don't trip it.
+ */
+export declare function validateValueShape(field: Field, value: unknown): string | null;
 /**
  * Validate a field value against its validation rules
  */

package/dist/field-validation/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/field-validation/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAKxD,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAUrD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAClC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,GAAG,EACV,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC1B,CAAC,CAiID;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAO/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC,wBAAwB,CAAC,CAqDnC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/field-validation/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAKxD,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAUrD;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAmC9E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAClC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,GAAG,EACV,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC1B,CAAC,CA6ID;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAO/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC,wBAAwB,CAAC,CAqDnC"}