@aphexcms/cms-core 9.4.0 → 9.5.0

package/dist/hooks.js

@@ -1,11 +1,35 @@
 import { handleAuthHook } from './auth/auth-hooks.js';
+import { getPreviewPerspective } from './preview/perspective.js';
+import { resolveCapabilities } from './types/capabilities.js';
 import { cmsLogger, setLogLevel, setLogger } from './utils/logger.js';
 import { createStorageAdapter as createStorageAdapterProvider } from './storage/providers/storage.js';
 import { AssetService as AssetServiceClass } from './services/asset-service.js';
 import { RolesService } from './services/roles-service.js';
+import { PluginSettingsService } from './services/plugin-settings-service.js';
 import { createCMS } from './engine.js';
 import { createLocalAPI } from './local-api/index.js';
+import { createPartResolver } from './plugins/resolver.js';
 import { createAphexApi, mountAphexBuiltins, toHonoHandler } from './server/api/index.js';
+/**
+ * Wrap a plugin route handler so it enforces `requiredCapabilities` before running.
+ * 401 when there's no authenticated principal at all; 403 when authenticated but
+ * missing a required capability. Uses the same server-resolved capability set every
+ * core resource checks — the client can't forge it.
+ */
+function gateHandler(handler, required) {
+    return (c) => {
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Authentication required' }, 401);
+        }
+        const caps = resolveCapabilities(auth);
+        const missing = required.filter((cap) => !caps.has(cap));
+        if (missing.length > 0) {
+            return c.json({ success: false, error: 'Insufficient permissions', missingCapabilities: missing }, 403);
+        }
+        return handler(c);
+    };
+}
 let cmsInstances = null;
 let schemaError = null;
 let initPromise = null;
@@ -89,8 +113,28 @@ export function createCMSHook(config) {
             // Build the Hono API app shell. User middleware/overrides register
             // FIRST (so they sit ahead of built-ins in the chain), then we mount
             // the built-in routes, then GraphQL.
+            // Index plugin parts (validates duplicate part ids). Mount plugin server
+            // routes after the user's `api` hook and before built-ins, so a plugin's
+            // `POST /bookings` becomes `POST /api/bookings`, overridable by the app.
+            const partResolver = createPartResolver(currentConfig.plugins ?? []);
+            // Per-(org, plugin) config store — merges declared defaults with stored
+            // values and writes edits back, scoped to the org. The encryption key gates
+            // `secret` fields (absent → secrets disabled, fail safe).
+            const pluginSettingsService = new PluginSettingsService(databaseAdapter, partResolver, currentConfig.security?.secretEncryptionKey ?? null);
             const apiApp = createAphexApi();
             currentConfig.api?.(apiApp);
+            for (const route of partResolver.serverRoutes()) {
+                // Gate every plugin route by its declared `requiredCapabilities` before the
+                // handler runs, so a declared capability is ENFORCED rather than merely
+                // documented. `'public'` is the single ungated path and the author had to
+                // write it: an empty list still requires authentication, and omitting the
+                // field entirely doesn't type-check. Ungated is therefore always a choice,
+                // never an oversight.
+                const handler = route.requiredCapabilities === 'public'
+                    ? route.handler
+                    : gateHandler(route.handler, route.requiredCapabilities);
+                apiApp.on(route.method, route.path, handler);
+            }
             mountAphexBuiltins(apiApp);
             // Initialize schemas with validation
             try {
@@ -115,9 +159,11 @@ export function createCMSHook(config) {
                         cmsEngine,
                         localAPI,
                         rolesService,
+                        pluginSettingsService,
                         logger: cmsLogger,
                         auth: currentConfig.auth?.provider,
-                        apiApp
+                        apiApp,
+                        partResolver
                     }, currentConfig.schemaTypes, graphqlConfig);
                     // Register GraphQL directly on the Hono app. The Yoga handler
                     // internally distinguishes GET (GraphiQL UI) from POST (queries),
@@ -147,10 +193,12 @@ export function createCMSHook(config) {
                 cmsEngine: cmsEngine,
                 localAPI: localAPI,
                 rolesService,
+                pluginSettingsService,
                 logger: cmsLogger,
                 auth: currentConfig.auth?.provider,
                 graphqlSettings,
-                apiApp
+                apiApp,
+                partResolver
             };
             resolveInit();
         }
@@ -166,6 +214,15 @@ export function createCMSHook(config) {
             if (authResponse)
                 return authResponse;
         }
+        // Resolve the read perspective once per request so site loads inherit it
+        // (published normally / draft in an authenticated `?aphex-preview` session)
+        // via `locals.previewPerspective` — no per-load wiring. Apps can override the
+        // policy with `config.preview.resolvePerspective`.
+        event.locals.previewPerspective =
+            currentConfig.preview?.resolvePerspective?.({
+                auth: event.locals.auth,
+                url: event.url
+            }) ?? getPreviewPerspective(event.locals.auth, event.url);
         return resolve(event);
     };
 }

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export * from './field-validation/rule.js';
 export * from './field-validation/utils.js';
 export { createContentHash, hasUnpublishedChanges } from './utils/content-hash.js';
 export * from './schema-utils/index.js';
+export * from './theme/index.js';
+export * from './plugins/index.js';
 export * from './utils/index.js';
 export * from './api/index.js';
 export type { ApiResponse } from './api/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAkBA,cAAc,eAAe,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjG,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGhF,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAkBA,cAAc,eAAe,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjG,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGhF,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAI9B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -23,6 +23,11 @@ export * from './field-validation/utils.js';
 export { createContentHash, hasUnpublishedChanges } from './utils/content-hash.js';
 // Schema utilities
 export * from './schema-utils/index.js';
+// Theme design-system tokens — plain TS (Svelte-free), safe for the universal barrel.
+export * from './theme/index.js';
+// Plugin API — definePlugin(), part types, part resolver. Runtime is plain JS
+// (svelte/hono imports are type-only), so it's safe on both server and client.
+export * from './plugins/index.js';
 // General utility functions (logger, image URL builder, etc)
 export * from './utils/index.js';
 // Unified API client

package/dist/lib/admin/block-previews.svelte.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Rich-text block preview registry (client-side context).
+ *
+ * By default a custom Portable Text block renders in the editor as a generic card
+ * (title/subtitle from its `preview` config). That's fine for data-ish blocks, but for
+ * visual ones — an embed, a gallery, a button — authors expect to see the real thing
+ * inline while writing (the Ghost/Sanity "what you see is what you get" editor).
+ *
+ * An app registers a preview per block `_type`; RichtextField resolves it and the
+ * ProseMirror node view mounts it INSTEAD of the generic card. The preview still gets
+ * `onEdit`/`onDelete` so the block stays editable and removable.
+ *
+ * Deliberately separate from the field-component registry: that one supplies *inputs*
+ * (`field`/`value`/`onUpdate`); this one supplies *renderers* (`data`/`onEdit`). Same
+ * idea, different contract.
+ */
+import { type Component } from 'svelte';
+import type { PreviewSource } from '../utils/preview.js';
+/**
+ * The stable props a block preview component receives.
+ *
+ * Also the contract for core's own built-in views (the generic card and the image
+ * view), so all three are mountable by the node view through one type.
+ */
+export interface BlockPreviewProps {
+    /** The block's `_type`. */
+    type: string;
+    /** The block's `_key` — its stable identity within the field's array. */
+    nodeKey: string;
+    /** The block's stored data (its fields). */
+    data: Record<string, unknown>;
+    /** The block type's schema, for reading its `preview` config if useful. */
+    schema?: PreviewSource;
+    /** True while the block is selected in the editor. */
+    selected?: boolean;
+    /** Open the block's edit modal — wire this to a click/edit affordance. */
+    onEdit: () => void;
+    /** Remove the block. */
+    onDelete: () => void;
+}
+export type BlockPreviewLookup = (type: string) => Component<BlockPreviewProps> | undefined;
+/** Publish the block-preview lookup to descendants (call in the admin shell). */
+export declare function setBlockPreviews(lookup: BlockPreviewLookup): void;
+/** Resolve the lookup. Returns a no-op lookup outside the admin shell. */
+export declare function useBlockPreviews(): BlockPreviewLookup;
+//# sourceMappingURL=block-previews.svelte.d.ts.map

package/dist/lib/admin/block-previews.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"block-previews.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/block-previews.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IACjC,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;AAI5F,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAEjE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,kBAAkB,CAErD"}

package/dist/lib/admin/block-previews.svelte.js

@@ -0,0 +1,27 @@
+/**
+ * Rich-text block preview registry (client-side context).
+ *
+ * By default a custom Portable Text block renders in the editor as a generic card
+ * (title/subtitle from its `preview` config). That's fine for data-ish blocks, but for
+ * visual ones — an embed, a gallery, a button — authors expect to see the real thing
+ * inline while writing (the Ghost/Sanity "what you see is what you get" editor).
+ *
+ * An app registers a preview per block `_type`; RichtextField resolves it and the
+ * ProseMirror node view mounts it INSTEAD of the generic card. The preview still gets
+ * `onEdit`/`onDelete` so the block stays editable and removable.
+ *
+ * Deliberately separate from the field-component registry: that one supplies *inputs*
+ * (`field`/`value`/`onUpdate`); this one supplies *renderers* (`data`/`onEdit`). Same
+ * idea, different contract.
+ */
+import { getContext, setContext } from 'svelte';
+const BLOCK_PREVIEWS_KEY = Symbol.for('aphex.admin.block-previews');
+/** Publish the block-preview lookup to descendants (call in the admin shell). */
+export function setBlockPreviews(lookup) {
+    setContext(BLOCK_PREVIEWS_KEY, lookup);
+}
+/** Resolve the lookup. Returns a no-op lookup outside the admin shell. */
+export function useBlockPreviews() {
+    return getContext(BLOCK_PREVIEWS_KEY) ?? (() => undefined);
+}
+//# sourceMappingURL=block-previews.svelte.js.map

package/dist/lib/admin/block-previews.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"block-previews.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/block-previews.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AA4BhE,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAEpE,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IAC1D,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC/B,OAAO,UAAU,CAAiC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC"}

package/dist/lib/admin/field-components.svelte.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Field-input widget registry (client-side context).
+ *
+ * Plugins contribute custom input widgets via `aphex/field/component` parts, keyed
+ * by an `input` string. A field opts into one with `{ …, input: 'color' }`.
+ * The admin shell publishes a lookup here; SchemaField (however deeply nested)
+ * resolves the widget and renders it in place of the built-in for that field type.
+ */
+import { type Component } from 'svelte';
+import type { FieldComponentProps } from '../plugins/types.js';
+export type FieldComponentLookup = (input: string) => Component<FieldComponentProps> | undefined;
+/** Publish the widget lookup to descendants (call in the admin shell). */
+export declare function setFieldComponents(lookup: FieldComponentLookup): void;
+/** Resolve the widget lookup. Returns a no-op lookup outside the admin shell. */
+export declare function useFieldComponents(): FieldComponentLookup;
+//# sourceMappingURL=field-components.svelte.d.ts.map

package/dist/lib/admin/field-components.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-components.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/field-components.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;AAIjG,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAErE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,IAAI,oBAAoB,CAEzD"}

package/dist/lib/admin/field-components.svelte.js

@@ -0,0 +1,19 @@
+/**
+ * Field-input widget registry (client-side context).
+ *
+ * Plugins contribute custom input widgets via `aphex/field/component` parts, keyed
+ * by an `input` string. A field opts into one with `{ …, input: 'color' }`.
+ * The admin shell publishes a lookup here; SchemaField (however deeply nested)
+ * resolves the widget and renders it in place of the built-in for that field type.
+ */
+import { getContext, setContext } from 'svelte';
+const FIELD_COMPONENTS_KEY = Symbol.for('aphex.admin.field-components');
+/** Publish the widget lookup to descendants (call in the admin shell). */
+export function setFieldComponents(lookup) {
+    setContext(FIELD_COMPONENTS_KEY, lookup);
+}
+/** Resolve the widget lookup. Returns a no-op lookup outside the admin shell. */
+export function useFieldComponents() {
+    return getContext(FIELD_COMPONENTS_KEY) ?? (() => undefined);
+}
+//# sourceMappingURL=field-components.svelte.js.map

package/dist/lib/admin/field-components.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-components.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/field-components.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAKhE,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC9D,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB;IACjC,OAAO,UAAU,CAAmC,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAChG,CAAC"}

package/dist/lib/admin/nav.svelte.d.ts

@@ -0,0 +1,34 @@
+import type { AdminArea } from './types.js';
+/** The known admin URL params. Central list so intents never typo a key. */
+export type AdminParam = 'view' | 'docType' | 'docId' | 'action' | 'stack' | 'history' | 'focus' | 'orgId' | 'fromDocId' | 'fromDocType';
+/** A set of param changes: a value sets the key, `null` clears it. */
+export type ParamPatch = Partial<Record<AdminParam, string | null>>;
+export interface AdminNav {
+    /** Apply a param patch and navigate. `replace` defaults to true. */
+    patch(changes: ParamPatch, opts?: {
+        replace?: boolean;
+    }): Promise<void>;
+    /** Switch the top-level area/tab. `structure` clears `?view`; others set it. */
+    openArea(area: AdminArea): Promise<void>;
+    /** Show a document type's list (structure area). */
+    openType(docType: string): Promise<void>;
+    /**
+     * Open a document in the editor (structure area). `docType` is optional — when
+     * omitted the existing `?docType` is preserved (the URL effect resolves it).
+     */
+    openDocument(docId: string, docType?: string, opts?: {
+        replace?: boolean;
+    }): Promise<void>;
+    /** Start creating a new document of a type. */
+    createDocument(docType: string): Promise<void>;
+    /** Close the current document, back to its type's list. */
+    closeToType(docType: string): Promise<void>;
+    /** Back to the dashboard (no type, no doc). */
+    goHome(): Promise<void>;
+}
+/** Create an admin nav and publish it to descendants (call once in the shell). */
+export declare function setAdminNav(basePath?: string): AdminNav;
+/** Read the admin nav. `undefined` outside the admin shell (safe to guard). */
+export declare function useAdminNav(): AdminNav | undefined;
+export declare function createAdminNav(basePath?: string): AdminNav;
+//# sourceMappingURL=nav.svelte.d.ts.map

package/dist/lib/admin/nav.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/nav.svelte.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GACnB,MAAM,GACN,SAAS,GACT,OAAO,GACP,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,aAAa,CAAC;AAEjB,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,QAAQ;IACxB,oEAAoE;IACpE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,+CAA+C;IAC/C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,+CAA+C;IAC/C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,QAAQ,SAAW,GAAG,QAAQ,CAIzD;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,IAAI,QAAQ,GAAG,SAAS,CAElD;AAED,wBAAgB,cAAc,CAAC,QAAQ,SAAW,GAAG,QAAQ,CAgE5D"}

package/dist/lib/admin/nav.svelte.js

@@ -0,0 +1,79 @@
+/**
+ * Admin URL navigation — the single place that knows the admin's query-param
+ * vocabulary and how each navigation intent maps onto it.
+ *
+ * The admin encodes its whole view state in the URL (`?view`, `?docType`, `?docId`,
+ * `?action`, `?stack`, …) and a URL-watching effect derives component state from it.
+ * That's good (shareable, back-button-friendly) but the writes were scattered as
+ * ad-hoc `SvelteURLSearchParams` + `goto` blocks, each hand-clearing the params it
+ * happened to remember — which is how "opening a doc left a stale ?view" slipped in.
+ *
+ * This module replaces those with named intents. Each intent declares the FULL set
+ * of params it touches (setting some, clearing others), so no caller has to
+ * remember the interactions. `patch()` remains for the rare bespoke case.
+ */
+import { getContext, setContext } from 'svelte';
+import { goto } from '$app/navigation';
+import { page } from '$app/state';
+import { SvelteURLSearchParams } from 'svelte/reactivity';
+const ADMIN_NAV_KEY = Symbol.for('aphex.admin.nav');
+/** Create an admin nav and publish it to descendants (call once in the shell). */
+export function setAdminNav(basePath = '/admin') {
+    const nav = createAdminNav(basePath);
+    setContext(ADMIN_NAV_KEY, nav);
+    return nav;
+}
+/** Read the admin nav. `undefined` outside the admin shell (safe to guard). */
+export function useAdminNav() {
+    return getContext(ADMIN_NAV_KEY);
+}
+export function createAdminNav(basePath = '/admin') {
+    async function patch(changes, { replace = true } = {}) {
+        const params = new SvelteURLSearchParams(page.url.searchParams);
+        for (const [key, value] of Object.entries(changes)) {
+            if (value == null)
+                params.delete(key);
+            else
+                params.set(key, value);
+        }
+        const query = params.toString();
+        await goto(`${basePath}${query ? `?${query}` : ''}`, {
+            replaceState: replace,
+            keepFocus: true
+        });
+    }
+    return {
+        patch,
+        openArea: (area) => 
+        // A plugin/other area is addressable via ?view; structure is the default (no ?view).
+        // Leaving an area always drops any open document.
+        patch({
+            view: area === 'structure' ? null : area,
+            docId: null,
+            docType: null,
+            stack: null,
+            action: null
+        }),
+        openType: (docType) => patch({ docType, docId: null, action: null, stack: null, history: null, view: null }, { replace: false }),
+        openDocument: (docId, docType, opts) => patch({
+            docId,
+            ...(docType ? { docType } : {}),
+            action: null,
+            fromDocId: null,
+            fromDocType: null,
+            view: null
+        }, { replace: opts?.replace ?? false }),
+        createDocument: (docType) => patch({ docType, action: 'create', docId: null, stack: null, view: null }, { replace: false }),
+        closeToType: (docType) => patch({ docType, docId: null, action: null, stack: null, focus: null, history: null, view: null }, { replace: false }),
+        goHome: () => patch({
+            view: null,
+            docType: null,
+            docId: null,
+            action: null,
+            stack: null,
+            focus: null,
+            history: null
+        })
+    };
+}
+//# sourceMappingURL=nav.svelte.js.map

package/dist/lib/admin/nav.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/nav.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAwC1D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEpD,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,QAAQ,GAAG,QAAQ;IAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW;IAC1B,OAAO,UAAU,CAAuB,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAG,QAAQ;IACjD,KAAK,UAAU,KAAK,CAAC,OAAmB,EAAE,EAAE,OAAO,GAAG,IAAI,KAA4B,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACpD,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,KAAK;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAClB,qFAAqF;QACrF,kDAAkD;QAClD,KAAK,CAAC;YACL,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACxC,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;SACZ,CAAC;QACH,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,KAAK,CACJ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC9E,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACtC,KAAK,CACJ;YACC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,IAAI,EAAE,IAAI;SACV,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CACnC;QACF,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,KAAK,CACJ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnE,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CACxB,KAAK,CACJ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC3F,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB;QACF,MAAM,EAAE,GAAG,EAAE,CACZ,KAAK,CAAC;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,IAAI;SACb,CAAC;KACH,CAAC;AACH,CAAC"}

package/dist/lib/admin/slots.svelte.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { type Snippet } from 'svelte';
+/** Well-known slot names. Plain strings are allowed too (e.g. plugin-defined). */
+export type AdminSlotName = 'navbar-start' | 'navbar-end' | 'document-actions' | 'admin-tabs' | (string & {});
+export interface AdminSlotEntry {
+    /** Stable id — re-registering with the same id replaces the prior entry. */
+    id: string;
+    snippet: Snippet;
+    /** Ascending sort within the slot. Defaults to 0. */
+    order?: number;
+}
+export declare class AdminSlots {
+    #private;
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name: AdminSlotName, entry: AdminSlotEntry): () => void;
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name: AdminSlotName): AdminSlotEntry[];
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name: AdminSlotName): boolean;
+}
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export declare function setAdminSlots(): AdminSlots;
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export declare function useAdminSlots(): AdminSlots | undefined;
+//# sourceMappingURL=slots.svelte.d.ts.map

package/dist/lib/admin/slots.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/slots.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAmC,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGvE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,YAAY,GACZ,kBAAkB,GAClB,YAAY,GACZ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjB,MAAM,WAAW,cAAc;IAC9B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,IAAI;IAgBhE,wEAAwE;IACxE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,EAAE;IAI1C,qEAAqE;IACrE,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO;CAGjC;AAID,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,CAI1C;AAED,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,UAAU,GAAG,SAAS,CAEtD"}

package/dist/lib/admin/slots.svelte.js

@@ -0,0 +1,68 @@
+/**
+ * Admin slot registry — the extension-point primitive for the admin shell.
+ *
+ * Named regions ("slots") in the admin chrome that any component can render UI
+ * into at runtime, without the shell knowing who the contributor is and without
+ * anyone patching AdminApp/Sidebar directly. This is the client-side half of the
+ * plugin system's "extension slots" (see references/PLUGIN_SYSTEM_PLAN.md §4):
+ * registration happens in the browser via context + snippets, never through
+ * SvelteKit `load` (load data must stay serializable — components can't cross it).
+ *
+ * Today's first consumer is the document editor, which registers its toolbar into
+ * the `navbar-start` / `navbar-end` slots so its controls live in the single top
+ * bar. Tomorrow, plugin document-actions and admin tools register the same way.
+ *
+ * Usage:
+ *   // shell (once, high in the tree)
+ *   const slots = setAdminSlots();
+ *   // outlet
+ *   {#each slots.get('navbar-end') as entry (entry.id)}{@render entry.snippet()}{/each}
+ *   // contributor (auto-cleans up)
+ *   const slots = useAdminSlots();
+ *   $effect(() => slots?.register('navbar-end', { id: 'editor', snippet: bar }));
+ */
+import { getContext, setContext, untrack } from 'svelte';
+import { SvelteMap } from 'svelte/reactivity';
+export class AdminSlots {
+    // Reactive so outlets re-render as entries come and go.
+    #slots = new SvelteMap();
+    /**
+     * Register a snippet into a slot. Returns an unregister function — call it on
+     * cleanup (returning it from an `$effect` does this automatically).
+     */
+    register(name, entry) {
+        const current = untrack(() => this.#slots.get(name) ?? []);
+        const next = [...current.filter((e) => e.id !== entry.id), entry].sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+        this.#slots.set(name, next);
+        return () => {
+            const list = untrack(() => this.#slots.get(name));
+            if (!list)
+                return;
+            const filtered = list.filter((e) => e.id !== entry.id);
+            if (filtered.length > 0)
+                this.#slots.set(name, filtered);
+            else
+                this.#slots.delete(name);
+        };
+    }
+    /** Entries registered in a slot, in sort order. Empty array if none. */
+    get(name) {
+        return this.#slots.get(name) ?? [];
+    }
+    /** Whether a slot has any entries — handy for conditional chrome. */
+    has(name) {
+        return this.get(name).length > 0;
+    }
+}
+const ADMIN_SLOTS_KEY = Symbol.for('aphex.admin.slots');
+/** Create a registry and publish it to descendants. Call once in the admin shell. */
+export function setAdminSlots() {
+    const slots = new AdminSlots();
+    setContext(ADMIN_SLOTS_KEY, slots);
+    return slots;
+}
+/** Read the registry. Returns `undefined` outside an admin shell (safe to guard). */
+export function useAdminSlots() {
+    return getContext(ADMIN_SLOTS_KEY);
+}
+//# sourceMappingURL=slots.svelte.js.map

package/dist/lib/admin/slots.svelte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.svelte.js","sourceRoot":"","sources":["../../../src/lib/admin/slots.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAgB,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkB9C,MAAM,OAAO,UAAU;IACtB,wDAAwD;IACxD,MAAM,GAAG,IAAI,SAAS,EAA4B,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,IAAmB,EAAE,KAAqB;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACrE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CACzC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5B,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;;gBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,GAAG,CAAC,IAAmB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,qEAAqE;IACrE,GAAG,CAAC,IAAmB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;CACD;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAExD,qFAAqF;AACrF,MAAM,UAAU,aAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAyB,eAAe,CAAC,CAAC;AAC5D,CAAC"}

package/dist/lib/admin/types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The active admin area (tab). Built-in tools are named literals; plugin admin
+ * tools are addressed as `plugin:<tool-id>`, so the tab system is open-ended
+ * without the shell hardcoding plugin knowledge.
+ */
+export type AdminArea = 'structure' | 'vision' | 'media' | `plugin:${string}`;
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/admin/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,MAAM,EAAE,CAAC"}

package/dist/lib/admin/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lib/admin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/admin/types.ts"],"names":[],"mappings":""}

package/dist/lib/api/schemas/api-keys.d.ts

@@ -1,59 +1,26 @@
 import { z } from 'zod';
-import { type Capability } from '../../types/capabilities.js';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
 }>;
-export declare const apiKeyCapabilitySchema: z.ZodEnum<{
-    "document.read": "document.read";
-    "document.create": "document.create";
-    "document.update": "document.update";
-    "document.delete": "document.delete";
-    "document.publish": "document.publish";
-    "document.unpublish": "document.unpublish";
-    "asset.read": "asset.read";
-    "asset.upload": "asset.upload";
-    "asset.delete": "asset.delete";
-    "member.invite": "member.invite";
-    "member.remove": "member.remove";
-    "member.changeRole": "member.changeRole";
-    "apiKey.manage": "apiKey.manage";
-    "role.manage": "role.manage";
-    "org.settings": "org.settings";
-}>;
+export declare const apiKeyCapabilitySchema: z.ZodString;
 export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         read: "read";
         write: "write";
     }>>>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        "document.read": "document.read";
-        "document.create": "document.create";
-        "document.update": "document.update";
-        "document.delete": "document.delete";
-        "document.publish": "document.publish";
-        "document.unpublish": "document.unpublish";
-        "asset.read": "asset.read";
-        "asset.upload": "asset.upload";
-        "asset.delete": "asset.delete";
-        "member.invite": "member.invite";
-        "member.remove": "member.remove";
-        "member.changeRole": "member.changeRole";
-        "apiKey.manage": "apiKey.manage";
-        "role.manage": "role.manage";
-        "org.settings": "org.settings";
-    }>>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodTransform<{
     permissions: ("read" | "write")[] | undefined;
-    capabilities: Capability[] | undefined;
+    capabilities: string[] | undefined;
     name: string;
     expiresInDays?: number | undefined;
 }, {
     name: string;
     permissions?: ("read" | "write")[] | undefined;
-    capabilities?: ("document.read" | "document.create" | "document.update" | "document.delete" | "document.publish" | "document.unpublish" | "asset.read" | "asset.upload" | "asset.delete" | "member.invite" | "member.remove" | "member.changeRole" | "apiKey.manage" | "role.manage" | "org.settings")[] | undefined;
+    capabilities?: string[] | undefined;
     expiresInDays?: number | undefined;
 }>>;
 export type ApiKeyPermission = z.infer<typeof apiKeyPermissionSchema>;

package/dist/lib/api/schemas/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIpG,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAElC,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;EAA4B,CAAC;AAIhE,eAAO,MAAM,sBAAsB,aAAmB,CAAC;AASvD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;GAoB5B,CAAC;AAIL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/lib/api/schemas/api-keys.js

@@ -1,8 +1,11 @@
 import { z } from 'zod';
-import { ALL_CAPABILITIES, normalizeCapabilities } from '../../types/capabilities.js';
+import { normalizeCapabilities } from '../../types/capabilities.js';
+import { capabilitySchema } from './roles.js';
 // ---------- Shared ----------
 export const apiKeyPermissionSchema = z.enum(['read', 'write']);
-export const apiKeyCapabilitySchema = z.enum(ALL_CAPABILITIES);
+// Same capability-id format guard as roles; the authoritative validity check
+// (against the runtime registry) happens in the route handler.
+export const apiKeyCapabilitySchema = capabilitySchema;
 // ---------- POST /settings/api-keys ----------
 // Two provisioning modes:
 //   1. Coarse `permissions`: 'read' alone, or 'write' (always implies read).