@aphexcms/cms-core 9.4.0 → 9.5.1

package/dist/server/api/index.js

@@ -16,6 +16,7 @@ import { organizationsInvitationsRouter } from './routes/organizations-invitatio
 import { organizationsMembersRouter } from './routes/organizations-members.js';
 import { organizationsSwitchRouter } from './routes/organizations-switch.js';
 import { rolesRouter } from './routes/roles.js';
+import { pluginSettingsRouter } from './routes/plugin-settings.js';
 import { userPreferencesRouter } from './routes/user-preferences.js';
 import { userRouter } from './routes/user.js';
 /**
@@ -77,6 +78,8 @@ export function mountAphexBuiltins(app) {
     app.route('/organizations', organizationsRouter);
     // Roles — combined router covers /, /:name, no precedence concern.
     app.route('/roles', rolesRouter);
+    // Plugin settings — the config plane. `/`, `/:pluginId`, no precedence concern.
+    app.route('/plugin-settings', pluginSettingsRouter);
     // User account routes — register specifics first.
     // `/user/cms-preference`, `/user/request-password-reset`,
     // `/user/reset-password` need to win over `/user` PATCH otherwise

package/dist/server/api/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA8JrC,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CAoKrC,CAAC"}

package/dist/server/api/routes/assets.js

@@ -25,6 +25,7 @@ export const assetsRouter = new Hono()
             assetType: q.assetType,
             mimeType: q.mimeType,
             search: q.search,
+            includeSystem: q.includeSystem ?? false,
             limit: q.limit ?? 20,
             offset: q.offset ?? 0
         };
@@ -34,7 +35,8 @@ export const assetsRouter = new Hono()
             databaseAdapter.countAssets(auth.organizationId, {
                 assetType: filters.assetType,
                 mimeType: filters.mimeType,
-                search: filters.search
+                search: filters.search,
+                includeSystem: filters.includeSystem
             })
         ]);
         const pageSize = filters.limit || 20;
@@ -101,6 +103,8 @@ export const assetsRouter = new Hono()
         const creditLine = formData.get('creditLine') || undefined;
         const schemaType = formData.get('schemaType') || undefined;
         const fieldPath = formData.get('fieldPath') || undefined;
+        const system = formData.get('system') === 'true' || undefined;
+        const usage = formData.get('usage') || undefined;
         const targetOrganizationId = auth.organizationId;
         const uploadData = {
             organizationId: targetOrganizationId,
@@ -115,7 +119,9 @@ export const assetsRouter = new Hono()
             createdBy: auth.type === 'session' ? auth.user.id : undefined,
             metadata: {
                 schemaType,
-                fieldPath
+                fieldPath,
+                system,
+                usage
             }
         };
         const asset = await assetService.uploadAsset(targetOrganizationId, uploadData);

package/dist/server/api/routes/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA8H7C,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAoI7C,CAAC"}

package/dist/server/api/routes/organizations.js

@@ -78,7 +78,10 @@ export const organizationsRouter = new Hono()
             parentOrganizationId: auth.organizationId,
             createdBy: auth.user.id
         });
-        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
+        // Seed with the install's full capability set (core + plugin-declared), the
+        // same one the boot reconcile uses — otherwise a brand-new org's owner would
+        // be missing every capability its plugins declare until the next restart.
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id, c.var.aphexCMS.cmsEngine.ownerCapabilities());
         await databaseAdapter.addMember({
             organizationId: newOrganization.id,
             userId: auth.user.id,

package/dist/server/api/routes/plugin-settings.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const pluginSettingsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=plugin-settings.d.ts.map

package/dist/server/api/routes/plugin-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/plugin-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6DzC,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CA2E7C,CAAC"}

package/dist/server/api/routes/plugin-settings.js

@@ -0,0 +1,108 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability } from '../../../types/capabilities.js';
+import { savePluginSettingsRequest } from '../../../api/schemas/plugin-settings.js';
+import { PluginSettingsValidationError } from '../../../services/plugin-settings-service.js';
+/**
+ * Require a session with `plugin.settings.manage`. Returns the narrowed session auth
+ * to proceed, or a 401/403 Response to short-circuit — so callers get a typed org id
+ * without a non-null assertion.
+ */
+function requireManage(c) {
+    const auth = c.var.auth;
+    if (!auth || auth.type !== 'session') {
+        return c.json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, 401);
+    }
+    if (!hasCapability(auth, 'plugin.settings.manage')) {
+        return c.json({
+            success: false,
+            error: 'Forbidden',
+            message: 'The plugin.settings.manage capability is required'
+        }, 403);
+    }
+    return auth;
+}
+/**
+ * Does this session satisfy a settings section's own `requiredCapabilities`?
+ *
+ * `plugin.settings.manage` is the floor, checked by `requireManage`. A declaration may
+ * additionally name narrower capabilities to gate itself more tightly — the part's
+ * documented contract, and the same convention `hooks.ts` applies to plugin routes and
+ * `resolver.ts` applies to actions and tools. Without this the declared gate was
+ * silently ignored, so anyone who could manage settings could overwrite every plugin's
+ * secrets regardless of what the plugin asked for.
+ */
+function canAccessSettings(auth, required) {
+    if (!required || required.length === 0)
+        return true;
+    return required.every((capability) => hasCapability(auth, capability));
+}
+export const pluginSettingsRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const auth = requireManage(c);
+        if (auth instanceof Response)
+            return auth;
+        const { pluginSettingsService, partResolver } = c.var.aphexCMS;
+        // One entry per plugin that declared settings AND that this session is
+        // allowed to see, with the org's effective values. `getMasked` — never
+        // `get` — so secret plaintext never reaches the client (secrets come back
+        // as a mask placeholder).
+        const declarations = partResolver
+            .settingsDeclarations()
+            .filter((decl) => canAccessSettings(auth, decl.requiredCapabilities));
+        const secretsEnabled = pluginSettingsService.secretsEnabled;
+        const data = await Promise.all(declarations.map(async (decl) => ({
+            pluginId: decl.pluginId,
+            title: decl.title,
+            values: await pluginSettingsService.getMasked(auth.organizationId, decl.pluginId)
+        })));
+        return c.json({ success: true, data, secretsEnabled });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list plugin settings:', error);
+        return c.json({ success: false, error: 'Internal error' }, 500);
+    }
+})
+    .put('/:pluginId', zValidator('json', savePluginSettingsRequest), async (c) => {
+    try {
+        const auth = requireManage(c);
+        if (auth instanceof Response)
+            return auth;
+        const { pluginSettingsService, partResolver } = c.var.aphexCMS;
+        const pluginId = c.req.param('pluginId');
+        // Reject plugins that never declared settings — nothing to write to.
+        const declaration = partResolver.settingsDeclaration(pluginId);
+        if (!declaration) {
+            return c.json({
+                success: false,
+                error: 'Unknown plugin settings',
+                message: `Plugin "${pluginId}" has not declared any settings.`
+            }, 404);
+        }
+        // Honour the declaration's own gate. GET only ever returns masked secrets,
+        // so the exposure this closes is write: without it, anyone holding
+        // `plugin.settings.manage` could overwrite the secrets of a plugin that
+        // asked for a narrower capability.
+        if (!canAccessSettings(auth, declaration.requiredCapabilities)) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: `Plugin "${pluginId}" requires: ${declaration.requiredCapabilities?.join(', ')}`
+            }, 403);
+        }
+        const { values } = c.req.valid('json');
+        const saved = await pluginSettingsService.save(auth.organizationId, pluginId, values);
+        return c.json({ success: true, data: { pluginId, values: saved } });
+    }
+    catch (error) {
+        // A value that doesn't match its declared field type is the caller's fault, not
+        // ours — report it as such, with the specific issues, rather than an opaque 500.
+        if (error instanceof PluginSettingsValidationError) {
+            return c.json({ success: false, error: 'Validation failed', issues: error.issues }, 400);
+        }
+        cmsLogger.error('Failed to save plugin settings:', error);
+        return c.json({ success: false, error: 'Internal error' }, 500);
+    }
+});

package/dist/server/api/routes/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CAuSpC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAwBzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CA+TpC,CAAC"}

package/dist/server/api/routes/roles.js

@@ -3,6 +3,24 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { hasCapability, BUILTIN_ROLE_NAMES } from '../../../types/capabilities.js';
 import { createRoleRequest, updateRoleRequest } from '../../../api/schemas/roles.js';
+/**
+ * Authoritative capability validation against the runtime registry. The zod schema
+ * only guards the id *format*; this rejects ids that don't actually exist in the
+ * catalog (built-in + plugin-declared), so a role can't be granted a phantom
+ * capability. Returns a 400 Response to short-circuit, or null when all are valid.
+ */
+function rejectUnknownCapabilities(c, caps) {
+    const known = new Set(c.var.aphexCMS.partResolver.capabilityCatalog().map((d) => d.id));
+    const unknown = caps.filter((cap) => !known.has(cap));
+    if (unknown.length === 0)
+        return null;
+    return c.json({
+        success: false,
+        error: 'Unknown capability',
+        message: `These capabilities are not registered: ${unknown.join(', ')}`,
+        unknownCapabilities: unknown
+    }, 400);
+}
 /**
  * Roles router. Combines `/roles` (list, create) and `/roles/:name`
  * (update, delete) so the wire URLs are
@@ -63,6 +81,9 @@ export const rolesRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
+        const badCaps = rejectUnknownCapabilities(c, body.capabilities);
+        if (badCaps)
+            return badCaps;
         if (BUILTIN_ROLE_NAMES.includes(body.name)) {
             return c.json({
                 success: false,
@@ -132,6 +153,22 @@ export const rolesRouter = new Hono()
             }, 400);
         }
         const body = c.req.valid('json');
+        // `owner` is defined as "every capability" and is reconciled back to the
+        // full set on every boot, so accepting an edit here would appear to work
+        // and then silently revert on the next restart. Same reasoning as the
+        // hardcoded block on deleting built-in roles below.
+        if (name === 'owner' && body.capabilities !== undefined) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: '"owner" always holds every capability and its permissions cannot be changed. Create a custom role to grant narrower access.'
+            }, 403);
+        }
+        if (body.capabilities) {
+            const badCaps = rejectUnknownCapabilities(c, body.capabilities);
+            if (badCaps)
+                return badCaps;
+        }
         const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
         if (!updated) {
             return c.json({

package/dist/server/api/routes/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA6IpC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA2JpC,CAAC"}

package/dist/server/api/routes/user.js

@@ -16,7 +16,7 @@ export const userRouter = new Hono()
         return c.json({
             success: false,
             error: 'Invalid request body',
-            message: 'name is required',
+            message: 'name or image is required',
             issues: result.error.issues
         }, 400);
     }
@@ -37,8 +37,19 @@ export const userRouter = new Hono()
                 error: 'Auth provider not configured'
             }, 500);
         }
-        const { name } = c.req.valid('json');
-        await provider.changeUserName(auth.user.id, name);
+        const { name, image } = c.req.valid('json');
+        if (name !== undefined) {
+            await provider.changeUserName(auth.user.id, name);
+        }
+        if (image !== undefined) {
+            if (!provider.changeUserImage) {
+                return c.json({
+                    success: false,
+                    error: 'Auth provider does not support profile image updates'
+                }, 500);
+            }
+            await provider.changeUserImage(auth.user.id, image);
+        }
         return c.json({ success: true, message: 'User updated successfully' });
     }
     catch (error) {

package/dist/services/asset-service.d.ts

@@ -21,6 +21,7 @@ export interface AssetFilters {
     assetType?: 'image' | 'file';
     mimeType?: string;
     search?: string;
+    includeSystem?: boolean;
     limit?: number;
     offset?: number;
 }

package/dist/services/asset-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;;OAUG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhF;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}
+{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;;OAUG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhF;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}

package/dist/services/index.d.ts

@@ -3,4 +3,6 @@ export type { AssetUploadData, AssetFilters } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
 export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
+export { PluginSettingsService } from './plugin-settings-service.js';
+export type { ResolvedSettings } from './plugin-settings-service.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/services/index.js

@@ -5,3 +5,4 @@ export { AssetService } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
 export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
+export { PluginSettingsService } from './plugin-settings-service.js';

package/dist/services/plugin-settings-service.d.ts

@@ -0,0 +1,76 @@
+import type { DatabaseAdapter } from '../db/index.js';
+import type { PartResolver } from '../plugins/resolver.js';
+import type { SettingsPart } from '../plugins/types.js';
+/** Placeholder shown to the client for a secret that has a stored value. */
+export declare const SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+/**
+ * The persistence this service needs — the settings slice of `DatabaseAdapter`, which
+ * satisfies it structurally. Declaring the narrow dependency rather than the whole
+ * adapter keeps the service honest about its reach (config values only, never content)
+ * and lets it be constructed against a stub.
+ */
+export type PluginSettingsStore = Pick<DatabaseAdapter, 'getPluginSettings' | 'setPluginSettings'>;
+/** Likewise the resolver slice: this service only ever looks up settings declarations. */
+export type SettingsDeclarationSource = Pick<PartResolver, 'settingsDeclaration'>;
+/** A declared settings section plus whether the plugin registered one at all. */
+export interface ResolvedSettings {
+    /** The plugin's settings declaration, or `null` if it declared none. */
+    declaration: SettingsPart | null;
+    /** Declared defaults merged with the org's stored values (secrets masked). */
+    values: Record<string, unknown>;
+    /** Whether an encryption key is configured — the UI flags secret fields read-only if not. */
+    secretsEnabled: boolean;
+}
+/** Raised when a submitted value doesn't match its declared field type. */
+export declare class PluginSettingsValidationError extends Error {
+    readonly issues: string[];
+    constructor(issues: string[]);
+}
+export declare class PluginSettingsService {
+    /** Narrowed to the two methods this service uses — the full adapter satisfies it. */
+    private db;
+    /** Likewise: settings resolution is the only part of the resolver needed here. */
+    private resolver;
+    /** Key for encrypting `secret` fields; when absent, secrets are disabled (fail safe). */
+    private encryptionKey;
+    constructor(
+    /** Narrowed to the two methods this service uses — the full adapter satisfies it. */
+    db: PluginSettingsStore, 
+    /** Likewise: settings resolution is the only part of the resolver needed here. */
+    resolver: SettingsDeclarationSource, 
+    /** Key for encrypting `secret` fields; when absent, secrets are disabled (fail safe). */
+    encryptionKey?: string | null);
+    /** Whether secret fields can be stored/read (an encryption key is configured). */
+    get secretsEnabled(): boolean;
+    private secretFieldNames;
+    /**
+     * Effective values for injection into plugin **server** code: declared defaults
+     * overlaid with stored values, with secrets **decrypted** to plaintext. Secrets
+     * that can't be decrypted (no key, or a bad envelope) are omitted, never returned
+     * as ciphertext. This is the sensitive read — never send its result to a client.
+     */
+    get(organizationId: string, pluginId: string): Promise<Record<string, unknown>>;
+    /**
+     * Effective values for the **client/API**: same merge, but secrets are **masked** —
+     * a stored secret becomes {@link SECRET_MASK}, an unset one an empty string. Plaintext
+     * secrets never cross this boundary.
+     */
+    getMasked(organizationId: string, pluginId: string): Promise<Record<string, unknown>>;
+    /**
+     * Resolve for the admin surface: the declaration plus masked values plus whether
+     * secrets are enabled. `declaration: null` when the plugin declares no settings.
+     */
+    resolve(organizationId: string, pluginId: string): Promise<ResolvedSettings>;
+    /**
+     * Persist a partial edit. Only declared field names are accepted, and each value is
+     * type-checked against its declaration — an invalid patch is rejected whole, never
+     * applied in part, so a failed save can't leave settings half-written. Secret fields
+     * are encrypted; a blank or still-masked secret submission means "leave unchanged"
+     * (so the client never has to echo the real value back). Returns the new **masked**
+     * values — a save response never leaks a plaintext secret.
+     *
+     * @throws {PluginSettingsValidationError} when a value doesn't match its field type.
+     */
+    save(organizationId: string, pluginId: string, patch: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=plugin-settings-service.d.ts.map

package/dist/services/plugin-settings-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/plugin-settings-service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,4EAA4E;AAC5E,eAAO,MAAM,WAAW,yCAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,GAAG,mBAAmB,CAAC,CAAC;AAEnG,0FAA0F;AAC1F,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AAElF,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,wEAAwE;IACxE,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IACjC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,6FAA6F;IAC7F,cAAc,EAAE,OAAO,CAAC;CACxB;AAwBD,2EAA2E;AAC3E,qBAAa,6BAA8B,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;gBAAhB,MAAM,EAAE,MAAM,EAAE;CAIrC;AAkDD,qBAAa,qBAAqB;IAEhC,qFAAqF;IACrF,OAAO,CAAC,EAAE;IACV,kFAAkF;IAClF,OAAO,CAAC,QAAQ;IAChB,yFAAyF;IACzF,OAAO,CAAC,aAAa;;IALrB,qFAAqF;IAC7E,EAAE,EAAE,mBAAmB;IAC/B,kFAAkF;IAC1E,QAAQ,EAAE,yBAAyB;IAC3C,yFAAyF;IACjF,aAAa,GAAE,MAAM,GAAG,IAAW;IAG5C,kFAAkF;IAClF,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,OAAO,CAAC,gBAAgB;IAIxB;;;;;OAKG;IACG,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA6BrF;;;;OAIG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc3F;;;OAGG;IACG,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAMlF;;;;;;;;;OASG;IACG,IAAI,CACT,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CA2CnC"}