@aphexcms/cms-core 9.8.0 → 9.9.0

package/dist/server/api/routes/agent-change-sets.js

@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { hasCapability } from '../../../types/capabilities.js';
-import { RevisionConflictError } from '../../../db/interfaces.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { withCreatedByNames } from './resolve-created-by.js';
 const listChangeSetsQuery = z.object({

package/dist/server/api/routes/document-versions.js

@@ -3,7 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { hasCapability } from '../../../types/capabilities.js';
-import { RevisionConflictError } from '../../../db/interfaces.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
 import { listVersionsQuery, restoreVersionRequest } from '../../../api/schemas/documents.js';
 export const documentVersionsRouter = new Hono()
     .get('/:id/versions', zValidator('query', listVersionsQuery, (result, c) => {

package/dist/server/api/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAiO5C,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA6O5C,CAAC"}

package/dist/server/api/routes/documents-by-id.js

@@ -2,8 +2,8 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { PermissionError } from '../../../local-api/permissions.js';
-import { SingletonOperationError } from '../../../local-api/collection-api.js';
-import { RevisionConflictError } from '../../../db/interfaces.js';
+import { SingletonOperationError, DocumentValidationError } from '../../../local-api/collection-api.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateDocumentRequest } from '../../../api/schemas/documents.js';
 export const documentsByIdRouter = new Hono()
@@ -108,6 +108,15 @@ export const documentsByIdRouter = new Hono()
                 currentRevision: error.currentRevision
             }, 409);
         }
+        // A malformed payload is the caller's fault, not the server's.
+        if (error instanceof DocumentValidationError) {
+            return c.json({
+                success: false,
+                error: 'Validation failed',
+                message: error.message,
+                issues: error.errors
+            }, 400);
+        }
         if (error instanceof Error && error.message.includes('validation errors')) {
             return c.json({ success: false, error: 'Validation failed', message: error.message }, 400);
         }

package/dist/server/api/routes/documents-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkU/C,CAAC"}
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CA8U/C,CAAC"}

package/dist/server/api/routes/documents-publish.js

@@ -1,7 +1,8 @@
 import { Hono } from 'hono';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { PermissionError } from '../../../local-api/permissions.js';
-import { RevisionConflictError } from '../../../db/interfaces.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
+import { DocumentValidationError } from '../../../local-api/collection-api.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { scheduleDocumentRequest, publishDocumentRequest, unpublishDocumentRequest } from '../../../api/schemas/documents.js';
 export const documentsPublishRouter = new Hono()
@@ -178,6 +179,15 @@ export const documentsPublishRouter = new Hono()
                 currentRevision: error.currentRevision
             }, 409);
         }
+        // A malformed payload is the caller's fault, not the server's.
+        if (error instanceof DocumentValidationError) {
+            return c.json({
+                success: false,
+                error: 'Validation failed',
+                message: error.message,
+                issues: error.errors
+            }, 400);
+        }
         if (error instanceof Error && error.message.includes('validation errors')) {
             return c.json({
                 success: false,

package/dist/server/api/routes/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CA6MzC,CAAC"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CAyNzC,CAAC"}

package/dist/server/api/routes/documents.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { PermissionError } from '../../../local-api/permissions.js';
+import { DocumentValidationError } from '../../../local-api/collection-api.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { createDocumentRequest, getDocumentsByIdsQuery, listDocumentsQuery } from '../../../api/schemas/documents.js';
 const DEFAULT_PAGE_SIZE = 20;
@@ -148,6 +149,15 @@ export const documentsRouter = new Hono()
         if (error instanceof PermissionError) {
             return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
+        // A malformed payload is the caller's fault, not the server's.
+        if (error instanceof DocumentValidationError) {
+            return c.json({
+                success: false,
+                error: 'Validation failed',
+                message: error.message,
+                issues: error.errors
+            }, 400);
+        }
         if (error instanceof Error && error.message.includes('validation errors')) {
             return c.json({ success: false, error: 'Validation failed', message: error.message }, 400);
         }

package/dist/server/api/routes/jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6CzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAkDnC,CAAC"}
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6HzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAuKnC,CAAC"}

package/dist/server/api/routes/jobs.js

@@ -2,23 +2,35 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { hasCapability } from '../../../types/capabilities.js';
+import { jobActionRequestSchema } from '../../../api/schemas/jobs.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { withCreatedByNames } from './resolve-created-by.js';
-// Read-only history / observability for the durable spine. Gated on `document.read`:
-// the operational log of publish work is visible to anyone who can read content.
+import { withOrganizationNames } from './resolve-organization-names.js';
+// Read-only history / observability for the durable spine, plus the two operator actions
+// that make a dead letter recoverable. Reads are gated on `document.read`: the operational
+// log of publish work is visible to anyone who can read content. Mutations are gated on
+// `org.settings` — see `requireJobControl`.
 // Mirrors JobStatus (types/events) as a zod enum — the API contract's source of truth.
 const jobStatus = z.enum(['pending', 'leased', 'completed', 'failed', 'cancelled']);
+/**
+ * `?scope=all` widens a history read from the active organization to the whole instance.
+ * Super admins only — it's the one place the admin UI crosses a tenant boundary.
+ */
+const historyScope = z.enum(['organization', 'all']);
 const listJobsQuery = z.object({
     status: jobStatus.optional(),
     type: z.string().optional(),
+    scope: historyScope.optional(),
     limit: z.coerce.number().int().min(1).max(200).optional(),
     offset: z.coerce.number().int().min(0).optional()
 });
 const listEventsQuery = z.object({
     type: z.string().optional(),
+    scope: historyScope.optional(),
     limit: z.coerce.number().int().min(1).max(200).optional(),
     offset: z.coerce.number().int().min(0).optional()
 });
+const healthQuery = z.object({ scope: historyScope.optional() });
 /** Map an adapter Page into the ApiResponse `pagination` shape the client expects. */
 function toPagination(page) {
     const pageSize = page.limit || 1;
@@ -31,6 +43,9 @@ function toPagination(page) {
         hasPrevPage: page.offset > 0
     };
 }
+function isSuperAdmin(auth) {
+    return auth.type === 'session' && auth.user.role === 'super_admin';
+}
 function requireHistoryAccess(c) {
     const auth = c.var.auth;
     if (!auth || auth.type === 'partial_session') {
@@ -39,7 +54,55 @@ function requireHistoryAccess(c) {
     if (!hasCapability(auth, 'document.read')) {
         return { error: c.json({ success: false, error: 'Insufficient permissions' }, 403) };
     }
-    return { organizationId: authToContext(auth).organizationId };
+    return { auth, organizationId: authToContext(auth).organizationId };
+}
+/**
+ * Gate for retry/cancel — `org.settings`, which only `admin` and `owner` hold.
+ *
+ * Requeueing a job *runs* it, and a job can be anything: a scheduled publish, a GDPR
+ * erasure, a plugin's webhook delivery. There's no single content capability that covers
+ * that surface, so the gate is the operational one. It's not a widening: both roles that
+ * hold `org.settings` already hold every document and asset capability, so retrying can't
+ * let anyone cause an effect they couldn't cause directly.
+ */
+function requireJobControl(c) {
+    const auth = c.var.auth;
+    if (!auth || auth.type === 'partial_session') {
+        return { error: c.json({ success: false, error: 'Authentication required' }, 401) };
+    }
+    if (!hasCapability(auth, 'org.settings')) {
+        return { error: c.json({ success: false, error: 'Insufficient permissions' }, 403) };
+    }
+    return { auth, organizationId: authToContext(auth).organizationId };
+}
+/**
+ * Which organization a read covers: the caller's, or every one of them.
+ *
+ * `undefined` means instance-wide to the adapter, which bypasses RLS — so this returns it
+ * only for a super admin who explicitly asked. Anyone else asking for `scope=all` is quietly
+ * scoped back to their own org rather than refused: the parameter is a view preference, and
+ * failing the whole page over it would be a worse experience than showing what they can see.
+ */
+function readScope(auth, organizationId, scope) {
+    return scope === 'all' && isSuperAdmin(auth) ? undefined : organizationId;
+}
+/**
+ * Resolve which organization an action targets, and prove the caller may act there.
+ *
+ * A body `organizationId` is only honored for a super admin acting from the instance-wide
+ * view. For everyone else it must match the active organization — a mismatch is a 403, not a
+ * silent fallback, because a body that names another tenant is either a bug or an attempt.
+ */
+function resolveActionOrganization(c, auth, activeOrganizationId, requested) {
+    if (!requested || requested === activeOrganizationId) {
+        return { organizationId: activeOrganizationId };
+    }
+    if (!isSuperAdmin(auth)) {
+        return {
+            error: c.json({ success: false, error: 'Cannot act on jobs outside your active organization' }, 403)
+        };
+    }
+    return { organizationId: requested };
 }
 export const jobsRouter = new Hono()
     .get('/jobs', async (c) => {
@@ -51,21 +114,115 @@ export const jobsRouter = new Hono()
         if (!parsed.success) {
             return c.json({ success: false, error: 'Invalid query', issues: parsed.error.issues }, 400);
         }
-        const { status, type, limit, offset } = parsed.data;
+        const { status, type, scope, limit, offset } = parsed.data;
+        const organizationId = readScope(gate.auth, gate.organizationId, scope);
         const { databaseAdapter } = c.var.aphexCMS;
-        const page = await databaseAdapter.listJobs({
-            organizationId: gate.organizationId,
-            status,
-            type,
-            limit,
-            offset
-        });
-        return c.json({ success: true, data: page.items, pagination: toPagination(page) });
+        const page = await databaseAdapter.listJobs({ organizationId, status, type, limit, offset });
+        // Only the instance-wide view needs org names; org-scoped rows are all the same org.
+        const items = organizationId
+            ? page.items
+            : await withOrganizationNames(page.items, databaseAdapter);
+        return c.json({ success: true, data: items, pagination: toPagination(page) });
     }
     catch (error) {
         cmsLogger.error('Failed to list jobs:', error);
         return c.json({ success: false, error: 'Failed to list jobs' }, 500);
     }
+})
+    .get('/jobs/health', async (c) => {
+    try {
+        const gate = requireHistoryAccess(c);
+        if ('error' in gate)
+            return gate.error;
+        const parsed = healthQuery.safeParse(c.req.query());
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid query', issues: parsed.error.issues }, 400);
+        }
+        const organizationId = readScope(gate.auth, gate.organizationId, parsed.data.scope);
+        const { databaseAdapter } = c.var.aphexCMS;
+        const health = await databaseAdapter.outboxHealth({ organizationId });
+        return c.json({ success: true, data: health });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to read outbox health:', error);
+        return c.json({ success: false, error: 'Failed to read outbox health' }, 500);
+    }
+})
+    .post('/jobs/:id/retry', async (c) => {
+    try {
+        const gate = requireJobControl(c);
+        if ('error' in gate)
+            return gate.error;
+        const body = await c.req.json().catch(() => ({}));
+        const parsed = jobActionRequestSchema.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+        }
+        const target = resolveActionOrganization(c, gate.auth, gate.organizationId, parsed.data.organizationId);
+        if ('error' in target)
+            return target.error;
+        const id = c.req.param('id');
+        const { databaseAdapter } = c.var.aphexCMS;
+        const job = await databaseAdapter.requeueJob(target.organizationId, id, {
+            runAt: new Date()
+        });
+        if (!job) {
+            // The guard matched nothing: either the job isn't there, or it's in a state that
+            // can't be requeued. Read it back so the message says which — "already running"
+            // and "no such job" call for completely different reactions from an operator.
+            const existing = await databaseAdapter.getJob(target.organizationId, id);
+            if (!existing)
+                return c.json({ success: false, error: 'Job not found' }, 404);
+            return c.json({
+                success: false,
+                error: `Only failed or cancelled jobs can be retried — this one is ${existing.status}.`
+            }, 409);
+        }
+        cmsLogger.info(`[jobs] Job ${id} (${job.type}) requeued by ${gate.auth.type === 'session' ? gate.auth.user.id : 'api key'}`);
+        return c.json({ success: true, data: job });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to retry job:', error);
+        return c.json({ success: false, error: 'Failed to retry job' }, 500);
+    }
+})
+    .post('/jobs/:id/cancel', async (c) => {
+    try {
+        const gate = requireJobControl(c);
+        if ('error' in gate)
+            return gate.error;
+        const body = await c.req.json().catch(() => ({}));
+        const parsed = jobActionRequestSchema.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+        }
+        const target = resolveActionOrganization(c, gate.auth, gate.organizationId, parsed.data.organizationId);
+        if ('error' in target)
+            return target.error;
+        const id = c.req.param('id');
+        const { databaseAdapter } = c.var.aphexCMS;
+        const existing = await databaseAdapter.getJob(target.organizationId, id);
+        if (!existing)
+            return c.json({ success: false, error: 'Job not found' }, 404);
+        // `cancelJob` itself is unguarded — the scheduled-publish flow calls it on jobs it
+        // knows are pending. Here the state has to be checked first: cancelling a `leased`
+        // job would only look like it worked, because the worker holding it settles the row
+        // afterwards and overwrites the status.
+        if (existing.status !== 'pending' && existing.status !== 'failed') {
+            return c.json({
+                success: false,
+                error: `Only pending or failed jobs can be cancelled — this one is ${existing.status}.`
+            }, 409);
+        }
+        await databaseAdapter.cancelJob(target.organizationId, id);
+        const job = await databaseAdapter.getJob(target.organizationId, id);
+        cmsLogger.info(`[jobs] Job ${id} (${existing.type}) cancelled by ${gate.auth.type === 'session' ? gate.auth.user.id : 'api key'}`);
+        return c.json({ success: true, data: job });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to cancel job:', error);
+        return c.json({ success: false, error: 'Failed to cancel job' }, 500);
+    }
 })
     .get('/events', async (c) => {
     try {
@@ -76,15 +233,12 @@ export const jobsRouter = new Hono()
         if (!parsed.success) {
             return c.json({ success: false, error: 'Invalid query', issues: parsed.error.issues }, 400);
         }
-        const { type, limit, offset } = parsed.data;
+        const { type, scope, limit, offset } = parsed.data;
+        const organizationId = readScope(gate.auth, gate.organizationId, scope);
         const { databaseAdapter, auth } = c.var.aphexCMS;
-        const page = await databaseAdapter.listEvents({
-            organizationId: gate.organizationId,
-            type,
-            limit,
-            offset
-        });
-        const items = await withCreatedByNames(page.items, auth);
+        const page = await databaseAdapter.listEvents({ organizationId, type, limit, offset });
+        const named = await withCreatedByNames(page.items, auth);
+        const items = organizationId ? named : await withOrganizationNames(named, databaseAdapter);
         return c.json({ success: true, data: items, pagination: toPagination(page) });
     }
     catch (error) {

package/dist/server/api/routes/organizations-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAuOhD,CAAC"}
+{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAkDzC,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAiQhD,CAAC"}

package/dist/server/api/routes/organizations-by-id.js

@@ -2,7 +2,42 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateOrganizationRequest } from '../../../api/schemas/organizations.js';
-import { hasCapability } from '../../../types/capabilities.js';
+import { isInstanceRole } from '../../../types/capabilities.js';
+/** How many assets to pull per page while erasing an organization's media. */
+const ASSET_ERASE_PAGE_SIZE = 200;
+/**
+ * Delete every asset in an organization — object storage included.
+ *
+ * Paged rather than loaded at once so a large media library doesn't have to fit in
+ * memory. Always reads page zero: each pass deletes what it read, so the next unerased
+ * asset is always at the front. Best-effort per asset — one failed object shouldn't
+ * abandon the rest, and the caller's retry will pick up whatever is left.
+ */
+async function eraseOrganizationAssets(assetService, organizationId) {
+    for (;;) {
+        const page = await assetService.findAssets(organizationId, {
+            limit: ASSET_ERASE_PAGE_SIZE,
+            offset: 0
+        });
+        if (page.length === 0)
+            return;
+        let erased = 0;
+        for (const asset of page) {
+            try {
+                await assetService.deleteAsset(organizationId, asset.id);
+                erased++;
+            }
+            catch (error) {
+                cmsLogger.warn(`Could not erase asset ${asset.id} while deleting org:`, error);
+            }
+        }
+        // Nothing went away, so paging again would loop forever on the same failures.
+        if (erased === 0) {
+            cmsLogger.error(`Stopped erasing assets for org ${organizationId}: ${page.length} remain and none could be deleted.`);
+            return;
+        }
+    }
+}
 export const organizationsByIdRouter = new Hono()
     .get('/:id', async (c) => {
     try {
@@ -56,7 +91,7 @@ export const organizationsByIdRouter = new Hono()
     }
 }), async (c) => {
     try {
-        const { databaseAdapter } = c.var.aphexCMS;
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
         const auth = c.var.auth;
         const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
@@ -74,7 +109,17 @@ export const organizationsByIdRouter = new Hono()
             }, 400);
         }
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
-        if (!membership || !hasCapability(auth, 'org.settings')) {
+        // Capabilities have to be evaluated against the *target* organization.
+        // `auth.capabilities` is resolved once per request for the caller's
+        // **active** org, so checking it here let an admin in org A who is only a
+        // viewer in org B edit B's settings simply by leaving A active.
+        // Instance roles still override — they hold every capability everywhere.
+        let canEditSettings = isInstanceRole(auth);
+        if (membership && !canEditSettings) {
+            const targetCapabilities = await rolesService.getCapabilities(id, membership.role);
+            canEditSettings = targetCapabilities.includes('org.settings');
+        }
+        if (!membership || !canEditSettings) {
             return c.json({
                 success: false,
                 error: 'Forbidden',
@@ -155,6 +200,19 @@ export const organizationsByIdRouter = new Hono()
                 }
             }
         }
+        // Files first, while the rows that point at them still exist. Deleting the
+        // organization cascades its `cms_assets` rows away, and those rows hold the
+        // only record of each object's storage path — so anything not erased here
+        // stays in the bucket forever, unreferenced and unfindable, still publicly
+        // readable by URL. `assetService.deleteAsset` removes the object *and* the
+        // row; the cascade then has less to do.
+        //
+        // Synchronous and unbounded, which is the known limit: an organization with
+        // tens of thousands of assets will make this request slow. The durable fix is
+        // to drain them through the job queue, which needs a deletion state machine
+        // (the org has to stay readable while its assets are erased) — deliberately
+        // not built here. It is safe to retry: an already-erased asset is a no-op.
+        await eraseOrganizationAssets(c.var.aphexCMS.assetService, id);
         await databaseAdapter.removeAllMembers(id);
         await databaseAdapter.removeAllInvitations(id);
         await databaseAdapter.deleteOrganization(id);

package/dist/server/api/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4MxD,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4OxD,CAAC"}

package/dist/server/api/routes/organizations-invitations.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { inviteMemberRequest, cancelInvitationRequest } from '../../../api/schemas/organizations.js';
 import { hasCapability } from '../../../types/capabilities.js';
+import { isPendingInvitation, isStaleInvitation, invitationExpiryFrom } from '../../../auth/invitation-status.js';
 /**
  * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
  * that adds email sending after the invite row is created. While that
@@ -38,6 +39,18 @@ export const organizationsInvitationsRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
+        // The same restriction the member role-change route enforces, and for
+        // the same reason: `member.changeRole` refuses to promote anyone to
+        // owner, so admins must not be able to reach the same place by inviting
+        // a brand-new one instead — that detour would let an admin seat an
+        // accomplice above the actual owner.
+        if (body.role === 'owner' && auth.organizationRole !== 'owner') {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'Only owners can invite members as owner'
+            }, 403);
+        }
         const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
         if (!roleRow) {
             return c.json({
@@ -67,7 +80,10 @@ export const organizationsInvitationsRouter = new Hono()
             }
         }
         const existingInvitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
-        const pendingInvitation = existingInvitations.find((inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null);
+        const sameEmail = existingInvitations.filter((inv) => inv.email.toLowerCase() === body.email.toLowerCase());
+        // Arrow, not point-free: `.find(isPendingInvitation)` would pass the array
+        // index as the `now` argument.
+        const pendingInvitation = sameEmail.find((inv) => isPendingInvitation(inv));
         if (pendingInvitation) {
             return c.json({
                 success: false,
@@ -75,6 +91,19 @@ export const organizationsInvitationsRouter = new Hono()
                 message: 'This email has already been invited to the organization'
             }, 400);
         }
+        // Clear lapsed invitations for this address so re-inviting replaces rather
+        // than accumulates. `isStaleInvitation` deliberately spares accepted ones —
+        // those are the record that somebody joined by invitation. Best-effort: a
+        // stale row is inert to every other path, so failing to tidy up shouldn't
+        // block the invitation actually being asked for.
+        for (const stale of sameEmail.filter((inv) => isStaleInvitation(inv))) {
+            try {
+                await databaseAdapter.deleteInvitation(stale.id, auth.organizationId);
+            }
+            catch (error) {
+                cmsLogger.warn('Failed to clear expired invitation:', error);
+            }
+        }
         const token = crypto.randomUUID();
         const invitation = await databaseAdapter.createInvitation({
             organizationId: auth.organizationId,
@@ -82,7 +111,7 @@ export const organizationsInvitationsRouter = new Hono()
             role: body.role,
             invitedBy: auth.user.id,
             token,
-            expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
+            expiresAt: invitationExpiryFrom()
         });
         return c.json({
             success: true,

package/dist/server/api/routes/resolve-organization-names.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseAdapter } from '../../../db/interfaces/index.js';
+/**
+ * Resolve `organizationId` on a list of rows to the organization's name.
+ *
+ * Only needed by the instance-wide history views, where rows from several tenants sit in one
+ * table and a bare uuid tells a super admin nothing about which customer is affected. The
+ * org-scoped views skip this entirely — every row belongs to the org you're already in.
+ *
+ * Lookups are deduped and run in parallel; an org that can't be read resolves to `null`
+ * rather than failing the page, since a missing name is cosmetic and a 500 is not.
+ */
+export declare function withOrganizationNames<T extends {
+    organizationId: string;
+}>(rows: T[], db: DatabaseAdapter): Promise<Array<T & {
+    organizationName: string | null;
+}>>;
+//# sourceMappingURL=resolve-organization-names.d.ts.map

package/dist/server/api/routes/resolve-organization-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-organization-names.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/resolve-organization-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,EAC/E,IAAI,EAAE,CAAC,EAAE,EACT,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG;IAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgBzD"}

package/dist/server/api/routes/resolve-organization-names.js

@@ -0,0 +1,25 @@
+/**
+ * Resolve `organizationId` on a list of rows to the organization's name.
+ *
+ * Only needed by the instance-wide history views, where rows from several tenants sit in one
+ * table and a bare uuid tells a super admin nothing about which customer is affected. The
+ * org-scoped views skip this entirely — every row belongs to the org you're already in.
+ *
+ * Lookups are deduped and run in parallel; an org that can't be read resolves to `null`
+ * rather than failing the page, since a missing name is cosmetic and a 500 is not.
+ */
+export async function withOrganizationNames(rows, db) {
+    const ids = [...new Set(rows.map((r) => r.organizationId))];
+    const names = new Map();
+    await Promise.all(ids.map(async (id) => {
+        try {
+            const org = await db.findOrganizationById(id);
+            if (org)
+                names.set(id, org.name);
+        }
+        catch {
+            // Unreadable org — leave the name null and show the id.
+        }
+    }));
+    return rows.map((r) => ({ ...r, organizationName: names.get(r.organizationId) ?? null }));
+}

package/dist/server/api/routes/user.d.ts

@@ -1,12 +1,4 @@
 import { Hono } from 'hono';
 import type { AphexEnv } from '../index.js';
-/**
- * User account routes that delegate to the configured AuthProvider.
- *
- * cms-core ships these as Hono routers so studio doesn't need to maintain
- * SvelteKit `+server.ts` files for them. The wire format and side effects
- * (e.g. the password-reset email) are owned by the AuthProvider impl —
- * cms-core's role is just to expose them over HTTP.
- */
 export declare const userRouter: Hono<AphexEnv>;
 //# sourceMappingURL=user.d.ts.map

package/dist/server/api/routes/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA2JpC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAoJzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAmNpC,CAAC"}