@aphexcms/cms-core 9.8.0 → 9.9.0

package/dist/server/api/routes/user.js

@@ -2,6 +2,47 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest } from '../../../api/schemas/user.js';
+import { RateLimiter, clientAddress } from '../rate-limit.js';
+// Throttles for the two unauthenticated facades below. Both call the auth provider
+// *server-side*, which bypasses the provider's own HTTP rate limiter entirely (it only
+// engages for calls carrying a real request) — so without these they are unlimited.
+//
+// Two buckets per endpoint, because either one alone is porous: the address bucket stops
+// one host hammering many mailboxes, and the email/token bucket still holds when the
+// address is forged, which `x-forwarded-for` always permits.
+const RESET_REQUEST_WINDOW_MS = 60_000;
+const resetRequestByAddress = new RateLimiter({ windowMs: RESET_REQUEST_WINDOW_MS, max: 5 });
+// Tighter than the address bucket: nobody legitimately asks for the same mailbox's reset
+// link three times a minute, and this is the half an attacker can't sidestep.
+const resetRequestByEmail = new RateLimiter({ windowMs: RESET_REQUEST_WINDOW_MS, max: 2 });
+// The redemption side is a token-guessing surface rather than an email one, so it's keyed
+// on the address and on the token itself — a single token being retried is the signature of
+// a brute-force attempt, not of a user clicking their link again.
+const RESET_SUBMIT_WINDOW_MS = 60_000;
+const resetSubmitByAddress = new RateLimiter({ windowMs: RESET_SUBMIT_WINDOW_MS, max: 10 });
+const resetSubmitByToken = new RateLimiter({ windowMs: RESET_SUBMIT_WINDOW_MS, max: 5 });
+/**
+ * Apply every bucket and return a 429 response if any of them is exhausted.
+ *
+ * All buckets are consumed, not short-circuited: a request that trips the first limit must
+ * still count against the others, or an attacker could keep a secondary bucket permanently
+ * fresh by deliberately tripping the primary one.
+ */
+function enforceRateLimits(c, checks) {
+    let retryAfter = 0;
+    for (const { limiter, key } of checks) {
+        const result = limiter.check(key);
+        if (!result.allowed)
+            retryAfter = Math.max(retryAfter, result.retryAfterSeconds);
+    }
+    if (retryAfter === 0)
+        return null;
+    return c.json({
+        success: false,
+        error: 'Too many requests',
+        message: `Too many attempts. Try again in ${retryAfter} second${retryAfter === 1 ? '' : 's'}.`
+    }, 429, { 'Retry-After': String(retryAfter) });
+}
 /**
  * User account routes that delegate to the configured AuthProvider.
  *
@@ -10,6 +51,72 @@ import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest }
  * (e.g. the password-reset email) are owned by the AuthProvider impl —
  * cms-core's role is just to expose them over HTTP.
  */
+/**
+ * Avatars are stored as the CDN path `/media/<assetId>/<filename>`, which is what
+ * makes the underlying asset recoverable from the profile field. Anything else —
+ * an absolute storage URL from before this format, or an external provider's
+ * avatar — has no asset of ours behind it and is left alone.
+ */
+function avatarAssetId(image) {
+    return /^\/media\/([^/]+)\//.exec(image)?.[1] ?? null;
+}
+/**
+ * Is `assetId` an asset this user uploaded as their own avatar?
+ *
+ * The gate on both pointing the profile field at an asset and deleting the one
+ * it used to point at. Both checks read *server-written* facts only:
+ *
+ * - `createdBy` is stamped from the session by the upload route, so it can't be
+ *   forged onto somebody else's asset.
+ * - `metadata.system` marks the asset as hidden infrastructure rather than
+ *   content, which is what an avatar is.
+ *
+ * Without this, `image` was simply a string the client chose: an attacker could
+ * point their avatar at any asset in the organization and then change it again,
+ * and the replace-cleanup below would delete that asset for them — a delete with
+ * none of the `asset.delete` capability checks the assets API enforces, usable
+ * by any authenticated user including a viewer.
+ */
+async function isOwnAvatarAsset(assetService, organizationId, userId, assetId) {
+    const asset = await assetService.findAssetById(organizationId, assetId);
+    if (!asset || asset.createdBy !== userId)
+        return false;
+    const metadata = asset.metadata;
+    return (typeof metadata === 'object' &&
+        metadata !== null &&
+        metadata.system === true);
+}
+/**
+ * Delete the asset behind a superseded avatar.
+ *
+ * Server-side rather than in the client for two reasons. The `asset.delete`
+ * capability gates the assets API, so a viewer replacing their own avatar could
+ * never clean up after themselves — their old pictures would accumulate forever.
+ * And doing it here means every caller of this route inherits the behaviour
+ * instead of each one remembering to orchestrate it.
+ *
+ * Re-checks ownership rather than trusting that the stored value passed the
+ * inbound check: rows written before that check existed are still out there.
+ *
+ * Best-effort by design: the profile field has already moved, so a failure here
+ * leaks a file but never leaves a broken avatar. Failing the request would
+ * report the leak by making the user's save look broken, which is worse.
+ */
+async function discardAvatarAsset(assetService, organizationId, userId, image) {
+    const id = avatarAssetId(image);
+    if (!id)
+        return;
+    try {
+        if (!(await isOwnAvatarAsset(assetService, organizationId, userId, id))) {
+            cmsLogger.warn('[User API] Refusing to delete superseded avatar asset that is not the user’s own:', id);
+            return;
+        }
+        await assetService.deleteAsset(organizationId, id);
+    }
+    catch (error) {
+        cmsLogger.warn('[User API] Could not delete superseded avatar asset:', error);
+    }
+}
 export const userRouter = new Hono()
     .patch('/', zValidator('json', updateUserRequest, (result, c) => {
     if (!result.success) {
@@ -48,7 +155,31 @@ export const userRouter = new Hono()
                     error: 'Auth provider does not support profile image updates'
                 }, 500);
             }
+            // An avatar may only point at an asset this user uploaded as an avatar.
+            // `image` is a free-form string from the client, and the replace
+            // cleanup below deletes whatever the *previous* value pointed at — so
+            // without this, setting the field to another asset's path and then
+            // changing it again is an unauthenticated-by-capability delete of any
+            // asset in the organization. Non-asset values (an external provider's
+            // URL, or the absolute storage URLs avatars used to use) have no asset
+            // of ours behind them and pass through.
+            const incomingAssetId = image === null ? null : avatarAssetId(image);
+            if (incomingAssetId &&
+                !(await isOwnAvatarAsset(c.var.aphexCMS.assetService, auth.organizationId, auth.user.id, incomingAssetId))) {
+                return c.json({
+                    success: false,
+                    error: 'Forbidden',
+                    message: 'That image is not one of your uploaded avatars'
+                }, 403);
+            }
+            // Read the outgoing avatar before overwriting the field — once it's
+            // gone the asset is unreachable, and an avatar nothing points at is
+            // personal data with no way left to find or erase it.
+            const current = await provider.getUserById(auth.user.id);
             await provider.changeUserImage(auth.user.id, image);
+            if (current?.image && current.image !== image) {
+                await discardAvatarAsset(c.var.aphexCMS.assetService, auth.organizationId, auth.user.id, current.image);
+            }
         }
         return c.json({ success: true, message: 'User updated successfully' });
     }
@@ -77,6 +208,13 @@ export const userRouter = new Hono()
             return c.json({ success: false, error: 'Auth provider not configured' }, 500);
         }
         const { email, redirectTo } = c.req.valid('json');
+        // Keyed on the normalized address so casing/whitespace can't mint a fresh bucket.
+        const limited = enforceRateLimits(c, [
+            { limiter: resetRequestByAddress, key: clientAddress(c.req.raw.headers) },
+            { limiter: resetRequestByEmail, key: email.trim().toLowerCase() }
+        ]);
+        if (limited)
+            return limited;
         await provider.requestPasswordReset(email, redirectTo);
         // Constant response shape regardless of whether the email exists,
         // to avoid account enumeration via the API.
@@ -110,6 +248,12 @@ export const userRouter = new Hono()
             return c.json({ success: false, error: 'Auth provider not configured' }, 500);
         }
         const { token, newPassword } = c.req.valid('json');
+        const limited = enforceRateLimits(c, [
+            { limiter: resetSubmitByAddress, key: clientAddress(c.req.raw.headers) },
+            { limiter: resetSubmitByToken, key: token }
+        ]);
+        if (limited)
+            return limited;
         await provider.resetPassword(token, newPassword);
         return c.json({ success: true, message: 'Password reset successfully' });
     }

package/dist/server/index.d.ts

@@ -4,6 +4,10 @@ export * from '../cache/index.js';
 export * from '../email/index.js';
 export * from '../ai/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
+export { isInstanceEmpty, canDetermineInstanceEmptiness } from '../auth/instance-state.js';
+export * from '../auth/bootstrap.js';
+export * from '../auth/sign-up-policy.js';
+export * from '../auth/account-deletion.js';
 export { createCMSConfig } from '../config.js';
 export { cmsLogger, setLogger, type Logger } from '../utils/logger.js';
 export { CMSEngine } from '../engine.js';
@@ -17,11 +21,12 @@ export { AssetService } from '../services/asset-service.js';
 export { RolesService } from '../services/roles-service.js';
 export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
 export { createAphexApi, mountAphexBuiltins, toHonoHandler, type AphexEnv } from './api/index.js';
+export { RateLimiter, clientAddress, type RateLimitRule, type RateLimitResult } from './api/rate-limit.js';
 export * from '../jobs/index.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';
 export { getPreviewPerspective, type PreviewPerspective } from '../preview/perspective.js';
 export { createGraphQLHandler, type GraphQLConfig, type GraphQLSettings, type GraphQLHandlerResult } from '../graphql/index.js';
-export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext, type Collections, type SingletonCollection, type LocalAPIContext, type CreateOptions, type UpdateOptions } from '../local-api/index.js';
+export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, DocumentValidationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext, type Collections, type SingletonCollection, type LocalAPIContext, type CreateOptions, type UpdateOptions } from '../local-api/index.js';
 export { buildContentTools, type McpTool, type McpToolResult, type McpToolDeps } from '../mcp/tools.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACxF,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK/F,OAAO,EACN,WAAW,EACX,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,MAAM,kBAAkB,CAAC;AAG1B,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}

package/dist/server/index.js

@@ -8,6 +8,10 @@ export * from '../email/index.js';
 export * from '../ai/index.js';
 // Authentication errors
 export { AuthError } from '../auth/auth-errors.js';
+export { isInstanceEmpty, canDetermineInstanceEmptiness } from '../auth/instance-state.js';
+export * from '../auth/bootstrap.js';
+export * from '../auth/sign-up-policy.js';
+export * from '../auth/account-deletion.js';
 // Configuration system
 export { createCMSConfig } from '../config.js';
 // Logger
@@ -33,6 +37,10 @@ export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
 // Hono API app — exposed so user apps (and tests) can construct or extend
 // the same router the SK catch-all forwards to.
 export { createAphexApi, mountAphexBuiltins, toHonoHandler } from './api/index.js';
+// Fixed-window throttle for unauthenticated endpoints. Exposed because an app adding its own
+// public route needs the same guard the password-reset facades use — and because the caveat
+// travels with it: this is per-process memory, so N instances give N× the configured limit.
+export { RateLimiter, clientAddress } from './api/rate-limit.js';
 // Job execution — the DB-backed job runner (claim → run handler → complete/retry/fail).
 export * from '../jobs/index.js';
 // Schema utilities
@@ -44,7 +52,7 @@ export { getPreviewPerspective } from '../preview/perspective.js';
 // GraphQL (built-in, enabled by default)
 export { createGraphQLHandler } from '../graphql/index.js';
 // Local API (unified operations layer)
-export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext } from '../local-api/index.js';
+export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, DocumentValidationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext } from '../local-api/index.js';
 // MCP — transport-agnostic tool registry (the MCP route + a future AI panel
 // both consume these). The SvelteKit route handler is at ./routes/mcp.
 export { buildContentTools } from '../mcp/tools.js';

package/dist/services/references-service.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseAdapter } from '../db/interfaces.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
 import type { SchemaType } from '../types/schemas.js';
 /**
  * Maintains the back-reference index. After every doc save the collection-API

package/dist/services/references-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}
+{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}

package/dist/types/capabilities.d.ts

@@ -111,6 +111,20 @@ export declare function isInstanceRole(auth: Auth): boolean;
  * seed for the org role so behavior remains safe.
  */
 export declare function hasCapability(auth: Auth, capability: Capability | (string & {})): boolean;
+/**
+ * Expand an API key's coarse `read`/`write` scopes into capabilities.
+ *
+ * The compatibility path for keys issued before the capability model existed,
+ * and the default for keys created without an explicit allowlist.
+ *
+ * **This expansion is not itself a permission check.** It says what the scopes
+ * mean, not what the key's owner may actually do — the caller is responsible for
+ * intersecting the result with the owner's grantable set before trusting it, or
+ * a `write` key would confer `document.delete` to an owner whose role never had
+ * it. `AuthService.validateApiKey` does that clamp; anything else deriving
+ * capabilities from scopes must too.
+ */
+export declare function coarseApiKeyCapabilities(permissions: readonly string[]): string[];
 /**
  * Resolve the effective capability set for an Auth.
  *

package/dist/types/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,GAEd,wBAAwB,CAAC;AAM5B;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAiBxC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAM,GAClD,oBAAoB,CAOtB;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAiGlE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,GAAE,SAAS,oBAAoB,EAAO,GACzC,oBAAoB,EAAE,CAMxB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA6C5D,CAAC;AAeF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAI3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAEzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAoCnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,GAEd,wBAAwB,CAAC;AAM5B;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAiBxC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAM,GAClD,oBAAoB,CAOtB;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAiGlE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,GAAE,SAAS,oBAAoB,EAAO,GACzC,oBAAoB,EAAE,CAMxB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA6C5D,CAAC;AAeF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAI3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAEzF;AAgBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAwBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}

package/dist/types/capabilities.js

@@ -298,6 +298,37 @@ export function isInstanceRole(auth) {
 export function hasCapability(auth, capability) {
     return resolveCapabilities(auth).has(capability);
 }
+/** What the coarse `read` scope buys a key. */
+const API_KEY_READ_CAPABILITIES = ['document.read', 'asset.read'];
+/** What the coarse `write` scope adds on top. */
+const API_KEY_WRITE_CAPABILITIES = [
+    'document.create',
+    'document.update',
+    'document.delete',
+    'document.publish',
+    'document.unpublish',
+    'asset.upload',
+    'asset.delete'
+];
+/**
+ * Expand an API key's coarse `read`/`write` scopes into capabilities.
+ *
+ * The compatibility path for keys issued before the capability model existed,
+ * and the default for keys created without an explicit allowlist.
+ *
+ * **This expansion is not itself a permission check.** It says what the scopes
+ * mean, not what the key's owner may actually do — the caller is responsible for
+ * intersecting the result with the owner's grantable set before trusting it, or
+ * a `write` key would confer `document.delete` to an owner whose role never had
+ * it. `AuthService.validateApiKey` does that clamp; anything else deriving
+ * capabilities from scopes must too.
+ */
+export function coarseApiKeyCapabilities(permissions) {
+    const caps = [...API_KEY_READ_CAPABILITIES];
+    if (permissions.includes('write'))
+        caps.push(...API_KEY_WRITE_CAPABILITIES);
+    return caps;
+}
 /**
  * Resolve the effective capability set for an Auth.
  *
@@ -318,25 +349,13 @@ export function resolveCapabilities(auth) {
     if (auth.type === 'session' && INSTANCE_ROLE_OVERRIDES.has(auth.user.role)) {
         return new Set(ALL_CAPABILITIES);
     }
+    // Reached only when the key carries no capability list at all — an explicit
+    // one, including an empty one, is authoritative and was returned above.
+    // "Empty" must mean *nothing*, never "fall back to the coarse set": an
+    // allowlist that a clamp stripped to nothing would otherwise resolve to more
+    // than it asked for.
     if (auth.type === 'api_key') {
-        // Explicit capability allowlist wins — lets operators issue keys scoped
-        // to exactly what they need (e.g. a key that can only publish one
-        // collection). Falls back to the coarse read/write mapping otherwise
-        // for keys issued before the capability model existed.
-        if (Array.isArray(auth.capabilities) && auth.capabilities.length > 0) {
-            return new Set(auth.capabilities);
-        }
-        const caps = new Set(['document.read', 'asset.read']);
-        if (auth.permissions.includes('write')) {
-            caps.add('document.create');
-            caps.add('document.update');
-            caps.add('document.delete');
-            caps.add('document.publish');
-            caps.add('document.unpublish');
-            caps.add('asset.upload');
-            caps.add('asset.delete');
-        }
-        return caps;
+        return new Set(coarseApiKeyCapabilities(auth.permissions));
     }
     // Session without pre-resolved capabilities → seed fallback.
     const builtin = BUILTIN_ROLE_SEED[auth.organizationRole];

package/dist/types/events.d.ts

@@ -113,17 +113,23 @@ export interface Page<T> {
     limit: number;
     offset: number;
 }
-/** Query for the read-only event history. Newest first. */
+/**
+ * Query for the read-only event history. Newest first.
+ *
+ * Omit `organizationId` to read across every organization — the instance-wide view.
+ * Only two callers may do that: the worker (which has override access by construction)
+ * and a super admin in the admin history view. Anything request-scoped must pass an id.
+ */
 export interface ListEventsOptions {
-    organizationId: string;
+    organizationId?: string;
     /** Filter by exact event type (e.g. `document.published`). */
     type?: string;
     limit?: number;
     offset?: number;
 }
-/** Query for the read-only job history. Newest first. */
+/** Query for the read-only job history. Newest first. Omitting `organizationId` reads instance-wide — see `ListEventsOptions`. */
 export interface ListJobsOptions {
-    organizationId: string;
+    organizationId?: string;
     /** Filter by one status or several (e.g. only `failed`). */
     status?: JobStatus | JobStatus[];
     /** Filter by exact job type. */
@@ -131,4 +137,21 @@ export interface ListJobsOptions {
     limit?: number;
     offset?: number;
 }
+/**
+ * The relay's backlog, as a health signal.
+ *
+ * This is the one number that distinguishes "nothing happened" from "nothing is being
+ * processed". Jobs and events both look quiet-but-healthy when no worker is calling
+ * `POST /api/internal/workers/run`; a growing outbox backlog is the only place that
+ * shows up, because emission still writes rows that nobody is draining.
+ *
+ * `oldestPendingAt` matters more than `pending`: a big count that is seconds old is a
+ * busy instance, while a single row an hour old means the relay has stopped.
+ */
+export interface OutboxHealth {
+    /** Rows with `processedAt IS NULL`. */
+    pending: number;
+    /** `createdAt` of the oldest unprocessed row, or null when the backlog is empty. */
+    oldestPendingAt: Date | null;
+}
 //# sourceMappingURL=events.d.ts.map

package/dist/types/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/lib/types/events.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,IAAI,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACX;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,kGAAkG;AAClG,MAAM,WAAW,IAAI,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/lib/types/events.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,IAAI,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACX;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,kGAAkG;AAClG,MAAM,WAAW,IAAI,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kIAAkI;AAClI,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC5B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B"}

package/dist/utils/fetch-remote-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-remote-file.d.ts","sourceRoot":"","sources":["../../src/lib/utils/fetch-remote-file.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AA6EtD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;sBAGsB;AACtB,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAuEtE"}
+{"version":3,"file":"fetch-remote-file.d.ts","sourceRoot":"","sources":["../../src/lib/utils/fetch-remote-file.ts"],"names":[],"mappings":"AA8CA,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AA6EtD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;sBAGsB;AACtB,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0EtE"}

package/dist/utils/fetch-remote-file.js

@@ -11,7 +11,35 @@
 // that gets validated and the address that gets connected to must be the exact same one.
 import { lookup } from 'node:dns/promises';
 import net from 'node:net';
-import { Agent, fetch as undiciFetch } from 'undici';
+// Loading `undici` is deferred, and Node's own dispatcher is forced into place first. That
+// ordering is the whole point of this function, and getting it wrong breaks something far away:
+//
+// Node's built-in fetch and the userland `undici` package share one slot —
+// `globalThis[Symbol.for('undici.globalDispatcher.1')]` — and whoever writes it first wins.
+// Importing `undici` claims that slot if it's still empty, and on Node 24+ the *built-in* fetch
+// then routes through this bundled userland copy (as a `Dispatcher1Wrapper`). Its stricter
+// `processHeader` rejects an explicit `content-length`, which the S3 client sets on every PUT — so
+// merely importing this module killed every S3/R2 upload in the process with "invalid
+// content-length header".
+//
+// The slot is non-configurable once set, and Node caches its wrapper internally, so this can't be
+// undone after the fact: writing the symbol back (even to `undefined`) leaves fetch broken. The
+// only fix is to not lose the race. A `data:` fetch resolves entirely in-process — no socket, no
+// DNS — and is enough to make Node install its dispatcher, after which undici's import leaves the
+// slot alone and both work.
+//
+// This module hangs off the `/server` barrel (server/index.ts → mcp/tools → here), so with a
+// static `import` every Aphex app broke its own uploads at boot. It only showed in production:
+// `vite dev` loads SSR modules lazily, so a real request usually primed Node's dispatcher first,
+// while a production build imports the graph eagerly at startup and undici gets there first.
+let undiciPromise;
+function loadUndici() {
+    undiciPromise ??= (async () => {
+        await fetch('data:text/plain,0').catch(() => undefined);
+        return import('undici');
+    })();
+    return undiciPromise;
+}
 export const MAX_REMOTE_FILE_BYTES = 10 * 1024 * 1024; // matches the API's global JSON body cap
 const FETCH_TIMEOUT_MS = 10_000;
 const MAX_REDIRECTS = 5;
@@ -79,7 +107,7 @@ async function resolvePinnedHost(hostname) {
  * whatever hostname undici asks it to resolve, it hands back this exact IP, so the socket that
  * actually opens is guaranteed to be the one that passed `isPrivateOrReservedIp`. The hostname
  * itself still flows through normally for the Host header and TLS SNI/cert validation. */
-function pinnedDispatcher(host) {
+function pinnedDispatcher(Agent, host) {
     return new Agent({
         connect: {
             lookup: (_hostname, options, callback) => {
@@ -94,6 +122,7 @@ function pinnedDispatcher(host) {
  * hop), a request timeout, and a streamed size cap (not just a Content-Length check, since that
  * header can lie). */
 export async function fetchRemoteFile(url) {
+    const { Agent, fetch: undiciFetch } = await loadUndici();
     let current = url;
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
         const parsed = new URL(current);
@@ -112,7 +141,7 @@ export async function fetchRemoteFile(url) {
                 res = await undiciFetch(current, {
                     redirect: 'manual',
                     signal: controller.signal,
-                    dispatcher: pinnedDispatcher(pinnedHost),
+                    dispatcher: pinnedDispatcher(Agent, pinnedHost),
                     headers: REQUEST_HEADERS
                 });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aphexcms/cms-core",
-  "version": "9.8.0",
+  "version": "9.9.0",
   "description": "Aphex CMS Core - A Sanity-style CMS with ports and adapters architecture",
   "publishConfig": {
     "access": "public",
@@ -82,7 +82,7 @@
     "svelte": "^5.44.0",
     "tailwind-merge": "^3.4.0",
     "tailwind-variants": "^3.2.2",
-    "@aphexcms/ui": "^0.8.3"
+    "@aphexcms/ui": "^0.8.5"
   },
   "peerDependenciesMeta": {
     "graphql": {
@@ -115,10 +115,10 @@
     "dayjs": "^1.11.19",
     "dompurify": "^3.4.12",
     "esbuild": "^0.27.0",
-    "hono": "^4.12.15",
+    "hono": "^4.12.34",
     "marked": "^18.0.7",
     "picocolors": "^1.1.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "svelte-sonner": "^1.0.7",
     "tsx": "^4.20.6",
     "undici": "^8.9.0",
@@ -129,7 +129,7 @@
     "@eslint/js": "^9.39.1",
     "@internationalized/date": "^3.10.0",
     "@sveltejs/adapter-auto": "^7.0.0",
-    "@sveltejs/kit": "^2.59.1",
+    "@sveltejs/kit": "^2.70.2",
     "@sveltejs/package": "^2.5.6",
     "@sveltejs/vite-plugin-svelte": "^7.0.0",
     "@tailwindcss/vite": "^4.3.0",
@@ -147,7 +147,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.0",
     "vite": "^8.1.5",
-    "vitest": "^4.0.14"
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "build": "svelte-package && tsc && node ../../scripts/fix-imports.js ./dist",