@aphexcms/cms-core 9.8.0 → 9.9.0

package/dist/lib/server/api/routes/organizations-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-by-id.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,MAAM,CAAC,MAAM,uBAAuB,GAAmB,IAAI,IAAI,EAAY;KACzE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,2CAA2C;aACpD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,KAAK,CACL,MAAM,EACN,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4DAA4D;aACrE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,kBAAkB;iBAC/D,EACD,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,UAAU,GAIZ,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErE,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3B,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,wCAAwC;aACjD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,WAAW,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,eAAe,CAAC,iBAAiB,CACtC,MAAM,CAAC,MAAM,EACb,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxD,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAE7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,CAAC"}
+{"version":3,"file":"organizations-by-id.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG7D,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACrC,YAMC,EACD,cAAsB;IAEtB,SAAS,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE;YAC1D,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,CAAC;SACT,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE9B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzD,MAAM,EAAE,CAAC;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAChF,CAAC;QACF,CAAC;QAED,8EAA8E;QAC9E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YAClB,SAAS,CAAC,KAAK,CACd,kCAAkC,cAAc,KAAK,IAAI,CAAC,MAAM,oCAAoC,CACpG,CAAC;YACF,OAAO;QACR,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAmB,IAAI,IAAI,EAAY;KACzE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,2CAA2C;aACpD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,KAAK,CACL,MAAM,EACN,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAE9E,uEAAuE;QACvE,oEAAoE;QACpE,0EAA0E;QAC1E,gEAAgE;QAChE,yEAAyE;QACzE,IAAI,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,kBAAkB,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACnF,eAAe,GAAG,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4DAA4D;aACrE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,kBAAkB;iBAC/D,EACD,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,UAAU,GAIZ,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErE,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3B,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,wCAAwC;aACjD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,WAAW,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,eAAe,CAAC,iBAAiB,CACtC,MAAM,CAAC,MAAM,EACb,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxD,CAAC;YACF,CAAC;QACF,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAE7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,CAAC"}

package/dist/lib/server/api/routes/organizations-invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4MxD,CAAC"}
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA4OxD,CAAC"}

package/dist/lib/server/api/routes/organizations-invitations.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { inviteMemberRequest, cancelInvitationRequest } from '../../../api/schemas/organizations.js';
 import { hasCapability } from '../../../types/capabilities.js';
+import { isPendingInvitation, isStaleInvitation, invitationExpiryFrom } from '../../../auth/invitation-status.js';
 /**
  * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
  * that adds email sending after the invite row is created. While that
@@ -38,6 +39,18 @@ export const organizationsInvitationsRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
+        // The same restriction the member role-change route enforces, and for
+        // the same reason: `member.changeRole` refuses to promote anyone to
+        // owner, so admins must not be able to reach the same place by inviting
+        // a brand-new one instead — that detour would let an admin seat an
+        // accomplice above the actual owner.
+        if (body.role === 'owner' && auth.organizationRole !== 'owner') {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'Only owners can invite members as owner'
+            }, 403);
+        }
         const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
         if (!roleRow) {
             return c.json({
@@ -67,7 +80,10 @@ export const organizationsInvitationsRouter = new Hono()
             }
         }
         const existingInvitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
-        const pendingInvitation = existingInvitations.find((inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null);
+        const sameEmail = existingInvitations.filter((inv) => inv.email.toLowerCase() === body.email.toLowerCase());
+        // Arrow, not point-free: `.find(isPendingInvitation)` would pass the array
+        // index as the `now` argument.
+        const pendingInvitation = sameEmail.find((inv) => isPendingInvitation(inv));
         if (pendingInvitation) {
             return c.json({
                 success: false,
@@ -75,6 +91,19 @@ export const organizationsInvitationsRouter = new Hono()
                 message: 'This email has already been invited to the organization'
             }, 400);
         }
+        // Clear lapsed invitations for this address so re-inviting replaces rather
+        // than accumulates. `isStaleInvitation` deliberately spares accepted ones —
+        // those are the record that somebody joined by invitation. Best-effort: a
+        // stale row is inert to every other path, so failing to tidy up shouldn't
+        // block the invitation actually being asked for.
+        for (const stale of sameEmail.filter((inv) => isStaleInvitation(inv))) {
+            try {
+                await databaseAdapter.deleteInvitation(stale.id, auth.organizationId);
+            }
+            catch (error) {
+                cmsLogger.warn('Failed to clear expired invitation:', error);
+            }
+        }
         const token = crypto.randomUUID();
         const invitation = await databaseAdapter.createInvitation({
             organizationId: auth.organizationId,
@@ -82,7 +111,7 @@ export const organizationsInvitationsRouter = new Hono()
             role: body.role,
             invitedBy: auth.user.id,
             token,
-            expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
+            expiresAt: invitationExpiryFrom()
         });
         return c.json({
             success: true,

package/dist/lib/server/api/routes/organizations-invitations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations-invitations.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAmB,IAAI,IAAI,EAAY;KAChF,IAAI,CACJ,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,8CAA8C;aACvD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,wBAAwB;aAC5D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,4BAA4B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,YAAY,EAAE,CAAC;gBAClB,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAClE,YAAY,CAAC,EAAE,EACf,IAAI,CAAC,cAAc,CACnB,CAAC;gBACF,IAAI,kBAAkB,EAAE,CAAC;oBACxB,OAAO,CAAC,CAAC,IAAI,CACZ;wBACC,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,kBAAkB;wBACzB,OAAO,EAAE,mDAAmD;qBAC5D,EACD,GAAG,CACH,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,2BAA2B,CAC5E,IAAI,CAAC,cAAc,CACnB,CAAC;QACF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CACxF,CAAC;QAEF,IAAI,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,yDAAyD;aAClE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;YACzD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kCAAkC;SAC3C,EACD,GAAG,CACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CACN,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kDAAkD;aAC3D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,gBAAgB,CACrD,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,cAAc,CACnB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}
+{"version":3,"file":"organizations-invitations.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACN,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,iCAAiC,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAmB,IAAI,IAAI,EAAY;KAChF,IAAI,CACJ,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,8CAA8C;aACvD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,yCAAyC;aAClD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,wBAAwB;aAC5D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,4BAA4B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,YAAY,EAAE,CAAC;gBAClB,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAClE,YAAY,CAAC,EAAE,EACf,IAAI,CAAC,cAAc,CACnB,CAAC;gBACF,IAAI,kBAAkB,EAAE,CAAC;oBACxB,OAAO,CAAC,CAAC,IAAI,CACZ;wBACC,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,kBAAkB;wBACzB,OAAO,EAAE,mDAAmD;qBAC5D,EACD,GAAG,CACH,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,2BAA2B,CAC5E,IAAI,CAAC,cAAc,CACnB,CAAC;QACF,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAC7D,CAAC;QACF,2EAA2E;QAC3E,+BAA+B;QAC/B,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5E,IAAI,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,yDAAyD;aAClE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,iDAAiD;QACjD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC;gBACJ,MAAM,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;YACzD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,KAAK;YACL,SAAS,EAAE,oBAAoB,EAAE;SACjC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kCAAkC;SAC3C,EACD,GAAG,CACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CACN,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kDAAkD;aAC3D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,gBAAgB,CACrD,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,cAAc,CACnB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/resolve-organization-names.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseAdapter } from '../../../db/interfaces/index.js';
+/**
+ * Resolve `organizationId` on a list of rows to the organization's name.
+ *
+ * Only needed by the instance-wide history views, where rows from several tenants sit in one
+ * table and a bare uuid tells a super admin nothing about which customer is affected. The
+ * org-scoped views skip this entirely — every row belongs to the org you're already in.
+ *
+ * Lookups are deduped and run in parallel; an org that can't be read resolves to `null`
+ * rather than failing the page, since a missing name is cosmetic and a 500 is not.
+ */
+export declare function withOrganizationNames<T extends {
+    organizationId: string;
+}>(rows: T[], db: DatabaseAdapter): Promise<Array<T & {
+    organizationName: string | null;
+}>>;
+//# sourceMappingURL=resolve-organization-names.d.ts.map

package/dist/lib/server/api/routes/resolve-organization-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-organization-names.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/resolve-organization-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,EAC/E,IAAI,EAAE,CAAC,EAAE,EACT,EAAE,EAAE,eAAe,GACjB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG;IAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgBzD"}

package/dist/lib/server/api/routes/resolve-organization-names.js

@@ -0,0 +1,26 @@
+/**
+ * Resolve `organizationId` on a list of rows to the organization's name.
+ *
+ * Only needed by the instance-wide history views, where rows from several tenants sit in one
+ * table and a bare uuid tells a super admin nothing about which customer is affected. The
+ * org-scoped views skip this entirely — every row belongs to the org you're already in.
+ *
+ * Lookups are deduped and run in parallel; an org that can't be read resolves to `null`
+ * rather than failing the page, since a missing name is cosmetic and a 500 is not.
+ */
+export async function withOrganizationNames(rows, db) {
+    const ids = [...new Set(rows.map((r) => r.organizationId))];
+    const names = new Map();
+    await Promise.all(ids.map(async (id) => {
+        try {
+            const org = await db.findOrganizationById(id);
+            if (org)
+                names.set(id, org.name);
+        }
+        catch {
+            // Unreadable org — leave the name null and show the id.
+        }
+    }));
+    return rows.map((r) => ({ ...r, organizationName: names.get(r.organizationId) ?? null }));
+}
+//# sourceMappingURL=resolve-organization-names.js.map

package/dist/lib/server/api/routes/resolve-organization-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-organization-names.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/resolve-organization-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,IAAS,EACT,EAAmB;IAEnB,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExC,MAAM,OAAO,CAAC,GAAG,CAChB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACR,wDAAwD;QACzD,CAAC;IACF,CAAC,CAAC,CACF,CAAC;IAEF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/lib/server/api/routes/user.d.ts

@@ -1,12 +1,4 @@
 import { Hono } from 'hono';
 import type { AphexEnv } from '../index.js';
-/**
- * User account routes that delegate to the configured AuthProvider.
- *
- * cms-core ships these as Hono routers so studio doesn't need to maintain
- * SvelteKit `+server.ts` files for them. The wire format and side effects
- * (e.g. the password-reset email) are owned by the AuthProvider impl —
- * cms-core's role is just to expose them over HTTP.
- */
 export declare const userRouter: Hono<AphexEnv>;
 //# sourceMappingURL=user.d.ts.map

package/dist/lib/server/api/routes/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA2JpC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAoJzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAmNpC,CAAC"}

package/dist/lib/server/api/routes/user.js

@@ -2,6 +2,47 @@ import { Hono } from 'hono';
 import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest } from '../../../api/schemas/user.js';
+import { RateLimiter, clientAddress } from '../rate-limit.js';
+// Throttles for the two unauthenticated facades below. Both call the auth provider
+// *server-side*, which bypasses the provider's own HTTP rate limiter entirely (it only
+// engages for calls carrying a real request) — so without these they are unlimited.
+//
+// Two buckets per endpoint, because either one alone is porous: the address bucket stops
+// one host hammering many mailboxes, and the email/token bucket still holds when the
+// address is forged, which `x-forwarded-for` always permits.
+const RESET_REQUEST_WINDOW_MS = 60_000;
+const resetRequestByAddress = new RateLimiter({ windowMs: RESET_REQUEST_WINDOW_MS, max: 5 });
+// Tighter than the address bucket: nobody legitimately asks for the same mailbox's reset
+// link three times a minute, and this is the half an attacker can't sidestep.
+const resetRequestByEmail = new RateLimiter({ windowMs: RESET_REQUEST_WINDOW_MS, max: 2 });
+// The redemption side is a token-guessing surface rather than an email one, so it's keyed
+// on the address and on the token itself — a single token being retried is the signature of
+// a brute-force attempt, not of a user clicking their link again.
+const RESET_SUBMIT_WINDOW_MS = 60_000;
+const resetSubmitByAddress = new RateLimiter({ windowMs: RESET_SUBMIT_WINDOW_MS, max: 10 });
+const resetSubmitByToken = new RateLimiter({ windowMs: RESET_SUBMIT_WINDOW_MS, max: 5 });
+/**
+ * Apply every bucket and return a 429 response if any of them is exhausted.
+ *
+ * All buckets are consumed, not short-circuited: a request that trips the first limit must
+ * still count against the others, or an attacker could keep a secondary bucket permanently
+ * fresh by deliberately tripping the primary one.
+ */
+function enforceRateLimits(c, checks) {
+    let retryAfter = 0;
+    for (const { limiter, key } of checks) {
+        const result = limiter.check(key);
+        if (!result.allowed)
+            retryAfter = Math.max(retryAfter, result.retryAfterSeconds);
+    }
+    if (retryAfter === 0)
+        return null;
+    return c.json({
+        success: false,
+        error: 'Too many requests',
+        message: `Too many attempts. Try again in ${retryAfter} second${retryAfter === 1 ? '' : 's'}.`
+    }, 429, { 'Retry-After': String(retryAfter) });
+}
 /**
  * User account routes that delegate to the configured AuthProvider.
  *
@@ -10,6 +51,72 @@ import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest }
  * (e.g. the password-reset email) are owned by the AuthProvider impl —
  * cms-core's role is just to expose them over HTTP.
  */
+/**
+ * Avatars are stored as the CDN path `/media/<assetId>/<filename>`, which is what
+ * makes the underlying asset recoverable from the profile field. Anything else —
+ * an absolute storage URL from before this format, or an external provider's
+ * avatar — has no asset of ours behind it and is left alone.
+ */
+function avatarAssetId(image) {
+    return /^\/media\/([^/]+)\//.exec(image)?.[1] ?? null;
+}
+/**
+ * Is `assetId` an asset this user uploaded as their own avatar?
+ *
+ * The gate on both pointing the profile field at an asset and deleting the one
+ * it used to point at. Both checks read *server-written* facts only:
+ *
+ * - `createdBy` is stamped from the session by the upload route, so it can't be
+ *   forged onto somebody else's asset.
+ * - `metadata.system` marks the asset as hidden infrastructure rather than
+ *   content, which is what an avatar is.
+ *
+ * Without this, `image` was simply a string the client chose: an attacker could
+ * point their avatar at any asset in the organization and then change it again,
+ * and the replace-cleanup below would delete that asset for them — a delete with
+ * none of the `asset.delete` capability checks the assets API enforces, usable
+ * by any authenticated user including a viewer.
+ */
+async function isOwnAvatarAsset(assetService, organizationId, userId, assetId) {
+    const asset = await assetService.findAssetById(organizationId, assetId);
+    if (!asset || asset.createdBy !== userId)
+        return false;
+    const metadata = asset.metadata;
+    return (typeof metadata === 'object' &&
+        metadata !== null &&
+        metadata.system === true);
+}
+/**
+ * Delete the asset behind a superseded avatar.
+ *
+ * Server-side rather than in the client for two reasons. The `asset.delete`
+ * capability gates the assets API, so a viewer replacing their own avatar could
+ * never clean up after themselves — their old pictures would accumulate forever.
+ * And doing it here means every caller of this route inherits the behaviour
+ * instead of each one remembering to orchestrate it.
+ *
+ * Re-checks ownership rather than trusting that the stored value passed the
+ * inbound check: rows written before that check existed are still out there.
+ *
+ * Best-effort by design: the profile field has already moved, so a failure here
+ * leaks a file but never leaves a broken avatar. Failing the request would
+ * report the leak by making the user's save look broken, which is worse.
+ */
+async function discardAvatarAsset(assetService, organizationId, userId, image) {
+    const id = avatarAssetId(image);
+    if (!id)
+        return;
+    try {
+        if (!(await isOwnAvatarAsset(assetService, organizationId, userId, id))) {
+            cmsLogger.warn('[User API] Refusing to delete superseded avatar asset that is not the user’s own:', id);
+            return;
+        }
+        await assetService.deleteAsset(organizationId, id);
+    }
+    catch (error) {
+        cmsLogger.warn('[User API] Could not delete superseded avatar asset:', error);
+    }
+}
 export const userRouter = new Hono()
     .patch('/', zValidator('json', updateUserRequest, (result, c) => {
     if (!result.success) {
@@ -48,7 +155,31 @@ export const userRouter = new Hono()
                     error: 'Auth provider does not support profile image updates'
                 }, 500);
             }
+            // An avatar may only point at an asset this user uploaded as an avatar.
+            // `image` is a free-form string from the client, and the replace
+            // cleanup below deletes whatever the *previous* value pointed at — so
+            // without this, setting the field to another asset's path and then
+            // changing it again is an unauthenticated-by-capability delete of any
+            // asset in the organization. Non-asset values (an external provider's
+            // URL, or the absolute storage URLs avatars used to use) have no asset
+            // of ours behind them and pass through.
+            const incomingAssetId = image === null ? null : avatarAssetId(image);
+            if (incomingAssetId &&
+                !(await isOwnAvatarAsset(c.var.aphexCMS.assetService, auth.organizationId, auth.user.id, incomingAssetId))) {
+                return c.json({
+                    success: false,
+                    error: 'Forbidden',
+                    message: 'That image is not one of your uploaded avatars'
+                }, 403);
+            }
+            // Read the outgoing avatar before overwriting the field — once it's
+            // gone the asset is unreachable, and an avatar nothing points at is
+            // personal data with no way left to find or erase it.
+            const current = await provider.getUserById(auth.user.id);
             await provider.changeUserImage(auth.user.id, image);
+            if (current?.image && current.image !== image) {
+                await discardAvatarAsset(c.var.aphexCMS.assetService, auth.organizationId, auth.user.id, current.image);
+            }
         }
         return c.json({ success: true, message: 'User updated successfully' });
     }
@@ -77,6 +208,13 @@ export const userRouter = new Hono()
             return c.json({ success: false, error: 'Auth provider not configured' }, 500);
         }
         const { email, redirectTo } = c.req.valid('json');
+        // Keyed on the normalized address so casing/whitespace can't mint a fresh bucket.
+        const limited = enforceRateLimits(c, [
+            { limiter: resetRequestByAddress, key: clientAddress(c.req.raw.headers) },
+            { limiter: resetRequestByEmail, key: email.trim().toLowerCase() }
+        ]);
+        if (limited)
+            return limited;
         await provider.requestPasswordReset(email, redirectTo);
         // Constant response shape regardless of whether the email exists,
         // to avoid account enumeration via the API.
@@ -110,6 +248,12 @@ export const userRouter = new Hono()
             return c.json({ success: false, error: 'Auth provider not configured' }, 500);
         }
         const { token, newPassword } = c.req.valid('json');
+        const limited = enforceRateLimits(c, [
+            { limiter: resetSubmitByAddress, key: clientAddress(c.req.raw.headers) },
+            { limiter: resetSubmitByToken, key: token }
+        ]);
+        if (limited)
+            return limited;
         await provider.resetPassword(token, newPassword);
         return c.json({ success: true, message: 'Password reset successfully' });
     }

package/dist/lib/server/api/routes/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACN,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AAGnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB,IAAI,IAAI,EAAY;KAC5D,KAAK,CACL,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAErC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8BAA8B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sDAAsD;iBAC7D,EACD,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,yBAAyB,EACzB,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAEvD,kEAAkE;QAClE,4CAA4C;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,iBAAiB,EACjB,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAEjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;SAC5E,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACN,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG3D,mFAAmF;AACnF,uFAAuF;AACvF,oFAAoF;AACpF,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,6DAA6D;AAC7D,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,yFAAyF;AACzF,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE3F,0FAA0F;AAC1F,4FAA4F;AAC5F,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,oBAAoB,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5F,MAAM,kBAAkB,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF;;;;;;GAMG;AACH,SAAS,iBAAiB,CACzB,CAAmC,EACnC,MAAoD;IAEpD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,CAAC,CAAC,IAAI,CACZ;QACC,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,mCAAmC,UAAU,UAAU,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;KAC9F,EACD,GAAG,EACH,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACrC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACvD,CAAC;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,gBAAgB,CAC9B,YAAgC,EAChC,cAAsB,EACtB,MAAc,EACd,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QAChB,QAAiC,CAAC,MAAM,KAAK,IAAI,CAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAAgC,EAChC,cAAsB,EACtB,MAAc,EACd,KAAa;IAEb,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC;QACJ,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS,CAAC,IAAI,CACb,mFAAmF,EACnF,EAAE,CACF,CAAC;YACF,OAAO;QACR,CAAC;QACD,MAAM,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAmB,IAAI,IAAI,EAAY;KAC5D,KAAK,CACL,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAErC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8BAA8B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sDAAsD;iBAC7D,EACD,GAAG,CACH,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,iEAAiE;YACjE,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,wCAAwC;YACxC,MAAM,eAAe,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrE,IACC,eAAe;gBACf,CAAC,CAAC,MAAM,gBAAgB,CACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,IAAI,CAAC,EAAE,EACZ,eAAe,CACf,CAAC,EACD,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,gDAAgD;iBACzD,EACD,GAAG,CACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,MAAM,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC/C,MAAM,kBAAkB,CACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,IAAI,CAAC,EAAE,EACZ,OAAO,CAAC,KAAK,CACb,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,yBAAyB,EACzB,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElD,kFAAkF;QAClF,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAAE;YACpC,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACzE,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SACjE,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAEvD,kEAAkE;QAClE,4CAA4C;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,iBAAiB,EACjB,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAAE;YACpC,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACxE,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAEjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;SAC5E,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/index.d.ts

@@ -4,6 +4,10 @@ export * from '../cache/index.js';
 export * from '../email/index.js';
 export * from '../ai/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
+export { isInstanceEmpty, canDetermineInstanceEmptiness } from '../auth/instance-state.js';
+export * from '../auth/bootstrap.js';
+export * from '../auth/sign-up-policy.js';
+export * from '../auth/account-deletion.js';
 export { createCMSConfig } from '../config.js';
 export { cmsLogger, setLogger, type Logger } from '../utils/logger.js';
 export { CMSEngine } from '../engine.js';
@@ -17,11 +21,12 @@ export { AssetService } from '../services/asset-service.js';
 export { RolesService } from '../services/roles-service.js';
 export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
 export { createAphexApi, mountAphexBuiltins, toHonoHandler, type AphexEnv } from './api/index.js';
+export { RateLimiter, clientAddress, type RateLimitRule, type RateLimitResult } from './api/rate-limit.js';
 export * from '../jobs/index.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';
 export { getPreviewPerspective, type PreviewPerspective } from '../preview/perspective.js';
 export { createGraphQLHandler, type GraphQLConfig, type GraphQLSettings, type GraphQLHandlerResult } from '../graphql/index.js';
-export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext, type Collections, type SingletonCollection, type LocalAPIContext, type CreateOptions, type UpdateOptions } from '../local-api/index.js';
+export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, DocumentValidationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext, type Collections, type SingletonCollection, type LocalAPIContext, type CreateOptions, type UpdateOptions } from '../local-api/index.js';
 export { buildContentTools, type McpTool, type McpToolResult, type McpToolDeps } from '../mcp/tools.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACxF,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK/F,OAAO,EACN,WAAW,EACX,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,MAAM,kBAAkB,CAAC;AAG1B,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}

package/dist/lib/server/index.js

@@ -8,6 +8,10 @@ export * from '../email/index.js';
 export * from '../ai/index.js';
 // Authentication errors
 export { AuthError } from '../auth/auth-errors.js';
+export { isInstanceEmpty, canDetermineInstanceEmptiness } from '../auth/instance-state.js';
+export * from '../auth/bootstrap.js';
+export * from '../auth/sign-up-policy.js';
+export * from '../auth/account-deletion.js';
 // Configuration system
 export { createCMSConfig } from '../config.js';
 // Logger
@@ -33,6 +37,10 @@ export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
 // Hono API app — exposed so user apps (and tests) can construct or extend
 // the same router the SK catch-all forwards to.
 export { createAphexApi, mountAphexBuiltins, toHonoHandler } from './api/index.js';
+// Fixed-window throttle for unauthenticated endpoints. Exposed because an app adding its own
+// public route needs the same guard the password-reset facades use — and because the caveat
+// travels with it: this is per-process memory, so N instances give N× the configured limit.
+export { RateLimiter, clientAddress } from './api/rate-limit.js';
 // Job execution — the DB-backed job runner (claim → run handler → complete/retry/fail).
 export * from '../jobs/index.js';
 // Schema utilities
@@ -44,7 +52,7 @@ export { getPreviewPerspective } from '../preview/perspective.js';
 // GraphQL (built-in, enabled by default)
 export { createGraphQLHandler } from '../graphql/index.js';
 // Local API (unified operations layer)
-export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext } from '../local-api/index.js';
+export { LocalAPI, createLocalAPI, getLocalAPI, CollectionAPI, SingletonOperationError, DocumentValidationError, PermissionChecker, PermissionError, authToContext, requireAuth, systemContext } from '../local-api/index.js';
 // MCP — transport-agnostic tool registry (the MCP route + a future AI panel
 // both consume these). The SvelteKit route handler is at ./routes/mcp.
 export { buildContentTools } from '../mcp/tools.js';

package/dist/lib/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,+DAA+D;AAE/D,sDAAsD;AACtD,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAE5B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAsB,MAAM,qBAAqB,CAAC;AAEpE,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,SAAS;AACT,OAAO,EAAE,SAAS,EAAE,SAAS,EAAe,MAAM,iBAAiB,CAAC;AAEpE,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAqB,MAAM,UAAU,CAAC;AAExF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC,kCAAkC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAE7C,iDAAiD;AACjD,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,4EAA4E;AAC5E,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE5D,0EAA0E;AAC1E,gDAAgD;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAiB,MAAM,aAAa,CAAC;AAE/F,wFAAwF;AACxF,cAAc,eAAe,CAAC;AAE9B,mBAAmB;AACnB,cAAc,uBAAuB,CAAC;AAEtC,uCAAuC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,oBAAoB;AACpB,OAAO,EAAE,qBAAqB,EAA2B,MAAM,wBAAwB,CAAC;AAExF,yCAAyC;AACzC,OAAO,EACN,oBAAoB,EAIpB,MAAM,kBAAkB,CAAC;AAE1B,uCAAuC;AACvC,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EAMb,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,uEAAuE;AACvE,OAAO,EACN,iBAAiB,EAIjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,+DAA+D;AAE/D,sDAAsD;AACtD,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAE5B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAsB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACxF,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,SAAS;AACT,OAAO,EAAE,SAAS,EAAE,SAAS,EAAe,MAAM,iBAAiB,CAAC;AAEpE,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAqB,MAAM,UAAU,CAAC;AAExF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC,kCAAkC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAE7C,iDAAiD;AACjD,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,4EAA4E;AAC5E,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE5D,0EAA0E;AAC1E,gDAAgD;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAiB,MAAM,aAAa,CAAC;AAE/F,6FAA6F;AAC7F,4FAA4F;AAC5F,4FAA4F;AAC5F,OAAO,EACN,WAAW,EACX,aAAa,EAGb,MAAM,kBAAkB,CAAC;AAE1B,wFAAwF;AACxF,cAAc,eAAe,CAAC;AAE9B,mBAAmB;AACnB,cAAc,uBAAuB,CAAC;AAEtC,uCAAuC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,oBAAoB;AACpB,OAAO,EAAE,qBAAqB,EAA2B,MAAM,wBAAwB,CAAC;AAExF,yCAAyC;AACzC,OAAO,EACN,oBAAoB,EAIpB,MAAM,kBAAkB,CAAC;AAE1B,uCAAuC;AACvC,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EAMb,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,uEAAuE;AACvE,OAAO,EACN,iBAAiB,EAIjB,MAAM,cAAc,CAAC"}

package/dist/lib/services/references-service.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseAdapter } from '../db/interfaces.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
 import type { SchemaType } from '../types/schemas.js';
 /**
  * Maintains the back-reference index. After every doc save the collection-API

package/dist/lib/services/references-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}
+{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}

package/dist/lib/types/capabilities.d.ts

@@ -111,6 +111,20 @@ export declare function isInstanceRole(auth: Auth): boolean;
  * seed for the org role so behavior remains safe.
  */
 export declare function hasCapability(auth: Auth, capability: Capability | (string & {})): boolean;
+/**
+ * Expand an API key's coarse `read`/`write` scopes into capabilities.
+ *
+ * The compatibility path for keys issued before the capability model existed,
+ * and the default for keys created without an explicit allowlist.
+ *
+ * **This expansion is not itself a permission check.** It says what the scopes
+ * mean, not what the key's owner may actually do — the caller is responsible for
+ * intersecting the result with the owner's grantable set before trusting it, or
+ * a `write` key would confer `document.delete` to an owner whose role never had
+ * it. `AuthService.validateApiKey` does that clamp; anything else deriving
+ * capabilities from scopes must too.
+ */
+export declare function coarseApiKeyCapabilities(permissions: readonly string[]): string[];
 /**
  * Resolve the effective capability set for an Auth.
  *

package/dist/lib/types/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,GAEd,wBAAwB,CAAC;AAM5B;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAiBxC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAM,GAClD,oBAAoB,CAOtB;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAiGlE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,GAAE,SAAS,oBAAoB,EAAO,GACzC,oBAAoB,EAAE,CAMxB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA6C5D,CAAC;AAeF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAI3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAEzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAoCnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,GAEd,wBAAwB,CAAC;AAM5B;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAiBxC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAM,GAClD,oBAAoB,CAOtB;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAiGlE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,GAAE,SAAS,oBAAoB,EAAO,GACzC,oBAAoB,EAAE,CAMxB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA6C5D,CAAC;AAeF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAI3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAEzF;AAgBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAwBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}

package/dist/lib/types/capabilities.js

@@ -298,6 +298,37 @@ export function isInstanceRole(auth) {
 export function hasCapability(auth, capability) {
     return resolveCapabilities(auth).has(capability);
 }
+/** What the coarse `read` scope buys a key. */
+const API_KEY_READ_CAPABILITIES = ['document.read', 'asset.read'];
+/** What the coarse `write` scope adds on top. */
+const API_KEY_WRITE_CAPABILITIES = [
+    'document.create',
+    'document.update',
+    'document.delete',
+    'document.publish',
+    'document.unpublish',
+    'asset.upload',
+    'asset.delete'
+];
+/**
+ * Expand an API key's coarse `read`/`write` scopes into capabilities.
+ *
+ * The compatibility path for keys issued before the capability model existed,
+ * and the default for keys created without an explicit allowlist.
+ *
+ * **This expansion is not itself a permission check.** It says what the scopes
+ * mean, not what the key's owner may actually do — the caller is responsible for
+ * intersecting the result with the owner's grantable set before trusting it, or
+ * a `write` key would confer `document.delete` to an owner whose role never had
+ * it. `AuthService.validateApiKey` does that clamp; anything else deriving
+ * capabilities from scopes must too.
+ */
+export function coarseApiKeyCapabilities(permissions) {
+    const caps = [...API_KEY_READ_CAPABILITIES];
+    if (permissions.includes('write'))
+        caps.push(...API_KEY_WRITE_CAPABILITIES);
+    return caps;
+}
 /**
  * Resolve the effective capability set for an Auth.
  *
@@ -318,25 +349,13 @@ export function resolveCapabilities(auth) {
     if (auth.type === 'session' && INSTANCE_ROLE_OVERRIDES.has(auth.user.role)) {
         return new Set(ALL_CAPABILITIES);
     }
+    // Reached only when the key carries no capability list at all — an explicit
+    // one, including an empty one, is authoritative and was returned above.
+    // "Empty" must mean *nothing*, never "fall back to the coarse set": an
+    // allowlist that a clamp stripped to nothing would otherwise resolve to more
+    // than it asked for.
     if (auth.type === 'api_key') {
-        // Explicit capability allowlist wins — lets operators issue keys scoped
-        // to exactly what they need (e.g. a key that can only publish one
-        // collection). Falls back to the coarse read/write mapping otherwise
-        // for keys issued before the capability model existed.
-        if (Array.isArray(auth.capabilities) && auth.capabilities.length > 0) {
-            return new Set(auth.capabilities);
-        }
-        const caps = new Set(['document.read', 'asset.read']);
-        if (auth.permissions.includes('write')) {
-            caps.add('document.create');
-            caps.add('document.update');
-            caps.add('document.delete');
-            caps.add('document.publish');
-            caps.add('document.unpublish');
-            caps.add('asset.upload');
-            caps.add('asset.delete');
-        }
-        return caps;
+        return new Set(coarseApiKeyCapabilities(auth.permissions));
     }
     // Session without pre-resolved capabilities → seed fallback.
     const builtin = BUILTIN_ROLE_SEED[auth.organizationRole];