@aphexcms/cms-core 9.8.1 → 9.10.0

package/dist/events/built-in-consumers.js

@@ -0,0 +1,49 @@
+import { userDeleted } from './catalog.js';
+/** Extract the asset id from an avatar path, or null if it isn't one of ours. */
+function avatarAssetId(image) {
+    return /^\/media\/([^/]+)\//.exec(image)?.[1] ?? null;
+}
+/**
+ * Erase a deleted user's avatar — the file, not just the row.
+ *
+ * Account deletion removes the user record, and with it the only pointer to the avatar
+ * asset. Without this the image survives in object storage indefinitely, reachable by
+ * anyone holding its URL and invisible to the media browser (avatars are marked
+ * `system`), so nothing would ever surface it for cleanup. That is precisely the
+ * "personal data with no way left to find or erase it" case a right-to-erasure request
+ * has to be able to answer.
+ *
+ * Idempotent, as every consumer must be: a missing asset is a completed erasure, so a
+ * redelivery finds nothing and succeeds. It throws only when the delete itself fails, so
+ * a transient storage outage retries with backoff instead of silently giving up — the
+ * one outcome that would leave the data behind while reporting success.
+ */
+export const eraseUserAvatarConsumer = {
+    implements: 'aphex/event/consumer',
+    id: 'aphex.erase-user-avatar',
+    events: [userDeleted.type],
+    async handler({ event, assetService, logger }) {
+        const image = event.payload.image;
+        if (typeof image !== 'string' || !image)
+            return;
+        const assetId = avatarAssetId(image);
+        if (!assetId) {
+            // An external provider's avatar, or one of the absolute storage URLs written
+            // before avatars moved to `/media/<id>/`. Nothing of ours to delete, and no
+            // asset id recoverable from it — flag it so it can be cleared by hand.
+            logger.warn('[erase-user-avatar]', `User ${event.payload.userId} had a non-asset avatar (${image}); nothing to erase automatically.`);
+            return;
+        }
+        if (!assetService) {
+            // Throwing would retry forever against a host that has no asset service at
+            // all. Say so loudly once per attempt and let the delivery dead-letter.
+            throw new Error(`Cannot erase avatar asset ${assetId}: no asset service is configured on this host.`);
+        }
+        const deleted = await assetService.deleteAsset(event.organizationId, assetId);
+        logger.info('[erase-user-avatar]', deleted
+            ? `Erased avatar asset ${assetId} for deleted user ${event.payload.userId}`
+            : `Avatar asset ${assetId} was already gone for user ${event.payload.userId}`);
+    }
+};
+/** Every consumer core ships. Seeded into the part resolver ahead of plugin parts. */
+export const BUILT_IN_EVENT_CONSUMERS = [eraseUserAvatarConsumer];

package/dist/events/catalog.d.ts

@@ -5,4 +5,20 @@ export declare const documentPublished: import("./define-event.js").EventDefinit
     documentType: z.ZodString;
     publishedHash: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>>;
+/**
+ * Emitted when a user account is deleted, once per organization they belonged to — the
+ * erasure fan-out point. Consumers react by removing whatever that user left behind in
+ * *their* organization, so "delete my account" reaches per-org data without the deletion
+ * path having to know every consumer that cares.
+ *
+ * Carries `image` because it can't be looked up afterwards: the account row is gone by the
+ * time a consumer runs, taking the only pointer to the avatar asset with it. This is the
+ * one case where the payload holds a value rather than an identifier, and it's still not a
+ * secret — it's the same public CDN path the profile served.
+ */
+export declare const userDeleted: import("./define-event.js").EventDefinition<"user.deleted", z.ZodObject<{
+    userId: z.ZodString;
+    email: z.ZodNullable<z.ZodString>;
+    image: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>>;
 //# sourceMappingURL=catalog.d.ts.map

package/dist/events/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB;;;;kBAO7B,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB;;;;kBAO7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;kBAQvB,CAAC"}

package/dist/events/catalog.js

@@ -9,3 +9,20 @@ export const documentPublished = defineEvent('document.published', z.object({
     documentType: z.string(),
     publishedHash: z.string().nullable()
 }));
+/**
+ * Emitted when a user account is deleted, once per organization they belonged to — the
+ * erasure fan-out point. Consumers react by removing whatever that user left behind in
+ * *their* organization, so "delete my account" reaches per-org data without the deletion
+ * path having to know every consumer that cares.
+ *
+ * Carries `image` because it can't be looked up afterwards: the account row is gone by the
+ * time a consumer runs, taking the only pointer to the avatar asset with it. This is the
+ * one case where the payload holds a value rather than an identifier, and it's still not a
+ * secret — it's the same public CDN path the profile served.
+ */
+export const userDeleted = defineEvent('user.deleted', z.object({
+    userId: z.string(),
+    email: z.string().nullable(),
+    /** The profile image as stored, or null. `/media/<assetId>/<filename>` when it's ours. */
+    image: z.string().nullable()
+}));

package/dist/events/consumer.d.ts

@@ -32,11 +32,23 @@ export interface ConsumerSettingsReader {
     /** Decrypted settings for `pluginId` in the event's organization ({} if never configured). */
     get(pluginId: string): Promise<Record<string, unknown>>;
 }
+/**
+ * The asset operations a consumer may perform. Deliberately the *service*, not the database
+ * adapter: `databaseAdapter.deleteAsset` drops the row and leaves the file in object storage,
+ * which for an erasure consumer is the difference between deleting the pointer and deleting
+ * the data.
+ */
+export interface ConsumerAssetService {
+    findAssetById(organizationId: string, id: string): Promise<unknown>;
+    deleteAsset(organizationId: string, id: string): Promise<boolean>;
+}
 /** What an event-consumer handler receives. `databaseAdapter` is the live adapter (org-scoped calls take an org id). */
 export interface EventConsumerContext {
     event: ConsumedEvent;
     databaseAdapter: DatabaseAdapter;
     logger: Logger;
+    /** Assets in the event's organization, file included. `null` when the host wired none. */
+    assetService: ConsumerAssetService | null;
     /** Read this plugin's own decrypted settings for the event's org (e.g. a webhook URL secret). */
     settings: ConsumerSettingsReader;
     /**
@@ -49,6 +61,8 @@ export interface EventConsumerContext {
 /** Runtime services the consumer wrapper injects into each delivery's context. */
 export interface ConsumerHandlerDeps {
     pluginSettingsService: PluginSettingsReader;
+    /** The app's asset service, passed through to consumers that erase or rewrite media. */
+    assetService?: ConsumerAssetService | null;
     /** The app's email adapter (or `null` if email isn't configured). Passed straight to the consumer. */
     emailAdapter?: EmailAdapter | null;
 }

package/dist/events/consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../src/lib/events/consumer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChF;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACtC,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,wHAAwH;AACxH,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IACnC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,sGAAsG;IACtG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAqBD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,mBAAmB,GACvB,UAAU,CAcZ"}
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../src/lib/events/consumer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChF;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACtC,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,wHAAwH;AACxH,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,iGAAiG;IACjG,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IACnC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,wFAAwF;IACxF,YAAY,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,sGAAsG;IACtG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAqBD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,mBAAmB,GACvB,UAAU,CAeZ"}

package/dist/events/consumer.js

@@ -70,6 +70,7 @@ export function toConsumerJobHandler(handler, deps) {
             databaseAdapter,
             logger,
             settings,
+            assetService: deps.assetService ?? null,
             emailAdapter: deps.emailAdapter ?? null
         });
     };

package/dist/events/emit.d.ts

@@ -8,4 +8,27 @@ import type { Document } from '../types/document.js';
  * whether a version snapshot was taken.
  */
 export declare function emitDocumentPublished(tx: DatabaseAdapter, organizationId: string, doc: Document): Promise<void>;
+/** A user account at the moment it is deleted — the last chance to read these fields. */
+export interface DeletedUser {
+    id: string;
+    email?: string | null;
+    image?: string | null;
+}
+/**
+ * Emit `user.deleted` once per organization the user belonged to.
+ *
+ * Fans out per-org because the event log is org-scoped and erasure is an org-level
+ * concern: each organization holds its own residue of a user (their avatar, and in time
+ * whatever else), and each consumer runs against the org it was delivered for. One event
+ * naming a single "home" org would leave the others untouched.
+ *
+ * MUST be called on a TRANSACTION handle, in the same transaction as the deletion itself
+ * — the transactional-outbox guarantee. An account erased without its events emitted is
+ * personal data stranded with nothing left to point at it, which is the exact failure this
+ * exists to prevent.
+ *
+ * `organizationIds` are the caller's — read them *before* the deletion removes the
+ * membership rows, or this fans out to nothing.
+ */
+export declare function emitUserDeleted(tx: DatabaseAdapter, organizationIds: readonly string[], user: DeletedUser): Promise<void>;
 //# sourceMappingURL=emit.d.ts.map

package/dist/events/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/lib/events/emit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAC1C,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAWf"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/lib/events/emit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAC1C,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACpC,EAAE,EAAE,eAAe,EACnB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/events/emit.js

@@ -1,4 +1,4 @@
-import { documentPublished } from './catalog.js';
+import { documentPublished, userDeleted } from './catalog.js';
 /**
  * Emit `document.published` (and its outbox row) for a freshly published document. MUST be
  * called on a TRANSACTION handle (from `withTransaction`) so the event commits atomically with
@@ -18,3 +18,34 @@ export async function emitDocumentPublished(tx, organizationId, doc) {
         createdBy: doc.updatedBy
     });
 }
+/**
+ * Emit `user.deleted` once per organization the user belonged to.
+ *
+ * Fans out per-org because the event log is org-scoped and erasure is an org-level
+ * concern: each organization holds its own residue of a user (their avatar, and in time
+ * whatever else), and each consumer runs against the org it was delivered for. One event
+ * naming a single "home" org would leave the others untouched.
+ *
+ * MUST be called on a TRANSACTION handle, in the same transaction as the deletion itself
+ * — the transactional-outbox guarantee. An account erased without its events emitted is
+ * personal data stranded with nothing left to point at it, which is the exact failure this
+ * exists to prevent.
+ *
+ * `organizationIds` are the caller's — read them *before* the deletion removes the
+ * membership rows, or this fans out to nothing.
+ */
+export async function emitUserDeleted(tx, organizationIds, user) {
+    const payload = userDeleted.parse({
+        userId: user.id,
+        email: user.email ?? null,
+        image: user.image ?? null
+    });
+    for (const organizationId of organizationIds) {
+        await tx.appendEvent({
+            organizationId,
+            type: userDeleted.type,
+            payload,
+            createdBy: user.id
+        });
+    }
+}

package/dist/events/index.d.ts

@@ -1,4 +1,6 @@
 export * from './define-event.js';
 export * from './catalog.js';
 export * from './consumer.js';
+export * from './emit.js';
+export * from './built-in-consumers.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/events/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/events/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/events/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,sBAAsB,CAAC"}

package/dist/events/index.js

@@ -1,3 +1,5 @@
 export * from './define-event.js';
 export * from './catalog.js';
 export * from './consumer.js';
+export * from './emit.js';
+export * from './built-in-consumers.js';

package/dist/field-validation/utils.d.ts

@@ -2,13 +2,36 @@ import type { Field, SchemaType } from '../types/index.js';
 export interface ValidationError {
     level: 'error' | 'warning' | 'info';
     message: string;
+    /**
+     * Which of the two questions this error answers.
+     *
+     * `structural` — the data cannot be interpreted as the schema at all: wrong
+     * JSON shape for the field type, or a key the schema never declared. Never a
+     * legitimate work-in-progress state, so it's rejected on **every** write,
+     * drafts included. This is the class an agent or a bad client produces.
+     *
+     * `content` — the data is the right shape but isn't finished: required fields
+     * missing, ranges exceeded, cross-field invariants unmet. Perfectly legitimate
+     * mid-edit, so it's only enforced at publish.
+     *
+     * Defaults to `content` when unset — the conservative direction, since
+     * mislabelling a rule error as structural would block saving a draft.
+     */
+    kind?: 'structural' | 'content';
+}
+export interface FieldErrors {
+    field: string;
+    errors: string[];
+    kind: 'structural' | 'content';
 }
 export interface DocumentValidationResult {
     isValid: boolean;
-    errors: Array<{
-        field: string;
-        errors: string[];
-    }>;
+    errors: FieldErrors[];
+    /**
+     * The subset of `errors` that no draft may carry. Empty on a merely
+     * incomplete document; non-empty means the payload is malformed.
+     */
+    structuralErrors: FieldErrors[];
     normalizedData: Record<string, any>;
 }
 /**

package/dist/field-validation/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/field-validation/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,KAAK,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AAKnF,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAUrD;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAmC9E;AAwMD;;GAEG;AACH,wBAAsB,aAAa,CAClC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,GAAG,EACV,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC1B,CAAC,CAsJD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAO/D;AAwCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/field-validation/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,KAAK,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AAKnF,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;OAGG;IACH,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAUrD;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA6C9E;AAiOD;;GAEG;AACH,wBAAsB,aAAa,CAClC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,GAAG,EACV,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC1B,CAAC,CA0KD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAO/D;AAiED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE,GAAQ,GACf,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}

package/dist/field-validation/utils.js

@@ -76,8 +76,20 @@ export function validateValueShape(field, value) {
             return Array.isArray(value) ? null : `expected an array, got ${describeValue(value)}`;
         case 'object':
             return isPlainObject(value) ? null : `expected an object, got ${describeValue(value)}`;
+        case 'number':
+            // `''` is the empty state of a cleared number input, not a value.
+            if (value === '')
+                return null;
+            return typeof value === 'number' && Number.isFinite(value)
+                ? null
+                : `expected a number, got ${describeValue(value)}`;
+        case 'boolean':
+            if (value === '')
+                return null;
+            return typeof value === 'boolean' ? null : `expected a boolean, got ${describeValue(value)}`;
         default:
-            // number/boolean/date/datetime — left to existing auto-rules / user rules.
+            // date/datetime — shape is inseparable from format here, so the
+            // existing auto-rules own them.
             return null;
     }
 }
@@ -212,7 +224,8 @@ async function validateArrayItems(field, items, context) {
                 field: itemPath,
                 errors: [
                     `has type "${gotType}", which is not one of the declared array item types: ${declared}`
-                ]
+                ],
+                kind: 'structural'
             });
             continue;
         }
@@ -222,7 +235,10 @@ async function validateArrayItems(field, items, context) {
         // branch below and get full field validation already; this is the one shape the rest of
         // this function never checked.
         if (typeRef.type === 'block') {
-            results.push(...validatePortableTextBlock(item, itemPath));
+            // Every block check is a shape check.
+            for (const err of validatePortableTextBlock(item, itemPath)) {
+                results.push({ ...err, kind: 'structural' });
+            }
             continue;
         }
         if (typeRef.type === 'reference') {
@@ -231,7 +247,8 @@ async function validateArrayItems(field, items, context) {
                     field: itemPath,
                     errors: [
                         `expected a reference object { _type: 'reference', _ref: '<documentId>' }, got ${describeValue(item)}`
-                    ]
+                    ],
+                    kind: 'structural'
                 });
             }
             continue;
@@ -240,7 +257,8 @@ async function validateArrayItems(field, items, context) {
             if (!isPlainObject(item)) {
                 results.push({
                     field: itemPath,
-                    errors: [`expected an object, got ${describeValue(item)}`]
+                    errors: [`expected an object, got ${describeValue(item)}`],
+                    kind: 'structural'
                 });
                 continue;
             }
@@ -248,7 +266,11 @@ async function validateArrayItems(field, items, context) {
             for (const err of nested) {
                 for (const rawMessage of err.errors) {
                     const { path, reason } = splitFieldMessage(rawMessage);
-                    results.push({ field: `${itemPath}.${path ?? err.field}`, errors: [reason] });
+                    results.push({
+                        field: `${itemPath}.${path ?? err.field}`,
+                        errors: [reason],
+                        kind: err.kind
+                    });
                 }
             }
         }
@@ -273,15 +295,34 @@ export async function validateField(field, value, context = {}) {
     if (shapeError) {
         return {
             isValid: false,
-            errors: [{ level: 'error', message: `Field "${field.name}" ${shapeError}` }]
+            errors: [
+                { level: 'error', message: `Field "${field.name}" ${shapeError}`, kind: 'structural' }
+            ]
         };
     }
+    // Object fields were previously never recursed into: the shape check above only
+    // confirms the value IS an object, so a required field nested inside one was
+    // silently unenforced and an undeclared key inside one was never seen.
+    if (field.type === 'object' && isPlainObject(value) && Array.isArray(field.fields)) {
+        const nested = await validateFieldSet(field.fields, value, context);
+        for (const err of nested) {
+            allErrors.push({
+                level: 'error',
+                message: `Field "${field.name}.${err.field}" ${err.errors.join('; ')}`,
+                kind: err.kind
+            });
+        }
+    }
     // Array items are never validated by the shape check above (it only confirms
     // the value IS an array) — recurse into each item against `field.of` here.
     if (field.type === 'array' && Array.isArray(value)) {
         const itemErrors = await validateArrayItems(field, value, context);
         for (const err of itemErrors) {
-            allErrors.push({ level: 'error', message: `Field "${err.field}" ${err.errors.join('; ')}` });
+            allErrors.push({
+                level: 'error',
+                message: `Field "${err.field}" ${err.errors.join('; ')}`,
+                kind: err.kind
+            });
         }
     }
     // Add automatic validation for date/datetime/url fields based on type
@@ -399,6 +440,27 @@ export function getValidationClasses(hasErrors) {
  */
 async function validateFieldSet(fields, data, context) {
     const validationErrors = [];
+    // Keys present in the data but absent from the schema.
+    //
+    // Everything below walks the *schema's* fields and reads `data[field.name]`,
+    // so without this pass an undeclared key is never looked at — it validates
+    // clean and is persisted verbatim. That's how an agent writing invented field
+    // names silently corrupts a document.
+    //
+    // Underscore-prefixed keys are structural metadata (`_type`, `_key`, `_ref`),
+    // not content, so they're never "unknown".
+    const declared = new Set(fields.map((field) => field.name));
+    for (const key of Object.keys(data ?? {})) {
+        if (key.startsWith('_'))
+            continue;
+        if (declared.has(key))
+            continue;
+        validationErrors.push({
+            field: key,
+            errors: [`Unknown field "${key}" — not declared in the schema`],
+            kind: 'structural'
+        });
+    }
     for (const field of fields) {
         const value = data[field.name];
         const result = await validateField(field, value, {
@@ -406,11 +468,16 @@ async function validateFieldSet(fields, data, context) {
             document: context.document !== undefined ? context.document : data
         });
         if (!result.isValid) {
-            const errorMessages = result.errors.filter((e) => e.level === 'error').map((e) => e.message);
+            const errorEntries = result.errors.filter((e) => e.level === 'error');
+            const errorMessages = errorEntries.map((e) => e.message);
             if (errorMessages.length > 0) {
                 validationErrors.push({
                     field: field.name,
-                    errors: errorMessages
+                    errors: errorMessages,
+                    // One structural error makes the whole field structural: the value
+                    // can't be interpreted, so any content rules reported alongside it
+                    // are noise anyway.
+                    kind: errorEntries.some((e) => e.kind === 'structural') ? 'structural' : 'content'
                 });
             }
         }
@@ -449,6 +516,7 @@ export async function validateDocumentData(schema, data, context = {}) {
     return {
         isValid: validationErrors.length === 0,
         errors: validationErrors,
+        structuralErrors: validationErrors.filter((e) => e.kind === 'structural'),
         normalizedData
     };
 }

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from './forms/index.js';
 export * from './theme/index.js';
 export * from './plugins/index.js';
 export * from './utils/index.js';
+export * from './auth/invitation-status.js';
 export * from './api/index.js';
 export type { ApiResponse } from './api/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAkBA,cAAc,eAAe,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjG,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGhF,cAAc,sBAAsB,CAAC;AAIrC,cAAc,gBAAgB,CAAC;AAI/B,cAAc,eAAe,CAAC;AAG9B,cAAc,eAAe,CAAC;AAI9B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAkBA,cAAc,eAAe,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjG,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGhF,cAAc,sBAAsB,CAAC;AAIrC,cAAc,gBAAgB,CAAC;AAI/B,cAAc,eAAe,CAAC;AAG9B,cAAc,eAAe,CAAC;AAI9B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAI9B,cAAc,0BAA0B,CAAC;AAGzC,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -36,6 +36,9 @@ export * from './theme/index.js';
 export * from './plugins/index.js';
 // General utility functions (logger, image URL builder, etc)
 export * from './utils/index.js';
+// Invitation state predicates. Plain functions over a plain type — the one
+// definition of "pending"/"expired" shared by cms-core, @aphexcms/auth and apps.
+export * from './auth/invitation-status.js';
 // Unified API client
 export * from './api/index.js';
 // NOTE: The following are intentionally NOT re-exported from this root

package/dist/jobs/run-batch.d.ts

@@ -6,7 +6,7 @@ import type { LocalAPI } from '../local-api/index.js';
 import type { PartResolver } from '../plugins/resolver.js';
 import { type RunDueJobsResult } from './run-due-jobs.js';
 import { type RelayOutboxResult } from './relay.js';
-import { type PluginSettingsReader } from '../events/consumer.js';
+import { type ConsumerAssetService, type PluginSettingsReader } from '../events/consumer.js';
 /**
  * The slice of the CMS service container the runner needs. Structurally a subset
  * of `CMSInstances`, so callers can pass `event.locals.aphexCMS` (or `c.var.aphexCMS`)
@@ -22,6 +22,12 @@ export interface JobRunnerServices {
     pluginSettingsService: PluginSettingsReader;
     /** Handed to event consumers that send notifications; `null`/absent when email isn't configured. */
     emailAdapter?: EmailAdapter | null;
+    /**
+     * Handed to event consumers that erase or rewrite media — notably the built-in
+     * `user.deleted` avatar erasure, which needs the file gone from object storage and not
+     * merely the row gone from the table.
+     */
+    assetService?: ConsumerAssetService | null;
 }
 export interface RunJobsBatchOptions {
     /** Lease-owner label written to `cms_jobs.lease_owner` (crash-recovery visibility). */

package/dist/jobs/run-batch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-batch.d.ts","sourceRoot":"","sources":["../../src/lib/jobs/run-batch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAe,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAGN,KAAK,oBAAoB,EACzB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,iGAAiG;IACjG,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC3D,4EAA4E;IAC5E,KAAK,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAqC7B"}
+{"version":3,"file":"run-batch.d.ts","sourceRoot":"","sources":["../../src/lib/jobs/run-batch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAe,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAGN,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,iGAAiG;IACjG,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IACnC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC3D,4EAA4E;IAC5E,KAAK,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAuC7B"}

package/dist/jobs/run-batch.js

@@ -29,6 +29,7 @@ import { consumerJobType, toConsumerJobHandler } from '../events/consumer.js';
 export async function runJobsBatch(services, options = {}) {
     const { config, databaseAdapter, logger, localAPI, partResolver, pluginSettingsService } = services;
     const emailAdapter = services.emailAdapter ?? null;
+    const assetService = services.assetService ?? null;
     const relay = await relayOutbox(services, {
         organizationId: options.organizationId,
         batchSize: config.jobs?.relayBatchSize
@@ -40,7 +41,8 @@ export async function runJobsBatch(services, options = {}) {
     for (const consumer of partResolver.eventConsumers()) {
         consumerHandlers[consumerJobType(consumer.id)] = toConsumerJobHandler(consumer.handler, {
             pluginSettingsService,
-            emailAdapter
+            emailAdapter,
+            assetService
         });
     }
     const jobs = await runDueJobs({

package/dist/lib/api/organizations.d.ts

@@ -65,7 +65,8 @@ export declare class OrganizationsApi {
         success: boolean;
     }>>;
     /**
-     * Delete an organization (super_admin only)
+     * Delete an organization, its media, and every membership in it. Owners only —
+     * enforced by the route, not here.
      */
     static remove(id: string): Promise<ApiResponse<{
         success: boolean;

package/dist/lib/api/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/lib/api/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EACX,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,gBAAgB;IAC5B;;OAEG;WACU,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAIjE;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIxF;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAIhG;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIpE;;OAEG;WACU,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAY5D;;OAEG;WACU,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAIrE;;OAEG;WACU,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAI9F;;OAEG;WACU,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAIhG;;OAEG;WACU,gBAAgB,CAC5B,IAAI,EAAE,uBAAuB,GAC3B,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAI3C;;OAEG;WACU,MAAM,CAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,yBAAyB,GAC7B,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIrC;;OAEG;WACU,gBAAgB,CAC5B,IAAI,EAAE,uBAAuB,GAC3B,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI7C;;OAEG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAGD,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAazB,CAAC"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/lib/api/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EACX,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAC/D,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,gBAAgB;IAC5B;;OAEG;WACU,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAIjE;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIxF;;OAEG;WACU,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAIhG;;OAEG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIpE;;OAEG;WACU,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAY5D;;OAEG;WACU,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAIrE;;OAEG;WACU,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAI9F;;OAEG;WACU,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAIhG;;OAEG;WACU,gBAAgB,CAC5B,IAAI,EAAE,uBAAuB,GAC3B,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAI3C;;OAEG;WACU,MAAM,CAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,yBAAyB,GAC7B,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAIrC;;OAEG;WACU,gBAAgB,CAC5B,IAAI,EAAE,uBAAuB,GAC3B,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI7C;;;OAGG;WACU,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAG3E;AAGD,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAazB,CAAC"}

package/dist/lib/api/organizations.js

@@ -76,7 +76,8 @@ export class OrganizationsApi {
         return apiClient.delete('/organizations/invitations', data);
     }
     /**
-     * Delete an organization (super_admin only)
+     * Delete an organization, its media, and every membership in it. Owners only —
+     * enforced by the route, not here.
      */
     static async remove(id) {
         return apiClient.delete(`/organizations/${id}`);

package/dist/lib/api/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../src/lib/api/organizations.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AA6BrC,MAAM,OAAO,gBAAgB;IAC5B;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI;QAChB,OAAO,SAAS,CAAC,GAAG,CAAyB,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAA+B;QAClD,OAAO,SAAS,CAAC,IAAI,CAAe,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAA+B;QAClD,OAAO,SAAS,CAAC,IAAI,CAAuB,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,SAAS,CAAC,GAAG,CAAe,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO;YACN,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;SACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU;QACtB,OAAO,SAAS,CAAC,GAAG,CAAuB,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAyB;QAClD,OAAO,SAAS,CAAC,IAAI,CAAqB,4BAA4B,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAyB;QAClD,OAAO,SAAS,CAAC,MAAM,CAAuB,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC5B,IAA6B;QAE7B,OAAO,SAAS,CAAC,KAAK,CAAqB,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAClB,EAAU,EACV,IAA+B;QAE/B,OAAO,SAAS,CAAC,KAAK,CAAe,kBAAkB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC5B,IAA6B;QAE7B,OAAO,SAAS,CAAC,MAAM,CAAuB,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACD;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxD,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC5D,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9D,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClE,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClE,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;CAC1E,CAAC"}
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../src/lib/api/organizations.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AA6BrC,MAAM,OAAO,gBAAgB;IAC5B;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI;QAChB,OAAO,SAAS,CAAC,GAAG,CAAyB,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAA+B;QAClD,OAAO,SAAS,CAAC,IAAI,CAAe,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAA+B;QAClD,OAAO,SAAS,CAAC,IAAI,CAAuB,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,SAAS,CAAC,GAAG,CAAe,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO;YACN,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;SACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU;QACtB,OAAO,SAAS,CAAC,GAAG,CAAuB,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAyB;QAClD,OAAO,SAAS,CAAC,IAAI,CAAqB,4BAA4B,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAyB;QAClD,OAAO,SAAS,CAAC,MAAM,CAAuB,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC5B,IAA6B;QAE7B,OAAO,SAAS,CAAC,KAAK,CAAqB,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAClB,EAAU,EACV,IAA+B;QAE/B,OAAO,SAAS,CAAC,KAAK,CAAe,kBAAkB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC5B,IAA6B;QAE7B,OAAO,SAAS,CAAC,MAAM,CAAuB,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAU;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAuB,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACD;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxD,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC5D,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACtD,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9D,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClE,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClE,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;CAC1E,CAAC"}

package/dist/lib/api/schemas/api-keys.d.ts

@@ -1,25 +1,25 @@
 import { z } from 'zod';
 export declare const apiKeyPermissionSchema: z.ZodEnum<{
-    read: "read";
     write: "write";
+    read: "read";
 }>;
 export declare const apiKeyCapabilitySchema: z.ZodString;
 export declare const createApiKeyRequest: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        read: "read";
         write: "write";
+        read: "read";
     }>>>;
     capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodTransform<{
-    permissions: ("read" | "write")[] | undefined;
+    permissions: ("write" | "read")[] | undefined;
     capabilities: string[] | undefined;
     name: string;
     expiresInDays?: number | undefined;
 }, {
     name: string;
-    permissions?: ("read" | "write")[] | undefined;
+    permissions?: ("write" | "read")[] | undefined;
     capabilities?: string[] | undefined;
     expiresInDays?: number | undefined;
 }>>;

package/dist/lib/api/schemas/documents.d.ts

@@ -43,6 +43,7 @@ export declare const listDocumentsQuery: z.ZodObject<{
     type: z.ZodOptional<z.ZodString>;
     docType: z.ZodOptional<z.ZodString>;
     status: z.ZodOptional<z.ZodString>;
+    search: z.ZodOptional<z.ZodString>;
     page: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     pageSize: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;