@eaera-com/cms-sdk 0.1.66 → 0.1.67

package/dist/chunks/{_shared-DdBWuPm_.js → _shared-DZlTUzoa.js}

@@ -1,4 +1,4 @@
-import { a as COOKIE_DEFAULTS } from './storage.constant--64BDSPW.js';
+import { a as COOKIE_DEFAULTS } from './storage.constant-CVWam5ls.js';
 import { useRuntimeConfig } from '#imports';
 
 const TOKEN_COOKIE_OPTIONS = {
@@ -24,4 +24,4 @@ function readSdkConfig(event) {
 }
 
 export { TOKEN_COOKIE_OPTIONS as T, readSdkConfig as r };
-//# sourceMappingURL=_shared-DdBWuPm_.js.map
+//# sourceMappingURL=_shared-DZlTUzoa.js.map

package/dist/chunks/{_shared-DdBWuPm_.js.map → _shared-DZlTUzoa.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_shared-DdBWuPm_.js","sources":["../../src/server/auth/_shared.ts"],"sourcesContent":["import {\n  COOKIE_DEFAULTS,\n  REFRESH_TOKEN_STORAGE_KEY,\n  TOKEN_STORAGE_KEY,\n} from '../../common/constants/storage.constant';\nimport type { RequestCasing, ResponseCasing } from '../../common/constants/http.constant';\nimport { useRuntimeConfig } from '#imports';\n\n/** Cookie options for the httpOnly access-token cookie (server-side set). */\nexport const TOKEN_COOKIE_OPTIONS = {\n  httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,\n  secure: COOKIE_DEFAULTS.SECURE,\n  sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase() as 'lax',\n  path: COOKIE_DEFAULTS.PATH,\n  maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS,\n};\n\nexport { TOKEN_STORAGE_KEY, REFRESH_TOKEN_STORAGE_KEY };\n\n/**\n * Resolve the CMS backend URL + client id from the module options the Nuxt\n * module stored on `runtimeConfig.public.cmsSdkOptions` (mirrors the plugin\n * resolution). Runs inside the consumer's Nitro server where `useRuntimeConfig`\n * is auto-imported.\n */\nexport function readSdkConfig(event: unknown): {\n  cmsUrl: string;\n  clientId: string;\n  /** Default portal id for portal-scoped flows (module option `cmsSdk.portal`). */\n  portal?: string;\n  requestCasing?: RequestCasing;\n  responseCasing?: ResponseCasing;\n} {\n  const config = useRuntimeConfig(event) as { public?: Record<string, any> } | undefined;\n  const pub = (config?.public ?? {}) as Record<string, any>;\n  const opts = (pub.cmsSdkOptions ?? {}) as {\n    endpoints?: Record<string, string>;\n    clientId?: string;\n    portal?: string;\n    requestCasing?: RequestCasing;\n    responseCasing?: ResponseCasing;\n  };\n  const cmsUrl = pub[opts.endpoints?.cms ?? 'cmsUrl'];\n  const clientId = pub[opts.clientId ?? 'clientId'];\n  return {\n    cmsUrl,\n    clientId,\n    portal: opts.portal,\n    requestCasing: opts.requestCasing,\n    responseCasing: opts.responseCasing,\n  };\n}\n"],"names":[],"mappings":";;;AASO,MAAM,oBAAA,GAAuB;AAAA,EAClC,UAAU,eAAA,CAAgB,SAAA;AAAA,EAC1B,QAAQ,eAAA,CAAgB,MAAA;AAAA,EACxB,QAAA,EAAU,eAAA,CAAgB,SAAA,CAAU,WAAA,EAAY;AAAA,EAChD,MAAM,eAAA,CAAgB,IAAA;AAAA,EACtB,QAAQ,eAAA,CAAgB;AAC1B;AAUO,SAAS,cAAc,KAAA,EAO5B;AACA,EAAA,MAAM,MAAA,GAAS,iBAAiB,KAAK,CAAA;AACrC,EAAA,MAAM,GAAA,GAAO,MAAA,EAAQ,MAAA,IAAU,EAAC;AAChC,EAAA,MAAM,IAAA,GAAQ,GAAA,CAAI,aAAA,IAAiB,EAAC;AAOpC,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,CAAK,SAAA,EAAW,OAAO,QAAQ,CAAA;AAClD,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,UAAU,CAAA;AAChD,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,eAAe,IAAA,CAAK,aAAA;AAAA,IACpB,gBAAgB,IAAA,CAAK;AAAA,GACvB;AACF;;;;"}
+{"version":3,"file":"_shared-DZlTUzoa.js","sources":["../../src/server/auth/_shared.ts"],"sourcesContent":["import {\n  COOKIE_DEFAULTS,\n  REFRESH_TOKEN_STORAGE_KEY,\n  TOKEN_STORAGE_KEY,\n} from '../../common/constants/storage.constant';\nimport type { RequestCasing, ResponseCasing } from '../../common/constants/http.constant';\nimport { useRuntimeConfig } from '#imports';\n\n/** Cookie options for the httpOnly access-token cookie (server-side set). */\nexport const TOKEN_COOKIE_OPTIONS = {\n  httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,\n  secure: COOKIE_DEFAULTS.SECURE,\n  sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase() as 'lax',\n  path: COOKIE_DEFAULTS.PATH,\n  maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS,\n};\n\nexport { TOKEN_STORAGE_KEY, REFRESH_TOKEN_STORAGE_KEY };\n\n/**\n * Resolve the CMS backend URL + client id from the module options the Nuxt\n * module stored on `runtimeConfig.public.cmsSdkOptions` (mirrors the plugin\n * resolution). Runs inside the consumer's Nitro server where `useRuntimeConfig`\n * is auto-imported.\n */\nexport function readSdkConfig(event: unknown): {\n  cmsUrl: string;\n  clientId: string;\n  /** Default portal id for portal-scoped flows (module option `cmsSdk.portal`). */\n  portal?: string;\n  requestCasing?: RequestCasing;\n  responseCasing?: ResponseCasing;\n} {\n  const config = useRuntimeConfig(event) as { public?: Record<string, any> } | undefined;\n  const pub = (config?.public ?? {}) as Record<string, any>;\n  const opts = (pub.cmsSdkOptions ?? {}) as {\n    endpoints?: Record<string, string>;\n    clientId?: string;\n    portal?: string;\n    requestCasing?: RequestCasing;\n    responseCasing?: ResponseCasing;\n  };\n  const cmsUrl = pub[opts.endpoints?.cms ?? 'cmsUrl'];\n  const clientId = pub[opts.clientId ?? 'clientId'];\n  return {\n    cmsUrl,\n    clientId,\n    portal: opts.portal,\n    requestCasing: opts.requestCasing,\n    responseCasing: opts.responseCasing,\n  };\n}\n"],"names":[],"mappings":";;;AASO,MAAM,oBAAA,GAAuB;AAAA,EAClC,UAAU,eAAA,CAAgB,SAAA;AAAA,EAC1B,QAAQ,eAAA,CAAgB,MAAA;AAAA,EACxB,QAAA,EAAU,eAAA,CAAgB,SAAA,CAAU,WAAA,EAAY;AAAA,EAChD,MAAM,eAAA,CAAgB,IAAA;AAAA,EACtB,QAAQ,eAAA,CAAgB;AAC1B;AAUO,SAAS,cAAc,KAAA,EAO5B;AACA,EAAA,MAAM,MAAA,GAAS,iBAAiB,KAAK,CAAA;AACrC,EAAA,MAAM,GAAA,GAAO,MAAA,EAAQ,MAAA,IAAU,EAAC;AAChC,EAAA,MAAM,IAAA,GAAQ,GAAA,CAAI,aAAA,IAAiB,EAAC;AAOpC,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,CAAK,SAAA,EAAW,OAAO,QAAQ,CAAA;AAClD,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,UAAU,CAAA;AAChD,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,eAAe,IAAA,CAAK,aAAA;AAAA,IACpB,gBAAgB,IAAA,CAAK;AAAA,GACvB;AACF;;;;"}

package/dist/chunks/{storage.constant--64BDSPW.js → storage.constant-CVWam5ls.js}

@@ -10,6 +10,7 @@ const COOKIE_DEFAULTS = {
 };
 const STORE_PERSIST_KEY = {
   AUTH: "cms-auth-v1",
+  AUTHZ: "cms-authz-v1",
   CONTENT: "cms-content-v1",
   RULES: "cms-rules-v1",
   EXECUTIONS: "cms-executions-v1",
@@ -41,4 +42,4 @@ const COOKIE_SAME_SITE = {
 };
 
 export { COOKIE_SAME_SITE as C, PERSIST_KEY as P, REFRESH_TOKEN_STORAGE_KEY as R, STORE_PERSIST_KEY as S, TOKEN_STORAGE_KEY as T, COOKIE_DEFAULTS as a, PERSIST_ALLOWED_KEYS as b, PERSIST_MAX_BYTES as c, PERSIST_PREFIX as d, STORAGE_NAME as e };
-//# sourceMappingURL=storage.constant--64BDSPW.js.map
+//# sourceMappingURL=storage.constant-CVWam5ls.js.map

package/dist/chunks/storage.constant-CVWam5ls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.constant-CVWam5ls.js","sources":["../../src/common/constants/storage.constant.ts"],"sourcesContent":["/**\n * Token storage constants — the single source for the storage key so the\n * memory/localStorage/cookie adapters never drift apart.\n */\nexport const TOKEN_STORAGE_KEY = 'cms_access_token' as const;\n\n/**\n * Refresh-token cookie key. Stored as an httpOnly cookie (parallel to the access\n * token) so the SDK can silently rotate the access token when it expires.\n */\nexport const REFRESH_TOKEN_STORAGE_KEY = 'cms_refresh_token' as const;\n\n/** Cookie adapter defaults (overridable via `credentials.cookie`). */\nexport const COOKIE_DEFAULTS = {\n  MAX_AGE_SECONDS: 60 * 60 * 24 * 30, // 30 days\n  PATH: '/',\n  SECURE: true,\n  SAME_SITE: 'Lax',\n  HTTP_ONLY: true,\n} as const;\n\n/** Pinia persistence keys (versioned for schema migration). */\nexport const STORE_PERSIST_KEY = {\n  AUTH: 'cms-auth-v1',\n  AUTHZ: 'cms-authz-v1',\n  CONTENT: 'cms-content-v1',\n  RULES: 'cms-rules-v1',\n  EXECUTIONS: 'cms-executions-v1',\n  SETTINGS: 'cms-settings-v1',\n  LLM: 'cms-llm-v1',\n  LLM_PROVIDERS: 'cms-llm-providers-v1',\n  BARS: 'cms-bars-v1',\n  HISTORY: 'cms-history-v1',\n  KALSHI: 'cms-kalshi-v1',\n  GOV: 'cms-gov-v1',\n  PEOPLE: 'cms-people-v1',\n} as const;\n\n/**\n * Internal cookie persistence (replaces pinia-plugin-persistedstate).\n *\n * Each persisted state → its own cookie `${PERSIST_KEY.<store>}.${field}`.\n * The common `/api/cms-sdk/persist` endpoint may only set keys in\n * `PERSIST_ALLOWED_KEYS` (single source of truth, shared by the plugin + the\n * endpoint). The token key is always excluded as a belt-and-suspenders guard.\n */\nexport const PERSIST_PREFIX = 'cms-persist-' as const;\n\nexport const PERSIST_KEY = {\n  AUTH: 'cms-persist-auth',\n} as const;\n\n/** Max bytes per persisted cookie value (~4KB cookie cap, with headroom). */\nexport const PERSIST_MAX_BYTES = 3500;\n\n/** Allowlist of cookie keys the persist endpoint may set. */\nexport const PERSIST_ALLOWED_KEYS = [`${PERSIST_KEY.AUTH}.authUser`] as const;\n\n/**\n * Storage backend names accepted by `TokenManager`. Kept in sync with\n * `IStorageName` in `core/credentials/credential.type.ts`. The\n * `httpOnlyBridge` value is the recommended production backend (delegates\n * to a Nuxt server route).\n */\nexport const STORAGE_NAME = {\n  MEMORY: 'memory',\n  LOCAL_STORAGE: 'localStorage',\n  COOKIE: 'cookie',\n  HTTP_ONLY_BRIDGE: 'httpOnlyBridge',\n} as const;\nexport type StorageName = (typeof STORAGE_NAME)[keyof typeof STORAGE_NAME];\n\n/**\n * `Cookie SameSite` values (RFC 6265). Used by `cookieStorage` and the\n * SDK Nuxt module when setting the httpOnly access-token cookie. Mirrors\n * the `CookieSameSite` type in `core/credentials/storages/cookieStorage.ts`.\n */\nexport const COOKIE_SAME_SITE = {\n  STRICT: 'Strict',\n  LAX: 'Lax',\n  NONE: 'None',\n} as const;\nexport type CookieSameSite = (typeof COOKIE_SAME_SITE)[keyof typeof COOKIE_SAME_SITE];\n"],"names":[],"mappings":"AAIO,MAAM,iBAAA,GAAoB;AAM1B,MAAM,yBAAA,GAA4B;AAGlC,MAAM,eAAA,GAAkB;AAAA,EAC7B,eAAA,EAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA;AAAA,EAChC,IAAA,EAAM,GAAA;AAAA,EACN,MAAA,EAAQ,IAAA;AAAA,EACR,SAAA,EAAW,KAAA;AAAA,EACX,SAAA,EAAW;AACb;AAGO,MAAM,iBAAA,GAAoB;AAAA,EAC/B,IAAA,EAAM,aAAA;AAAA,EACN,KAAA,EAAO,cAAA;AAAA,EACP,OAAA,EAAS,gBAAA;AAAA,EACT,KAAA,EAAO,cAAA;AAAA,EACP,UAAA,EAAY,mBAAA;AAAA,EACZ,QAAA,EAAU,iBAAA;AAAA,EACV,GAAA,EAAK,YAAA;AAAA,EACL,aAAA,EAAe,sBAAA;AAAA,EACf,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,gBAAA;AAAA,EACT,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,YAAA;AAAA,EACL,MAAA,EAAQ;AACV;AAUO,MAAM,cAAA,GAAiB;AAEvB,MAAM,WAAA,GAAc;AAAA,EACzB,IAAA,EAAM;AACR;AAGO,MAAM,iBAAA,GAAoB;AAG1B,MAAM,oBAAA,GAAuB,CAAC,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA,SAAA,CAAW;AAQ5D,MAAM,YAAA,GAAe;AAAA,EAC1B,MAAA,EAAQ,QAAA;AAAA,EACR,aAAA,EAAe,cAAA;AAAA,EACf,MAAA,EAAQ,QAAA;AAAA,EACR,gBAAA,EAAkB;AACpB;AAQO,MAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,QAAA;AAAA,EACR,GAAA,EAAK,KAAA;AAAA,EACL,IAAA,EAAM;AACR;;;;"}

package/dist/common/constants/storage.constant.d.ts

@@ -19,6 +19,7 @@ export declare const COOKIE_DEFAULTS: {
 /** Pinia persistence keys (versioned for schema migration). */
 export declare const STORE_PERSIST_KEY: {
     readonly AUTH: "cms-auth-v1";
+    readonly AUTHZ: "cms-authz-v1";
     readonly CONTENT: "cms-content-v1";
     readonly RULES: "cms-rules-v1";
     readonly EXECUTIONS: "cms-executions-v1";

package/dist/common/constants/storage.constant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.constant.d.ts","sourceRoot":"","sources":["../../../src/common/constants/storage.constant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAG,kBAA2B,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAG,mBAA4B,CAAC;AAEtE,sEAAsE;AACtE,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC;AAEX,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;CAapB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAC;AAEtD,eAAO,MAAM,WAAW;;CAEd,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,wCAA4C,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"storage.constant.d.ts","sourceRoot":"","sources":["../../../src/common/constants/storage.constant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAG,kBAA2B,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAG,mBAA4B,CAAC;AAEtE,sEAAsE;AACtE,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC;AAEX,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;CAcpB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAC;AAEtD,eAAO,MAAM,WAAW;;CAEd,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,wCAA4C,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/index.js

@@ -3,8 +3,8 @@ import { H as HTTP_DEFAULTS, a as HTTP_RETRY_STATUS_CODES, b as HTTP_HEADER, R a
 export { S as SERIALIZATION_FORMAT } from './chunks/http.constant-BzH5tJTG.js';
 import { A as AUTH_PROXY_PATH, a as AUTH_ENDPOINT } from './chunks/auth.constant-CMI1lqQc.js';
 import { A as AUTHZ_PROXY_PATH, a as AUTHZ_ENDPOINT } from './chunks/authz.constant-BAarvacV.js';
-import { C as COOKIE_SAME_SITE, a as COOKIE_DEFAULTS, T as TOKEN_STORAGE_KEY, P as PERSIST_KEY, S as STORE_PERSIST_KEY } from './chunks/storage.constant--64BDSPW.js';
-export { b as PERSIST_ALLOWED_KEYS, c as PERSIST_MAX_BYTES, d as PERSIST_PREFIX, e as STORAGE_NAME } from './chunks/storage.constant--64BDSPW.js';
+import { C as COOKIE_SAME_SITE, a as COOKIE_DEFAULTS, T as TOKEN_STORAGE_KEY, P as PERSIST_KEY, S as STORE_PERSIST_KEY } from './chunks/storage.constant-CVWam5ls.js';
+export { b as PERSIST_ALLOWED_KEYS, c as PERSIST_MAX_BYTES, d as PERSIST_PREFIX, e as STORAGE_NAME } from './chunks/storage.constant-CVWam5ls.js';
 import { ref, shallowRef, watch, computed } from 'vue';
 import { W as WS_RECONNECT_INITIAL_MS, a as WS_RECONNECT_MAX_MS, b as WS_CONNECTION_STATE, c as WS_PING_INTERVAL_MS, d as WS_MESSAGE_TYPE, e as WS_CLOSE_CODE, f as WS_MAX_RECONNECT_ATTEMPTS, g as WS_AUTH_TIMEOUT_MS, h as WS_RECONNECT_JITTER_MS, i as WS_PING_WATCHDOG_CHECK_MS, j as WS_MAX_SUBSCRIPTIONS, k as WS_PING_WATCHDOG_FACTOR } from './chunks/mt5Retcode-DlZLQOLA.js';
 export { M as MT5_RETCODE, l as WS_ACTION_ACCEPTED_ERROR_CODE, m as WS_ACTION_ERROR_CODE, n as WS_ACTION_RESULT_ERROR_CODE, o as WS_ACTION_RESULT_TTL_MS, p as WS_AUTH_ERROR_CODE, q as WS_CLOSE_REASON, r as WS_MT5_EVENT_TYPE, s as WS_TOPIC, t as WS_TOPIC_NAMESPACE, u as accountTopic, v as adminTopic, w as mt5Topic, x as streamTopic, y as symbolTopic, z as userTopic, A as viewMt5Retcode } from './chunks/mt5Retcode-DlZLQOLA.js';
@@ -1192,7 +1192,7 @@ function createContentService(opts) {
       if (mock())
         return _okList(mockContentList(query));
       return api(CONTENT_ENDPOINT.BASE, {
-        query: _wireQuery(query)
+        query: _wireQuery$1(query)
       });
     },
     async detail(uuid) {
@@ -1247,7 +1247,7 @@ function createContentService(opts) {
     }
   };
 }
-function _wireQuery(query) {
+function _wireQuery$1(query) {
   const out = { ...query };
   if (out.packId !== void 0) {
     out.pack_id = out.packId;
@@ -1795,18 +1795,18 @@ function createExecutionsService(opts) {
         };
       }
       if (params.contentId) {
-        const { contentId: _id, offset = 0, limit = 50, ...rest } = params;
+        const { contentId: _id, offset = 0, limit = 50, ...rest2 } = params;
         const rows = await api(
           EXECUTIONS_ENDPOINT.byContent(params.contentId),
           {
-            query: { offset, limit, ...rest }
+            query: { offset, limit, ..._wireQuery(rest2) }
           }
         );
         const page = Math.floor(offset / Math.max(limit, 1)) + 1;
         return { items: rows, total: rows.length, page, perPage: limit };
       }
-      const { contentId: _drop, offset: _o, limit: _l, sourceType: _s, ...query } = params;
-      return api(EXECUTIONS_ENDPOINT.BASE, { query });
+      const { contentId: _drop, offset: _o, limit: _l, sourceType: _s, ...rest } = params;
+      return api(EXECUTIONS_ENDPOINT.BASE, { query: _wireQuery(rest) });
     },
     async detail(uuid) {
       if (mock()) return _mustFind$1(mockExecutionDetail(uuid), uuid);
@@ -1814,6 +1814,16 @@ function createExecutionsService(opts) {
     }
   };
 }
+function _wireQuery(params) {
+  const { contentUuid, perPage, excludeParams, includeUnlinked, llmOnly, ...rest } = params;
+  const q = { ...rest };
+  if (contentUuid != null) q.content_uuid = contentUuid;
+  if (perPage != null) q.per_page = perPage;
+  if (excludeParams != null) q.exclude_params = excludeParams;
+  if (includeUnlinked != null) q.include_unlinked = includeUnlinked;
+  if (llmOnly != null) q.llm_only = llmOnly;
+  return q;
+}
 function _mustFind$1(exec, uuid) {
   if (!exec) throw _notFound$2(`Execution ${uuid} not found`);
   return deepClone(exec);
@@ -3216,6 +3226,8 @@ function createNotificationsService(opts) {
     if (query.category) q.category = query.category;
     if (query.page != null) q.page = query.page;
     if (query.perPage != null) q.per_page = query.perPage;
+    if (query.sortBy) q.sort_by = query.sortBy;
+    if (query.sortDirection) q.sort_direction = query.sortDirection;
     return q;
   };
   return {
@@ -4049,17 +4061,30 @@ function createPeoplePackOpsService(opts) {
     async uninstall(slug, force = false) {
       await api(`${PACKS_ENDPOINT}/${encodeURIComponent(slug)}`, {
         method: "DELETE",
-        query: force ? { force: true } : void 0
+        body: force ? { force: true } : void 0
       });
     },
     async updateMetadata(slug, patch) {
-      const metadata = {
-        ...patch.metadata ?? {},
-        ...patch.disabled !== void 0 ? { "people.pack.disabled": patch.disabled } : {}
+      const row = await api(
+        `${PACKS_ENDPOINT}/${encodeURIComponent(slug)}`
+      );
+      const currentMeta = row?.metadata ?? {};
+      const merged = {
+        ...currentMeta,
+        ...patch.metadata ?? {}
       };
+      if (patch.disabled !== void 0) merged["people.pack.disabled"] = patch.disabled;
+      for (const key of [
+        "installedRef",
+        "installedRequestedRef",
+        "installed_ref",
+        "installed_requested_ref"
+      ]) {
+        if (currentMeta[key] !== void 0) merged[key] = currentMeta[key];
+      }
       return api(`${PACKS_ENDPOINT}/${encodeURIComponent(slug)}`, {
         method: "PUT",
-        body: { metadata }
+        body: { metadata: merged }
       });
     },
     async conflicts(slug) {
@@ -6909,116 +6934,134 @@ function _noSdk$a() {
   return new Error("Auth store: SDK not attached. Call setSdk() first.");
 }
 
-const useAuthzStore = defineStore("cms-authz", () => {
-  const sdk = shallowRef(null);
-  const portal = ref("");
-  const portalAccess = ref(null);
-  const loaded = ref(false);
-  const isLoading = ref(false);
-  const errorCode = ref("");
-  let inFlight = null;
-  const hasAccess = computed(() => portalAccess.value?.hasAccess ?? false);
-  const permissions = computed(() => portalAccess.value?.permissions ?? []);
-  const roles = computed(() => portalAccess.value?.roles ?? []);
-  const SESSION_INVALID_CODES = /* @__PURE__ */ new Set([
-    "UNAUTHENTICATED",
-    "INVALID_TOKEN_AUDIENCE"
-  ]);
-  const ACCESS_DENIED_CODE = "PORTAL_ACCESS_DENIED";
-  const isSessionInvalid = computed(
-    () => loaded.value && SESSION_INVALID_CODES.has(errorCode.value)
-  );
-  const isAccessDenied = computed(() => loaded.value && errorCode.value === ACCESS_DENIED_CODE);
-  const can = (permission) => {
-    if (!loaded.value || !hasAccess.value) return false;
-    const list = permissions.value;
-    return list.includes("*") || list.includes(permission);
-  };
-  const hasRole = (role) => roles.value.includes(role);
-  const hasAnyPermission = (list) => {
-    if (!loaded.value || !hasAccess.value) return false;
-    const granted = permissions.value;
-    return granted.includes("*") || list.some((p) => granted.includes(p));
-  };
-  const hasAllPermissions = (list) => {
-    if (!loaded.value || !hasAccess.value) return false;
-    const granted = permissions.value;
-    return granted.includes("*") || list.every((p) => granted.includes(p));
-  };
-  const setSdk = (instance) => {
-    sdk.value = instance;
-  };
-  const setPortal = (id) => {
-    portal.value = id;
-  };
-  const _reset = () => {
-    portalAccess.value = null;
-    loaded.value = false;
-    isLoading.value = false;
-    errorCode.value = "";
-    inFlight = null;
-  };
-  const loadPortalAccess = async (opts) => {
-    if (!sdk.value) throw new Error("Authz store: SDK not attached. Call setSdk() first.");
-    if (opts?.portal) portal.value = opts.portal;
-    if (loaded.value && !opts?.force) return;
-    if (inFlight) return inFlight;
-    isLoading.value = true;
-    inFlight = (async () => {
-      try {
-        portalAccess.value = await sdk.value.authz.portalAccess(portal.value || void 0);
-        errorCode.value = "";
-      } catch (e) {
-        portalAccess.value = null;
-        errorCode.value = _extractErrorCode(e);
-        if (!errorCode.value) console.error("[cms-authz] portalAccess failed:", e);
-      } finally {
-        loaded.value = true;
-        isLoading.value = false;
-        inFlight = null;
-      }
-    })();
-    return inFlight;
-  };
-  const auth = useAuthStore();
-  watch(
-    () => auth.loginEpoch,
-    () => {
+const useAuthzStore = defineStore(
+  "cms-authz",
+  () => {
+    const sdk = shallowRef(null);
+    const portal = ref("");
+    const portalAccess = ref(null);
+    const loaded = ref(false);
+    const isLoading = ref(false);
+    const errorCode = ref("");
+    let inFlight = null;
+    const hasAccess = computed(() => portalAccess.value?.hasAccess ?? false);
+    const permissions = computed(() => portalAccess.value?.permissions ?? []);
+    const roles = computed(() => portalAccess.value?.roles ?? []);
+    const SESSION_INVALID_CODES = /* @__PURE__ */ new Set([
+      "UNAUTHENTICATED",
+      "INVALID_TOKEN_AUDIENCE"
+    ]);
+    const ACCESS_DENIED_CODE = "PORTAL_ACCESS_DENIED";
+    const isSessionInvalid = computed(
+      () => loaded.value && SESSION_INVALID_CODES.has(errorCode.value)
+    );
+    const isAccessDenied = computed(() => loaded.value && errorCode.value === ACCESS_DENIED_CODE);
+    const can = (permission) => {
+      if (!loaded.value || !hasAccess.value) return false;
+      return permissions.value.some((g) => _permissionMatches(g, permission));
+    };
+    const hasRole = (role) => roles.value.includes(role);
+    const hasAnyPermission = (list) => {
+      if (!loaded.value || !hasAccess.value) return false;
+      const granted = permissions.value;
+      return list.some((p) => granted.some((g) => _permissionMatches(g, p)));
+    };
+    const hasAllPermissions = (list) => {
+      if (!loaded.value || !hasAccess.value) return false;
+      const granted = permissions.value;
+      return list.every((p) => granted.some((g) => _permissionMatches(g, p)));
+    };
+    const setSdk = (instance) => {
+      sdk.value = instance;
+    };
+    const setPortal = (id) => {
+      portal.value = id;
+    };
+    const _reset = () => {
       portalAccess.value = null;
       loaded.value = false;
+      isLoading.value = false;
       errorCode.value = "";
       inFlight = null;
+    };
+    const loadPortalAccess = async (opts) => {
+      if (!sdk.value) throw new Error("Authz store: SDK not attached. Call setSdk() first.");
+      if (opts?.portal) portal.value = opts.portal;
+      if (loaded.value && !opts?.force) return;
+      if (inFlight) return inFlight;
+      isLoading.value = true;
+      inFlight = (async () => {
+        try {
+          portalAccess.value = await sdk.value.authz.portalAccess(portal.value || void 0);
+          errorCode.value = "";
+        } catch (e) {
+          portalAccess.value = null;
+          errorCode.value = _extractErrorCode(e);
+          if (!errorCode.value) console.error("[cms-authz] portalAccess failed:", e);
+        } finally {
+          loaded.value = true;
+          isLoading.value = false;
+          inFlight = null;
+        }
+      })();
+      return inFlight;
+    };
+    const auth = useAuthStore();
+    watch(
+      () => auth.loginEpoch,
+      () => {
+        portalAccess.value = null;
+        loaded.value = false;
+        errorCode.value = "";
+        inFlight = null;
+      }
+    );
+    watch(
+      () => auth.isLoggedIn,
+      (loggedIn) => {
+        if (!loggedIn) _reset();
+      }
+    );
+    return {
+      // state
+      portal,
+      portalAccess,
+      loaded,
+      isLoading,
+      errorCode,
+      // getters
+      hasAccess,
+      permissions,
+      roles,
+      isSessionInvalid,
+      isAccessDenied,
+      // actions
+      setSdk,
+      setPortal,
+      loadPortalAccess,
+      can,
+      hasRole,
+      hasAnyPermission,
+      hasAllPermissions
+    };
+  },
+  {
+    // Rehydrate the portal-access cache across reloads — `permissions`,
+    // `roles`, and `hasAccess` are computeds derived from `portalAccess`,
+    // so persisting the source (plus `loaded` so `can()` trusts the cache
+    // on the first render after F5, per the store contract "read the cache,
+    // never fetch before rendering") restores the full authorization
+    // surface. App-level session-restore middleware is expected to call
+    // `loadPortalAccess({ force: true })` afterwards to refresh from the
+    // server — same fetch-on-restore contract as login / `loginEpoch` bump.
+    // Size: `IPortalAccess` is `{ portal, hasAccess, permissions[], roles[] }`,
+    // well under the `PERSIST_MAX_BYTES` cookie cap.
+    persist: {
+      key: STORE_PERSIST_KEY.AUTHZ,
+      pick: ["portalAccess", "loaded", "errorCode"]
     }
-  );
-  watch(
-    () => auth.isLoggedIn,
-    (loggedIn) => {
-      if (!loggedIn) _reset();
-    }
-  );
-  return {
-    // state
-    portal,
-    portalAccess,
-    loaded,
-    isLoading,
-    errorCode,
-    // getters
-    hasAccess,
-    permissions,
-    roles,
-    isSessionInvalid,
-    isAccessDenied,
-    // actions
-    setSdk,
-    setPortal,
-    loadPortalAccess,
-    can,
-    hasRole,
-    hasAnyPermission,
-    hasAllPermissions
-  };
-});
+  }
+);
 function _extractErrorCode(e) {
   const err = e;
   const payload = err?.data?.data ?? err?.data;
@@ -7026,6 +7069,16 @@ function _extractErrorCode(e) {
   const code = detail?.error ?? payload?.error;
   return typeof code === "string" ? code : "";
 }
+function _permissionMatches(granted, requested) {
+  if (granted === "*") return true;
+  const g = granted.split(":");
+  if (g.every((seg) => seg === "*")) return true;
+  const r = requested.split(":");
+  if (g.length > r.length) return false;
+  if (!g.every((seg, i) => seg === "*" || seg === r[i])) return false;
+  if (g.length < r.length && g.at(-1) !== "*") return false;
+  return true;
+}
 
 const useBarsStore = defineStore(
   "cms-bars",