@plumix/core 0.1.0

package/dist/rpc/procedures/lookup/list.js

@@ -0,0 +1,23 @@
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+import { lookupListInputSchema, requireAdapter } from "./schemas.js";
+// Generic pickers in the admin (`UserPicker`, `EntryPicker`, etc.)
+// dispatch to this procedure with `{ kind, query, scope }`. Server
+// looks up the registered `LookupAdapter` for the kind and forwards
+// the call. Unknown kinds 404 — the admin should never reach here
+// with a kind absent from the manifest, so a missing kind means
+// either a stale wire payload or a malicious caller.
+export const list = base
+    .use(authenticated)
+    .input(lookupListInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const { adapter } = requireAdapter(context, input.kind, errors);
+    const items = await adapter.list(context, {
+        query: input.query,
+        scope: input.scope,
+        limit: input.limit,
+        ids: input.ids,
+    });
+    return { items };
+});
+//# sourceMappingURL=list.js.map

package/dist/rpc/procedures/lookup/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/lookup/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAErE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,qDAAqD;AAErD,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI;KACrB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,qBAAqB,CAAC;KAC5B,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/lookup/resolve.d.ts

@@ -0,0 +1,66 @@
+export declare const resolve: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../index.js").AppContext, import("../../../index.js").AuthenticatedAppContext<typeof import("../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly kind: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, undefined>]>;
+    readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MaxLengthAction<string, 64, undefined>]>;
+    readonly scope: import("valibot").OptionalSchema<import("valibot").RecordSchema<import("valibot").StringSchema<undefined>, import("valibot").UnknownSchema, undefined>, undefined>;
+}, undefined>, import("@orpc/server").Schema<{
+    result: import("../../../index.js").LookupResult | null;
+}, {
+    result: import("../../../index.js").LookupResult | null;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/rpc/procedures/lookup/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/lookup/resolve.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAOhB,CAAC"}

package/dist/rpc/procedures/lookup/resolve.js

@@ -0,0 +1,18 @@
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+import { lookupResolveInputSchema, requireAdapter } from "./schemas.js";
+// Picker uses this to render the label of an already-selected ID
+// (e.g. when an entry's saved meta points at user id "42", the form
+// loads showing the user's name + role rather than the bare "42").
+// Returns `{ result: null }` when the target is gone or no longer
+// matches scope — same orphan semantics as `filterMetaOrphans`
+// applies here.
+export const resolve = base
+    .use(authenticated)
+    .input(lookupResolveInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const { adapter } = requireAdapter(context, input.kind, errors);
+    const result = await adapter.resolve(context, input.id, input.scope);
+    return { result };
+});
+//# sourceMappingURL=resolve.js.map

package/dist/rpc/procedures/lookup/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/lookup/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExE,iEAAiE;AACjE,oEAAoE;AACpE,mEAAmE;AACnE,kEAAkE;AAClE,+DAA+D;AAC/D,gBAAgB;AAEhB,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI;KACxB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,wBAAwB,CAAC;KAC/B,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/lookup/schemas.d.ts

@@ -0,0 +1,31 @@
+import * as v from "valibot";
+import type { AppContext } from "../../../context/app.js";
+import type { RegisteredLookupAdapter } from "../../../plugin/lookup.js";
+export declare const lookupListInputSchema: v.ObjectSchema<{
+    readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>]>;
+    readonly query: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    readonly scope: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+    readonly limit: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 100, undefined>]>, undefined>;
+    readonly ids: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 64, undefined>]>, undefined>, v.MaxLengthAction<string[], 100, undefined>]>, undefined>;
+}, undefined>;
+export declare const lookupResolveInputSchema: v.ObjectSchema<{
+    readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>]>;
+    readonly id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    readonly scope: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+}, undefined>;
+interface LookupErrors {
+    NOT_FOUND: (args: {
+        data: {
+            kind: string;
+            id: string;
+        };
+    }) => Error;
+    FORBIDDEN: (args: {
+        data: {
+            capability: string;
+        };
+    }) => Error;
+}
+export declare function requireAdapter(context: AppContext, kind: string, errors: LookupErrors): RegisteredLookupAdapter;
+export {};
+//# sourceMappingURL=schemas.d.ts.map

package/dist/rpc/procedures/lookup/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/lookup/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAkCzE,eAAO,MAAM,qBAAqB;;;;;;aAQhC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;aAInC,CAAC;AAEH,UAAU,YAAY;IACpB,SAAS,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAK,KAAK,CAAC;IACnE,SAAS,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAK,KAAK,CAAC;CAC9D;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,uBAAuB,CAgBzB"}

package/dist/rpc/procedures/lookup/schemas.js

@@ -0,0 +1,55 @@
+import * as v from "valibot";
+// `kind` matches the discriminator a reference field carries on its
+// `referenceTarget.kind`. Valid kinds are checked against the
+// adapter registry at handler time, so the schema only enforces a
+// shape (lowercase alphanum + dash/underscore, ≤ 64 chars) the
+// registry contract can store.
+const kindSchema = v.pipe(v.string(), v.regex(/^[a-z][a-z0-9_-]{0,63}$/i));
+const querySchema = v.pipe(v.string(), v.trim(), v.maxLength(200));
+// Scope rides through to the adapter as an opaque JSON object.
+// Per-kind validation lives in the adapter (e.g. `user` validates
+// `roles` against `USER_ROLES`); the RPC schema only confirms the
+// shape isn't an array or scalar.
+const scopeSchema = v.optional(v.record(v.string(), v.unknown()));
+// Realistic upper bound on a single id string. UUIDs are 36 chars;
+// `Number.MAX_SAFE_INTEGER` is 16 digits. 64 covers both with room
+// for plugin-supplied id formats (slug-like, prefixed) while
+// preventing CPU amplification on the regex parsers each adapter
+// runs against incoming ids.
+const ID_MAX_LENGTH = 64;
+// `ids` is the resolve-by-id batch path: when set, the adapter
+// returns rows matching any of these ids (still scope-filtered) in
+// a single query. Capped at 100 to match the meta pipeline's
+// `HARD_MULTI_REFERENCE_LIMIT` — the picker can't ship a wider
+// selection through to the validator anyway.
+const lookupListIdsSchema = v.pipe(v.array(v.pipe(v.string(), v.maxLength(ID_MAX_LENGTH))), v.maxLength(100));
+export const lookupListInputSchema = v.object({
+    kind: kindSchema,
+    query: v.optional(querySchema),
+    scope: scopeSchema,
+    limit: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(100))),
+    ids: v.optional(lookupListIdsSchema),
+});
+export const lookupResolveInputSchema = v.object({
+    kind: kindSchema,
+    id: v.pipe(v.string(), v.maxLength(ID_MAX_LENGTH)),
+    scope: scopeSchema,
+});
+export function requireAdapter(context, kind, errors) {
+    const registered = context.plugins.lookupAdapters.get(kind);
+    if (!registered) {
+        throw errors.NOT_FOUND({ data: { kind: "lookup_adapter", id: kind } });
+    }
+    // Picker-facing surface: the adapter's owner declared which
+    // capability gates list/resolve. Without it, any authenticated
+    // user could enumerate the adapter's universe (emails for `user`,
+    // titles for future `entry`, etc.) at a lower privilege than the
+    // matching list RPC enforces. Adapters that opt out (`null`) are
+    // public — make that an explicit decision per kind.
+    const { capability } = registered;
+    if (capability !== null && !context.auth.can(capability)) {
+        throw errors.FORBIDDEN({ data: { capability } });
+    }
+    return registered;
+}
+//# sourceMappingURL=schemas.js.map

package/dist/rpc/procedures/lookup/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/lookup/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAK7B,oEAAoE;AACpE,8DAA8D;AAC9D,kEAAkE;AAClE,+DAA+D;AAC/D,+BAA+B;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnE,+DAA+D;AAC/D,kEAAkE;AAClE,kEAAkE;AAClE,kCAAkC;AAClC,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAElE,mEAAmE;AACnE,mEAAmE;AACnE,6DAA6D;AAC7D,iEAAiE;AACjE,6BAA6B;AAC7B,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,+DAA+D;AAC/D,mEAAmE;AACnE,6DAA6D;AAC7D,+DAA+D;AAC/D,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EACvD,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC9B,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,CAAC,CAAC,QAAQ,CACf,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAChE;IACD,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,UAAU;IAChB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAClD,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC;AAOH,MAAM,UAAU,cAAc,CAC5B,OAAmB,EACnB,IAAY,EACZ,MAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,4DAA4D;IAC5D,+DAA+D;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAClC,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/rpc/procedures/lookup-adapters.d.ts

@@ -0,0 +1,3 @@
+import type { MutablePluginRegistry } from "../../plugin/manifest.js";
+export declare function registerCoreLookupAdapters(registry: MutablePluginRegistry): void;
+//# sourceMappingURL=lookup-adapters.d.ts.map

package/dist/rpc/procedures/lookup-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup-adapters.d.ts","sourceRoot":"","sources":["../../../src/rpc/procedures/lookup-adapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAStE,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,qBAAqB,GAC9B,IAAI,CA4BN"}

package/dist/rpc/procedures/lookup-adapters.js

@@ -0,0 +1,36 @@
+import { entryLookupAdapter } from "./entry/lookup.js";
+import { termLookupAdapter } from "./term/lookup.js";
+import { userLookupAdapter } from "./user/lookup.js";
+// Core adapters seed the registry before plugins install so plugin-
+// supplied kinds can't collide with built-ins (`registerLookupAdapter`
+// throws on duplicate kind).
+export function registerCoreLookupAdapters(registry) {
+    registry.lookupAdapters.set("user", {
+        kind: "user",
+        adapter: userLookupAdapter,
+        // Picker enumerates email + name; matches the `user.list` gate.
+        capability: "user:list",
+        registeredBy: null,
+    });
+    registry.lookupAdapters.set("entry", {
+        kind: "entry",
+        adapter: entryLookupAdapter,
+        // Picker enumerates entry titles across the requested
+        // `entryTypes`. `entry:read` is granted to subscribers, so this
+        // doesn't gate the picker tighter than the `entry.list` RPC
+        // does — but per-type read scoping is enforced inside the
+        // adapter via `inArray(entries.type, …)` from the field's scope.
+        capability: null,
+        registeredBy: null,
+    });
+    registry.lookupAdapters.set("term", {
+        kind: "term",
+        adapter: termLookupAdapter,
+        // Term names + slugs are public (`term:<taxonomy>:read` is on the
+        // subscriber baseline); per-taxonomy scoping is enforced inside
+        // the adapter via `inArray(terms.taxonomy, …)`.
+        capability: null,
+        registeredBy: null,
+    });
+}
+//# sourceMappingURL=lookup-adapters.js.map

package/dist/rpc/procedures/lookup-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup-adapters.js","sourceRoot":"","sources":["../../../src/rpc/procedures/lookup-adapters.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,oEAAoE;AACpE,uEAAuE;AACvE,6BAA6B;AAE7B,MAAM,UAAU,0BAA0B,CACxC,QAA+B;IAE/B,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE;QAClC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iBAAiB;QAC1B,gEAAgE;QAChE,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,kBAAkB;QAC3B,sDAAsD;QACtD,gEAAgE;QAChE,4DAA4D;QAC5D,0DAA0D;QAC1D,iEAAiE;QACjE,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE;QAClC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iBAAiB;QAC1B,kEAAkE;QAClE,gEAAgE;QAChE,gDAAgD;QAChD,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/rpc/procedures/lookup.errors.d.ts

@@ -0,0 +1,15 @@
+type LookupScopeErrorCode = "entry_types_required" | "term_taxonomies_required";
+/**
+ * A lookup adapter was called without the scope filter that enforces
+ * per-type / per-taxonomy read scoping. Thrown at runtime (not just the
+ * builder's TS level) because a wire-side caller could omit it and turn the
+ * picker into an unscoped enumeration channel. Named-error convention (#232).
+ */
+export declare class LookupScopeError extends Error {
+    readonly code: LookupScopeErrorCode;
+    private constructor();
+    static entryTypesRequired(): LookupScopeError;
+    static termTaxonomiesRequired(): LookupScopeError;
+}
+export {};
+//# sourceMappingURL=lookup.errors.d.ts.map

package/dist/rpc/procedures/lookup.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.errors.d.ts","sourceRoot":"","sources":["../../../src/rpc/procedures/lookup.errors.ts"],"names":[],"mappings":"AAAA,KAAK,oBAAoB,GAAG,sBAAsB,GAAG,0BAA0B,CAAC;AAEhF;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAKzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAEpC,OAAO;IAKP,MAAM,CAAC,kBAAkB,IAAI,gBAAgB;IAO7C,MAAM,CAAC,sBAAsB,IAAI,gBAAgB;CAMlD"}

package/dist/rpc/procedures/lookup.errors.js

@@ -0,0 +1,23 @@
+/**
+ * A lookup adapter was called without the scope filter that enforces
+ * per-type / per-taxonomy read scoping. Thrown at runtime (not just the
+ * builder's TS level) because a wire-side caller could omit it and turn the
+ * picker into an unscoped enumeration channel. Named-error convention (#232).
+ */
+export class LookupScopeError extends Error {
+    static {
+        LookupScopeError.prototype.name = "LookupScopeError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static entryTypesRequired() {
+        return new LookupScopeError("entry_types_required", "entry adapter: scope.entryTypes is required and must be non-empty");
+    }
+    static termTaxonomiesRequired() {
+        return new LookupScopeError("term_taxonomies_required", "term adapter: scope.termTaxonomies is required and must be non-empty");
+    }
+}
+//# sourceMappingURL=lookup.errors.js.map

package/dist/rpc/procedures/lookup.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.errors.js","sourceRoot":"","sources":["../../../src/rpc/procedures/lookup.errors.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,gBAAgB,CAAC,SAAS,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACvD,CAAC;IAEQ,IAAI,CAAuB;IAEpC,YAAoB,IAA0B,EAAE,OAAe;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,sBAAsB;QAC3B,OAAO,IAAI,gBAAgB,CACzB,0BAA0B,EAC1B,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF"}

package/dist/rpc/procedures/search/index.d.ts

@@ -0,0 +1,64 @@
+import * as v from "valibot";
+export declare const searchRouter: {
+    readonly query: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../index.js").AppContext, import("../../../index.js").AuthenticatedAppContext<typeof import("../../../db/schema/index.js")>>, v.ObjectSchema<{
+        readonly query: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 200, undefined>]>;
+        readonly limit: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 20, undefined>]>, undefined>;
+    }, undefined>, import("@orpc/server").Schema<readonly import("../../../search/admin-search.js").SearchGroup[], readonly import("../../../search/admin-search.js").SearchGroup[]>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+        readonly UNAUTHORIZED: {
+            readonly message: "Authentication required";
+        };
+        readonly BAD_REQUEST: {
+            readonly message: "Invalid input";
+            readonly data: v.ObjectSchema<{
+                readonly reason: v.StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly FORBIDDEN: {
+            readonly message: "Permission denied";
+            readonly data: v.ObjectSchema<{
+                readonly capability: v.StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly NOT_FOUND: {
+            readonly message: "Resource not found";
+            readonly data: v.ObjectSchema<{
+                readonly kind: v.StringSchema<undefined>;
+                readonly id: v.UnionSchema<[v.StringSchema<undefined>, v.NumberSchema<undefined>], undefined>;
+            }, undefined>;
+        };
+        readonly CONFLICT: {
+            readonly message: "Resource conflict";
+            readonly data: v.ObjectSchema<{
+                readonly reason: v.StringSchema<undefined>;
+                readonly key: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly PAYLOAD_TOO_LARGE: {
+            readonly message: "Payload too large";
+            readonly data: v.ObjectSchema<{
+                readonly limit: v.NumberSchema<undefined>;
+                readonly received: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly UNSUPPORTED_MEDIA_TYPE: {
+            readonly message: "Unsupported media type";
+            readonly data: v.ObjectSchema<{
+                readonly mime: v.StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly INVALID_BLOCK_CONTENT: {
+            readonly message: "Block content failed registry validation";
+            readonly data: v.ObjectSchema<{
+                readonly issues: v.ArraySchema<v.ObjectSchema<{
+                    readonly code: v.StringSchema<undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                    readonly path: v.StringSchema<undefined>;
+                    readonly nodeName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly attributeName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly markName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+        };
+    }>, Record<never, never>>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/rpc/procedures/search/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/search/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAiC7B,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAqB,CAAC"}

package/dist/rpc/procedures/search/index.js

@@ -0,0 +1,25 @@
+import * as v from "valibot";
+import { runAdminSearch } from "../../../search/admin-search.js";
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+const DEFAULT_LIMIT = 5;
+const searchInputSchema = v.object({
+    query: v.pipe(v.string(), v.trim(), v.maxLength(200)),
+    limit: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(20))),
+});
+/**
+ * Cross-domain admin search for the command palette. Fans out across the
+ * registered `admin:search:results` domains (entries, terms, users, and
+ * plugin-contributed ones) and returns grouped results. Each domain
+ * enforces its own capabilities server-side.
+ */
+const query = base
+    .use(authenticated)
+    .input(searchInputSchema)
+    .handler(async ({ input, context }) => {
+    if (input.query.length === 0)
+        return [];
+    return runAdminSearch(context.hooks, { query: input.query, limit: input.limit ?? DEFAULT_LIMIT }, context);
+});
+export const searchRouter = { query };
+//# sourceMappingURL=index.js.map

package/dist/rpc/procedures/search/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/search/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,QAAQ,CACf,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAC/D;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI;KACf,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,iBAAiB,CAAC;KACxB,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;IACpC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,cAAc,CACnB,OAAO,CAAC,KAAK,EACb,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa,EAAE,EAC3D,OAAO,CACR,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,KAAK,EAAW,CAAC"}

package/dist/rpc/procedures/settings/get.d.ts

@@ -0,0 +1,60 @@
+export declare const get: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../index.js").AppContext, import("../../../index.js").AuthenticatedAppContext<typeof import("../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly group: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "must be lowercase ASCII [a-z][a-z0-9_]*">]>;
+}, undefined>, import("@orpc/server").Schema<Readonly<Record<string, unknown>>, Readonly<Record<string, unknown>>>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=get.d.ts.map

package/dist/rpc/procedures/settings/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/settings/get.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAyBZ,CAAC"}

package/dist/rpc/procedures/settings/get.js

@@ -0,0 +1,35 @@
+import { eq } from "../../../db/index.js";
+import { settings } from "../../../db/schema/settings.js";
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+import { settingsGetInputSchema } from "./schemas.js";
+const CAPABILITY = "settings:manage";
+// Hard ceiling on rows returned per group. Registered-field count per
+// group is already capped at 200 (`MAX_FIELDS_PER_SETTINGS_GROUP` in
+// plugin/validation/meta-box-fields); doubling it here gives headroom for orphan keys
+// left by uninstalled plugins while still bounding response size.
+const MAX_GROUP_ROWS_PER_READ = 500;
+// Returns the full key → value bag for one group. Missing keys aren't
+// represented — callers (admin form loaders, plugin code) fall back to
+// the registered field's `default` when they need a placeholder.
+export const get = base
+    .use(authenticated)
+    .input(settingsGetInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    if (!context.auth.can(CAPABILITY)) {
+        throw errors.FORBIDDEN({ data: { capability: CAPABILITY } });
+    }
+    const filtered = await context.hooks.applyFilter("rpc:settings.get:input", input);
+    const rows = await context.db
+        .select({ key: settings.key, value: settings.value })
+        .from(settings)
+        .where(eq(settings.group, filtered.group))
+        .limit(MAX_GROUP_ROWS_PER_READ);
+    const bag = {};
+    for (const row of rows)
+        bag[row.key] = row.value;
+    return context.hooks.applyFilter("rpc:settings.get:output", bag, {
+        group: filtered.group,
+    });
+});
+//# sourceMappingURL=get.js.map

package/dist/rpc/procedures/settings/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/settings/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,sEAAsE;AACtE,qEAAqE;AACrE,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,sEAAsE;AACtE,uEAAuE;AACvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI;KACpB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,sBAAsB,CAAC;KAC7B,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAC9C,wBAAwB,EACxB,KAAK,CACN,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;SAC1B,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;SACpD,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;SACzC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAElC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IAEjD,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,EAAE;QAC/D,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}