alinea 2.0.0-preview.10 → 2.0.0-preview.11

package/dist/.init/content/pages/welcome.json

@@ -1,5 +1,5 @@
 {
-  "_id": "3K5v72iiSXMjBJwIX9mSIj8QqhI",
+  "_id": "3KHB2PydgBPbUsKveWcaGSXkqjV",
   "_type": "Page",
   "_index": "a0",
   "_seeded": "welcome.json",

package/dist/.mcp/later/dev.json

@@ -1 +1 @@
-{"url":"http://localhost:1","pid":3102}
+{"url":"http://localhost:1","pid":3065}

package/dist/.mcp/online/dev.json

@@ -1 +1 @@
-{"url":"http://localhost:40115","pid":3102}
+{"url":"http://localhost:38409","pid":3065}

package/dist/adapter/next/handler.js

@@ -67,8 +67,6 @@ function createHandlerWithDatabase(input, openGeneratedDatabase) {
       return failure(400, "Expected JSON");
     }
     if (!Array.isArray(mutations)) return failure(400, "Expected mutations");
-    const adjusted = await options.beforeCommit?.({ mutations });
-    if (adjusted) mutations = [...adjusted];
     const devServer = new Client({
       config,
       url: context.handlerUrl.href,
@@ -80,15 +78,19 @@ function createHandlerWithDatabase(input, openGeneratedDatabase) {
       }
     });
     let sha;
+    let user;
     try {
-      ;
+      user = await devServer.user();
+      if (!user) return failure(401, "Unauthorized");
+      const adjusted = await options.beforeCommit?.({ mutations, user });
+      if (adjusted) mutations = [...adjusted];
       ({ sha } = await devServer.mutate(mutations));
     } catch (error) {
       if (error instanceof HttpError) return failure(error.code, error.message);
       throw error;
     }
     try {
-      await afterCommit({ mutations, sha });
+      await afterCommit({ mutations, sha, user });
     } catch (error) {
       console.error("Alinea afterCommit hook failed", error);
     }

package/dist/backend/Handler.d.ts

@@ -2,12 +2,15 @@ import type { CMS } from 'alinea/core/CMS';
 import type { AuthedContext, RemoteConnection, RequestContext } from 'alinea/core/Connection';
 import type { LocalStore } from 'alinea/core/db/LocalStore';
 import type { Mutation } from 'alinea/core/db/Mutation';
+import type { User } from 'alinea/core/User';
 export interface Handler {
     (request: Request, context: RequestContext): Promise<Response>;
 }
 export type HookResponse<T = void> = void | T | Promise<void | T>;
 export interface BeforeCommitContext {
     mutations: ReadonlyArray<Mutation>;
+    /** The user committing the mutations */
+    user: User;
 }
 export interface AfterCommitContext extends BeforeCommitContext {
     sha: string;

package/dist/backend/Handler.js

@@ -273,7 +273,10 @@ function createHandler({
         const policy = await user.policy;
         let mutations = await body;
         await local.syncWith(cnx);
-        const adjusted = await hooks.beforeCommit?.({ mutations });
+        const adjusted = await hooks.beforeCommit?.({
+          mutations,
+          user: user.claims
+        });
         if (adjusted) mutations = adjusted;
         const attempt = async (retry = 0) => {
           if (retry > 0) await local.syncWith(cnx);
@@ -297,10 +300,7 @@ function createHandler({
         };
         const sha = await attempt();
         try {
-          await hooks.afterCommit?.({
-            mutations,
-            sha
-          });
+          await hooks.afterCommit?.({ mutations, sha, user: user.claims });
         } catch (error) {
           console.error("Alinea afterCommit hook failed", error);
         }

package/dist/backend/api/OAuth2.js

@@ -1,15 +1,12 @@
 import {
   parse
 } from "../../chunks/chunk-BYJRQTFR.js";
-import {
-  PLazy
-} from "../../chunks/chunk-IKINPSS5.js";
 import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/api/OAuth2.ts
 import { AuthResultType } from "alinea/cloud/AuthResult";
 import { Config } from "alinea/core/Config";
-import { HttpError } from "alinea/core/HttpError";
+import { ErrorCode, HttpError } from "alinea/core/HttpError";
 import { createId } from "alinea/core/Id";
 import { outcome } from "alinea/core/Outcome";
 import { assert } from "alinea/core/util/Assert";
@@ -459,6 +456,7 @@ import {
   MissingCredentialsError
 } from "../Auth.js";
 import { router } from "../router/Router.js";
+import { jwks } from "../util/JWKS.js";
 var COOKIE_VERIFIER = "alinea.cv";
 var COOKIE_ACCESS_TOKEN = "alinea.at";
 var COOKIE_REFRESH_TOKEN = "alinea.rt";
@@ -466,7 +464,7 @@ var OAuth2 = class {
   #context;
   #config;
   #client;
-  #jwks;
+  #jwksUri;
   #validateClaims;
   constructor(context, config, options) {
     assert(
@@ -489,19 +487,16 @@ var OAuth2 = class {
         return response;
       })
     });
-    const loadJwks = async () => {
-      try {
-        const res = await fetch(options.jwksUri);
-        if (res.status !== 200)
-          throw new HttpError(res.status, await res.text());
-        const jwks = await res.json();
-        return jwks.keys;
-      } catch (cause) {
-        this.#jwks = PLazy.from(loadJwks);
-        throw new Error("Remote unavailable", { cause });
-      }
-    };
-    this.#jwks = PLazy.from(loadJwks);
+    this.#jwksUri = options.jwksUri;
+  }
+  async #key(token) {
+    const { header } = decode(token);
+    const keys = await jwks(this.#jwksUri, header.kid).catch((cause) => {
+      throw new HttpError(ErrorCode.ServiceUnavailable, "Remote unavailable", {
+        cause
+      });
+    });
+    return selectKey(keys, header);
   }
   get #redirectUri() {
     const url = new URL(this.#context.handlerUrl);
@@ -612,11 +607,10 @@ var OAuth2 = class {
       [COOKIE_ACCESS_TOKEN]: accessToken,
       [COOKIE_REFRESH_TOKEN]: refreshToken
     } = parse(cookieHeader);
-    const jwks = await this.#jwks;
     try {
       if (!accessToken)
         throw new MissingCredentialsError("Missing access token cookie");
-      const key = selectKey(jwks, accessToken);
+      const key = await this.#key(accessToken);
       const user = await verify(accessToken, key);
       await this.#validateClaims(user);
       assert(user.exp, "Missing exp claim in access token");
@@ -626,13 +620,15 @@ var OAuth2 = class {
       return { ...ctx, user, token: accessToken };
     } catch (error) {
       if (!refreshToken) throw error;
+      if (error instanceof HttpError && error.code === ErrorCode.ServiceUnavailable)
+        throw error;
       const token = { accessToken, refreshToken, expiresAt: null };
       const newToken = await this.#client.refreshToken(token).catch((cause) => {
         throw new InvalidCredentialsError("Failed to refresh token", {
           cause: [cause, error]
         });
       });
-      const key = selectKey(jwks, newToken.accessToken);
+      const key = await this.#key(newToken.accessToken);
       const user = await verify(newToken.accessToken, key, {
         clockTolerance: 30
       }).catch((cause) => {
@@ -653,13 +649,12 @@ var OAuth2 = class {
     }
   }
 };
-function selectKey(jwks, token) {
-  const { header } = decode(token);
+function selectKey(jwks2, header) {
   const kid = header.kid;
   const alg = header.alg;
   if (!kid) {
-    if (jwks.length === 1) {
-      const key2 = jwks[0];
+    if (jwks2.length === 1) {
+      const key2 = jwks2[0];
       if (key2.alg && alg && key2.alg !== alg) {
         throw new Error(
           `Algorithm mismatch: token uses ${alg}, but key specifies ${key2.alg}`
@@ -671,7 +666,7 @@ function selectKey(jwks, token) {
       'Token is missing "kid" header, and JWKS contains multiple keys'
     );
   }
-  const key = jwks.find((k) => k.kid === kid);
+  const key = jwks2.find((k) => k.kid === kid);
   if (!key) throw new Error(`No key found for kid: ${kid}`);
   if (key.alg && alg && key.alg !== alg)
     throw new Error(

package/dist/backend/util/JWKS.d.ts

@@ -0,0 +1,4 @@
+export interface WebKey extends JsonWebKey {
+    kid: string;
+}
+export declare function jwks(uri: string, kid?: string): Promise<Array<WebKey>>;

package/dist/backend/util/JWKS.js

@@ -0,0 +1,40 @@
+import "../../chunks/chunk-CQ52GEHY.js";
+
+// src/backend/util/JWKS.ts
+import { HttpError } from "alinea/core/HttpError";
+import { isRecord } from "alinea/core/util/Objects";
+var lifetime = 10 * 60 * 1e3;
+var refreshInterval = 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+async function jwks(uri, kid) {
+  const cached = cache.get(uri);
+  if (!cached || Date.now() >= cached.expires) return load(uri, cached);
+  const keys = await cached.keys;
+  if (!kid || keys.some((key) => key.kid === kid)) return keys;
+  const current = cache.get(uri);
+  if (current && current !== cached) return current.keys;
+  if (Date.now() - cached.loaded < refreshInterval) return keys;
+  return load(uri, cached);
+}
+function load(uri, previous) {
+  const fetched = fetch(uri).then(async (response) => {
+    if (!response.ok) throw new HttpError(response.status);
+    const body = await response.json();
+    if (!isRecord(body) || !Array.isArray(body.keys))
+      throw new Error("Invalid signing keys");
+    return body.keys.filter(isKey);
+  });
+  const keys = previous ? fetched.catch(() => previous.keys) : fetched;
+  const entry = { keys, expires: Date.now() + lifetime, loaded: Date.now() };
+  cache.set(uri, entry);
+  keys.catch(() => {
+    if (cache.get(uri) === entry) cache.delete(uri);
+  });
+  return fetched;
+}
+function isKey(value) {
+  return isRecord(value) && typeof value.kid === "string";
+}
+export {
+  jwks
+};

package/dist/bundled.d.ts

@@ -601,12 +601,15 @@ declare module 'alinea/backend/Handler' {
   import type { AuthedContext, RemoteConnection, RequestContext } from 'alinea/core/Connection';
   import type { LocalStore } from 'alinea/core/db/LocalStore';
   import type { Mutation } from 'alinea/core/db/Mutation';
+  import type { User } from 'alinea/core/User';
   export interface Handler {
       (request: Request, context: RequestContext): Promise<Response>;
   }
   export type HookResponse<T = void> = void | T | Promise<void | T>;
   export interface BeforeCommitContext {
       mutations: ReadonlyArray<Mutation>;
+      /** The user committing the mutations */
+      user: User;
   }
   export interface AfterCommitContext extends BeforeCommitContext {
       sha: string;
@@ -881,6 +884,15 @@ declare module 'alinea/backend/util/JsonPatch' {
   
 }
 
+declare module 'alinea/backend/util/JWKS' {
+
+  export interface WebKey extends JsonWebKey {
+      kid: string;
+  }
+  export function jwks(uri: string, kid?: string): Promise<Array<WebKey>>;
+  
+}
+
 declare module 'alinea/backend/util/JWTPreviews' {
 
   import type { Previews } from 'alinea/backend/Previews';
@@ -1204,6 +1216,7 @@ declare module 'alinea/cli/Serve' {
       buildOptions?: BuildOptions;
       alineaDev?: boolean;
       production?: boolean;
+      roles?: Array<string>;
       onAfterGenerate?: (env?: Record<string, string>) => void;
   }
   export function serve(options: ServeOptions): Promise<void>;
@@ -1254,6 +1267,8 @@ declare module 'alinea/cli/serve/DevServer' {
       buildOptions?: BuildOptions;
       alineaDev?: boolean;
       production?: boolean;
+      /** Roles of the local user, instead of admin */
+      roles?: Array<string>;
       apiKey?: string;
       dashboardUrl: Promise<string>;
       onAfterGenerate?: (message: string, config: Config, databasePath: string) => void;
@@ -7111,9 +7126,8 @@ declare module 'alinea/core/Role' {
       archive: boolean;
       upload: boolean;
       /**
-       * @deprecated Never enforced. What a user can browse in the dashboard's
-       * entry tree and media library is controlled by `read`. Kept so existing
-       * roles keep type checking; it will be removed in a future major version.
+       * Find entries in pickers, for example to link to them, without opening
+       * them in the dashboard. Allowing `read` allows `explore` as well.
        */
       explore: boolean;
       manageMembers: boolean;
@@ -7149,12 +7163,13 @@ declare module 'alinea/core/Role' {
       constructor(acl?: ACL);
       get(resource: string): number;
       equals(that: ACL): boolean;
+      resolve(resource?: Resource): number;
   }
   export class Policy {
       #private;
       static ALLOW_ALL: Policy;
       static ALLOW_NONE: Policy;
-      protected acl: ACL;
+      protected acls: Array<ACL>;
       constructor(root?: Permission);
       static from(policy: Policy): Policy;
       equals(that: Policy): boolean;
@@ -7171,7 +7186,6 @@ declare module 'alinea/core/Role' {
       canPublish(resource?: Resource): boolean;
       canArchive(resource?: Resource): boolean;
       canUpload(resource?: Resource): boolean;
-      /** @deprecated `explore` is never enforced, use `canRead` instead. */
       canExplore(resource?: Resource): boolean;
       canManageMembers(): boolean;
       canAll(resource?: Resource): boolean;
@@ -7325,6 +7339,8 @@ declare module 'alinea/core/Scope' {
       constructor(config: Config);
       workspaceOf(root: HasRoot): HasWorkspace;
       keyOf(entity: Entity): string;
+      /** The type of a field and its path in there, such as `seo.title` */
+      fieldOf(field: Field): [type: string, path: string] | undefined;
       locationOf(entity: Entity): string[] | undefined;
       nameOf(entity: Entity): string | undefined;
       /** Configured spellings of a locale, matched case-insensitively. */
@@ -8029,6 +8045,7 @@ declare module 'alinea/core/Type' {
       function childrenOrder(type: Type): OrderBy | Array<OrderBy> | undefined;
       function isHidden(type: Type): boolean;
       function isCollapsed(type: Type): boolean;
+      function expands(type: Type): boolean;
       function searchableText(type: Type, value: any): string;
       function anchors(type: Type, value: Record<string, unknown>, path?: Array<string>, labels?: Array<string>): Array<EntryAnchorTarget>;
       function references(type: Type, value: Record<string, unknown>, path?: Array<string>, labels?: Array<string>): Array<EntryReferenceTarget>;
@@ -8066,11 +8083,13 @@ declare module 'alinea/core/Type' {
       /** Entries do not show up in the sidebar content tree */
       hidden?: true;
       /**
-       * Entries keep their children collapsed in the sidebar content tree when
-       * they are opened, the arrow expands them. Useful for entries with many
-       * children that are browsed in their overview instead.
+       * How entries show their children in the sidebar content tree. By default
+       * they expand when the entry is opened. With `true` they stay collapsed
+       * until the arrow is clicked, useful for entries with many children that
+       * are browsed in their overview instead. With `false` they are expanded
+       * from the start.
        */
-      collapsed?: true;
+      collapsed?: boolean;
       /** An icon (React component) to represent this type in the dashboard */
       icon?: ComponentType;
       /** A React component used to view an entry of this type in the dashboard */
@@ -8529,7 +8548,7 @@ declare module 'alinea/core/util/JWT' {
       };
   };
   type Algorithm = keyof typeof algorithms;
-  type JWTHeader = {
+  export type JWTHeader = {
       alg: Algorithm;
       kid?: string;
       typ?: string;
@@ -9609,7 +9628,7 @@ declare module 'alinea/dashboard/app/ExplorerPickerContent' {
    * The explorer of a picker opened at `location`, it starts over when the
    * location or condition changes
    */
-  export function usePickerExplorer(options: ExplorerOptions, location: ExplorerLocation, initialView: ExplorerView): {
+  export function usePickerExplorer(options: ExplorerOptions, requested: ExplorerLocation, initialView: ExplorerView): {
       explorer: import("alinea/dashboard/atoms/explorer").ExplorerAtoms;
       tree: (root: import("alinea/dashboard/atoms/root").RootAtoms, locale: string | null, location?: ExplorerLocation | undefined) => import("alinea/dashboard/atoms/root").TreeAtoms;
   };
@@ -10258,7 +10277,7 @@ declare module 'alinea/dashboard/atoms/config' {
       overview?: import("alinea/types").OverviewOptions;
       orderChildrenBy?: import("alinea/core/OrderBy").OrderBy | Array<import("alinea/core/OrderBy").OrderBy>;
       hidden?: true;
-      collapsed?: true;
+      collapsed?: boolean;
       icon?: ComponentType;
       view?: import("alinea/core/View").View<{
           type: import("alinea/types").Type;
@@ -10533,6 +10552,7 @@ declare module 'alinea/dashboard/atoms/entry' {
   import type { EntryReference } from 'alinea/core/db/EntryReference';
   import { Entry, EntryStatus } from 'alinea/core/Entry';
   import type { Order } from 'alinea/core/Graph';
+  import { Permission } from 'alinea/core/Role';
   import { type EntryDefaultView } from 'alinea/core/Type';
   import { type FieldValidationError } from 'alinea/core/Validation';
   import { Atom, Getter } from 'jotai';
@@ -10725,7 +10745,8 @@ declare module 'alinea/dashboard/atoms/entry' {
       view: import("jotai").WritableAtom<EntryDefaultView, [next: EntryDefaultView], void>;
       locales: (locale: string | null) => EntryLocaleAtoms;
   }
-  export const entryAtoms: (entryId: string) => Atom<Promise<EntryAtoms>>;
+  /** An entry with the versions the policy allows with the permission */
+  export function entryAtoms(entryId: string, permission?: Permission): Atom<Promise<EntryAtoms>>;
   /** The versions linking to an entry, that the user can read */
   export const incomingReferencesAtoms: (targetId: string) => Atom<Promise<EntryReferences>>;
   /** The versions linking to the entries, that the user can read */
@@ -10756,11 +10777,12 @@ declare module 'alinea/dashboard/atoms/entry' {
       id: string;
       locale: string | null;
   }>(items: Array<Item>, locale: string | null): Array<Item>;
-  export function loadTreeChildren(get: Getter, location: TreeChildrenLocation, locale: string | null, orderBy?: Order | Array<Order>): Promise<Array<TreeEntryAtoms>>;
+  export function loadTreeChildren(get: Getter, location: TreeChildrenLocation, locale: string | null, permission: Permission, orderBy?: Order | Array<Order>): Promise<Array<TreeEntryAtoms>>;
   export class TreeEntryAtoms {
       #private;
       readonly id: string;
-      constructor(id: string);
+      readonly permission: Permission;
+      constructor(id: string, permission: Permission);
       ready: Atom<Promise<this>>;
       raw: (locale: string | null) => Atom<Promise<Omit<TreeEntrySummary, "hasChildren">>>;
       summary: (locale: string | null) => Atom<Promise<{
@@ -10779,7 +10801,11 @@ declare module 'alinea/dashboard/atoms/entry' {
       parents: Atom<Promise<TreeEntryAtoms[]>>;
       children: (locale: string | null) => Atom<Promise<TreeEntryAtoms[]>>;
   }
-  export const treeEntryAtoms: (id: string) => TreeEntryAtoms;
+  /**
+   * An entry of a tree that lists what the policy allows with the permission.
+   * Pickers list what can be explored, the sidebar what can be read.
+   */
+  export function treeEntryAtoms(id: string, permission?: Permission): TreeEntryAtoms;
   export {};
   
 }
@@ -10802,12 +10828,13 @@ declare module 'alinea/dashboard/atoms/entryTable' {
 declare module 'alinea/dashboard/atoms/explorer' {
 
   import type { DragTypes, DropTarget, Key } from 'alinea/components';
+  import type { Config } from 'alinea/core/Config';
   import { type EntryStatus } from 'alinea/core/Entry';
   import type { EntryFields } from 'alinea/core/EntryFields';
   import type { Filter } from 'alinea/core/Filter';
   import type { GraphQuery } from 'alinea/core/Graph';
   import type { OverviewSort } from 'alinea/core/Overview';
-  import { type Policy } from 'alinea/core/Role';
+  import { Permission, type Policy } from 'alinea/core/Role';
   import type { RootData } from 'alinea/core/Root';
   import { Type } from 'alinea/core/Type';
   import { type Atom, type Getter, type PrimitiveAtom, type WritableAtom } from 'jotai';
@@ -10826,6 +10853,7 @@ declare module 'alinea/dashboard/atoms/explorer' {
       workspace: string;
       root: string;
   }
+  export function constrainLocation(location: ExplorerLocation, limits: Array<ExplorerLimitLocation> | undefined): ExplorerLocation;
   export interface ExplorerOptions {
       allowAllWorkspaces?: boolean;
       autoSelectFirstItem?: boolean;
@@ -10841,6 +10869,11 @@ declare module 'alinea/dashboard/atoms/explorer' {
       limitLocations?: Array<ExplorerLimitLocation>;
       mode?: 'browse' | 'search';
       nestedNavigation?: boolean;
+      /**
+       * Entries are listed when the policy allows this permission on them,
+       * defaults to read. Pickers list what can be explored.
+       */
+      permission?: Permission;
       pickChildren?: boolean;
       rootData?: Atom<RootData>;
       /**
@@ -10931,6 +10964,8 @@ declare module 'alinea/dashboard/atoms/explorer' {
    * same entries in the same way and share their scroll offset
    */
   export function explorerScrollKey(page: ExplorerReadyPage): string;
+  /** The locations an explorer can list: those of the picker the policy allows */
+  export function explorerLocations(config: Config, policy: Policy, options: ExplorerOptions): Array<ExplorerLimitLocation>;
   export interface ExplorerItemData {
       active?: boolean;
       createdAt?: number | null;
@@ -10985,7 +11020,7 @@ declare module 'alinea/dashboard/atoms/explorer' {
    * Loads the thumbnails and the entries linked from the overview columns of
    * the given explorer items in a single query
    */
-  export function withLinkedEntries<Item extends ExplorerItemData>(get: Getter, overview: OverviewState, items: Array<Item>, thumbnails?: boolean): Promise<Array<Item>>;
+  export function withLinkedEntries<Item extends ExplorerItemData>(get: Getter, overview: OverviewState, items: Array<Item>, permission?: Permission, thumbnails?: boolean): Promise<Array<Item>>;
   /** The selected entry can be moved to another parent */
   export function explorerItemCanMove(policy: Policy, item: ExplorerItemData): boolean;
   /** The selected entry can be deleted, in the language it is listed in */
@@ -11079,6 +11114,7 @@ declare module 'alinea/dashboard/atoms/explorer' {
       readonly supportsInlineExpansion: boolean;
       readonly pickChildren: boolean;
       readonly hasCondition: boolean;
+      readonly permission: Permission;
       readonly canSearchEverything: Atom<boolean>;
       readonly searchesEverything: Atom<boolean>;
       search: PrimitiveAtom<string> & {
@@ -11093,6 +11129,9 @@ declare module 'alinea/dashboard/atoms/explorer' {
       sidebarExpandedKeys: PrimitiveAtom<Set<string>> & {
           init: Set<string>;
       };
+      sidebarClosedKeys: PrimitiveAtom<Set<string>> & {
+          init: Set<string>;
+      };
       /** The column the editor sorted by, undefined for the default order */
       requestedSort: WritableAtom<OverviewSort | undefined, [
           OverviewSort | undefined
@@ -11138,6 +11177,8 @@ declare module 'alinea/dashboard/atoms/explorer' {
           init: null;
       };
       get limitLocations(): ExplorerLimitLocation[] | undefined;
+      /** The locations this explorer lists */
+      locations: Atom<ExplorerLimitLocation[]>;
       uploadsInCurrentFolder: Atom<import("alinea/dashboard/boot/ActivityEvent").Activity[]>;
       upload: WritableAtom<null, [files: ArrayLike<File> | Iterable<File>], Promise<void>> & {
           init: null;
@@ -11213,6 +11254,8 @@ declare module 'alinea/dashboard/atoms/link' {
           title: string;
       }>;
       anchors: Array<EntryAnchorTarget>;
+      /** The editor can open the entry, not only link to it */
+      readable: boolean;
   }
   export type LinkEntryState = {
       state: 'loading';
@@ -11627,6 +11670,7 @@ declare module 'alinea/dashboard/atoms/ReactiveNode' {
 declare module 'alinea/dashboard/atoms/root' {
 
   import type { EntryStatus } from 'alinea/core/Entry';
+  import { Permission } from 'alinea/core/Role';
   import { type RootData, type RootI18n } from 'alinea/core/Root';
   import { Schema } from 'alinea/core/Schema';
   import { ExplorerAtoms } from 'alinea/dashboard/atoms/explorer';
@@ -11671,12 +11715,22 @@ declare module 'alinea/dashboard/atoms/root' {
   interface TreeViewState {
       expandedKeys: PrimitiveAtom<Set<string>>;
       collapsedKeys: PrimitiveAtom<TreeCollapseState>;
+      closedKeys: PrimitiveAtom<Set<string>>;
   }
   export class TreeAtoms {
       #private;
       expandedKeys: PrimitiveAtom<Set<string>>;
       collapsedKeys: PrimitiveAtom<TreeCollapseState>;
-      constructor(root: RootAtoms, locale: string | null, selectedKeys: Atom<Set<Key>>, viewState?: TreeViewState);
+      /** Entries closed by hand, which stay closed when their type expands */
+      closedKeys: PrimitiveAtom<Set<string>>;
+      constructor(root: RootAtoms, locale: string | null, selectedKeys: Atom<Set<Key>>, viewState?: TreeViewState, permission?: Permission);
+      /**
+       * Applies what the user expanded and collapsed. Keys closed by hand are
+       * remembered, so entries of types that expand from the start stay closed.
+       */
+      expand: import("jotai").WritableAtom<null, [next: Set<string>], void> & {
+          init: null;
+      };
       view: Atom<TreeView>;
       snapshot: Atom<TreeSnapshot>;
       items: Atom<RootTreeItem[]>;
@@ -11695,8 +11749,9 @@ declare module 'alinea/dashboard/atoms/root' {
       readonly tree: (locale: string | null) => TreeAtoms;
       explorer: ExplorerAtoms;
       constructor(workspace: string, key: string);
-      createTree(locale: string | null, selectedKeys: Atom<Set<Key>>, expandedKeys?: PrimitiveAtom<Set<string>>): TreeAtoms;
-      treeEntries: (locale: string | null) => Atom<Promise<TreeEntryAtoms[]>>;
+      /** A tree that lists the entries the policy allows with the permission */
+      createTree(locale: string | null, selectedKeys: Atom<Set<Key>>, state?: Partial<Pick<TreeViewState, 'expandedKeys' | 'closedKeys'>>, permission?: Permission): TreeAtoms;
+      treeEntries(locale: string | null, permission?: Permission): Atom<Promise<TreeEntryAtoms[]>>;
       /**
        * The scroll offsets of the explorers of this root. The root explorer and
        * the overview of an entry can list the same location, which then keeps its

package/dist/chunks/{chunk-HXXBAY3B.js → chunk-YCQR5GRT.js}

@@ -1,7 +1,7 @@
 // package.json with { type: 'json' }
 var package_default = {
   name: "alinea",
-  version: "2.0.0-preview.10",
+  version: "2.0.0-preview.11",
   description: "Open source, Git-based headless CMS for Next.js",
   keywords: [
     "cms",

package/dist/cli/Mcp.js

@@ -1,6 +1,6 @@
 import {
   package_default
-} from "../chunks/chunk-HXXBAY3B.js";
+} from "../chunks/chunk-YCQR5GRT.js";
 import "../chunks/chunk-CQ52GEHY.js";
 
 // src/cli/Mcp.ts

package/dist/cli/Serve.d.ts

@@ -8,6 +8,7 @@ export interface ServeOptions {
     buildOptions?: BuildOptions;
     alineaDev?: boolean;
     production?: boolean;
+    roles?: Array<string>;
     onAfterGenerate?: (env?: Record<string, string>) => void;
 }
 export declare function serve(options: ServeOptions): Promise<void>;

package/dist/cli/Serve.js

@@ -1,6 +1,6 @@
 import {
   package_default
-} from "../chunks/chunk-HXXBAY3B.js";
+} from "../chunks/chunk-YCQR5GRT.js";
 import "../chunks/chunk-CQ52GEHY.js";
 
 // src/cli/Serve.ts
@@ -34,6 +34,7 @@ async function serve(options) {
       configFile: options.configFile,
       alineaDev: options.alineaDev,
       production: options.production,
+      roles: options.roles,
       apiKey,
       buildOptions: {
         ...buildOptions,
@@ -55,7 +56,9 @@ async function serve(options) {
 `;
           const showUrl = cmd === "dev" && !options.onAfterGenerate;
           const connector = gray(showUrl ? "\u251C" : "\u2570");
-          const details = `${connector} ${gray(msg)}
+          const roles = options.roles ? gray(`\u251C Signed in as ${options.roles.join(", ")}
+`) : "";
+          const details = `${roles}${connector} ${gray(msg)}
 `;
           const footer = showUrl ? `${gray("\u2570")} Local CMS:    ${url}
 

package/dist/cli/bin.js

@@ -220,7 +220,7 @@ var lib_default2 = (e, t2) => new o(e, t2);
 // package.json
 var package_default = {
   name: "alinea",
-  version: "2.0.0-preview.10",
+  version: "2.0.0-preview.11",
   description: "Open source, Git-based headless CMS for Next.js",
   keywords: [
     "cms",
@@ -336,7 +336,7 @@ prog.version(package_default.version).command("init").describe("Initialize a new
   ensureLibs(libs);
   const { init } = await import("./Init.js");
   return init(args);
-}).command("dev").alias("serve").describe("Start a development dashboard").option("-c, --config", "Config file location").option("-d, --dir", "Root directory of the project").option("-p, --port", "Port to listen on").option("--production", "Use production backend").option("--dev", "Watch alinea sources").action(async (args) => {
+}).command("dev").alias("serve").describe("Start a development dashboard").option("-c, --config", "Config file location").option("-d, --dir", "Root directory of the project").option("-p, --port", "Port to listen on").option("--production", "Use production backend").option("--dev", "Watch alinea sources").option("--role", "Sign in locally with this role, repeat for more").action(async (args) => {
   ensureNode();
   ensureLibs(libs);
   ensureEnv(args.dir);
@@ -349,6 +349,7 @@ prog.version(package_default.version).command("init").describe("Initialize a new
     cwd: args.dir,
     onAfterGenerate,
     configFile: args.config,
+    roles: args.role && [args.role].flat().filter((role) => typeof role === "string"),
     cmd: "dev"
   });
 }).command("mcp").describe("Connect coding agents to the content of the running dev server").option("-c, --config", "Config file location").option("-d, --dir", "Root directory of the project").action(async (args) => {