@aphexcms/cms-core 3.0.0 → 5.0.0

package/dist/lib/index.d.ts

@@ -1,2 +1,10 @@
-export * from './client/index.js';
+export * from './types/index.js';
+export type { SidebarUser, SidebarNavItem, SidebarBranding, SidebarData } from './types/sidebar.js';
+export * from './field-validation/rule.js';
+export * from './field-validation/utils.js';
+export { createContentHash, hasUnpublishedChanges } from './utils/content-hash.js';
+export * from './schema-utils/index.js';
+export * from './utils/index.js';
+export * from './api/index.js';
+export type { ApiResponse } from './api/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAkBA,cAAc,eAAe,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjG,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGhF,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/index.js

@@ -1,5 +1,44 @@
-// Aphex CMS Core - Main exports (client-safe only)
-// For server-side functionality, import from '@aphexcms/cms-core/server'
-// Re-export all client-safe functionality
-export * from './client/index.js';
+// Aphex CMS Core - Main exports
+//
+// This barrel is the "universal" entry point: every export here is safe to
+// resolve from Node ESM as well as Vite/SvelteKit — i.e. no `.svelte`
+// component files. That matters because ES-module `export *` eagerly links
+// every re-export, and if any server-side import path hits a raw `.svelte`
+// re-export, Node's native loader throws `ERR_UNKNOWN_FILE_EXTENSION` for
+// anything it happens to resolve through native ESM (SSR edge cases,
+// loader-hook workers, etc).
+//
+// If you need the Svelte admin components (`DocumentEditor`, `AdminApp`,
+// `Sidebar`, field components, `ConfirmDialogHost`, `PermissionsDebug`…)
+// import them from `@aphexcms/cms-core/client` instead.
+//
+// For server-only functionality (adapters, hooks, engine, routes), import
+// from `@aphexcms/cms-core/server`.
+// Core types (shared between client and server)
+export * from './types/index.js';
+// Field validation
+export * from './field-validation/rule.js';
+export * from './field-validation/utils.js';
+// Content hashing utilities
+export { createContentHash, hasUnpublishedChanges } from './utils/content-hash.js';
+// Schema utilities
+export * from './schema-utils/index.js';
+// General utility functions (logger, image URL builder, etc)
+export * from './utils/index.js';
+// Unified API client
+export * from './api/index.js';
+// NOTE: The following are intentionally NOT re-exported from this root
+// barrel. They're all Svelte runtime constructs — rune modules that use
+// `$state` or real `.svelte` components — and re-exporting them here would
+// transitively pull Svelte-only code through every import of
+// `@aphexcms/cms-core`, breaking Node-side usage (SSR module evaluation,
+// loader hooks, etc). Import from their dedicated subpaths instead:
+//
+//   import { setSchemaContext, getSchemaContext } from '@aphexcms/cms-core/client';
+//   import { setPermissionsContext, usePermissions } from '@aphexcms/cms-core/client';
+//   import { confirmDialog } from '@aphexcms/cms-core/client';
+//   import { toast } from 'svelte-sonner';
+//
+// Only use the root barrel (`@aphexcms/cms-core`) for server-safe utilities,
+// types, and pure JS helpers.
 //# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,yEAAyE;AAEzE,0CAA0C;AAC1C,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,qEAAqE;AACrE,6BAA6B;AAC7B,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AACxD,EAAE;AACF,0EAA0E;AAC1E,oCAAoC;AAEpC,gDAAgD;AAChD,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAEzC,4BAA4B;AAC5B,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,mBAAmB;AACnB,cAAc,sBAAsB,CAAC;AAErC,6DAA6D;AAC7D,cAAc,eAAe,CAAC;AAE9B,qBAAqB;AACrB,cAAc,aAAa,CAAC;AAG5B,uEAAuE;AACvE,wEAAwE;AACxE,2EAA2E;AAC3E,6DAA6D;AAC7D,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,oFAAoF;AACpF,uFAAuF;AACvF,+DAA+D;AAC/D,2CAA2C;AAC3C,EAAE;AACF,6EAA6E;AAC7E,8BAA8B"}

package/dist/lib/server/api/index.d.ts

@@ -0,0 +1,55 @@
+import { Hono } from 'hono';
+import type { CMSInstances } from '../../hooks.js';
+import type { Auth } from '../../types/auth.js';
+/**
+ * Hono environment for the Aphex API.
+ *
+ * Variables on `c.var`:
+ * - `aphexCMS` — the singleton CMS service container (db, storage, services).
+ * - `auth` — the resolved auth principal for this request, or null if anonymous.
+ *
+ * These are populated by the SvelteKit catch-all, which invokes
+ * `app.fetch(request, { aphexCMS, auth })` and the bridge middleware below
+ * lifts them onto `c.var`.
+ */
+export type AphexEnv = {
+    Variables: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+    Bindings: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+};
+/**
+ * Build the Aphex API Hono app shell.
+ *
+ * Returns a Hono app with `/api` basePath and the bridge middleware that
+ * lifts `app.fetch(req, env)` values onto `c.var`. Built-in routes are NOT
+ * mounted yet — call `mountAphexBuiltins(app)` after registering any user
+ * middleware/overrides (Hono is registration-order-strict).
+ */
+export declare function createAphexApi(): import("hono/hono-base").HonoBase<AphexEnv, import("hono/types").BlankSchema, "/api", "/api">;
+/**
+ * Mount cms-core's built-in resource routes onto an Aphex API app.
+ *
+ * Called by `createCMSHook` after `config.api?.(app)` runs, so user-provided
+ * middleware (e.g. an email-sending wrap on `/organizations/invitations`)
+ * registers ahead of the built-in handler and gets the chance to wrap it.
+ */
+export declare function mountAphexBuiltins(app: Hono<AphexEnv>): void;
+export type ApiRoutes = ReturnType<typeof createAphexApi>;
+/**
+ * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted
+ * onto a Hono router.
+ *
+ * Used for handlers that already exist in SK form (e.g. the built-in
+ * GraphQL Yoga app) and don't need to be rewritten just to flow through
+ * the Hono catch-all. We synthesize the minimum `event` shape those
+ * handlers actually read: `request` + `locals.{aphexCMS,auth}` + `params`
+ * + `url`. If a future SK handler reaches for `cookies`, `setHeaders`, or
+ * `getClientAddress`, extend the synthesized event accordingly.
+ */
+export declare function toHonoHandler(skHandler: (event: any) => Promise<Response> | Response): (c: import("hono").Context<AphexEnv>) => Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/server/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAY7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAoCrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAEzC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}

package/dist/lib/server/api/index.js

@@ -0,0 +1,107 @@
+import { Hono } from 'hono';
+import { schemasRouter } from './routes/schemas.js';
+import { documentsRouter } from './routes/documents.js';
+import { documentsByIdRouter } from './routes/documents-by-id.js';
+import { documentsPublishRouter } from './routes/documents-publish.js';
+import { documentsQueryRouter } from './routes/documents-query.js';
+import { documentVersionsRouter } from './routes/document-versions.js';
+import { assetsRouter } from './routes/assets.js';
+import { assetsByIdRouter } from './routes/assets-by-id.js';
+import { assetsBulkRouter } from './routes/assets-bulk.js';
+import { assetsReferencesRouter } from './routes/assets-references.js';
+import { organizationsRouter } from './routes/organizations.js';
+import { organizationsByIdRouter } from './routes/organizations-by-id.js';
+import { organizationsInvitationsRouter } from './routes/organizations-invitations.js';
+import { organizationsMembersRouter } from './routes/organizations-members.js';
+import { organizationsSwitchRouter } from './routes/organizations-switch.js';
+import { rolesRouter } from './routes/roles.js';
+import { userPreferencesRouter } from './routes/user-preferences.js';
+import { userRouter } from './routes/user.js';
+/**
+ * Build the Aphex API Hono app shell.
+ *
+ * Returns a Hono app with `/api` basePath and the bridge middleware that
+ * lifts `app.fetch(req, env)` values onto `c.var`. Built-in routes are NOT
+ * mounted yet — call `mountAphexBuiltins(app)` after registering any user
+ * middleware/overrides (Hono is registration-order-strict).
+ */
+export function createAphexApi() {
+    const app = new Hono().basePath('/api');
+    // Bridge: lift values passed via app.fetch(req, env) onto c.var so
+    // handlers can read c.var.aphexCMS / c.var.auth directly.
+    app.use('*', async (c, next) => {
+        c.set('aphexCMS', c.env.aphexCMS);
+        c.set('auth', c.env.auth);
+        await next();
+    });
+    return app;
+}
+/**
+ * Mount cms-core's built-in resource routes onto an Aphex API app.
+ *
+ * Called by `createCMSHook` after `config.api?.(app)` runs, so user-provided
+ * middleware (e.g. an email-sending wrap on `/organizations/invitations`)
+ * registers ahead of the built-in handler and gets the chance to wrap it.
+ */
+export function mountAphexBuiltins(app) {
+    // Order matters: more-specific paths (`/documents/query`,
+    // `/documents/:id/publish`, `/documents/:id/versions/...`) must be
+    // registered before `/documents/:id` so Hono's first-match-wins
+    // resolver doesn't capture them under the catch-all `:id` param.
+    app.route('/schemas', schemasRouter);
+    app.route('/documents', documentsQueryRouter);
+    app.route('/documents', documentsPublishRouter);
+    app.route('/documents', documentVersionsRouter);
+    app.route('/documents', documentsByIdRouter);
+    app.route('/documents', documentsRouter);
+    // Assets — same precedence rule: specific paths before parametric.
+    // `/assets/bulk` and `/assets/references/counts` must register before
+    // `/assets/:id` or Hono will capture them as `:id = "bulk"` etc.
+    app.route('/assets', assetsBulkRouter);
+    app.route('/assets', assetsReferencesRouter);
+    app.route('/assets', assetsByIdRouter);
+    app.route('/assets', assetsRouter);
+    // Organizations — specifics (/switch, /invitations, /members) before /:id.
+    app.route('/organizations', organizationsSwitchRouter);
+    app.route('/organizations', organizationsInvitationsRouter);
+    app.route('/organizations', organizationsMembersRouter);
+    app.route('/organizations', organizationsByIdRouter);
+    app.route('/organizations', organizationsRouter);
+    // Roles — combined router covers /, /:name, no precedence concern.
+    app.route('/roles', rolesRouter);
+    // User account routes — register specifics first.
+    // `/user/cms-preference`, `/user/request-password-reset`,
+    // `/user/reset-password` need to win over `/user` PATCH otherwise
+    // Hono would try to match them under the wrong handler chain.
+    app.route('/user', userPreferencesRouter);
+    app.route('/user', userRouter);
+}
+/**
+ * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted
+ * onto a Hono router.
+ *
+ * Used for handlers that already exist in SK form (e.g. the built-in
+ * GraphQL Yoga app) and don't need to be rewritten just to flow through
+ * the Hono catch-all. We synthesize the minimum `event` shape those
+ * handlers actually read: `request` + `locals.{aphexCMS,auth}` + `params`
+ * + `url`. If a future SK handler reaches for `cookies`, `setHeaders`, or
+ * `getClientAddress`, extend the synthesized event accordingly.
+ */
+export function toHonoHandler(skHandler) {
+    return async (c) => {
+        const fakeEvent = {
+            request: c.req.raw,
+            url: new URL(c.req.url),
+            params: c.req.param(),
+            locals: {
+                aphexCMS: c.var.aphexCMS,
+                auth: c.var.auth
+            },
+            // No-op fallbacks — only used if a wrapped SK handler probes for them.
+            setHeaders: () => undefined,
+            getClientAddress: () => c.req.header('x-forwarded-for') ?? '127.0.0.1'
+        };
+        return skHandler(fakeEvent);
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/server/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAwB3C;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAElD,mEAAmE;IACnE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAmB;IACrD,0DAA0D;IAC1D,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAChD,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAChD,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAEzC,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;IACvD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC5D,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAEjD,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAEjC,kDAAkD;IAClD,0DAA0D;IAC1D,kEAAkE;IAClE,8DAA8D;IAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAID;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC5B,SAAuD;IAEvD,OAAO,KAAK,EAAE,CAAmC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG;YACjB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAA4B;YAC/C,MAAM,EAAE;gBACP,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;gBACxB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;aAChB;YACD,uEAAuE;YACvE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;YAC3B,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,WAAW;SACtE,CAAC;QACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC;AACH,CAAC"}

package/dist/lib/server/api/routes/assets-bulk.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsBulkRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-bulk.d.ts.map

package/dist/lib/server/api/routes/assets-bulk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAkE3C,CAAC"}

package/dist/{routes → lib/server/api/routes}/assets-bulk.js

@@ -1,35 +1,34 @@
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { bulkDeleteAssetsRequest } from '../api/schemas/assets.js';
-export const DELETE = async ({ request, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { bulkDeleteAssetsRequest } from '../../../api/schemas/assets.js';
+export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bulkDeleteAssetsRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'No asset IDs provided',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { assetService, databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { assetService, databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type === 'partial_session') {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        const rawBody = await request.json();
-        const parsed = bulkDeleteAssetsRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'No asset IDs provided',
-                issues: parsed.error.issues
-            }, { status: 400 });
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
-        const { ids } = parsed.data;
-        // Check for references before deleting
+        const { ids } = c.req.valid('json');
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {
             const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids);
             referencedIds = ids.filter((id) => (counts[id] || 0) > 0);
         }
         if (referencedIds.length > 0) {
-            return json({
+            return c.json({
                 success: false,
                 error: `Cannot delete ${referencedIds.length} asset${referencedIds.length > 1 ? 's' : ''} because ${referencedIds.length > 1 ? 'they are' : 'it is'} still referenced by documents`,
                 referencedIds
-            }, { status: 409 });
+            }, 409);
         }
         const results = { deleted: 0, failed: 0 };
         for (const id of ids) {
@@ -46,10 +45,11 @@ export const DELETE = async ({ request, locals }) => {
                 results.failed++;
             }
         }
-        return json({ success: true, data: results });
+        return c.json({ success: true, data: results });
     }
     catch (error) {
         cmsLogger.error('Bulk delete failed:', error);
-        return json({ success: false, error: 'Bulk delete failed' }, { status: 500 });
+        return c.json({ success: false, error: 'Bulk delete failed' }, 500);
     }
-};
+});
+//# sourceMappingURL=assets-bulk.js.map

package/dist/lib/server/api/routes/assets-bulk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-bulk.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAGtE,MAAM,CAAC,MAAM,gBAAgB,GAAmB,IAAI,IAAI,EAAY,CAAC,MAAM,CAC1E,OAAO,EACP,UAAU,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CACpE,IAAI,CAAC,cAAc,EACnB,GAAG,CACH,CAAC;YACF,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB,aAAa,CAAC,MAAM,SAAS,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,gCAAgC;gBACnL,aAAa;aACb,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAE1C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/assets-by-id.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsByIdRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-by-id.d.ts.map

package/dist/lib/server/api/routes/assets-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CA8HzC,CAAC"}

package/dist/lib/server/api/routes/assets-by-id.js

@@ -0,0 +1,108 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateAssetRequest } from '../../../api/schemas/assets.js';
+export const assetsByIdRouter = new Hono()
+    .get('/:id', async (c) => {
+    try {
+        const { assetService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        const asset = await assetService.findAssetById(auth.organizationId, id);
+        if (!asset) {
+            return c.json({ success: false, error: 'Asset not found' }, 404);
+        }
+        return c.json({ success: true, data: asset });
+    }
+    catch (error) {
+        cmsLogger.error('[Asset API] Error fetching asset:', error);
+        return c.json({ success: false, error: 'Failed to fetch asset' }, 500);
+    }
+})
+    .delete('/:id', async (c) => {
+    try {
+        const id = c.req.param('id');
+        const { assetService, databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        if (databaseAdapter.findDocumentsReferencingAsset) {
+            const refs = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+            if (refs.length > 0) {
+                return c.json({
+                    success: false,
+                    error: `Cannot delete asset — it is referenced by ${refs.length} document${refs.length > 1 ? 's' : ''}`
+                }, 409);
+            }
+        }
+        const result = await assetService.deleteAsset(auth.organizationId, id);
+        if (!result) {
+            return c.json({ success: false, error: 'Asset not found or could not be deleted' }, 404);
+        }
+        return c.json({ success: true });
+    }
+    catch (error) {
+        cmsLogger.error('Error deleting asset:', error);
+        return c.json({ success: false, error: 'Failed to delete asset' }, 500);
+    }
+})
+    .patch('/:id', zValidator('json', updateAssetRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { assetService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        const { title, description, alt, creditLine } = c.req.valid('json');
+        let updatedAsset;
+        if (auth.type === 'session') {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.user.id
+            });
+        }
+        else {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.keyId
+            });
+        }
+        if (!updatedAsset) {
+            return c.json({ success: false, error: 'Asset not found' }, 404);
+        }
+        return c.json({ success: true, data: updatedAsset });
+    }
+    catch (error) {
+        cmsLogger.error('Error updating asset:', error);
+        return c.json({ success: false, error: 'Failed to update asset' }, 500);
+    }
+});
+//# sourceMappingURL=assets-by-id.js.map

package/dist/lib/server/api/routes/assets-by-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-by-id.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,CAAC,MAAM,gBAAgB,GAAmB,IAAI,IAAI,EAAY;KAClE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACF,CAAC,CAAC;KACD,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3B,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,eAAe,CAAC,6BAA6B,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,6BAA6B,CAC/D,IAAI,CAAC,cAAc,EACnB,EAAE,CACF,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6CAA6C,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;iBACvG,EACD,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,EACpE,GAAG,CACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;AACF,CAAC,CAAC;KACD,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACf,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,IAAI,YAA0B,CAAC;QAE/B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC9E,KAAK;gBACL,WAAW;gBACX,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;AACF,CAAC,CAAC,CAAC"}

package/dist/lib/server/api/routes/assets-references.d.ts

@@ -0,0 +1,15 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Asset references endpoints. Two distinct paths sharing one router file:
+ *   - GET  /:id/references          → docs that reference one asset
+ *   - POST /references/counts       → batch reference counts for many ids
+ *
+ * Mounted under `/assets`, so the wire paths are
+ * `/api/assets/:id/references` and `/api/assets/references/counts`.
+ *
+ * Order matters in createAphexApi(): mount this BEFORE assetsByIdRouter so
+ * `/references/counts` doesn't get captured as `:id = "references"`.
+ */
+export declare const assetsReferencesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-references.d.ts.map

package/dist/lib/server/api/routes/assets-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-references.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkFhD,CAAC"}

package/dist/lib/server/api/routes/assets-references.js

@@ -0,0 +1,78 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { assetReferenceCountsRequest } from '../../../api/schemas/assets.js';
+/**
+ * Asset references endpoints. Two distinct paths sharing one router file:
+ *   - GET  /:id/references          → docs that reference one asset
+ *   - POST /references/counts       → batch reference counts for many ids
+ *
+ * Mounted under `/assets`, so the wire paths are
+ * `/api/assets/:id/references` and `/api/assets/references/counts`.
+ *
+ * Order matters in createAphexApi(): mount this BEFORE assetsByIdRouter so
+ * `/references/counts` doesn't get captured as `:id = "references"`.
+ */
+export const assetsReferencesRouter = new Hono()
+    .get('/:id/references', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        const id = c.req.param('id');
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        if (!databaseAdapter.findDocumentsReferencingAsset) {
+            return c.json({ success: true, data: { references: [], total: 0 } });
+        }
+        const references = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+        return c.json({
+            success: true,
+            data: {
+                references,
+                total: references.length
+            }
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to find asset references:', error);
+        return c.json({ success: false, error: 'Failed to find asset references' }, 500);
+    }
+})
+    .post('/references/counts', zValidator('json', assetReferenceCountsRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        const { ids } = c.req.valid('json');
+        if (ids.length === 0) {
+            return c.json({ success: true, data: {} });
+        }
+        if (!databaseAdapter.countDocumentReferencesForAssets) {
+            const counts = {};
+            for (const id of ids)
+                counts[id] = 0;
+            return c.json({ success: true, data: counts });
+        }
+        const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids);
+        return c.json({ success: true, data: counts });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to count asset references:', error);
+        return c.json({ success: false, error: 'Failed to count asset references' }, 500);
+    }
+});
+//# sourceMappingURL=assets-references.js.map

package/dist/lib/server/api/routes/assets-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-references.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG1E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,IAAI,IAAI,EAAY;KACxE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,6BAA6B,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,6BAA6B,CACrE,IAAI,CAAC,cAAc,EACnB,EAAE,CACF,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACL,UAAU;gBACV,KAAK,EAAE,UAAU,CAAC,MAAM;aACxB;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;IAClF,CAAC;AACF,CAAC,CAAC;KACD,IAAI,CACJ,oBAAoB,EACpB,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,gCAAgC,EAAE,CAAC;YACvD,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gCAAgC,CACpE,IAAI,CAAC,cAAc,EACnB,GAAG,CACH,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/assets.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets.d.ts.map

package/dist/lib/server/api/routes/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA+IrC,CAAC"}