@aphexcms/cms-core 3.0.0 → 5.0.0

package/dist/{routes → lib/server/api/routes}/organizations-by-id.js

@@ -1,111 +1,97 @@
-// Aphex CMS Organization by ID API Handlers
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { updateOrganizationRequest } from '../api/schemas/organizations.js';
-import { hasCapability } from '../types/capabilities.js';
-// GET /api/organizations/[id] - Get organization by ID
-export const GET = async ({ params, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateOrganizationRequest } from '../../../api/schemas/organizations.js';
+import { hasCapability } from '../../../types/capabilities.js';
+export const organizationsByIdRouter = new Hono()
+    .get('/:id', async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Check if user is a member of this organization
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You are not a member of this organization'
-            }, { status: 403 });
+            }, 403);
         }
         const organization = await databaseAdapter.findOrganizationById(id);
         if (!organization) {
-            return json({
-                success: false,
-                error: 'Organization not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Organization not found' }, 404);
         }
-        return json({
-            success: true,
-            data: organization
-        });
+        return c.json({ success: true, data: organization });
     }
     catch (error) {
         cmsLogger.error('Failed to fetch organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to fetch organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
+    }
+})
+    .patch('/:id', zValidator('json', updateOrganizationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
     }
-};
-// PATCH /api/organizations/[id] - Update organization
-export const PATCH = async ({ params, request, locals }) => {
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Require `org.settings` capability + membership in the target org.
-        // Membership check stands regardless — even a capability holder can only
-        // edit orgs they actually belong to.
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership || !hasCapability(auth, 'org.settings')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to update organization settings'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = updateOrganizationRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Validate: if slug is being changed, check it's not already taken
+        const body = c.req.valid('json');
         if (body.slug) {
             const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
             if (existingOrg && existingOrg.id !== id) {
-                return json({
+                return c.json({
                     success: false,
                     error: 'Slug already exists',
                     message: `Organization with slug '${body.slug}' already exists`
-                }, { status: 409 });
+                }, 409);
             }
         }
-        // Update organization
         const updateData = {};
         if (body.name !== undefined)
             updateData.name = body.name;
@@ -115,57 +101,47 @@ export const PATCH = async ({ params, request, locals }) => {
             updateData.metadata = body.metadata;
         const updatedOrganization = await databaseAdapter.updateOrganization(id, updateData);
         if (!updatedOrganization) {
-            return json({
-                success: false,
-                error: 'Organization not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Organization not found' }, 404);
         }
-        return json({
-            success: true,
-            data: updatedOrganization
-        });
+        return c.json({ success: true, data: updatedOrganization });
     }
     catch (error) {
         cmsLogger.error('Failed to update organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to update organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-// DELETE /api/organizations/[id] - Delete an organization
-export const DELETE = async ({ params, locals }) => {
+})
+    .delete('/:id', async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Only owners can delete an organization
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership || membership.role !== 'owner') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'Only owners can delete an organization'
-            }, { status: 403 });
+            }, 403);
         }
-        // Get all members of the organization
         const members = await databaseAdapter.findOrganizationMembers(id);
-        // Handle member lifecycle
         for (const member of members) {
             const userSession = await databaseAdapter.findUserSession(member.userId);
             if (userSession?.activeOrganizationId === id) {
@@ -179,23 +155,18 @@ export const DELETE = async ({ params, locals }) => {
                 }
             }
         }
-        // Delete all members from the organization
         await databaseAdapter.removeAllMembers(id);
-        // Delete all invitations for the organization
         await databaseAdapter.removeAllInvitations(id);
-        // Delete the organization
         await databaseAdapter.deleteOrganization(id);
-        return json({
-            success: true,
-            message: 'Organization deleted successfully'
-        });
+        return c.json({ success: true, message: 'Organization deleted successfully' });
     }
     catch (error) {
         cmsLogger.error('Failed to delete organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to delete organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
+});
+//# sourceMappingURL=organizations-by-id.js.map

package/dist/lib/server/api/routes/organizations-by-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-by-id.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,MAAM,CAAC,MAAM,uBAAuB,GAAmB,IAAI,IAAI,EAAY;KACzE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,2CAA2C;aACpD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,KAAK,CACL,MAAM,EACN,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4DAA4D;aACrE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACZ;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,kBAAkB;iBAC/D,EACD,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,UAAU,GAIZ,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErE,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3B,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,wCAAwC;aACjD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,WAAW,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,eAAe,CAAC,iBAAiB,CACtC,MAAM,CAAC,MAAM,EACb,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxD,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAE7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,CAAC"}

package/dist/lib/server/api/routes/organizations-invitations.d.ts

@@ -0,0 +1,10 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
+ * that adds email sending after the invite row is created. While that
+ * shim exists, this Hono router sits dormant (specific SK routes win
+ * over the catch-all). Phase 5 moves the wrapper into `config.api`.
+ */
+export declare const organizationsInvitationsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-invitations.d.ts.map

package/dist/lib/server/api/routes/organizations-invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA0MxD,CAAC"}

package/dist/{routes → lib/server/api/routes}/organizations-invitations.js

@@ -1,84 +1,81 @@
-// Aphex CMS Organization Invitations API Handlers
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { inviteMemberRequest, cancelInvitationRequest } from '../api/schemas/organizations.js';
-import { hasCapability } from '../types/capabilities.js';
-// POST /api/organizations/invitations - Create/send an invitation
-export const POST = async ({ request, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { inviteMemberRequest, cancelInvitationRequest } from '../../../api/schemas/organizations.js';
+import { hasCapability } from '../../../types/capabilities.js';
+/**
+ * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
+ * that adds email sending after the invite row is created. While that
+ * shim exists, this Hono router sits dormant (specific SK routes win
+ * over the catch-all). Phase 5 moves the wrapper into `config.api`.
+ */
+export const organizationsInvitationsRouter = new Hono()
+    .post('/invitations', zValidator('json', inviteMemberRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'email and role are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.invite')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to invite members'
-            }, { status: 403 });
-        }
-        const rawBody = await request.json();
-        const parsed = inviteMemberRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                message: 'email and role are required',
-                issues: parsed.error.issues
-            }, { status: 400 });
+            }, 403);
         }
-        const body = parsed.data;
-        // Verify the role exists in this organization. Defends against
-        // clients sending a role name that was deleted between page load
-        // and submit, or against typos slipping past the format regex.
+        const body = c.req.valid('json');
         const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
         if (!roleRow) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unknown role',
                 message: `No role named "${body.role}" in this organization`
-            }, { status: 400 });
+            }, 400);
         }
-        // Reject self-invitation
         if (body.email.toLowerCase() === auth.user.email.toLowerCase()) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid invitation',
                 message: 'You cannot invite yourself'
-            }, { status: 400 });
+            }, 400);
         }
-        // Reject if the invitee is already a member of the organization
-        if (locals.aphexCMS.auth) {
-            const existingUser = await locals.aphexCMS.auth.getUserByEmail(body.email);
+        if (c.var.aphexCMS.auth) {
+            const existingUser = await c.var.aphexCMS.auth.getUserByEmail(body.email);
             if (existingUser) {
                 const existingMembership = await databaseAdapter.findUserMembership(existingUser.id, auth.organizationId);
                 if (existingMembership) {
-                    return json({
+                    return c.json({
                         success: false,
                         error: 'Already a member',
                         message: 'This user is already a member of the organization'
-                    }, { status: 400 });
+                    }, 400);
                 }
             }
         }
-        // Check if there's already a pending invitation for this email
         const existingInvitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
         const pendingInvitation = existingInvitations.find((inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null);
         if (pendingInvitation) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Already invited',
                 message: 'This email has already been invited to the organization'
-            }, { status: 400 });
+            }, 400);
         }
-        // Generate a unique invitation token
         const token = crypto.randomUUID();
-        // Create invitation - email sending is handled by the app layer
         const invitation = await databaseAdapter.createInvitation({
             organizationId: auth.organizationId,
             email: body.email.toLowerCase(),
@@ -87,70 +84,62 @@ export const POST = async ({ request, locals }) => {
             token,
             expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
         });
-        return json({
+        return c.json({
             success: true,
             data: invitation,
             message: 'Invitation created successfully.'
-        }, { status: 201 });
+        }, 201);
     }
     catch (error) {
         cmsLogger.error('Failed to create invitation:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to create invitation',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
+    }
+})
+    .delete('/invitations', zValidator('json', cancelInvitationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'invitationId is required',
+            issues: result.error.issues
+        }, 400);
     }
-};
-// DELETE /api/organizations/invitations - Cancel an invitation
-export const DELETE = async ({ request, locals }) => {
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.invite')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to cancel invitations'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = cancelInvitationRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Missing required field',
-                message: 'invitationId is required',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Delete the invitation
+        const body = c.req.valid('json');
         const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
         if (!deleted) {
-            return json({
-                success: false,
-                error: 'Invitation not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Invitation not found' }, 404);
         }
-        return json({
-            success: true,
-            message: 'Invitation canceled successfully'
-        });
+        return c.json({ success: true, message: 'Invitation canceled successfully' });
     }
     catch (error) {
         cmsLogger.error('Failed to cancel invitation:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to cancel invitation',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
+});
+//# sourceMappingURL=organizations-invitations.js.map

package/dist/lib/server/api/routes/organizations-invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-invitations.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAmB,IAAI,IAAI,EAAY;KAChF,IAAI,CACJ,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,8CAA8C;aACvD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,wBAAwB;aAC5D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,4BAA4B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,YAAY,EAAE,CAAC;gBAClB,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAClE,YAAY,CAAC,EAAE,EACf,IAAI,CAAC,cAAc,CACnB,CAAC;gBACF,IAAI,kBAAkB,EAAE,CAAC;oBACxB,OAAO,CAAC,CAAC,IAAI,CACZ;wBACC,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,kBAAkB;wBACzB,OAAO,EAAE,mDAAmD;qBAC5D,EACD,GAAG,CACH,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,2BAA2B,CAC5E,IAAI,CAAC,cAAc,CACnB,CAAC;QACF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACP,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAChF,CAAC;QAEF,IAAI,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,yDAAyD;aAClE,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;YACzD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kCAAkC;SAC3C,EACD,GAAG,CACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CACN,cAAc,EACd,UAAU,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kDAAkD;aAC3D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/organizations-members.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const organizationsMembersRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-members.d.ts.map

package/dist/lib/server/api/routes/organizations-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CAgRpD,CAAC"}