@aphexcms/cms-core 4.0.0 → 5.0.0

package/dist/api/schemas/user.d.ts

@@ -5,6 +5,16 @@ export declare const updateUserRequest: z.ZodObject<{
 export declare const updateUserPreferencesRequest: z.ZodObject<{
     includeChildOrganizations: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
+export declare const requestPasswordResetRequest: z.ZodObject<{
+    email: z.ZodString;
+    redirectTo: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const resetPasswordRequest: z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strip>;
 export type UpdateUserRequest = z.infer<typeof updateUserRequest>;
 export type UpdateUserPreferencesRequest = z.infer<typeof updateUserPreferencesRequest>;
+export type RequestPasswordResetRequest = z.infer<typeof requestPasswordResetRequest>;
+export type ResetPasswordRequest = z.infer<typeof resetPasswordRequest>;
 //# sourceMappingURL=user.d.ts.map

package/dist/api/schemas/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAIH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/api/schemas/user.js

@@ -9,3 +9,13 @@ export const updateUserPreferencesRequest = z
     includeChildOrganizations: z.boolean().optional()
 })
     .strict();
+// ---------- POST /user/request-password-reset ----------
+export const requestPasswordResetRequest = z.object({
+    email: z.string().email(),
+    redirectTo: z.string().optional()
+});
+// ---------- POST /user/reset-password ----------
+export const resetPasswordRequest = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(1)
+});

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAc5D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAa5D"}

package/dist/config.js

@@ -9,7 +9,6 @@ export function createCMSConfig(config) {
                 ...config.customization?.branding
             },
             ...config.customization
-        },
-        plugins: config.plugins ?? []
+        }
     };
 }

package/dist/hooks.d.ts

@@ -1,4 +1,5 @@
 import type { Handle } from '@sveltejs/kit';
+import type { Hono } from 'hono';
 import type { CMSConfig } from './types/index.js';
 import type { DatabaseAdapter } from './db/index.js';
 import type { AssetService } from './services/asset-service.js';
@@ -9,6 +10,7 @@ import type { GraphQLSettings } from './graphql/index.js';
 import { RolesService } from './services/roles-service.js';
 import { CMSEngine } from './engine.js';
 import { type LocalAPI } from './local-api/index.js';
+import { type AphexEnv } from './server/api/index.js';
 export interface CMSInstances {
     config: CMSConfig;
     assetService: AssetService;
@@ -20,10 +22,7 @@ export interface CMSInstances {
     rolesService: RolesService;
     auth?: AuthProvider;
     graphqlSettings?: GraphQLSettings | null;
-    pluginRoutes?: Map<string, {
-        handler: (event: any) => Promise<Response> | Response;
-        pluginName: string;
-    }>;
+    apiApp: Hono<AphexEnv>;
 }
 export declare function createCMSHook(config: CMSConfig): Handle;
 //# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,GAAG,CACjB,MAAM,EACN;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAC7E,CAAC;CACF;AAiFD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CA8LvD"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAIN,KAAK,QAAQ,EACb,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;CACvB;AA0BD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAgJvD"}

package/dist/hooks.js

@@ -5,6 +5,7 @@ import { AssetService as AssetServiceClass } from './services/asset-service.js';
 import { RolesService } from './services/roles-service.js';
 import { createCMS } from './engine.js';
 import { createLocalAPI } from './local-api/index.js';
+import { createAphexApi, mountAphexBuiltins, toHonoHandler } from './server/api/index.js';
 let cmsInstances = null;
 let schemaError = null;
 let initPromise = null;
@@ -26,51 +27,6 @@ function createDefaultStorageAdapter() {
         baseUrl: '' // No direct URL - all access through /assets/{id}/{filename}
     });
 }
-/**
- * Resolves a plugin configuration to an actual CMSPlugin instance
- * Supports three formats:
- * 1. String: 'my-plugin' - dynamically imports default export
- * 2. Object with name/options: { name: 'my-plugin', options: {...} }
- * 3. Already instantiated plugin: CMSPlugin object
- */
-async function resolvePlugin(pluginConfig) {
-    // Format 3: Already an instantiated plugin
-    if (typeof pluginConfig === 'object' && 'install' in pluginConfig) {
-        return pluginConfig;
-    }
-    // Format 1: String reference
-    if (typeof pluginConfig === 'string') {
-        try {
-            const pluginModule = await import(/* @vite-ignore */ pluginConfig);
-            const plugin = pluginModule.default || pluginModule;
-            if (typeof plugin === 'function') {
-                // If it's a factory function, call it with no options
-                return plugin();
-            }
-            return plugin;
-        }
-        catch (error) {
-            throw new Error(`Failed to load plugin "${pluginConfig}". Make sure it's installed: npm install ${pluginConfig}\nError: ${error}`);
-        }
-    }
-    // Format 2: Object with name and options
-    if (typeof pluginConfig === 'object' && 'name' in pluginConfig) {
-        try {
-            const pluginModule = await import(/* @vite-ignore */ pluginConfig.name);
-            const pluginFactory = pluginModule.default || pluginModule;
-            if (typeof pluginFactory === 'function') {
-                // Call factory with options
-                return pluginFactory(pluginConfig.options || {});
-            }
-            // If not a factory, return as-is (assuming it's already a plugin)
-            return pluginFactory;
-        }
-        catch (error) {
-            throw new Error(`Failed to load plugin "${pluginConfig.name}". Make sure it's installed: npm install ${pluginConfig.name}\nError: ${error}`);
-        }
-    }
-    throw new Error(`Invalid plugin configuration: ${JSON.stringify(pluginConfig)}`);
-}
 export function createCMSHook(config) {
     if (!config) {
         throw new Error('[CMS] createCMSHook received an undefined config. ' +
@@ -112,6 +68,12 @@ export function createCMSHook(config) {
             const rolesService = new RolesService(databaseAdapter, config.cache ?? null);
             // Initialize Local API (unified operations layer)
             const localAPI = createLocalAPI(config, databaseAdapter);
+            // Build the Hono API app shell. User middleware/overrides register
+            // FIRST (so they sit ahead of built-ins in the chain), then we mount
+            // the built-in routes, then GraphQL.
+            const apiApp = createAphexApi();
+            config.api?.(apiApp);
+            mountAphexBuiltins(apiApp);
             // Initialize schemas with validation
             try {
                 await cmsEngine.initialize();
@@ -120,44 +82,6 @@ export function createCMSHook(config) {
                 cmsLogger.error('[CMS]', 'Failed to initialize:', error);
                 schemaError = error instanceof Error ? error : new Error(String(error));
             }
-            // Build plugin route map and install plugins (do this ONCE at startup)
-            const pluginRoutes = new Map();
-            // Resolve and install plugins
-            if (config.plugins && config.plugins.length > 0) {
-                for (const pluginConfig of config.plugins) {
-                    try {
-                        // Resolve plugin config to actual CMSPlugin instance (may involve dynamic import)
-                        const plugin = await resolvePlugin(pluginConfig);
-                        cmsLogger.info('[CMS]', `Loading plugin: ${plugin.name}@${plugin.version}`);
-                        // Build route map before installation
-                        if (plugin.routes) {
-                            for (const [path, handler] of Object.entries(plugin.routes)) {
-                                pluginRoutes.set(path, { handler, pluginName: plugin.name });
-                            }
-                        }
-                        // Create temporary cmsInstances for installation (will be replaced below)
-                        const tempInstances = {
-                            config,
-                            databaseAdapter: databaseAdapter,
-                            assetService: assetService,
-                            storageAdapter: storageAdapter,
-                            emailAdapter: emailAdapter,
-                            cmsEngine: cmsEngine,
-                            localAPI: localAPI,
-                            rolesService,
-                            auth: config.auth?.provider,
-                            pluginRoutes
-                        };
-                        // Install the plugin
-                        cmsLogger.info('[CMS]', `Installing plugin: ${plugin.name}`);
-                        await plugin.install(tempInstances);
-                    }
-                    catch (error) {
-                        cmsLogger.error('[CMS]', 'Failed to load/install plugin:', error);
-                        throw error;
-                    }
-                }
-            }
             // Initialize built-in GraphQL (enabled by default, opt-out with graphql: false)
             let graphqlSettings = null;
             if (config.graphql !== false) {
@@ -174,15 +98,20 @@ export function createCMSHook(config) {
                         localAPI,
                         rolesService,
                         auth: config.auth?.provider,
-                        pluginRoutes
+                        apiApp
                     }, config.schemaTypes, graphqlConfig);
-                    // Register GraphQL route (normalize path to always have leading /)
+                    // Register GraphQL directly on the Hono app. The Yoga handler
+                    // internally distinguishes GET (GraphiQL UI) from POST (queries),
+                    // so we mount with `app.all()` and let it route by method.
+                    //
+                    // Path is normalized to be relative to the `/api` basePath:
+                    // e.g. config path "/api/graphql" → mount at "/graphql".
                     const rawPath = graphqlConfig.path ?? '/api/graphql';
-                    const endpoint = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
-                    pluginRoutes.set(endpoint, {
-                        handler: result.handler,
-                        pluginName: 'built-in:graphql'
-                    });
+                    const fullPath = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
+                    const honoPath = fullPath.startsWith('/api')
+                        ? fullPath.slice('/api'.length) || '/'
+                        : fullPath;
+                    apiApp.all(honoPath, toHonoHandler(result.handler));
                     graphqlSettings = result.settings;
                 }
                 catch (error) {
@@ -201,7 +130,7 @@ export function createCMSHook(config) {
                 rolesService,
                 auth: config.auth?.provider,
                 graphqlSettings,
-                pluginRoutes
+                apiApp
             };
             resolveInit();
         }
@@ -217,14 +146,6 @@ export function createCMSHook(config) {
             if (authResponse)
                 return authResponse;
         }
-        // Check if a plugin handles this route (O(1) lookup)
-        if (cmsInstances.pluginRoutes && cmsInstances.pluginRoutes.size > 0) {
-            const pluginRoute = cmsInstances.pluginRoutes.get(event.url.pathname);
-            if (pluginRoute) {
-                cmsLogger.debug('[CMS]', `Plugin ${pluginRoute.pluginName} handling route: ${event.url.pathname}`);
-                return pluginRoute.handler(event);
-            }
-        }
         return resolve(event);
     };
 }

package/dist/lib/api/schemas/user.d.ts

@@ -5,6 +5,16 @@ export declare const updateUserRequest: z.ZodObject<{
 export declare const updateUserPreferencesRequest: z.ZodObject<{
     includeChildOrganizations: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
+export declare const requestPasswordResetRequest: z.ZodObject<{
+    email: z.ZodString;
+    redirectTo: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const resetPasswordRequest: z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strip>;
 export type UpdateUserRequest = z.infer<typeof updateUserRequest>;
 export type UpdateUserPreferencesRequest = z.infer<typeof updateUserPreferencesRequest>;
+export type RequestPasswordResetRequest = z.infer<typeof requestPasswordResetRequest>;
+export type ResetPasswordRequest = z.infer<typeof resetPasswordRequest>;
 //# sourceMappingURL=user.d.ts.map

package/dist/lib/api/schemas/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAIH,eAAO,MAAM,4BAA4B;;kBAI/B,CAAC;AAIX,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAIH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/lib/api/schemas/user.js

@@ -9,4 +9,14 @@ export const updateUserPreferencesRequest = z
     includeChildOrganizations: z.boolean().optional()
 })
     .strict();
+// ---------- POST /user/request-password-reset ----------
+export const requestPasswordResetRequest = z.object({
+    email: z.string().email(),
+    redirectTo: z.string().optional()
+});
+// ---------- POST /user/reset-password ----------
+export const resetPasswordRequest = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(1)
+});
 //# sourceMappingURL=user.js.map

package/dist/lib/api/schemas/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oCAAoC;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAEH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/lib/api/schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oCAAoC;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAEH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,0DAA0D;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,kDAAkD;AAElD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC"}

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAc5D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAa5D"}

package/dist/lib/config.js

@@ -9,8 +9,7 @@ export function createCMSConfig(config) {
                 ...config.customization?.branding
             },
             ...config.customization
-        },
-        plugins: config.plugins ?? []
+        }
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,eAAe,CAAC,MAAiB;IAChD,OAAO;QACN,yEAAyE;QACzE,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,kCAAkC;QACnE,aAAa,EAAE;YACd,QAAQ,EAAE;gBACT,KAAK,EAAE,WAAW;gBAClB,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ;aACjC;YACD,GAAG,MAAM,CAAC,aAAa;SACvB;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;KAC7B,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,eAAe,CAAC,MAAiB;IAChD,OAAO;QACN,yEAAyE;QACzE,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,kCAAkC;QACnE,aAAa,EAAE;YACd,QAAQ,EAAE;gBACT,KAAK,EAAE,WAAW;gBAClB,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ;aACjC;YACD,GAAG,MAAM,CAAC,aAAa;SACvB;KACD,CAAC;AACH,CAAC"}

package/dist/lib/hooks.d.ts

@@ -1,4 +1,5 @@
 import type { Handle } from '@sveltejs/kit';
+import type { Hono } from 'hono';
 import type { CMSConfig } from './types/index.js';
 import type { DatabaseAdapter } from './db/index.js';
 import type { AssetService } from './services/asset-service.js';
@@ -9,6 +10,7 @@ import type { GraphQLSettings } from './graphql/index.js';
 import { RolesService } from './services/roles-service.js';
 import { CMSEngine } from './engine.js';
 import { type LocalAPI } from './local-api/index.js';
+import { type AphexEnv } from './server/api/index.js';
 export interface CMSInstances {
     config: CMSConfig;
     assetService: AssetService;
@@ -20,10 +22,7 @@ export interface CMSInstances {
     rolesService: RolesService;
     auth?: AuthProvider;
     graphqlSettings?: GraphQLSettings | null;
-    pluginRoutes?: Map<string, {
-        handler: (event: any) => Promise<Response> | Response;
-        pluginName: string;
-    }>;
+    apiApp: Hono<AphexEnv>;
 }
 export declare function createCMSHook(config: CMSConfig): Handle;
 //# sourceMappingURL=hooks.d.ts.map

package/dist/lib/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,EAAE,GAAG,CACjB,MAAM,EACN;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAC7E,CAAC;CACF;AAiFD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CA8LvD"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/lib/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAa,SAAS,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAIN,KAAK,QAAQ,EACb,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;CACvB;AA0BD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAgJvD"}

package/dist/lib/hooks.js

@@ -5,6 +5,7 @@ import { AssetService as AssetServiceClass } from './services/asset-service.js';
 import { RolesService } from './services/roles-service.js';
 import { createCMS } from './engine.js';
 import { createLocalAPI } from './local-api/index.js';
+import { createAphexApi, mountAphexBuiltins, toHonoHandler } from './server/api/index.js';
 let cmsInstances = null;
 let schemaError = null;
 let initPromise = null;
@@ -26,51 +27,6 @@ function createDefaultStorageAdapter() {
         baseUrl: '' // No direct URL - all access through /assets/{id}/{filename}
     });
 }
-/**
- * Resolves a plugin configuration to an actual CMSPlugin instance
- * Supports three formats:
- * 1. String: 'my-plugin' - dynamically imports default export
- * 2. Object with name/options: { name: 'my-plugin', options: {...} }
- * 3. Already instantiated plugin: CMSPlugin object
- */
-async function resolvePlugin(pluginConfig) {
-    // Format 3: Already an instantiated plugin
-    if (typeof pluginConfig === 'object' && 'install' in pluginConfig) {
-        return pluginConfig;
-    }
-    // Format 1: String reference
-    if (typeof pluginConfig === 'string') {
-        try {
-            const pluginModule = await import(/* @vite-ignore */ pluginConfig);
-            const plugin = pluginModule.default || pluginModule;
-            if (typeof plugin === 'function') {
-                // If it's a factory function, call it with no options
-                return plugin();
-            }
-            return plugin;
-        }
-        catch (error) {
-            throw new Error(`Failed to load plugin "${pluginConfig}". Make sure it's installed: npm install ${pluginConfig}\nError: ${error}`);
-        }
-    }
-    // Format 2: Object with name and options
-    if (typeof pluginConfig === 'object' && 'name' in pluginConfig) {
-        try {
-            const pluginModule = await import(/* @vite-ignore */ pluginConfig.name);
-            const pluginFactory = pluginModule.default || pluginModule;
-            if (typeof pluginFactory === 'function') {
-                // Call factory with options
-                return pluginFactory(pluginConfig.options || {});
-            }
-            // If not a factory, return as-is (assuming it's already a plugin)
-            return pluginFactory;
-        }
-        catch (error) {
-            throw new Error(`Failed to load plugin "${pluginConfig.name}". Make sure it's installed: npm install ${pluginConfig.name}\nError: ${error}`);
-        }
-    }
-    throw new Error(`Invalid plugin configuration: ${JSON.stringify(pluginConfig)}`);
-}
 export function createCMSHook(config) {
     if (!config) {
         throw new Error('[CMS] createCMSHook received an undefined config. ' +
@@ -112,6 +68,12 @@ export function createCMSHook(config) {
             const rolesService = new RolesService(databaseAdapter, config.cache ?? null);
             // Initialize Local API (unified operations layer)
             const localAPI = createLocalAPI(config, databaseAdapter);
+            // Build the Hono API app shell. User middleware/overrides register
+            // FIRST (so they sit ahead of built-ins in the chain), then we mount
+            // the built-in routes, then GraphQL.
+            const apiApp = createAphexApi();
+            config.api?.(apiApp);
+            mountAphexBuiltins(apiApp);
             // Initialize schemas with validation
             try {
                 await cmsEngine.initialize();
@@ -120,44 +82,6 @@ export function createCMSHook(config) {
                 cmsLogger.error('[CMS]', 'Failed to initialize:', error);
                 schemaError = error instanceof Error ? error : new Error(String(error));
             }
-            // Build plugin route map and install plugins (do this ONCE at startup)
-            const pluginRoutes = new Map();
-            // Resolve and install plugins
-            if (config.plugins && config.plugins.length > 0) {
-                for (const pluginConfig of config.plugins) {
-                    try {
-                        // Resolve plugin config to actual CMSPlugin instance (may involve dynamic import)
-                        const plugin = await resolvePlugin(pluginConfig);
-                        cmsLogger.info('[CMS]', `Loading plugin: ${plugin.name}@${plugin.version}`);
-                        // Build route map before installation
-                        if (plugin.routes) {
-                            for (const [path, handler] of Object.entries(plugin.routes)) {
-                                pluginRoutes.set(path, { handler, pluginName: plugin.name });
-                            }
-                        }
-                        // Create temporary cmsInstances for installation (will be replaced below)
-                        const tempInstances = {
-                            config,
-                            databaseAdapter: databaseAdapter,
-                            assetService: assetService,
-                            storageAdapter: storageAdapter,
-                            emailAdapter: emailAdapter,
-                            cmsEngine: cmsEngine,
-                            localAPI: localAPI,
-                            rolesService,
-                            auth: config.auth?.provider,
-                            pluginRoutes
-                        };
-                        // Install the plugin
-                        cmsLogger.info('[CMS]', `Installing plugin: ${plugin.name}`);
-                        await plugin.install(tempInstances);
-                    }
-                    catch (error) {
-                        cmsLogger.error('[CMS]', 'Failed to load/install plugin:', error);
-                        throw error;
-                    }
-                }
-            }
             // Initialize built-in GraphQL (enabled by default, opt-out with graphql: false)
             let graphqlSettings = null;
             if (config.graphql !== false) {
@@ -174,15 +98,20 @@ export function createCMSHook(config) {
                         localAPI,
                         rolesService,
                         auth: config.auth?.provider,
-                        pluginRoutes
+                        apiApp
                     }, config.schemaTypes, graphqlConfig);
-                    // Register GraphQL route (normalize path to always have leading /)
+                    // Register GraphQL directly on the Hono app. The Yoga handler
+                    // internally distinguishes GET (GraphiQL UI) from POST (queries),
+                    // so we mount with `app.all()` and let it route by method.
+                    //
+                    // Path is normalized to be relative to the `/api` basePath:
+                    // e.g. config path "/api/graphql" → mount at "/graphql".
                     const rawPath = graphqlConfig.path ?? '/api/graphql';
-                    const endpoint = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
-                    pluginRoutes.set(endpoint, {
-                        handler: result.handler,
-                        pluginName: 'built-in:graphql'
-                    });
+                    const fullPath = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
+                    const honoPath = fullPath.startsWith('/api')
+                        ? fullPath.slice('/api'.length) || '/'
+                        : fullPath;
+                    apiApp.all(honoPath, toHonoHandler(result.handler));
                     graphqlSettings = result.settings;
                 }
                 catch (error) {
@@ -201,7 +130,7 @@ export function createCMSHook(config) {
                 rolesService,
                 auth: config.auth?.provider,
                 graphqlSettings,
-                pluginRoutes
+                apiApp
             };
             resolveInit();
         }
@@ -217,14 +146,6 @@ export function createCMSHook(config) {
             if (authResponse)
                 return authResponse;
         }
-        // Check if a plugin handles this route (O(1) lookup)
-        if (cmsInstances.pluginRoutes && cmsInstances.pluginRoutes.size > 0) {
-            const pluginRoute = cmsInstances.pluginRoutes.get(event.url.pathname);
-            if (pluginRoute) {
-                cmsLogger.debug('[CMS]', `Plugin ${pluginRoute.pluginName} handling route: ${event.url.pathname}`);
-                return pluginRoute.handler(event);
-            }
-        }
         return resolve(event);
     };
 }

package/dist/lib/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/lib/hooks.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,oBAAoB,IAAI,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAa,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAoBlE,IAAI,YAAY,GAAwB,IAAI,CAAC;AAC7C,IAAI,WAAW,GAAiB,IAAI,CAAC;AACrC,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;;GAGG;AACH,SAAS,iBAAiB;IACzB,MAAM,KAAK,GAAI,MAAc,CAAC,mBAAmB,KAAK,IAAI,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,MAAc,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,iBAAiB;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,2BAA2B;IACnC,OAAO,4BAA4B,CAAC,OAAO,EAAE;QAC5C,QAAQ,EAAE,kBAAkB,EAAE,6DAA6D;QAC3F,OAAO,EAAE,EAAE,CAAC,6DAA6D;KACzE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,YAA6B;IACzD,2CAA2C;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QACnE,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC;YAEpD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,sDAAsD;gBACtD,OAAO,MAAM,EAAE,CAAC;YACjB,CAAC;YAED,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,0BAA0B,YAAY,4CAA4C,YAAY,YAAY,KAAK,EAAE,CACjH,CAAC;QACH,CAAC;IACF,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;QAChE,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC;YAE3D,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;gBACzC,4BAA4B;gBAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,kEAAkE;YAClE,OAAO,aAAa,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,0BAA0B,YAAY,CAAC,IAAI,4CAA4C,YAAY,CAAC,IAAI,YAAY,KAAK,EAAE,CAC3H,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,oDAAoD;YACnD,6EAA6E,CAC9E,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,IAAI,MAAM,CAAC,QAAQ;QAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,uEAAuE;QACvE,uEAAuE;QAEvE,uDAAuD;QACvD,gFAAgF;QAChF,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,YAAY,IAAI,CAAC,iBAAiB,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;YACtE,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC/B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,WAAuB,CAAC;YAC5B,WAAW,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;YAE1D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YAC3C,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;YACxC,wEAAwE;YACxE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,IAAI,2BAA2B,EAAE,CAAC;YACvE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YAE7E,kDAAkD;YAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAEzD,qCAAqC;YACrC,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBACzD,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,uEAAuE;YACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;YAEJ,8BAA8B;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACJ,kFAAkF;wBAClF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;wBAEjD,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBAE5E,sCAAsC;wBACtC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;4BACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gCAC7D,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;4BAC9D,CAAC;wBACF,CAAC;wBAED,0EAA0E;wBAC1E,MAAM,aAAa,GAAG;4BACrB,MAAM;4BACN,eAAe,EAAE,eAAe;4BAChC,YAAY,EAAE,YAAY;4BAC1B,cAAc,EAAE,cAAc;4BAC9B,YAAY,EAAE,YAAY;4BAC1B,SAAS,EAAE,SAAS;4BACpB,QAAQ,EAAE,QAAQ;4BAClB,YAAY;4BACZ,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;4BAC3B,YAAY;yBACZ,CAAC;wBAEF,qBAAqB;wBACrB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;oBACrC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;wBAClE,MAAM,KAAK,CAAC;oBACb,CAAC;gBACF,CAAC;YACF,CAAC;YAED,gFAAgF;YAChF,IAAI,eAAe,GAA2B,IAAI,CAAC;YAEnD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACJ,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;oBACjE,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACxC;wBACC,MAAM;wBACN,eAAe;wBACf,YAAY;wBACZ,cAAc;wBACd,YAAY;wBACZ,SAAS;wBACT,QAAQ;wBACR,YAAY;wBACZ,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;wBAC3B,YAAY;qBACZ,EACD,MAAM,CAAC,WAAW,EAClB,aAAa,CACb,CAAC;oBAEF,mEAAmE;oBACnE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,IAAI,cAAc,CAAC;oBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;oBACnE,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE;wBAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,UAAU,EAAE,kBAAkB;qBAC9B,CAAC,CAAC;oBACH,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAC;oBACjE,uCAAuC;gBACxC,CAAC;YACF,CAAC;YAED,YAAY,GAAG;gBACd,MAAM;gBACN,eAAe,EAAE,eAAe;gBAChC,YAAY,EAAE,YAAY;gBAC1B,cAAc,EAAE,cAAc;gBAC9B,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,YAAY;gBACZ,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;gBAC3B,eAAe;gBACf,YAAY;aACZ,CAAC;YAEF,WAAY,EAAE,CAAC;QAChB,CAAC;QAED,2EAA2E;QAC3E,IAAI,YAAY,EAAE,CAAC;YACjB,YAAoB,CAAC,WAAW,GAAG,WAAW,CAAC;QACjD,CAAC;QAED,qEAAqE;QACrE,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAErC,gCAAgC;QAChC,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,MAAM,cAAc,CACxC,KAAK,EACL,MAAM,EACN,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,eAAe,EAC5B,YAAY,CAAC,YAAY,CACzB,CAAC;YACF,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QAED,qDAAqD;QACrD,IAAI,YAAY,CAAC,YAAY,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtE,IAAI,WAAW,EAAE,CAAC;gBACjB,SAAS,CAAC,KAAK,CACd,OAAO,EACP,UAAU,WAAW,CAAC,UAAU,oBAAoB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CACxE,CAAC;gBACF,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;QAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/lib/hooks.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,oBAAoB,IAAI,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAa,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EACN,cAAc,EACd,kBAAkB,EAClB,aAAa,EAEb,MAAM,oBAAoB,CAAC;AAiB5B,IAAI,YAAY,GAAwB,IAAI,CAAC;AAC7C,IAAI,WAAW,GAAiB,IAAI,CAAC;AACrC,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;;GAGG;AACH,SAAS,iBAAiB;IACzB,MAAM,KAAK,GAAI,MAAc,CAAC,mBAAmB,KAAK,IAAI,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,MAAc,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,iBAAiB;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,2BAA2B;IACnC,OAAO,4BAA4B,CAAC,OAAO,EAAE;QAC5C,QAAQ,EAAE,kBAAkB,EAAE,6DAA6D;QAC3F,OAAO,EAAE,EAAE,CAAC,6DAA6D;KACzE,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,oDAAoD;YACnD,6EAA6E,CAC9E,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,IAAI,MAAM,CAAC,QAAQ;QAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,uEAAuE;QACvE,uEAAuE;QAEvE,uDAAuD;QACvD,gFAAgF;QAChF,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,YAAY,IAAI,CAAC,iBAAiB,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;YACtE,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC/B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,WAAuB,CAAC;YAC5B,WAAW,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;YAE1D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YAC3C,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;YACxC,wEAAwE;YACxE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,IAAI,2BAA2B,EAAE,CAAC;YACvE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YAE7E,kDAAkD;YAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAEzD,mEAAmE;YACnE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YACrB,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAE3B,qCAAqC;YACrC,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBACzD,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,gFAAgF;YAChF,IAAI,eAAe,GAA2B,IAAI,CAAC;YAEnD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACJ,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;oBACjE,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACxC;wBACC,MAAM;wBACN,eAAe;wBACf,YAAY;wBACZ,cAAc;wBACd,YAAY;wBACZ,SAAS;wBACT,QAAQ;wBACR,YAAY;wBACZ,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;wBAC3B,MAAM;qBACN,EACD,MAAM,CAAC,WAAW,EAClB,aAAa,CACb,CAAC;oBAEF,8DAA8D;oBAC9D,kEAAkE;oBAClE,2DAA2D;oBAC3D,EAAE;oBACF,4DAA4D;oBAC5D,yDAAyD;oBACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,IAAI,cAAc,CAAC;oBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;oBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;wBAC3C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG;wBACtC,CAAC,CAAC,QAAQ,CAAC;oBACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;oBACpD,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAC;oBACjE,uCAAuC;gBACxC,CAAC;YACF,CAAC;YAED,YAAY,GAAG;gBACd,MAAM;gBACN,eAAe,EAAE,eAAe;gBAChC,YAAY,EAAE,YAAY;gBAC1B,cAAc,EAAE,cAAc;gBAC9B,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,YAAY;gBACZ,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;gBAC3B,eAAe;gBACf,MAAM;aACN,CAAC;YAEF,WAAY,EAAE,CAAC;QAChB,CAAC;QAED,2EAA2E;QAC3E,IAAI,YAAY,EAAE,CAAC;YACjB,YAAoB,CAAC,WAAW,GAAG,WAAW,CAAC;QACjD,CAAC;QAED,qEAAqE;QACrE,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAErC,gCAAgC;QAChC,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,MAAM,cAAc,CACxC,KAAK,EACL,MAAM,EACN,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,eAAe,EAC5B,YAAY,CAAC,YAAY,CACzB,CAAC;YACF,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACH,CAAC"}

package/dist/lib/server/api/index.d.ts

@@ -0,0 +1,55 @@
+import { Hono } from 'hono';
+import type { CMSInstances } from '../../hooks.js';
+import type { Auth } from '../../types/auth.js';
+/**
+ * Hono environment for the Aphex API.
+ *
+ * Variables on `c.var`:
+ * - `aphexCMS` — the singleton CMS service container (db, storage, services).
+ * - `auth` — the resolved auth principal for this request, or null if anonymous.
+ *
+ * These are populated by the SvelteKit catch-all, which invokes
+ * `app.fetch(request, { aphexCMS, auth })` and the bridge middleware below
+ * lifts them onto `c.var`.
+ */
+export type AphexEnv = {
+    Variables: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+    Bindings: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+};
+/**
+ * Build the Aphex API Hono app shell.
+ *
+ * Returns a Hono app with `/api` basePath and the bridge middleware that
+ * lifts `app.fetch(req, env)` values onto `c.var`. Built-in routes are NOT
+ * mounted yet — call `mountAphexBuiltins(app)` after registering any user
+ * middleware/overrides (Hono is registration-order-strict).
+ */
+export declare function createAphexApi(): import("hono/hono-base").HonoBase<AphexEnv, import("hono/types").BlankSchema, "/api", "/api">;
+/**
+ * Mount cms-core's built-in resource routes onto an Aphex API app.
+ *
+ * Called by `createCMSHook` after `config.api?.(app)` runs, so user-provided
+ * middleware (e.g. an email-sending wrap on `/organizations/invitations`)
+ * registers ahead of the built-in handler and gets the chance to wrap it.
+ */
+export declare function mountAphexBuiltins(app: Hono<AphexEnv>): void;
+export type ApiRoutes = ReturnType<typeof createAphexApi>;
+/**
+ * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted
+ * onto a Hono router.
+ *
+ * Used for handlers that already exist in SK form (e.g. the built-in
+ * GraphQL Yoga app) and don't need to be rewritten just to flow through
+ * the Hono catch-all. We synthesize the minimum `event` shape those
+ * handlers actually read: `request` + `locals.{aphexCMS,auth}` + `params`
+ * + `url`. If a future SK handler reaches for `cookies`, `setHeaders`, or
+ * `getClientAddress`, extend the synthesized event accordingly.
+ */
+export declare function toHonoHandler(skHandler: (event: any) => Promise<Response> | Response): (c: import("hono").Context<AphexEnv>) => Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/server/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAY7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAoCrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAEzC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}