@aphexcms/cms-core 4.0.0 → 5.0.1

package/dist/server/api/routes/documents-query.d.ts

@@ -0,0 +1,8 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * POST /api/documents/query — Advanced document querying with complex
+ * filters. Body shape mirrors LocalAPI's `FindOptions`.
+ */
+export declare const documentsQueryRouter: Hono<AphexEnv>;
+//# sourceMappingURL=documents-query.d.ts.map

package/dist/server/api/routes/documents-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAiF/C,CAAC"}

package/dist/server/api/routes/documents-query.js

@@ -0,0 +1,74 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { authToContext } from '../../../local-api/auth-helpers.js';
+import { PermissionError } from '../../../local-api/permissions.js';
+import { cmsLogger } from '../../../utils/logger.js';
+import { queryDocumentsRequest } from '../../../api/schemas/documents.js';
+const DEFAULT_PAGE_SIZE = 20;
+const DEFAULT_PAGE = 1;
+/**
+ * POST /api/documents/query — Advanced document querying with complex
+ * filters. Body shape mirrors LocalAPI's `FindOptions`.
+ */
+export const documentsQueryRouter = new Hono().post('/query', zValidator('json', queryDocumentsRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Bad Request',
+            message: 'Document type is required in request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { localAPI } = c.var.aphexCMS;
+        const context = authToContext(c.var.auth);
+        const body = c.req.valid('json');
+        const documentType = body.type;
+        if (!localAPI.hasCollection(documentType)) {
+            return c.json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${documentType}' not found. Available: ${localAPI.getCollectionNames().join(', ')}`
+            }, 400);
+        }
+        const page = body.page ?? DEFAULT_PAGE;
+        const pageSize = body.pageSize ?? body.limit ?? DEFAULT_PAGE_SIZE;
+        const offset = body.offset !== undefined ? body.offset : (page - 1) * pageSize;
+        const findOptions = {
+            where: body.where,
+            limit: pageSize,
+            offset,
+            sort: body.sort,
+            depth: body.depth ?? 0,
+            select: body.select,
+            perspective: body.perspective ?? 'draft',
+            includeChildOrganizations: body.includeChildOrganizations,
+            filterOrganizationIds: body.filterOrganizationIds
+        };
+        const result = await localAPI.collections[documentType].find(context, findOptions);
+        return c.json({
+            success: true,
+            data: result.docs,
+            pagination: {
+                total: result.totalDocs,
+                page: result.page,
+                pageSize: result.limit,
+                totalPages: result.totalPages,
+                hasNextPage: result.hasNextPage,
+                hasPrevPage: result.hasPrevPage
+            }
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to query documents:', error);
+        if (error instanceof PermissionError) {
+            return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
+        }
+        return c.json({
+            success: false,
+            error: 'Failed to query documents',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});

package/dist/server/api/routes/documents.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const documentsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=documents.d.ts.map

package/dist/server/api/routes/documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,eAAe,EAAE,IAAI,CAAC,QAAQ,CAuKxC,CAAC"}

package/dist/{lib → server/api}/routes/documents.js

@@ -1,28 +1,25 @@
-// Aphex CMS Document API Handlers
-import { json } from '@sveltejs/kit';
-import { authToContext } from '../local-api/auth-helpers.js';
-import { PermissionError } from '../local-api/permissions.js';
-import { cmsLogger } from '../utils/logger.js';
-import { createDocumentRequest, listDocumentsQuery } from '../api/schemas/documents.js';
-// Default values for API
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { authToContext } from '../../../local-api/auth-helpers.js';
+import { PermissionError } from '../../../local-api/permissions.js';
+import { cmsLogger } from '../../../utils/logger.js';
+import { createDocumentRequest, listDocumentsQuery } from '../../../api/schemas/documents.js';
 const DEFAULT_PAGE_SIZE = 20;
 const DEFAULT_PAGE = 1;
-// GET /api/documents - Simple document listing with basic filters
-export const GET = async ({ url, locals }) => {
+export const documentsRouter = new Hono()
+    .get('/', zValidator('query', listDocumentsQuery, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid query parameters',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { localAPI } = locals.aphexCMS;
-        const context = authToContext(locals.auth);
-        // Parse + validate query params with zod
-        const rawQuery = Object.fromEntries(url.searchParams.entries());
-        const parsedQuery = listDocumentsQuery.safeParse(rawQuery);
-        if (!parsedQuery.success) {
-            return json({
-                success: false,
-                error: 'Invalid query parameters',
-                issues: parsedQuery.error.issues
-            }, { status: 400 });
-        }
-        const q = parsedQuery.data;
+        const { localAPI } = c.var.aphexCMS;
+        const context = authToContext(c.var.auth);
+        const q = c.req.valid('query');
         const docType = q.type ?? q.docType;
         const status = q.status;
         const sortParam = Array.isArray(q.sort) ? q.sort.join(',') : q.sort;
@@ -34,38 +31,35 @@ export const GET = async ({ url, locals }) => {
         const offset = (page - 1) * pageSize;
         const depth = q.depth ?? 0;
         if (!docType) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Bad Request',
                 message: 'Document type is required. Use ?type=page or ?docType=page'
-            }, { status: 400 });
+            }, 400);
         }
-        // Get collection API (TypeScript-safe)
         const collection = localAPI.collections[docType];
         if (!collection) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid document type',
                 message: `Collection '${docType}' not found. Available: ${localAPI.getCollectionNames().join(', ')}`
-            }, { status: 400 });
+            }, 400);
         }
-        // Build where clause from query params
         const where = {};
         if (status) {
             where.status = { equals: status };
         }
-        // Query via LocalAPI
         const result = await collection.find(context, {
             where: Object.keys(where).length > 0 ? where : undefined,
             limit: pageSize,
-            offset: offset,
-            depth: depth,
+            offset,
+            depth,
             sort: sortParam || undefined,
             perspective,
             includeChildOrganizations,
             filterOrganizationIds
         });
-        return json({
+        return c.json({
             success: true,
             data: result.docs,
             pagination: {
@@ -81,77 +75,60 @@ export const GET = async ({ url, locals }) => {
     catch (error) {
         cmsLogger.error('Failed to fetch documents:', error);
         if (error instanceof PermissionError) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: error.message
-            }, { status: 403 });
+            return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to fetch documents',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-// POST /api/documents - Create new document
-export const POST = async ({ request, locals }) => {
+})
+    .post('/', zValidator('json', createDocumentRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { localAPI } = locals.aphexCMS;
-        const context = authToContext(locals.auth);
-        const rawBody = await request.json();
-        const parsed = createDocumentRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const documentType = parsed.data.type;
-        const documentData = (parsed.data.draftData ?? parsed.data.data);
-        const shouldPublish = parsed.data.publish ?? false;
-        // Get collection API (TypeScript-safe)
+        const { localAPI } = c.var.aphexCMS;
+        const context = authToContext(c.var.auth);
+        const parsed = c.req.valid('json');
+        const documentType = parsed.type;
+        const documentData = (parsed.draftData ?? parsed.data);
+        const shouldPublish = parsed.publish ?? false;
         const collection = localAPI.collections[documentType];
         if (!collection) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid document type',
                 message: `Collection '${documentType}' not found. Available: ${localAPI.getCollectionNames().join(', ')}`
-            }, { status: 400 });
+            }, 400);
         }
-        // Create via LocalAPI (permission checks and validation happen inside)
         const result = await collection.create(context, documentData, {
             publish: shouldPublish
         });
-        return json({
+        return c.json({
             success: true,
             data: result.document,
             validation: result.validation
-        }, { status: 201 });
+        }, 201);
     }
     catch (error) {
         cmsLogger.error('Failed to create document:', error);
         if (error instanceof PermissionError) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: error.message
-            }, { status: 403 });
+            return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
-        // Validation errors from publish attempts
         if (error instanceof Error && error.message.includes('validation errors')) {
-            return json({
-                success: false,
-                error: 'Validation failed',
-                message: error.message
-            }, { status: 400 });
+            return c.json({ success: false, error: 'Validation failed', message: error.message }, 400);
         }
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to create document',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-//# sourceMappingURL=documents.js.map
+});

package/dist/server/api/routes/organizations-by-id.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const organizationsByIdRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-by-id.d.ts.map

package/dist/server/api/routes/organizations-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAuOhD,CAAC"}

package/dist/{lib → server/api}/routes/organizations-by-id.js

@@ -1,111 +1,97 @@
-// Aphex CMS Organization by ID API Handlers
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { updateOrganizationRequest } from '../api/schemas/organizations.js';
-import { hasCapability } from '../types/capabilities.js';
-// GET /api/organizations/[id] - Get organization by ID
-export const GET = async ({ params, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateOrganizationRequest } from '../../../api/schemas/organizations.js';
+import { hasCapability } from '../../../types/capabilities.js';
+export const organizationsByIdRouter = new Hono()
+    .get('/:id', async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Check if user is a member of this organization
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You are not a member of this organization'
-            }, { status: 403 });
+            }, 403);
         }
         const organization = await databaseAdapter.findOrganizationById(id);
         if (!organization) {
-            return json({
-                success: false,
-                error: 'Organization not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Organization not found' }, 404);
         }
-        return json({
-            success: true,
-            data: organization
-        });
+        return c.json({ success: true, data: organization });
     }
     catch (error) {
         cmsLogger.error('Failed to fetch organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to fetch organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
+    }
+})
+    .patch('/:id', zValidator('json', updateOrganizationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
     }
-};
-// PATCH /api/organizations/[id] - Update organization
-export const PATCH = async ({ params, request, locals }) => {
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Require `org.settings` capability + membership in the target org.
-        // Membership check stands regardless — even a capability holder can only
-        // edit orgs they actually belong to.
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership || !hasCapability(auth, 'org.settings')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to update organization settings'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = updateOrganizationRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Validate: if slug is being changed, check it's not already taken
+        const body = c.req.valid('json');
         if (body.slug) {
             const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
             if (existingOrg && existingOrg.id !== id) {
-                return json({
+                return c.json({
                     success: false,
                     error: 'Slug already exists',
                     message: `Organization with slug '${body.slug}' already exists`
-                }, { status: 409 });
+                }, 409);
             }
         }
-        // Update organization
         const updateData = {};
         if (body.name !== undefined)
             updateData.name = body.name;
@@ -115,57 +101,47 @@ export const PATCH = async ({ params, request, locals }) => {
             updateData.metadata = body.metadata;
         const updatedOrganization = await databaseAdapter.updateOrganization(id, updateData);
         if (!updatedOrganization) {
-            return json({
-                success: false,
-                error: 'Organization not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Organization not found' }, 404);
         }
-        return json({
-            success: true,
-            data: updatedOrganization
-        });
+        return c.json({ success: true, data: updatedOrganization });
     }
     catch (error) {
         cmsLogger.error('Failed to update organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to update organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-// DELETE /api/organizations/[id] - Delete an organization
-export const DELETE = async ({ params, locals }) => {
+})
+    .delete('/:id', async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Missing required field',
                 message: 'Organization ID is required'
-            }, { status: 400 });
+            }, 400);
         }
-        // Only owners can delete an organization
         const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
         if (!membership || membership.role !== 'owner') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'Only owners can delete an organization'
-            }, { status: 403 });
+            }, 403);
         }
-        // Get all members of the organization
         const members = await databaseAdapter.findOrganizationMembers(id);
-        // Handle member lifecycle
         for (const member of members) {
             const userSession = await databaseAdapter.findUserSession(member.userId);
             if (userSession?.activeOrganizationId === id) {
@@ -179,24 +155,17 @@ export const DELETE = async ({ params, locals }) => {
                 }
             }
         }
-        // Delete all members from the organization
         await databaseAdapter.removeAllMembers(id);
-        // Delete all invitations for the organization
         await databaseAdapter.removeAllInvitations(id);
-        // Delete the organization
         await databaseAdapter.deleteOrganization(id);
-        return json({
-            success: true,
-            message: 'Organization deleted successfully'
-        });
+        return c.json({ success: true, message: 'Organization deleted successfully' });
     }
     catch (error) {
         cmsLogger.error('Failed to delete organization:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to delete organization',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-//# sourceMappingURL=organizations-by-id.js.map
+});

package/dist/server/api/routes/organizations-invitations.d.ts

@@ -0,0 +1,10 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
+ * that adds email sending after the invite row is created. While that
+ * shim exists, this Hono router sits dormant (specific SK routes win
+ * over the catch-all). Phase 5 moves the wrapper into `config.api`.
+ */
+export declare const organizationsInvitationsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-invitations.d.ts.map

package/dist/server/api/routes/organizations-invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CA0MxD,CAAC"}