@aphexcms/cms-core 4.0.0 → 5.0.1

package/dist/server/api/routes/organizations.js

@@ -0,0 +1,98 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { createOrganizationRequest } from '../../../api/schemas/organizations.js';
+export const organizationsRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const memberships = await databaseAdapter.findUserOrganizations(auth.user.id);
+        const organizations = memberships.map((m) => ({
+            id: m.organization.id,
+            name: m.organization.name,
+            slug: m.organization.slug,
+            metadata: m.organization.metadata,
+            role: m.member.role,
+            joinedAt: m.member.createdAt,
+            isActive: m.organization.id === auth.organizationId
+        }));
+        return c.json({ success: true, data: organizations });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to fetch organizations:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to fetch organizations',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/', zValidator('json', createOrganizationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'Organization name and slug are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (auth.user.role !== 'super_admin') {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'Only super admins can create organizations'
+            }, 403);
+        }
+        const body = c.req.valid('json');
+        const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
+        if (existingOrg) {
+            return c.json({
+                success: false,
+                error: 'Slug already exists',
+                message: `Organization with slug '${body.slug}' already exists`
+            }, 409);
+        }
+        const newOrganization = await databaseAdapter.createOrganization({
+            name: body.name,
+            slug: body.slug,
+            metadata: body.metadata || null,
+            parentOrganizationId: auth.organizationId,
+            createdBy: auth.user.id
+        });
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
+        await databaseAdapter.addMember({
+            organizationId: newOrganization.id,
+            userId: auth.user.id,
+            role: 'owner'
+        });
+        await databaseAdapter.updateUserSession(auth.user.id, newOrganization.id);
+        return c.json({ success: true, data: newOrganization }, 201);
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create organization:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to create organization',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});

package/dist/server/api/routes/roles.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Roles router. Combines `/roles` (list, create) and `/roles/:name`
+ * (update, delete) so the wire URLs are
+ * `/api/roles` and `/api/roles/:name`.
+ *
+ * Note: built-in role names cannot be deleted; they're seeded on every
+ * org and a custom row with the same name would be unreachable.
+ */
+export declare const rolesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/server/api/routes/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CAuSpC,CAAC"}

package/dist/server/api/routes/roles.js

@@ -0,0 +1,218 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../../../types/capabilities.js';
+import { createRoleRequest, updateRoleRequest } from '../../../api/schemas/roles.js';
+/**
+ * Roles router. Combines `/roles` (list, create) and `/roles/:name`
+ * (update, delete) so the wire URLs are
+ * `/api/roles` and `/api/roles/:name`.
+ *
+ * Note: built-in role names cannot be deleted; they're seeded on every
+ * org and a custom row with the same name would be unreachable.
+ */
+export const rolesRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const { rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const roles = await rolesService.listRoles(auth.organizationId);
+        return c.json({ success: true, data: roles });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list roles:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to list roles',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/', zValidator('json', createRoleRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'name and capabilities are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const body = c.req.valid('json');
+        if (BUILTIN_ROLE_NAMES.includes(body.name)) {
+            return c.json({
+                success: false,
+                error: 'Reserved name',
+                message: `"${body.name}" is a built-in role name. Edit the existing role instead.`
+            }, 409);
+        }
+        const existing = await databaseAdapter.findRoleByName(auth.organizationId, body.name);
+        if (existing) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: `A role named "${body.name}" already exists in this organization.`
+            }, 409);
+        }
+        const role = await databaseAdapter.createRole({
+            organizationId: auth.organizationId,
+            name: body.name,
+            description: body.description ?? null,
+            capabilities: body.capabilities,
+            isBuiltIn: false
+        });
+        await rolesService.invalidate(auth.organizationId, body.name);
+        return c.json({ success: true, data: role }, 201);
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to create role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .patch('/:name', zValidator('json', updateRoleRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const name = c.req.param('name');
+        if (!name) {
+            return c.json({
+                success: false,
+                error: 'Invalid request',
+                message: 'Role name is required'
+            }, 400);
+        }
+        const body = c.req.valid('json');
+        const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
+        if (!updated) {
+            return c.json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, 404);
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return c.json({ success: true, data: updated });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .delete('/:name', async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const name = c.req.param('name');
+        if (!name) {
+            return c.json({
+                success: false,
+                error: 'Invalid request',
+                message: 'Role name is required'
+            }, 400);
+        }
+        if (BUILTIN_ROLE_NAMES.includes(name)) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: `"${name}" is a built-in role and cannot be deleted.`
+            }, 403);
+        }
+        const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
+        const inUseByMember = members.some((m) => m.role === name);
+        const invitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
+        const inUseByInvitation = invitations.some((i) => i.role === name && !i.acceptedAt);
+        if (inUseByMember || inUseByInvitation) {
+            return c.json({
+                success: false,
+                error: 'Role in use',
+                message: `Cannot delete "${name}": reassign affected members or invitations first.`
+            }, 409);
+        }
+        const deleted = await databaseAdapter.deleteRole(auth.organizationId, name);
+        if (!deleted) {
+            return c.json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, 404);
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return c.json({ success: true, message: 'Role deleted' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to delete role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to delete role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});

package/dist/server/api/routes/schemas.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const schemasRouter: Hono<AphexEnv>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/server/api/routes/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,aAAa,EAAE,IAAI,CAAC,QAAQ,CAwBtC,CAAC"}

package/dist/server/api/routes/schemas.js

@@ -0,0 +1,26 @@
+import { Hono } from 'hono';
+import { cmsLogger } from '../../../utils/logger.js';
+// Annotated as Hono<AphexEnv> (not the full chained type) so cms-core's
+// .d.ts emit doesn't blow up under TS7056. Chained-route inference would
+// only matter for hono/client RPC, which is out of scope here.
+export const schemasRouter = new Hono()
+    .get('/', (c) => {
+    const { cmsEngine } = c.var.aphexCMS;
+    // Read from config so validation functions survive (not from DB).
+    const schemas = cmsEngine.config.schemaTypes;
+    return c.json({ success: true, data: schemas });
+})
+    .get('/:type', (c) => {
+    const type = c.req.param('type');
+    const { cmsEngine } = c.var.aphexCMS;
+    if (!type) {
+        return c.json({ error: 'Schema type is required' }, 400);
+    }
+    cmsLogger.debug('GETTING SCHEMA TYPE FROM: ', type);
+    const schema = cmsEngine.getSchemaTypeByName(type);
+    cmsLogger.debug('SCHEMA: ', schema);
+    if (!schema) {
+        return c.json({ error: `Schema type '${type}' not found` }, 404);
+    }
+    return c.json({ success: true, data: schema });
+});

package/dist/server/api/routes/user-preferences.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const userPreferencesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=user-preferences.d.ts.map

package/dist/server/api/routes/user-preferences.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-preferences.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user-preferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAkF/C,CAAC"}

package/dist/server/api/routes/user-preferences.js

@@ -0,0 +1,62 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateUserPreferencesRequest } from '../../../api/schemas/user.js';
+export const userPreferencesRouter = new Hono()
+    .get('/cms-preference', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const userProfile = await databaseAdapter.findUserProfileById(auth.user.id);
+        return c.json({ success: true, data: userProfile?.preferences || {} });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to get user preferences:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to get user preferences',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .patch('/cms-preference', zValidator('json', updateUserPreferencesRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'Invalid preference values',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const body = c.req.valid('json');
+        await databaseAdapter.updateUserPreferences(auth.user.id, body);
+        const userProfile = await databaseAdapter.findUserProfileById(auth.user.id);
+        return c.json({ success: true, data: userProfile?.preferences || {} });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update user preferences:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update user preferences',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});

package/dist/server/api/routes/user.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * User account routes that delegate to the configured AuthProvider.
+ *
+ * cms-core ships these as Hono routers so studio doesn't need to maintain
+ * SvelteKit `+server.ts` files for them. The wire format and side effects
+ * (e.g. the password-reset email) are owned by the AuthProvider impl —
+ * cms-core's role is just to expose them over HTTP.
+ */
+export declare const userRouter: Hono<AphexEnv>;
+//# sourceMappingURL=user.d.ts.map

package/dist/server/api/routes/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA6IpC,CAAC"}

package/dist/server/api/routes/user.js

@@ -0,0 +1,113 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest } from '../../../api/schemas/user.js';
+/**
+ * User account routes that delegate to the configured AuthProvider.
+ *
+ * cms-core ships these as Hono routers so studio doesn't need to maintain
+ * SvelteKit `+server.ts` files for them. The wire format and side effects
+ * (e.g. the password-reset email) are owned by the AuthProvider impl —
+ * cms-core's role is just to expose them over HTTP.
+ */
+export const userRouter = new Hono()
+    .patch('/', zValidator('json', updateUserRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'name is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const auth = c.var.auth;
+        const provider = c.var.aphexCMS.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!provider) {
+            return c.json({
+                success: false,
+                error: 'Auth provider not configured'
+            }, 500);
+        }
+        const { name } = c.req.valid('json');
+        await provider.changeUserName(auth.user.id, name);
+        return c.json({ success: true, message: 'User updated successfully' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update user:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update user',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/request-password-reset', zValidator('json', requestPasswordResetRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'email is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const provider = c.var.aphexCMS.auth;
+        if (!provider) {
+            return c.json({ success: false, error: 'Auth provider not configured' }, 500);
+        }
+        const { email, redirectTo } = c.req.valid('json');
+        await provider.requestPasswordReset(email, redirectTo);
+        // Constant response shape regardless of whether the email exists,
+        // to avoid account enumeration via the API.
+        return c.json({
+            success: true,
+            message: 'If an account exists with that email, a password reset link has been sent'
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to request password reset:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to request password reset',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/reset-password', zValidator('json', resetPasswordRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required fields',
+            message: 'token and newPassword are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const provider = c.var.aphexCMS.auth;
+        if (!provider) {
+            return c.json({ success: false, error: 'Auth provider not configured' }, 500);
+        }
+        const { token, newPassword } = c.req.valid('json');
+        await provider.resetPassword(token, newPassword);
+        return c.json({ success: true, message: 'Password reset successfully' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to reset password:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to reset password',
+            message: error instanceof Error ? error.message : 'Invalid or expired token'
+        }, 500);
+    }
+});

package/dist/server/index.d.ts

@@ -13,7 +13,8 @@ export * from '../storage/providers/storage.js';
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
 export { RolesService } from '../services/roles-service.js';
-export * from '../routes-exports.js';
+export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
+export { createAphexApi, mountAphexBuiltins, toHonoHandler, type AphexEnv } from './api/index.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';
 export { createGraphQLHandler, type GraphQLConfig, type GraphQLSettings, type GraphQLHandlerResult } from '../graphql/index.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EACN,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,KAAK,QAAQ,EACb,MAAM,aAAa,CAAC;AAGrB,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -23,9 +23,13 @@ export * from '../storage/providers/storage.js';
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
 export { RolesService } from '../services/roles-service.js';
-// API Route handlers (for re-exporting in your app's API routes)
-// Re-export from routes-exports to avoid .js extension issues in workspace
-export * from '../routes-exports.js';
+// CDN handler — re-exported for the studio/template `media/[id]/[filename]/
+// +server.ts` shim. Lives outside `/api` (URLs are baked into published
+// documents, can't move onto the catch-all without breaking links).
+export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
+// Hono API app — exposed so user apps (and tests) can construct or extend
+// the same router the SK catch-all forwards to.
+export { createAphexApi, mountAphexBuiltins, toHonoHandler } from './api/index.js';
 // Schema utilities
 export * from '../schema-utils/index.js';
 // Content hash utilities (server-side)