@aphexcms/cms-core 4.0.0 → 5.0.1

package/dist/lib/server/api/routes/organizations.js

@@ -0,0 +1,99 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { createOrganizationRequest } from '../../../api/schemas/organizations.js';
+export const organizationsRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const memberships = await databaseAdapter.findUserOrganizations(auth.user.id);
+        const organizations = memberships.map((m) => ({
+            id: m.organization.id,
+            name: m.organization.name,
+            slug: m.organization.slug,
+            metadata: m.organization.metadata,
+            role: m.member.role,
+            joinedAt: m.member.createdAt,
+            isActive: m.organization.id === auth.organizationId
+        }));
+        return c.json({ success: true, data: organizations });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to fetch organizations:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to fetch organizations',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/', zValidator('json', createOrganizationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'Organization name and slug are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (auth.user.role !== 'super_admin') {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'Only super admins can create organizations'
+            }, 403);
+        }
+        const body = c.req.valid('json');
+        const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
+        if (existingOrg) {
+            return c.json({
+                success: false,
+                error: 'Slug already exists',
+                message: `Organization with slug '${body.slug}' already exists`
+            }, 409);
+        }
+        const newOrganization = await databaseAdapter.createOrganization({
+            name: body.name,
+            slug: body.slug,
+            metadata: body.metadata || null,
+            parentOrganizationId: auth.organizationId,
+            createdBy: auth.user.id
+        });
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
+        await databaseAdapter.addMember({
+            organizationId: newOrganization.id,
+            userId: auth.user.id,
+            role: 'owner'
+        });
+        await databaseAdapter.updateUserSession(auth.user.id, newOrganization.id);
+        return c.json({ success: true, data: newOrganization }, 201);
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create organization:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to create organization',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});
+//# sourceMappingURL=organizations.js.map

package/dist/lib/server/api/routes/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAG/E,MAAM,CAAC,MAAM,mBAAmB,GAAmB,IAAI,IAAI,EAAY;KACrE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrB,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;YACrB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;YACzB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;YACzB,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ;YACjC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC5B,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,cAAc;SACnD,CAAC,CAAC,CAAC;QAEJ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,IAAI,CACJ,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,yCAAyC;YAClD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4CAA4C;aACrD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,kBAAkB;aAC/D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC;YAChE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,oBAAoB,EAAE,IAAI,CAAC,cAAc;YACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,eAAe,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,SAAS,CAAC;YAC/B,cAAc,EAAE,eAAe,CAAC,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,IAAI,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAE1E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/roles.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Roles router. Combines `/roles` (list, create) and `/roles/:name`
+ * (update, delete) so the wire URLs are
+ * `/api/roles` and `/api/roles/:name`.
+ *
+ * Note: built-in role names cannot be deleted; they're seeded on every
+ * org and a custom row with the same name would be unreachable.
+ */
+export declare const rolesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/lib/server/api/routes/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CAuSpC,CAAC"}

package/dist/lib/server/api/routes/roles.js

@@ -0,0 +1,219 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability, BUILTIN_ROLE_NAMES } from '../../../types/capabilities.js';
+import { createRoleRequest, updateRoleRequest } from '../../../api/schemas/roles.js';
+/**
+ * Roles router. Combines `/roles` (list, create) and `/roles/:name`
+ * (update, delete) so the wire URLs are
+ * `/api/roles` and `/api/roles/:name`.
+ *
+ * Note: built-in role names cannot be deleted; they're seeded on every
+ * org and a custom row with the same name would be unreachable.
+ */
+export const rolesRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const { rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const roles = await rolesService.listRoles(auth.organizationId);
+        return c.json({ success: true, data: roles });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list roles:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to list roles',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/', zValidator('json', createRoleRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'name and capabilities are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const body = c.req.valid('json');
+        if (BUILTIN_ROLE_NAMES.includes(body.name)) {
+            return c.json({
+                success: false,
+                error: 'Reserved name',
+                message: `"${body.name}" is a built-in role name. Edit the existing role instead.`
+            }, 409);
+        }
+        const existing = await databaseAdapter.findRoleByName(auth.organizationId, body.name);
+        if (existing) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: `A role named "${body.name}" already exists in this organization.`
+            }, 409);
+        }
+        const role = await databaseAdapter.createRole({
+            organizationId: auth.organizationId,
+            name: body.name,
+            description: body.description ?? null,
+            capabilities: body.capabilities,
+            isBuiltIn: false
+        });
+        await rolesService.invalidate(auth.organizationId, body.name);
+        return c.json({ success: true, data: role }, 201);
+    }
+    catch (error) {
+        cmsLogger.error('Failed to create role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to create role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .patch('/:name', zValidator('json', updateRoleRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const name = c.req.param('name');
+        if (!name) {
+            return c.json({
+                success: false,
+                error: 'Invalid request',
+                message: 'Role name is required'
+            }, 400);
+        }
+        const body = c.req.valid('json');
+        const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
+        if (!updated) {
+            return c.json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, 404);
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return c.json({ success: true, data: updated });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .delete('/:name', async (c) => {
+    try {
+        const { databaseAdapter, rolesService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!hasCapability(auth, 'role.manage')) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to manage roles'
+            }, 403);
+        }
+        const name = c.req.param('name');
+        if (!name) {
+            return c.json({
+                success: false,
+                error: 'Invalid request',
+                message: 'Role name is required'
+            }, 400);
+        }
+        if (BUILTIN_ROLE_NAMES.includes(name)) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: `"${name}" is a built-in role and cannot be deleted.`
+            }, 403);
+        }
+        const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
+        const inUseByMember = members.some((m) => m.role === name);
+        const invitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
+        const inUseByInvitation = invitations.some((i) => i.role === name && !i.acceptedAt);
+        if (inUseByMember || inUseByInvitation) {
+            return c.json({
+                success: false,
+                error: 'Role in use',
+                message: `Cannot delete "${name}": reassign affected members or invitations first.`
+            }, 409);
+        }
+        const deleted = await databaseAdapter.deleteRole(auth.organizationId, name);
+        if (!deleted) {
+            return c.json({
+                success: false,
+                error: 'Not found',
+                message: `No role named "${name}" in this organization`
+            }, 404);
+        }
+        await rolesService.invalidate(auth.organizationId, name);
+        return c.json({ success: true, message: 'Role deleted' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to delete role:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to delete role',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});
+//# sourceMappingURL=roles.js.map

package/dist/lib/server/api/routes/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmB,IAAI,IAAI,EAAY;KAC7D,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrB,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,IAAI,CACJ,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4CAA4C;aACrD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAK,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,4DAA4D;aAClF,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,wCAAwC;aAC3E,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;YAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,KAAK,CACL,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4CAA4C;aACrD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,uBAAuB;aAChC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kBAAkB,IAAI,wBAAwB;aACvD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4CAA4C;aACrD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,uBAAuB;aAChC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAK,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,IAAI,IAAI,6CAA6C;aAC9D,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3F,MAAM,iBAAiB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAEpF,IAAI,aAAa,IAAI,iBAAiB,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,kBAAkB,IAAI,oDAAoD;aACnF,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kBAAkB,IAAI,wBAAwB;aACvD,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,CAAC"}

package/dist/lib/server/api/routes/schemas.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const schemasRouter: Hono<AphexEnv>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/lib/server/api/routes/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAKzC,eAAO,MAAM,aAAa,EAAE,IAAI,CAAC,QAAQ,CAwBtC,CAAC"}

package/dist/lib/server/api/routes/schemas.js

@@ -0,0 +1,27 @@
+import { Hono } from 'hono';
+import { cmsLogger } from '../../../utils/logger.js';
+// Annotated as Hono<AphexEnv> (not the full chained type) so cms-core's
+// .d.ts emit doesn't blow up under TS7056. Chained-route inference would
+// only matter for hono/client RPC, which is out of scope here.
+export const schemasRouter = new Hono()
+    .get('/', (c) => {
+    const { cmsEngine } = c.var.aphexCMS;
+    // Read from config so validation functions survive (not from DB).
+    const schemas = cmsEngine.config.schemaTypes;
+    return c.json({ success: true, data: schemas });
+})
+    .get('/:type', (c) => {
+    const type = c.req.param('type');
+    const { cmsEngine } = c.var.aphexCMS;
+    if (!type) {
+        return c.json({ error: 'Schema type is required' }, 400);
+    }
+    cmsLogger.debug('GETTING SCHEMA TYPE FROM: ', type);
+    const schema = cmsEngine.getSchemaTypeByName(type);
+    cmsLogger.debug('SCHEMA: ', schema);
+    if (!schema) {
+        return c.json({ error: `Schema type '${type}' not found` }, 404);
+    }
+    return c.json({ success: true, data: schema });
+});
+//# sourceMappingURL=schemas.js.map

package/dist/lib/server/api/routes/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAmB,IAAI,IAAI,EAAY;KAC/D,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;IACf,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,kEAAkE;IAClE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC;KACD,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAErC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnD,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,IAAI,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC"}

package/dist/lib/server/api/routes/user-preferences.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const userPreferencesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=user-preferences.d.ts.map

package/dist/lib/server/api/routes/user-preferences.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-preferences.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user-preferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAkF/C,CAAC"}

package/dist/lib/server/api/routes/user-preferences.js

@@ -0,0 +1,63 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateUserPreferencesRequest } from '../../../api/schemas/user.js';
+export const userPreferencesRouter = new Hono()
+    .get('/cms-preference', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const userProfile = await databaseAdapter.findUserProfileById(auth.user.id);
+        return c.json({ success: true, data: userProfile?.preferences || {} });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to get user preferences:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to get user preferences',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .patch('/cms-preference', zValidator('json', updateUserPreferencesRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'Invalid preference values',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const body = c.req.valid('json');
+        await databaseAdapter.updateUserPreferences(auth.user.id, body);
+        const userProfile = await databaseAdapter.findUserProfileById(auth.user.id);
+        return c.json({ success: true, data: userProfile?.preferences || {} });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update user preferences:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update user preferences',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});
+//# sourceMappingURL=user-preferences.js.map

package/dist/lib/server/api/routes/user-preferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-preferences.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user-preferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAGzE,MAAM,CAAC,MAAM,qBAAqB,GAAmB,IAAI,IAAI,EAAY;KACvE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,gCAAgC;YACvC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC;KACD,KAAK,CACL,iBAAiB,EACjB,UAAU,CAAC,MAAM,EAAE,4BAA4B,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mCAAmC;YAC1C,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/api/routes/user.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * User account routes that delegate to the configured AuthProvider.
+ *
+ * cms-core ships these as Hono routers so studio doesn't need to maintain
+ * SvelteKit `+server.ts` files for them. The wire format and side effects
+ * (e.g. the password-reset email) are owned by the AuthProvider impl —
+ * cms-core's role is just to expose them over HTTP.
+ */
+export declare const userRouter: Hono<AphexEnv>;
+//# sourceMappingURL=user.d.ts.map

package/dist/lib/server/api/routes/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA6IpC,CAAC"}

package/dist/lib/server/api/routes/user.js

@@ -0,0 +1,114 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateUserRequest, requestPasswordResetRequest, resetPasswordRequest } from '../../../api/schemas/user.js';
+/**
+ * User account routes that delegate to the configured AuthProvider.
+ *
+ * cms-core ships these as Hono routers so studio doesn't need to maintain
+ * SvelteKit `+server.ts` files for them. The wire format and side effects
+ * (e.g. the password-reset email) are owned by the AuthProvider impl —
+ * cms-core's role is just to expose them over HTTP.
+ */
+export const userRouter = new Hono()
+    .patch('/', zValidator('json', updateUserRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'name is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const auth = c.var.auth;
+        const provider = c.var.aphexCMS.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        if (!provider) {
+            return c.json({
+                success: false,
+                error: 'Auth provider not configured'
+            }, 500);
+        }
+        const { name } = c.req.valid('json');
+        await provider.changeUserName(auth.user.id, name);
+        return c.json({ success: true, message: 'User updated successfully' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to update user:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to update user',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/request-password-reset', zValidator('json', requestPasswordResetRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'email is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const provider = c.var.aphexCMS.auth;
+        if (!provider) {
+            return c.json({ success: false, error: 'Auth provider not configured' }, 500);
+        }
+        const { email, redirectTo } = c.req.valid('json');
+        await provider.requestPasswordReset(email, redirectTo);
+        // Constant response shape regardless of whether the email exists,
+        // to avoid account enumeration via the API.
+        return c.json({
+            success: true,
+            message: 'If an account exists with that email, a password reset link has been sent'
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to request password reset:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to request password reset',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+})
+    .post('/reset-password', zValidator('json', resetPasswordRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required fields',
+            message: 'token and newPassword are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const provider = c.var.aphexCMS.auth;
+        if (!provider) {
+            return c.json({ success: false, error: 'Auth provider not configured' }, 500);
+        }
+        const { token, newPassword } = c.req.valid('json');
+        await provider.resetPassword(token, newPassword);
+        return c.json({ success: true, message: 'Password reset successfully' });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to reset password:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to reset password',
+            message: error instanceof Error ? error.message : 'Invalid or expired token'
+        }, 500);
+    }
+});
+//# sourceMappingURL=user.js.map

package/dist/lib/server/api/routes/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACN,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AAGnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB,IAAI,IAAI,EAAY;KAC5D,KAAK,CACL,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAErC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8BAA8B;aACrC,EACD,GAAG,CACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,yBAAyB,EACzB,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAEvD,kEAAkE;QAClE,4CAA4C;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD;KACA,IAAI,CACJ,iBAAiB,EACjB,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACX,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAEjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CACZ;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;SAC5E,EACD,GAAG,CACH,CAAC;IACH,CAAC;AACF,CAAC,CACD,CAAC"}

package/dist/lib/server/index.d.ts

@@ -13,7 +13,8 @@ export * from '../storage/providers/storage.js';
 export * from '../services/index.js';
 export { AssetService } from '../services/asset-service.js';
 export { RolesService } from '../services/roles-service.js';
-export * from '../routes-exports.js';
+export { GET as serveAssetCDN } from '../routes/assets-cdn.js';
+export { createAphexApi, mountAphexBuiltins, toHonoHandler, type AphexEnv } from './api/index.js';
 export * from '../schema-utils/index.js';
 export { createHashForPublishing } from '../utils/content-hash.js';
 export { createGraphQLHandler, type GraphQLConfig, type GraphQLSettings, type GraphQLHandlerResult } from '../graphql/index.js';

package/dist/lib/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EACN,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,KAAK,QAAQ,EACb,MAAM,aAAa,CAAC;AAGrB,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC"}