@actuate-media/cms-core 0.83.0 → 0.85.0

package/dist/__tests__/api/collections-discovery.test.js

@@ -1,348 +0,0 @@
-/**
- * Regression tests for the `/api/cms/collections` discovery endpoint
- * shipped in PR F (Phase 7 — MCP-parity stylistic cleanup).
- *
- * Purpose: enumerate the configured collections without relying on the
- * OpenAPI generator, which has historically drifted out of sync with
- * the admin-visible surface. The endpoint is unauthenticated by design
- * — the response contains schema-shape metadata that is already public
- * via `/openapi.json` — but we test that contract here so a future
- * change can't silently widen it.
- */
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { setActuateConfig } from '../../config/runtime.js';
-const SECRET = 'test-secret-collections-discovery-pr-f-12345';
-describe('GET /api/cms/collections (PR F discovery endpoint)', () => {
-    // Snapshot every env var any test in this file touches so we can
-    // restore them in `afterEach`. Mirrors the pattern in health.test.ts —
-    // PR #155 review (Bugbot) caught that the prior implementation set
-    // CMS_SECRET in beforeEach but never restored it, leaking state into
-    // any other test that runs after this file.
-    const original = {
-        CMS_SECRET: process.env.CMS_SECRET,
-        CMS_SESSION_SECRET: process.env.CMS_SESSION_SECRET,
-    };
-    beforeEach(() => {
-        process.env.CMS_SECRET = SECRET;
-        delete process.env.CMS_SESSION_SECRET;
-    });
-    afterEach(() => {
-        for (const [k, v] of Object.entries(original)) {
-            if (v === undefined)
-                delete process.env[k];
-            else
-                process.env[k] = v;
-        }
-        delete globalThis.__actuateConfig;
-    });
-    function makeHandler() {
-        setActuateConfig({
-            secret: SECRET,
-            collections: {
-                posts: {
-                    slug: 'posts',
-                    labels: { singular: 'Post', plural: 'Posts' },
-                    type: 'post',
-                    urlPrefix: 'blog',
-                    fields: {
-                        title: { type: 'text', required: true },
-                        body: { type: 'richText' },
-                        author: { type: 'relationship', relationTo: 'users' },
-                    },
-                },
-                pages: {
-                    slug: 'pages',
-                    labels: { singular: 'Page', plural: 'Pages' },
-                    type: 'page',
-                    fields: {
-                        title: { type: 'text', required: true },
-                        slug: { type: 'slug', required: true },
-                    },
-                },
-                hidden_internal: {
-                    slug: 'hidden_internal',
-                    labels: { singular: 'Internal', plural: 'Internal' },
-                    fields: { name: { type: 'text' } },
-                    admin: { hidden: true },
-                },
-            },
-        });
-        return handleActuateAPI({ prismaClient: {} });
-    }
-    it('returns one entry per configured collection with field summaries', async () => {
-        const handler = makeHandler();
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        expect(response.status).toBe(200);
-        const payload = (await response.json());
-        expect(payload.data).toHaveLength(3);
-        const bySlug = new Map(payload.data.map((c) => [c.slug, c]));
-        const posts = bySlug.get('posts');
-        expect(posts.labels).toEqual({ singular: 'Post', plural: 'Posts' });
-        expect(posts.type).toBe('post');
-        expect(posts.fieldCount).toBe(3);
-        expect(posts.fields).toEqual(expect.arrayContaining([
-            { name: 'title', type: 'text', required: true },
-            { name: 'body', type: 'richText', required: false },
-            // Relationship fields now surface their target collection so an agent
-            // can resolve slugs against it (WS-C C2).
-            { name: 'author', type: 'relationship', required: false, relationTo: 'users' },
-        ]));
-        const pages = bySlug.get('pages');
-        expect(pages.type).toBe('page');
-        expect(pages.fieldCount).toBe(2);
-        expect(pages.fields.find((f) => f.name === 'title')?.required).toBe(true);
-    });
-    it('surfaces admin.hidden as `hidden: true` so agents can choose to skip them', async () => {
-        // Internal collections should still be discoverable — the agent
-        // might legitimately want to read from them — but the flag lets
-        // the agent down-rank them in its planning.
-        const handler = makeHandler();
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        const payload = (await response.json());
-        const hiddenEntry = payload.data.find((c) => c.slug === 'hidden_internal');
-        expect(hiddenEntry?.hidden).toBe(true);
-        const postsEntry = payload.data.find((c) => c.slug === 'posts');
-        expect(postsEntry?.hidden).toBe(false);
-    });
-    it('returns 500 when no CMS config is registered (deploy misconfig)', async () => {
-        // Defensive: route must error loudly when getActuateConfig() is
-        // missing instead of returning `{ data: [] }`, which would lie to
-        // the MCP fallback chain about the server's actual state.
-        const handler = handleActuateAPI({ prismaClient: {} });
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        expect(response.status).toBe(500);
-    });
-    it('surfaces admin.description / icon / color / group for the Posts admin area', async () => {
-        // The Posts dashboard area renders per-collection cards that need
-        // these visual hints (icon, accent color, description) plus the
-        // grouping marker. Locking the contract here keeps the admin
-        // client and server in sync — if a field is renamed server-side,
-        // the test catches it before /posts/types renders empty cards.
-        setActuateConfig({
-            secret: SECRET,
-            collections: {
-                blog: {
-                    slug: 'blog',
-                    labels: { singular: 'Blog Post', plural: 'Blog' },
-                    type: 'post',
-                    urlPrefix: 'blog',
-                    fields: { title: { type: 'text', required: true } },
-                    admin: {
-                        group: 'Posts',
-                        description: 'Blog posts and articles.',
-                        icon: 'file-text',
-                        color: 'purple',
-                    },
-                },
-                pages: {
-                    slug: 'pages',
-                    labels: { singular: 'Page', plural: 'Pages' },
-                    type: 'page',
-                    fields: { title: { type: 'text', required: true } },
-                },
-            },
-        });
-        const handler = handleActuateAPI({ prismaClient: {} });
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        const payload = (await response.json());
-        const blog = payload.data.find((c) => c.slug === 'blog');
-        expect(blog.description).toBe('Blog posts and articles.');
-        expect(blog.icon).toBe('file-text');
-        expect(blog.color).toBe('purple');
-        expect(blog.group).toBe('Posts');
-        expect(blog.urlPrefix).toBe('blog');
-        // Collections without admin metadata should emit `null` (not
-        // `undefined`) so the wire shape stays JSON-stable.
-        const pages = payload.data.find((c) => c.slug === 'pages');
-        expect(pages.description).toBeNull();
-        expect(pages.icon).toBeNull();
-        expect(pages.color).toBeNull();
-        expect(pages.group).toBeNull();
-    });
-    it('does not leak deeper schema (validators, hooks, access functions)', async () => {
-        // The response is unauthenticated — field-level validators or
-        // access functions could include source pointers / closure state
-        // that mustn't ship in the public surface. Keep the contract tight:
-        // every field always carries `name`/`type`/`required`, and may ONLY
-        // additionally carry the relationship-resolver hints (`relationTo`,
-        // `hasMany`, `options`) plus the WS-B4 nested-schema keys (`fields`,
-        // `minRows`, `maxRows`, `blocks`). Anything else is a leak. The walk is
-        // recursive so nested array/blocks subfields are held to the same bar.
-        const ALLOWED_FIELD_KEYS = new Set([
-            'name',
-            'type',
-            'required',
-            'relationTo',
-            'hasMany',
-            'options',
-            'fields',
-            'minRows',
-            'maxRows',
-            'blocks',
-        ]);
-        const ALLOWED_BLOCK_KEYS = new Set(['slug', 'label', 'fields']);
-        function assertFieldClean(field) {
-            expect(field).toHaveProperty('name');
-            expect(field).toHaveProperty('type');
-            expect(field).toHaveProperty('required');
-            for (const key of Object.keys(field)) {
-                expect(ALLOWED_FIELD_KEYS.has(key)).toBe(true);
-            }
-            if (Array.isArray(field.fields)) {
-                for (const sub of field.fields)
-                    assertFieldClean(sub);
-            }
-            if (Array.isArray(field.blocks)) {
-                for (const block of field.blocks) {
-                    for (const key of Object.keys(block)) {
-                        expect(ALLOWED_BLOCK_KEYS.has(key)).toBe(true);
-                    }
-                    for (const sub of block.fields ?? []) {
-                        assertFieldClean(sub);
-                    }
-                }
-            }
-        }
-        // Config exercises array + blocks so the recursive guard actually runs.
-        setActuateConfig({
-            secret: SECRET,
-            collections: {
-                landing: {
-                    slug: 'landing',
-                    labels: { singular: 'Landing', plural: 'Landing' },
-                    type: 'page',
-                    fields: {
-                        title: { type: 'text', required: true },
-                        features: {
-                            type: 'array',
-                            fields: { heading: { type: 'text' }, icon: { type: 'text' } },
-                        },
-                        layout: {
-                            type: 'blocks',
-                            blocks: [
-                                {
-                                    slug: 'hero',
-                                    labels: { singular: 'Hero', plural: 'Heroes' },
-                                    fields: { headline: { type: 'text' } },
-                                },
-                            ],
-                        },
-                    },
-                },
-            },
-        });
-        const handler = handleActuateAPI({ prismaClient: {} });
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        const payload = (await response.json());
-        for (const collection of payload.data) {
-            for (const field of collection.fields)
-                assertFieldClean(field);
-        }
-    });
-    it('surfaces array element subfields and blocks variant subfields (WS-B4)', async () => {
-        // An agent planning a deep create needs the shape of each array row and
-        // each block variant — not just `type: 'array'`. Lock the recursive
-        // contract so a refactor can't silently flatten it back to top-level only.
-        setActuateConfig({
-            secret: SECRET,
-            collections: {
-                landing: {
-                    slug: 'landing',
-                    labels: { singular: 'Landing', plural: 'Landing' },
-                    type: 'page',
-                    fields: {
-                        gallery: {
-                            type: 'array',
-                            minRows: 1,
-                            maxRows: 8,
-                            fields: {
-                                image: { type: 'media', required: true },
-                                caption: { type: 'text' },
-                            },
-                        },
-                        layout: {
-                            type: 'blocks',
-                            blocks: [
-                                {
-                                    slug: 'hero',
-                                    labels: { singular: 'Hero', plural: 'Heroes' },
-                                    fields: { headline: { type: 'text', required: true } },
-                                },
-                                {
-                                    slug: 'cta',
-                                    labels: { singular: 'CTA', plural: 'CTAs' },
-                                    fields: { url: { type: 'url' } },
-                                },
-                            ],
-                        },
-                    },
-                },
-            },
-        });
-        const handler = handleActuateAPI({ prismaClient: {} });
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        const payload = (await response.json());
-        const landing = payload.data.find((c) => c.slug === 'landing');
-        const byField = new Map(landing.fields.map((f) => [f.name, f]));
-        const gallery = byField.get('gallery');
-        expect(gallery.type).toBe('array');
-        expect(gallery.minRows).toBe(1);
-        expect(gallery.maxRows).toBe(8);
-        const galleryFields = new Map((gallery.fields ?? []).map((f) => [f.name, f]));
-        expect(galleryFields.get('image')).toEqual({ name: 'image', type: 'media', required: true });
-        expect(galleryFields.get('caption')?.required).toBe(false);
-        const layout = byField.get('layout');
-        expect(layout.type).toBe('blocks');
-        expect(layout.blocks).toHaveLength(2);
-        const hero = layout.blocks.find((b) => b.slug === 'hero');
-        expect(hero.label).toBe('Hero');
-        expect(hero.fields.find((f) => f.name === 'headline')?.required).toBe(true);
-        const cta = layout.blocks.find((b) => b.slug === 'cta');
-        expect(cta.fields.map((f) => f.name)).toEqual(['url']);
-    });
-    it('surfaces relationTo / hasMany / select options for the relationship resolver (WS-C C2)', async () => {
-        // The MCP relationship-resolver tools (get_relationship_fields,
-        // resolve_relationship) depend on the discovery endpoint exposing where a
-        // relationship field points and the enum choices for a select field. Lock
-        // the contract so a future refactor can't silently drop these.
-        setActuateConfig({
-            secret: SECRET,
-            collections: {
-                articles: {
-                    slug: 'articles',
-                    labels: { singular: 'Article', plural: 'Articles' },
-                    type: 'post',
-                    fields: {
-                        author: { type: 'relationship', relationTo: 'team' },
-                        related: { type: 'relationship', relationTo: ['posts', 'case-studies'], hasMany: true },
-                        hero: { type: 'media' },
-                        status: {
-                            type: 'select',
-                            options: [
-                                { label: 'News', value: 'news' },
-                                { label: 'Guide', value: 'guide' },
-                            ],
-                        },
-                    },
-                },
-            },
-        });
-        const handler = handleActuateAPI({ prismaClient: {} });
-        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
-        const payload = (await response.json());
-        const articles = payload.data.find((c) => c.slug === 'articles');
-        const byName = new Map(articles.fields.map((f) => [f.name, f]));
-        expect(byName.get('author')?.relationTo).toBe('team');
-        expect(byName.get('author')?.hasMany).toBeUndefined();
-        expect(byName.get('related')?.relationTo).toEqual(['posts', 'case-studies']);
-        expect(byName.get('related')?.hasMany).toBe(true);
-        // Media fields have no relationTo (the media store is implicit).
-        expect(byName.get('hero')?.relationTo).toBeUndefined();
-        expect(byName.get('status')?.options).toEqual([
-            { label: 'News', value: 'news' },
-            { label: 'Guide', value: 'guide' },
-        ]);
-    });
-});
-//# sourceMappingURL=collections-discovery.test.js.map

package/dist/__tests__/api/collections-discovery.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"collections-discovery.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/collections-discovery.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,MAAM,MAAM,GAAG,8CAA8C,CAAA;AAE7D,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,qEAAqE;IACrE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;KACnD,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,CAAA;;gBAC9D,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,OAAQ,UAA4C,CAAC,eAAe,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,SAAS,WAAW;QAClB,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE;wBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;wBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE;qBACtD;iBACF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;qBACvC;iBACF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;oBACpD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;oBAClC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB;aACF;SACO,CAAC,CAAA;QACX,OAAO,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CASrC,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAE5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAC1B,MAAM,CAAC,eAAe,CAAC;YACrB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;YACnD,sEAAsE;YACtE,0CAA0C;YAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SAC/E,CAAC,CACH,CAAA;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,gEAAgE;QAChE,gEAAgE;QAChE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAErC,CAAA;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAA;QAC1E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;QAC/D,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,gEAAgE;QAChE,kEAAkE;QAClE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,+DAA+D;QAC/D,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;oBACjD,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;oBACnD,KAAK,EAAE;wBACL,KAAK,EAAE,OAAO;wBACd,WAAW,EAAE,0BAA0B;wBACvC,IAAI,EAAE,WAAW;wBACjB,KAAK,EAAE,QAAQ;qBAChB;iBACF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;iBACpD;aACF;SACO,CAAC,CAAA;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CASrC,CAAA;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAEnC,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC7B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,8DAA8D;QAC9D,iEAAiE;QACjE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;YACjC,MAAM;YACN,MAAM;YACN,UAAU;YACV,YAAY;YACZ,SAAS;YACT,SAAS;YACT,QAAQ;YACR,SAAS;YACT,SAAS;YACT,QAAQ;SACT,CAAC,CAAA;QACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QAE/D,SAAS,gBAAgB,CAAC,KAA8B;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChD,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM;oBAAE,gBAAgB,CAAC,GAA8B,CAAC,CAAA;YAClF,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAwC,EAAE,CAAC;oBACnE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAChD,CAAC;oBACD,KAAK,MAAM,GAAG,IAAK,KAAK,CAAC,MAAyC,IAAI,EAAE,EAAE,CAAC;wBACzE,gBAAgB,CAAC,GAAG,CAAC,CAAA;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;oBAClD,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,QAAQ,EAAE;4BACR,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;yBAC9D;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE;gCACN;oCACE,IAAI,EAAE,MAAM;oCACZ,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;oCAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;iCACvC;6BACF;yBACF;qBACF;iBACF;aACF;SACO,CAAC,CAAA;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAErC,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM;gBAAE,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,wEAAwE;QACxE,oEAAoE;QACpE,2EAA2E;QAC3E,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;oBAClD,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,CAAC;4BACV,OAAO,EAAE,CAAC;4BACV,MAAM,EAAE;gCACN,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;gCACxC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;6BAC1B;yBACF;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE;gCACN;oCACE,IAAI,EAAE,MAAM;oCACZ,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;oCAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;iCACvD;gCACD;oCACE,IAAI,EAAE,KAAK;oCACX,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;oCAC3C,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;iCACjC;6BACF;yBACF;qBACF;iBACF;aACF;SACO,CAAC,CAAA;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAgBrC,CAAA;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAE,CAAA;QAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAE/D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAE,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAA;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAE,CAAA;QACzD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,gEAAgE;QAChE,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,QAAQ,EAAE;oBACR,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE;oBACnD,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE;wBACpD,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;wBACvF,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;wBACvB,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE;gCACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gCAChC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;6BACnC;yBACF;qBACF;iBACF;aACF;SACO,CAAC,CAAA;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAWrC,CAAA;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAA;QACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAE/D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;QAErD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEjD,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,aAAa,EAAE,CAAA;QAEtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;YAC5C,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;YAChC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SACnC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/comments-routes.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=comments-routes.test.d.ts.map

package/dist/__tests__/api/comments-routes.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"comments-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/comments-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/comments-routes.test.js

@@ -1,266 +0,0 @@
-import { beforeEach, describe, expect, it } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { createSession } from '../../auth/session.js';
-import { initDB } from '../../db.js';
-import { generateToken as generateCsrfToken } from '../../security/csrf.js';
-/**
- * Integration tests for the comment REST endpoints introduced in slice 4
- * of Phase 3. The point of these tests is to exercise the *handler* layer
- * end-to-end (auth, CSRF, JSON envelopes, status code mapping) — the pure
- * service logic is covered by `realtime/comments.test.ts`.
- *
- * We back the mock DB with a tiny in-memory implementation of the subset
- * of Prisma we use, so the routes execute against real-ish data without a
- * Postgres instance.
- */
-const SECRET = 'test-secret-for-comments-routes-1234567890abcd';
-function createMockDB() {
-    const rows = new Map();
-    let counter = 0;
-    return {
-        rows,
-        session: {
-            findUnique: async () => ({ revokedAt: null }),
-        },
-        user: {},
-        media: {},
-        documentComment: {
-            async findUnique({ where }) {
-                return rows.get(where.id) ?? null;
-            },
-            async findMany({ where, orderBy, take, }) {
-                let r = Array.from(rows.values()).filter((row) => {
-                    if (where.documentId !== undefined && row.documentId !== where.documentId)
-                        return false;
-                    if (Object.prototype.hasOwnProperty.call(where, 'resolvedAt') && row.resolvedAt !== null)
-                        return false;
-                    if (Object.prototype.hasOwnProperty.call(where, 'deletedAt') && row.deletedAt !== null)
-                        return false;
-                    return true;
-                });
-                if (orderBy?.createdAt === 'asc') {
-                    r = r.sort((a, b) => {
-                        const ax = a.createdAt instanceof Date ? a.createdAt.getTime() : 0;
-                        const bx = b.createdAt instanceof Date ? b.createdAt.getTime() : 0;
-                        return ax - bx;
-                    });
-                }
-                if (typeof take === 'number')
-                    r = r.slice(0, take);
-                return r;
-            },
-            async create({ data, }) {
-                counter += 1;
-                const now = new Date(Date.UTC(2026, 5, 1, 0, 0, counter));
-                const row = {
-                    id: `c-${counter}`,
-                    documentId: data.documentId,
-                    parentId: data.parentId,
-                    userId: data.userId,
-                    body: data.body,
-                    anchor: data.anchor,
-                    resolvedAt: null,
-                    resolvedById: null,
-                    deletedAt: null,
-                    createdAt: now,
-                    updatedAt: now,
-                };
-                rows.set(row.id, row);
-                return row;
-            },
-            async update({ where, data }) {
-                const existing = rows.get(where.id);
-                if (!existing)
-                    throw new Error(`row ${where.id} not found`);
-                const next = {
-                    ...existing,
-                    ...data,
-                    updatedAt: new Date(),
-                };
-                rows.set(where.id, next);
-                return next;
-            },
-        },
-        auditLog: {
-            // logEvent does fire-and-forget writes; we just accept anything.
-            create: async () => ({}),
-        },
-    };
-}
-async function sessionHeaders(role, userId = 'user-1') {
-    const token = await createSession({ userId, role, sessionId: `session-${userId}` }, { secret: SECRET });
-    const csrf = await generateCsrfToken();
-    return {
-        cookie: `actuate_session=${token}; actuate_csrf=${csrf}`,
-        'x-csrf-token': csrf,
-        'content-type': 'application/json',
-    };
-}
-describe('comments REST endpoints (Phase 3 slice 4)', () => {
-    let db;
-    let handler;
-    beforeEach(() => {
-        process.env.CMS_SECRET = SECRET;
-        db = createMockDB();
-        initDB(db);
-        handler = handleActuateAPI({ prismaClient: db });
-    });
-    it('rejects unauthenticated POST', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            // No session cookie — auth should reject before CSRF runs.
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ body: 'hi' }),
-        }));
-        // CSRF runs *before* auth, so an unauthenticated POST without a CSRF
-        // token returns 403 instead of 401. Either status is fine for this
-        // test — we just want to confirm anonymous writes are blocked.
-        expect([401, 403]).toContain(res.status);
-    });
-    it('requires write role for POST', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers: await sessionHeaders('VIEWER'),
-            body: JSON.stringify({ body: 'hi' }),
-        }));
-        expect(res.status).toBe(403);
-    });
-    it('creates a top-level comment for an editor', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers: await sessionHeaders('EDITOR'),
-            body: JSON.stringify({ body: 'Looks great!', anchor: { from: 'AQ==', to: 'Ag==' } }),
-        }));
-        expect(res.status).toBe(201);
-        const json = (await res.json());
-        expect(json.data.body).toBe('Looks great!');
-        expect(json.data.anchor).toEqual({ from: 'AQ==', to: 'Ag==' });
-    });
-    it('returns 400 on empty body', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers: await sessionHeaders('EDITOR'),
-            body: JSON.stringify({ body: '   ' }),
-        }));
-        expect(res.status).toBe(400);
-    });
-    it('lists active comments only by default', async () => {
-        const headers = await sessionHeaders('EDITOR');
-        await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ body: 'open one' }),
-        }));
-        const createRes = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ body: 'will resolve' }),
-        }));
-        const created = (await createRes.json());
-        await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}/resolve`, {
-            method: 'POST',
-            headers,
-        }));
-        const listRes = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            headers: { cookie: headers.cookie },
-        }));
-        expect(listRes.status).toBe(200);
-        const list = (await listRes.json());
-        expect(list.data.map((c) => c.body)).toEqual(['open one']);
-        const listAll = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeResolved=true', {
-            headers: { cookie: headers.cookie },
-        }));
-        const allBodies = (await listAll.json()).data.map((c) => c.body);
-        expect(allBodies).toContain('will resolve');
-    });
-    it('blocks includeDeleted for non-admins', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeDeleted=true', {
-            headers: { cookie: (await sessionHeaders('EDITOR')).cookie },
-        }));
-        expect(res.status).toBe(403);
-    });
-    it('lets admins request includeDeleted', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeDeleted=true', {
-            headers: { cookie: (await sessionHeaders('ADMIN')).cookie },
-        }));
-        expect(res.status).toBe(200);
-    });
-    it('allows the author to edit but blocks other editors', async () => {
-        const authorHeaders = await sessionHeaders('EDITOR', 'user-1');
-        const otherHeaders = await sessionHeaders('EDITOR', 'user-2');
-        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers: authorHeaders,
-            body: JSON.stringify({ body: 'mine' }),
-        }));
-        const created = (await create.json());
-        const evil = await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}`, {
-            method: 'PATCH',
-            headers: otherHeaders,
-            body: JSON.stringify({ body: 'tampered' }),
-        }));
-        expect(evil.status).toBe(403);
-        const good = await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}`, {
-            method: 'PATCH',
-            headers: authorHeaders,
-            body: JSON.stringify({ body: 'fixed' }),
-        }));
-        expect(good.status).toBe(200);
-        const dto = (await good.json());
-        expect(dto.data.body).toBe('fixed');
-    });
-    it('resolves and re-opens a thread, then soft-deletes it', async () => {
-        const headers = await sessionHeaders('EDITOR');
-        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ body: 'thread' }),
-        }));
-        const { data } = (await create.json());
-        const resolved = await handler(new Request(`https://example.com/api/cms/comments/${data.id}/resolve`, {
-            method: 'POST',
-            headers,
-        }));
-        expect(resolved.status).toBe(200);
-        const resolvedDto = (await resolved.json());
-        expect(resolvedDto.data.isResolved).toBe(true);
-        const reopened = await handler(new Request(`https://example.com/api/cms/comments/${data.id}/reopen`, {
-            method: 'POST',
-            headers,
-        }));
-        expect(reopened.status).toBe(200);
-        const deleted = await handler(new Request(`https://example.com/api/cms/comments/${data.id}`, {
-            method: 'DELETE',
-            headers,
-        }));
-        expect(deleted.status).toBe(200);
-        const deletedDto = (await deleted.json());
-        expect(deletedDto.data.deletedAt).not.toBeNull();
-    });
-    it('returns 404 when patching a missing comment', async () => {
-        const res = await handler(new Request('https://example.com/api/cms/comments/does-not-exist', {
-            method: 'PATCH',
-            headers: await sessionHeaders('EDITOR'),
-            body: JSON.stringify({ body: 'ghost' }),
-        }));
-        expect(res.status).toBe(404);
-    });
-    it('threads a reply through the create endpoint', async () => {
-        const headers = await sessionHeaders('EDITOR');
-        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ body: 'root' }),
-        }));
-        const root = (await create.json()).data;
-        const reply = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ body: 'reply', parentId: root.id }),
-        }));
-        expect(reply.status).toBe(201);
-        const replyDto = (await reply.json());
-        expect(replyDto.data.parentId).toBe(root.id);
-    });
-});
-//# sourceMappingURL=comments-routes.test.js.map