@aotter/mantle-cloudflare 0.0.11-alpha.73 → 0.1.0-alpha.2

package/dist/mount/mountServerEndpoints.js

@@ -1,16 +1,16 @@
-import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, redactForWire, runtimeDiagnostic, } from "@aotter/mantle-spec";
+import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, meetsRole, redactForWire, runtimeDiagnostic, checkSchemaListFilter, schemaSortableFields, } from "@aotter/mantle-spec";
 import { ViewParamCoercionError, coerceViewParams, compilePathMatcher, evaluateAuthAll, } from "@aotter/mantle-runtime";
 import { indexHtml } from "@aotter/mantle-admin-ui";
 import { resolveCaller } from "./resolveCaller.js";
 import { runMantleUseCase } from "./runMantleUseCase.js";
-import { STAFF_ROLE_SET } from "../auth/createAuth.js";
+import { decodeMemberCursor, STAFF_ROLE_SET, } from "../auth/createAuth.js";
+import { rejectCrossOriginMutation } from "../auth/rejectCrossOriginMutation.js";
 import { AOTTER_FAVICON_SVG } from "../assets/aotterFavicon.js";
 const [PAGE_PARAM, SHOW_PARAM] = VIEW_PARAMS_RESERVED;
 /** Mount HTTP Triggers + Views + the Better Auth admin surface.
- *  HTTP Trigger bearer-token authentication is delegated to the OAuth
- *  provider lib (via `createMcpApiHandler`) — if a Trigger needs
- *  identity, route it under an MCP `apiHandler` instead of a Hono
- *  catch-all. */
+ *  HTTP Triggers resolve configured credentials and sessions through
+ *  `resolveCaller`; the target Procedure's `requires.auth` owns
+ *  authorization. */
 export function mountServerEndpoints(app, ref) {
     for (const t of ref.manifests) {
         if (t.kind !== "Trigger")
@@ -89,10 +89,10 @@ function mountAdminBetterAuth(app, ref, auth) {
         "/admin/c/:collection",
         "/admin/c/:collection/:id",
         "/admin/media",
-        "/admin/approvals",
         "/admin/preferences",
         "/admin/settings",
         "/admin/staff",
+        "/admin/members",
         "/admin/ops",
         "/admin/views/:name",
     ]) {
@@ -146,19 +146,47 @@ function mountAdminBetterAuth(app, ref, auth) {
             return body(c, gate);
         });
     };
-    // Staff management is owner-only — a step above `guarded` (any
-    // staff). Role semantics follow StaffRoleHierarchy: only `owner`
-    // "manages staff".
-    const ownerGuarded = (method, path, body) => {
+    const roleGuarded = (method, path, minimumRole, body) => {
         guarded(method, path, (c, gate) => {
-            if (gate.role !== "owner")
-                return adminNotOwner(c, path);
+            if (!meetsRole(gate.role, minimumRole)) {
+                return adminInsufficientRole(c, path, minimumRole);
+            }
             return body(c, gate);
         });
     };
-    guarded("get", "/admin/api/me", (_c, gate) => Response.json({ login: gate.login, role: gate.role, userId: gate.userId }));
-    ownerGuarded("get", "/admin/api/staff", async () => Response.json({ users: await auth.listUsers() }));
-    ownerGuarded("patch", "/admin/api/staff/:id/role", async (c, gate) => {
+    guarded("get", "/admin/api/me", (_c, gate) => Response.json({ login: gate.login, role: gate.role, userId: gate.userId, image: gate.image }));
+    roleGuarded("get", "/admin/api/staff", "owner", async () => Response.json({ users: await auth.listUsers() }));
+    roleGuarded("get", "/admin/api/members", "editor", async (c) => {
+        const rawLimit = c.req.query("limit");
+        const limit = rawLimit === undefined ? 50 : Number(rawLimit);
+        const cursor = c.req.query("cursor") || undefined;
+        const search = c.req.query("search")?.trim() || undefined;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100 ||
+            (cursor && !decodeMemberCursor(cursor)) || (search?.length ?? 0) > 200) {
+            return Response.json({
+                ok: false,
+                diagnostic: runtimeDiagnostic({
+                    code: "INPUT_VALIDATION_FAILED",
+                    severity: "error",
+                    path: "GET /admin/api/members",
+                    expected: "limit 1..100, a valid cursor, and search up to 200 characters",
+                    message: "Member list parameters are invalid.",
+                }),
+            }, { status: 400 });
+        }
+        const result = await auth.listMembers({
+            limit,
+            search,
+            cursor,
+            cursorDirection: c.req.query("cursor_direction") === "backward" ? "backward" : "forward",
+        });
+        return Response.json({
+            items: result.items,
+            previous_cursor: result.previousCursor,
+            next_cursor: result.nextCursor,
+        });
+    });
+    roleGuarded("patch", "/admin/api/staff/:id/role", "owner", async (c, gate) => {
         const userId = c.req.param("id") ?? "";
         const body = (await c.req.raw.json().catch(() => ({})));
         const role = body.role === null ? null : typeof body.role === "string" ? body.role : undefined;
@@ -204,7 +232,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         }
         return Response.json({ ok: true });
     });
-    ownerGuarded("post", "/admin/api/staff/invitations", async (c) => {
+    roleGuarded("post", "/admin/api/staff/invitations", "owner", async (c, gate) => {
         const body = (await c.req.raw.json().catch(() => ({})));
         const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
         const role = typeof body.role === "string" ? body.role : "";
@@ -222,21 +250,23 @@ function mountAdminBetterAuth(app, ref, auth) {
         }
         const result = await auth.inviteUser(email, role);
         if (result.kind === "exists") {
-            return Response.json({
-                ok: false,
-                userId: result.id,
-                diagnostic: runtimeDiagnostic({
-                    code: "CONFLICT",
-                    severity: "error",
-                    path: "POST /admin/api/staff/invitations",
-                    expected: "an email without an existing user row",
-                    message: "That email already has an account — adjust its role in the staff list instead.",
-                }),
-            }, { status: 409 });
+            if (result.id === gate.userId) {
+                return Response.json({
+                    ok: false,
+                    diagnostic: runtimeDiagnostic({
+                        code: "AUTH_DENIED",
+                        severity: "error",
+                        path: "POST /admin/api/staff/invitations",
+                        expected: "an email other than the caller's",
+                        message: "You cannot change your own role.",
+                    }),
+                }, { status: 403 });
+            }
+            await auth.setUserRole(result.id, role);
         }
         return Response.json({ ok: true, userId: result.id });
     });
-    ownerGuarded("delete", "/admin/api/staff/invitations/:id", async (c) => {
+    roleGuarded("delete", "/admin/api/staff/invitations/:id", "owner", async (c) => {
         const revoked = await auth.revokeInvite(c.req.param("id") ?? "");
         if (!revoked) {
             return Response.json({
@@ -267,8 +297,8 @@ function mountAdminBetterAuth(app, ref, auth) {
             return handleViewRequest(c.req.raw, runtime, viewName, ref, c.env, waitUntil, "/admin/api/views");
         });
     }
-    guarded("get", "/admin/api/operations", () => Response.json({
-        operations: operations.map((op) => ({
+    guarded("get", "/admin/api/operations", (c, gate) => Response.json({
+        operations: operations.filter((op) => evaluateAuthAll(op.procedure.spec.requires, adminHandlerContext(c, gate), `GET /admin/api/operations/${op.name}`, "runtime") === null).map((op) => ({
             name: op.name,
             title: op.title,
             description: op.description,
@@ -315,19 +345,19 @@ function mountAdminBetterAuth(app, ref, auth) {
     });
     guarded("get", "/admin/api/site", async (c) => {
         const runtime = await ref.get();
-        const site = await runtime.siteConfig.load();
-        const url = new URL(c.req.url);
+        const { origin, ...site } = await runtime.siteConfig.load();
+        const publicUrl = origin || new URL(c.req.url).origin;
         return Response.json({
             ...site,
-            publicUrl: site.origin || url.origin,
-            mcpUrl: `${url.origin}/mcp/staff`,
+            publicUrl,
+            mcpUrl: `${publicUrl}/mcp/staff`,
         });
     });
-    guarded("get", "/admin/api/site-settings", async () => runMantleUseCase("GET /admin/api/site-settings", async () => {
+    roleGuarded("get", "/admin/api/site-settings", "owner", async () => runMantleUseCase("GET /admin/api/site-settings", async () => {
         const runtime = await ref.get();
         return adminSiteSettings(await runtime.siteConfig.load());
     }));
-    guarded("patch", "/admin/api/site-settings", async (c) => runMantleUseCase("PATCH /admin/api/site-settings", async () => {
+    roleGuarded("patch", "/admin/api/site-settings", "owner", async (c) => runMantleUseCase("PATCH /admin/api/site-settings", async () => {
         const runtime = await ref.get();
         const body = (await c.req.raw.json().catch(() => ({})));
         const site = await runtime.updateSiteSettings.execute({
@@ -357,6 +387,21 @@ function mountAdminBetterAuth(app, ref, auth) {
         const rawLimit = c.req.query("limit");
         const parsedLimit = rawLimit ? Number.parseInt(rawLimit, 10) : NaN;
         const statusQuery = c.req.query("status");
+        const sortDirection = c.req.query("direction") === "asc" ? "asc" : "desc";
+        const filterField = c.req.query("filter_field");
+        const filterValue = c.req.query("filter_value");
+        if (Boolean(filterField) !== Boolean(filterValue)) {
+            return Response.json({
+                ok: false,
+                diagnostic: runtimeDiagnostic({
+                    code: "INPUT_VALIDATION_FAILED",
+                    severity: "error",
+                    path: "GET /admin/api/entries",
+                    expected: "filter_field and filter_value together",
+                    message: "List filters require both `filter_field` and `filter_value`.",
+                }),
+            }, { status: 400 });
+        }
         // Admin pagination needs the cursored shape — `executePage` returns
         // `{ rows, nextCursor? }`. `execute()` is the flat-array variant
         // for app code.
@@ -365,10 +410,57 @@ function mountAdminBetterAuth(app, ref, auth) {
             status: statusQuery && statusQuery !== "all" ? statusQuery : undefined,
             limit: Number.isFinite(parsedLimit) ? parsedLimit : 99,
             cursor: c.req.query("cursor") ?? undefined,
+            cursorDirection: c.req.query("cursor_direction") === "backward" ? "backward" : "forward",
             search: c.req.query("search") || undefined,
+            filter: filterField && filterValue
+                ? { field: filterField, value: filterValue }
+                : undefined,
+            sort: {
+                field: c.req.query("sort") || "updatedAt",
+                direction: sortDirection,
+            },
+        });
+        const translationLocales = new Map();
+        const translationSchemas = schemas.filter((schema) => schema.spec.translates?.parent === collection);
+        for (const schema of translationSchemas) {
+            const field = schema.spec.translates.on;
+            const parentValues = new Map();
+            for (const row of result.rows) {
+                const value = primitiveJoinValue(row.data[field]);
+                if (value !== null)
+                    parentValues.set(joinValueKey(value), value);
+            }
+            const translations = await runtime.entryReader.readByDataFieldIn({
+                collection: schema.metadata.name,
+                field,
+                values: [...parentValues.values()],
+            });
+            const localesByValue = new Map();
+            for (const entry of translations) {
+                const value = primitiveJoinValue(entry.data[field]);
+                if (value === null || !entry.locale)
+                    continue;
+                const key = joinValueKey(value);
+                const locales = localesByValue.get(key) ?? new Set();
+                locales.add(entry.locale);
+                localesByValue.set(key, locales);
+            }
+            for (const row of result.rows) {
+                const value = primitiveJoinValue(row.data[field]);
+                if (value === null)
+                    continue;
+                const locales = translationLocales.get(row.id) ?? new Set();
+                for (const locale of localesByValue.get(joinValueKey(value)) ?? [])
+                    locales.add(locale);
+                translationLocales.set(row.id, locales);
+            }
+        }
+        const items = result.rows.map((row) => adminListItem(row, schemasByName, [...(translationLocales.get(row.id) ?? [])]));
+        return Response.json({
+            items,
+            previous_cursor: result.previousCursor ?? null,
+            next_cursor: result.nextCursor ?? null,
         });
-        const items = result.rows.map((row) => adminListItem(row, schemasByName));
-        return Response.json({ items, next_cursor: result.nextCursor ?? null });
     });
     guarded("get", "/admin/api/entries/export", async (c) => {
         const collection = c.req.query("collection");
@@ -426,6 +518,10 @@ function mountAdminBetterAuth(app, ref, auth) {
                 message: "A non-empty `collection` is required.",
             }));
         }
+        if (gate.role === "contributor" &&
+            (schemasByName.get(body.collection)?.spec.lifecycle ?? "publishing") === "operational") {
+            throw new DiagnosticError(adminRoleDiagnostic("POST /admin/api/entries", "editor", "Contributors can create drafts, not operational records."));
+        }
         const row = await runtime.createDraft.execute({
             collection: body.collection,
             data: objectField(body.data),
@@ -438,6 +534,13 @@ function mountAdminBetterAuth(app, ref, auth) {
     guarded("patch", "/admin/api/entries/:id", async (c, gate) => runMantleUseCase(`PATCH /admin/api/entries/${c.req.param("id")}`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
+        if (gate.role === "contributor") {
+            const current = await runtime.getEntry.execute({ id });
+            const lifecycle = schemasByName.get(current.collection)?.spec.lifecycle ?? "publishing";
+            if (lifecycle === "operational" || current.status !== "draft") {
+                throw new DiagnosticError(adminRoleDiagnostic(`PATCH /admin/api/entries/${id}`, "editor", "Contributors can edit drafts only."));
+            }
+        }
         const body = (await c.req.raw.json().catch(() => ({})));
         const updated = await runtime.updateDraft.execute({
             id,
@@ -448,7 +551,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         });
         return entryEditorPayload(runtime, updated, schemas);
     }));
-    guarded("post", "/admin/api/entries/:id/publish", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/publish`, async () => {
+    roleGuarded("post", "/admin/api/entries/:id/publish", "editor", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/publish`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
         const body = await c.req.raw.json().catch(() => ({}));
@@ -459,7 +562,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         });
         return entryEditorPayload(runtime, row, schemas);
     }));
-    guarded("post", "/admin/api/entries/:id/unpublish", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/unpublish`, async () => {
+    roleGuarded("post", "/admin/api/entries/:id/unpublish", "editor", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/unpublish`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
         const body = await c.req.raw.json().catch(() => ({}));
@@ -470,7 +573,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         });
         return entryEditorPayload(runtime, row, schemas);
     }));
-    guarded("delete", "/admin/api/entries/:id", async (c, gate) => runMantleUseCase(`DELETE /admin/api/entries/${c.req.param("id")}`, async () => {
+    roleGuarded("delete", "/admin/api/entries/:id", "editor", async (c, gate) => runMantleUseCase(`DELETE /admin/api/entries/${c.req.param("id")}`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
         const body = await c.req.raw.json().catch(() => ({}));
@@ -485,7 +588,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     //   directly to R2 S3 (Worker bypassed) → POST /uploads/:groupId/commit.
     const MEDIA_UPLOADS_PATH = "/admin/api/media/uploads";
     const MEDIA_COMMIT_PATH = "/admin/api/media/uploads/:uploadGroupId/commit";
-    guarded("post", MEDIA_UPLOADS_PATH, async (c) => {
+    roleGuarded("post", MEDIA_UPLOADS_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -547,7 +650,7 @@ function mountAdminBetterAuth(app, ref, auth) {
             caption: typeof body.caption === "string" ? body.caption : undefined,
         }));
     });
-    guarded("post", MEDIA_COMMIT_PATH, async (c) => {
+    roleGuarded("post", MEDIA_COMMIT_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -567,7 +670,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     // `mediaStorage` is bound (mirrors the upload handlers above).
     const MEDIA_LIST_PATH = "/admin/api/media";
     const MEDIA_ASSET_PATH = "/admin/api/media/:id";
-    guarded("get", MEDIA_LIST_PATH, async (c) => {
+    roleGuarded("get", MEDIA_LIST_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -586,7 +689,7 @@ function mountAdminBetterAuth(app, ref, auth) {
             };
         });
     });
-    guarded("get", MEDIA_ASSET_PATH, async (c) => {
+    roleGuarded("get", MEDIA_ASSET_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -594,7 +697,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         const id = c.req.param("id");
         return runMantleUseCase(`GET ${MEDIA_ASSET_PATH}`, async () => adminMediaItem(await media.getAsset.execute(id)));
     });
-    guarded("patch", MEDIA_ASSET_PATH, async (c) => {
+    roleGuarded("patch", MEDIA_ASSET_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -620,7 +723,7 @@ function mountAdminBetterAuth(app, ref, auth) {
             caption: typeof body.caption === "string" ? body.caption : undefined,
         })));
     });
-    guarded("delete", MEDIA_ASSET_PATH, async (c) => {
+    roleGuarded("delete", MEDIA_ASSET_PATH, "editor", async (c) => {
         const runtime = await ref.get();
         const media = runtime.media;
         if (!media)
@@ -827,7 +930,7 @@ function titleFieldKey(data, schema) {
  *  next to the system column (#443). NAME-based only, on purpose: no
  *  fuzzy/semantic matching, just these two well-known reserved names. */
 const DATA_PREVIEW_SYSTEM_COLUMN_NAMES = new Set(["updatedAt", "createdAt"]);
-/** Operational (`lifecycle: none`) collections have no title/status
+/** Operational collections have no title/status
  *  workflow worth a dedicated column — instead the admin list shows up
  *  to 3 raw data columns. Mirrors the client-side column-picking rule
  *  in `collection-view.tsx`: first 3 `required` properties, skipping
@@ -835,7 +938,7 @@ const DATA_PREVIEW_SYSTEM_COLUMN_NAMES = new Set(["updatedAt", "createdAt"]);
  *  above (#443). Kept small on the wire on purpose — this is a
  *  preview, not the full entry. */
 function adminDataPreview(data, manifest) {
-    if (!manifest || manifest.spec.lifecycle !== "none")
+    if (!manifest || manifest.spec.lifecycle !== "operational")
         return undefined;
     const schema = manifest.spec.schema;
     // Schema-stable skip (not per-row): rows with a blank title field
@@ -874,7 +977,7 @@ function isStringTypedSchema(schema) {
     const types = Array.isArray(rawType) ? rawType : rawType ? [rawType] : [];
     return types.includes("string");
 }
-function adminListItem(row, schemasByName) {
+function adminListItem(row, schemasByName, translationLocales = []) {
     const manifest = schemasByName.get(row.collection);
     return {
         id: row.id,
@@ -884,6 +987,7 @@ function adminListItem(row, schemasByName) {
         version: row.version,
         title: adminEntryTitle(row.data, manifest?.spec.schema),
         updated_at: row.updatedAt,
+        translation_locales: translationLocales,
         data_preview: adminDataPreview(row.data, manifest),
     };
 }
@@ -937,6 +1041,7 @@ async function entryEditorPayload(runtime, row, schemas) {
     return {
         collection: adminEditorCollection(schema, schemas),
         entry: adminEditorEntry(row),
+        parentEntryId: await parentEntryId(runtime, schema, row, schemas),
         related,
     };
 }
@@ -945,7 +1050,7 @@ function adminEditorCollection(schema, schemas) {
         name: schema.metadata.name,
         title: schema.spec.title,
         description: schema.spec.description ?? null,
-        lifecycle: schema.spec.lifecycle ?? "simple",
+        lifecycle: schema.spec.lifecycle ?? "publishing",
         parent: collectionParentFor(schema, schemas),
         hasTranslations: schemas.some((candidate) => candidate.spec.translates?.parent === schema.metadata.name),
         localized: schema.spec.localized ?? Boolean(schema.spec.translates),
@@ -953,6 +1058,8 @@ function adminEditorCollection(schema, schemas) {
         schema: schema.spec.schema,
         uiSchema: schema.spec.uiSchema ?? null,
         mediaFields: mediaFieldsForCollection(schema, schemas),
+        sortableFields: schemaSortableFields(schema),
+        filter: checkSchemaListFilter(schema).filter,
     };
 }
 function adminEditorEntry(row) {
@@ -973,7 +1080,9 @@ async function relatedEntrySections(runtime, parentSchema, parentRow, schemas) {
         const childSchema = schemas.find((schema) => schema.metadata.name === relationship.collection);
         if (!childSchema)
             continue;
-        const entries = await entriesByDataValue(runtime, relationship.collection, relationship.childField, relationship.parentValue);
+        const entries = relationship.parentValue === null
+            ? []
+            : await entriesByDataValue(runtime, relationship.collection, relationship.childField, relationship.parentValue);
         sections.push({
             collection: adminEditorCollection(childSchema, schemas),
             relationship: {
@@ -989,12 +1098,11 @@ async function relatedEntrySections(runtime, parentSchema, parentRow, schemas) {
 }
 function discoverChildRelationships(parentSchema, parentRow, schemas) {
     const parentName = parentSchema.metadata.name;
-    const parentProps = parentSchema.spec.schema.properties ?? {};
     const relationships = [];
     const seen = new Set();
-    const add = (childSchema, kind, parentField, childField) => {
-        const parentValue = primitiveJoinValue(parentRow.data[parentField]);
-        if (parentValue == null)
+    const add = (childSchema, kind, parentField, childField, rawParentValue) => {
+        const parentValue = primitiveJoinValue(rawParentValue);
+        if (parentValue == null && kind !== "translation")
             return;
         const key = `${childSchema.metadata.name}:${kind}:${parentField}:${childField}:${String(parentValue)}`;
         if (seen.has(key))
@@ -1008,45 +1116,27 @@ function discoverChildRelationships(parentSchema, parentRow, schemas) {
             parentValue,
         });
     };
+    const translates = parentSchema.spec.translates;
+    if (translates) {
+        add(parentSchema, "translation", translates.on, translates.on, parentRow.data[translates.on]);
+    }
     for (const childSchema of schemas) {
         if (childSchema.metadata.name === parentName)
             continue;
         const childProps = childSchema.spec.schema.properties ?? {};
         const translates = childSchema.spec.translates;
         if (translates?.parent === parentName) {
-            add(childSchema, "translation", translates.on, translates.on);
+            add(childSchema, "translation", translates.on, translates.on, parentRow.data[translates.on]);
             continue;
         }
-        for (const [childField] of Object.entries(childProps)) {
-            const parentField = conventionalParentField(parentName, childField, parentProps);
-            if (parentField)
-                add(childSchema, "field", parentField, childField);
+        for (const [childField, childProperty] of Object.entries(childProps)) {
+            if (childProperty[MANTLE_REF_KEYWORD] === parentName) {
+                add(childSchema, "field", "id", childField, parentRow.id);
+            }
         }
     }
     return relationships;
 }
-function conventionalParentField(parentCollectionName, childField, parentProps) {
-    const bases = new Set([
-        camelCaseIdentifier(parentCollectionName),
-        singularizeIdentifier(camelCaseIdentifier(parentCollectionName)),
-    ]);
-    for (const base of bases) {
-        for (const [parentField, parentSchema] of Object.entries(parentProps)) {
-            if (!isPrimitiveJoinSchema(parentSchema))
-                continue;
-            if (childField === `${base}${capitalizeIdentifier(parentField)}`)
-                return parentField;
-        }
-    }
-    return null;
-}
-function isPrimitiveJoinSchema(schema) {
-    const rawType = schema.type;
-    const types = Array.isArray(rawType) ? rawType : rawType ? [rawType] : [];
-    if (types.length === 0 && schema.enum)
-        return true;
-    return types.some((type) => type === "string" || type === "number" || type === "integer" || type === "boolean");
-}
 function collectionParentFor(childSchema, schemas) {
     if (childSchema.spec.translates) {
         return {
@@ -1060,27 +1150,30 @@ function collectionParentFor(childSchema, schemas) {
     // parent, so it's buried under the parent in the sidebar). Optional
     // ref = weak reference — the collection stays top-level.
     const childRequired = new Set(childSchema.spec.schema.required ?? []);
-    for (const parentSchema of schemas) {
-        if (parentSchema.metadata.name === childSchema.metadata.name)
-            continue;
-        if (parentSchema.spec.translates)
+    const schemaNames = new Set(schemas
+        .filter((schema) => !schema.spec.translates)
+        .map((schema) => schema.metadata.name));
+    for (const [childField, childProperty] of Object.entries(childProps)) {
+        if (!childRequired.has(childField))
             continue;
-        const parentProps = parentSchema.spec.schema.properties ?? {};
-        for (const [childField] of Object.entries(childProps)) {
-            if (!childRequired.has(childField))
-                continue;
-            const parentField = conventionalParentField(parentSchema.metadata.name, childField, parentProps);
-            if (parentField) {
-                return {
-                    collection: parentSchema.metadata.name,
-                    parentField,
-                    childField,
-                };
-            }
+        const parent = childProperty[MANTLE_REF_KEYWORD];
+        if (typeof parent === "string" && schemaNames.has(parent)) {
+            return { collection: parent, parentField: "id", childField };
         }
     }
     return null;
 }
+async function parentEntryId(runtime, childSchema, childRow, schemas) {
+    const parent = collectionParentFor(childSchema, schemas);
+    if (!parent)
+        return null;
+    const value = primitiveJoinValue(childRow.data[parent.childField]);
+    if (value === null)
+        return null;
+    if (parent.parentField === "id" && typeof value === "string")
+        return value;
+    return (await entriesByDataValue(runtime, parent.collection, parent.parentField, value))[0]?.id ?? null;
+}
 function primitiveJoinValue(value) {
     if (typeof value === "string" && value !== "")
         return value;
@@ -1090,27 +1183,8 @@ function primitiveJoinValue(value) {
         return value;
     return null;
 }
-function camelCaseIdentifier(value) {
-    return value
-        .split(/[^a-zA-Z0-9]+/)
-        .filter(Boolean)
-        .map((part, index) => {
-        const lower = part.charAt(0).toLowerCase() + part.slice(1);
-        return index === 0 ? lower : capitalizeIdentifier(lower);
-    })
-        .join("");
-}
-function singularizeIdentifier(value) {
-    if (value.endsWith("ies"))
-        return `${value.slice(0, -3)}y`;
-    if (value.endsWith("ses"))
-        return value.slice(0, -2);
-    if (value.endsWith("s") && value.length > 1)
-        return value.slice(0, -1);
-    return value;
-}
-function capitalizeIdentifier(value) {
-    return value.charAt(0).toUpperCase() + value.slice(1);
+function joinValueKey(value) {
+    return `${typeof value}:${String(value)}`;
 }
 async function entriesByDataValue(runtime, collection, field, value) {
     return runtime.entryReader.findManyByDataField({
@@ -1122,7 +1196,9 @@ async function entriesByDataValue(runtime, collection, field, value) {
 }
 function adminSiteSettings(site) {
     return {
-        ...site,
+        brand: site.brand,
+        title: site.title,
+        description: site.description,
         ga4MeasurementId: site.ga4MeasurementId ?? "",
         facebookPixelId: site.facebookPixelId ?? "",
     };
@@ -1174,6 +1250,7 @@ async function readStaffGate(c, auth) {
         kind: "ok",
         userId: session.user.id,
         login,
+        image: session.user.image ?? null,
         role: role,
         sessionId: session.session.id,
     };
@@ -1192,14 +1269,32 @@ async function handleHttpTrigger(req, runtime, ref, triggerName, triggerPath, pa
     const caller = await resolveCaller(req, {
         auth: ref.auth,
         credentialResolver: ref.credentialResolver,
-        oauthBearer: ref.oauthBearer,
+        jwtBearer: ref.jwtBearer,
         env,
         waitUntil,
     });
     if (caller.kind === "invalid") {
         return Response.json({ ok: false, diagnostic: caller.diagnostic }, { status: caller.status });
     }
-    const body = await readBody(req);
+    if (caller.context.auth?.credential === "session") {
+        const rejected = rejectCrossOriginMutation(req);
+        if (rejected)
+            return rejected;
+    }
+    let body;
+    try {
+        body = await readBody(req);
+    }
+    catch {
+        const diagnostic = runtimeDiagnostic({
+            code: "INPUT_VALIDATION_FAILED",
+            severity: "error",
+            path: `${triggerPathPrefix}#/body`,
+            expected: "valid JSON",
+            message: "HTTP Trigger request body is not valid JSON.",
+        });
+        return Response.json({ ok: false, diagnostic: redactForWire(diagnostic) }, { status: 400 });
+    }
     // Spread order matters: URL path params are authoritative for the
     // resource identifier (a `DELETE /entries/{id}` body MUST NOT spoof
     // `id`). Body fields fill in non-path inputs only.
@@ -1237,7 +1332,7 @@ mountPath) {
     const caller = await resolveCaller(req, {
         auth: ref.auth,
         credentialResolver: ref.credentialResolver,
-        oauthBearer: ref.oauthBearer,
+        jwtBearer: ref.jwtBearer,
         env,
         waitUntil,
     });
@@ -1299,13 +1394,8 @@ async function readBody(req) {
     const ct = req.headers.get("content-type") ?? "";
     if (!ct.includes("json"))
         return {};
-    try {
-        const parsed = await req.json();
-        return parsed ?? {};
-    }
-    catch {
-        return {};
-    }
+    const parsed = await req.json();
+    return parsed ?? {};
 }
 function openApiToHono(path) {
     return path.replace(/\{([^}]+)\}/g, ":$1");
@@ -1366,18 +1456,22 @@ function adminUnauthenticated(c, path) {
 // instead of bouncing them back to /admin/sign-in (which the OAuth
 // re-auth then silently fast-forwards through, producing a visible
 // 5-step redirect chain that looks like an infinite loop).
-function adminNotOwner(c, path) {
+function adminInsufficientRole(c, path, minimumRole) {
+    const diagnostic = adminRoleDiagnostic(`${c.req.method} ${path}`, minimumRole, `This action requires the ${minimumRole} role.`);
     return Response.json({
         ok: false,
-        diagnostic: runtimeDiagnostic({
-            code: "AUTH_DENIED",
-            severity: "error",
-            path: `${c.req.method} ${path}`,
-            expected: "owner role for the signed-in user",
-            message: "Staff management is owner-only.",
-        }),
+        diagnostic,
     }, { status: 403 });
 }
+function adminRoleDiagnostic(path, minimumRole, message) {
+    return runtimeDiagnostic({
+        code: "AUTH_DENIED",
+        severity: "error",
+        path,
+        expected: `${minimumRole} role or higher for the signed-in user`,
+        message,
+    });
+}
 function adminNotStaff(c, path, login) {
     return Response.json({
         ok: false,