@beechcms/api 0.4.0-preview.1

package/src/public/query-builder.ts

@@ -0,0 +1,241 @@
+import type { Seed } from '@beechcms/core'
+import { parsePositiveInt } from '../shared/query-utils'
+
+export type PublicQueryInput = {
+  page?: string
+  limit?: string
+  latest?: string
+}
+
+type PublicFilterLogic = 'AND' | 'OR'
+type PublicFilterOperator =
+  | 'eq'
+  | 'neq'
+  | 'gt'
+  | 'gte'
+  | 'lt'
+  | 'lte'
+  | 'contains'
+  | 'not_contains'
+  | 'starts_with'
+  | 'ends_with'
+  | 'is_empty'
+  | 'is_not_empty'
+  | 'in'
+  | 'not_in'
+  | 'has_tag'
+  | 'has_any_tag'
+  | 'has_all_tags'
+
+type PublicFilterCondition = {
+  field: string
+  op: PublicFilterOperator
+  value?: unknown
+}
+
+type ParsedPublicFilter = {
+  where: PublicFilterCondition[]
+  logic: PublicFilterLogic
+}
+
+const PUBLIC_FILTER_OPERATORS = new Set<PublicFilterOperator>([
+  'eq', 'neq', 'gt', 'gte', 'lt', 'lte',
+  'contains', 'not_contains', 'starts_with', 'ends_with',
+  'is_empty', 'is_not_empty', 'in', 'not_in',
+  'has_tag', 'has_any_tag', 'has_all_tags',
+])
+
+const SYSTEM_COLUMNS = new Set(['id', 'slug', 'status', 'created_at', 'updated_at'])
+
+function asString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null
+}
+
+/**
+ * Risolve il nome colonna SQL per un campo.
+ * In v0.4.0 il nome colonna = branch.alias (nessun json_extract).
+ */
+function resolveFieldExpression(
+  seed: Seed | null,
+  field: string
+): { expr: string; fieldType: string } | null {
+  if (SYSTEM_COLUMNS.has(field)) {
+    const type = field === 'created_at' || field === 'updated_at' ? 'number' : 'text'
+    return { expr: field, fieldType: type }
+  }
+  const branch = seed?.branches.find((b) => b.alias === field)
+  if (!branch) return null
+  return { expr: branch.alias, fieldType: branch.type }
+}
+
+function validateLogic(logicRaw: unknown): PublicFilterLogic {
+  if (logicRaw === undefined) return 'AND'
+  if (typeof logicRaw !== 'string') throw new TypeError("Invalid filter: 'logic' must be 'AND' or 'OR'")
+  const normalized = logicRaw.toUpperCase()
+  if (normalized !== 'AND' && normalized !== 'OR') throw new TypeError("Invalid filter: 'logic' must be 'AND' or 'OR'")
+  return normalized
+}
+
+function parseWhereCondition(raw: unknown): PublicFilterCondition | null {
+  if (!raw || typeof raw !== 'object') return null
+  const maybe = raw as Record<string, unknown>
+  const field = asString(maybe.field)
+  const opRaw = asString(maybe.op)
+  if (!field || !opRaw || !PUBLIC_FILTER_OPERATORS.has(opRaw as PublicFilterOperator)) {
+    throw new TypeError(`Invalid filter: unknown operator '${opRaw ?? 'undefined'}'`)
+  }
+  return { field, op: opRaw as PublicFilterOperator, value: maybe.value }
+}
+
+export function parsePublicFilter(raw: string | undefined): ParsedPublicFilter | null {
+  if (!raw) return null
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    throw new TypeError('Invalid filter: malformed JSON')
+  }
+  if (!parsed || typeof parsed !== 'object') throw new TypeError('Invalid filter: object expected')
+  const filterObj = parsed as Record<string, unknown>
+  const logic = validateLogic(filterObj.logic)
+  if (!Array.isArray(filterObj.where)) throw new TypeError("Invalid filter: 'where' must be an array")
+  const where = filterObj.where
+    .map(parseWhereCondition)
+    .filter((item): item is PublicFilterCondition => item !== null)
+  return { where, logic }
+}
+
+function ensureValueArray(value: unknown, op: PublicFilterOperator, field: string): unknown[] {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new TypeError(`Invalid filter: operator '${op}' for field '${field}' requires a non-empty array`)
+  }
+  return value
+}
+
+function buildTextOperation(
+  op: PublicFilterOperator,
+  expr: string,
+  field: string,
+  value: unknown
+): { clause: string; bindings: Array<string | number> } {
+  const str = asString(value)
+  if (!str) throw new TypeError(`Invalid filter: operator '${op}' for field '${field}' requires a string value`)
+  if (op === 'contains')     return { clause: `LOWER(CAST(${expr} AS TEXT)) LIKE LOWER(?)`, bindings: [`%${str}%`] }
+  if (op === 'not_contains') return { clause: `LOWER(CAST(${expr} AS TEXT)) NOT LIKE LOWER(?)`, bindings: [`%${str}%`] }
+  if (op === 'starts_with')  return { clause: `LOWER(CAST(${expr} AS TEXT)) LIKE LOWER(?)`, bindings: [`${str}%`] }
+  return { clause: `LOWER(CAST(${expr} AS TEXT)) LIKE LOWER(?)`, bindings: [`%${str}`] }
+}
+
+function buildSetOperation(
+  op: PublicFilterOperator,
+  expr: string,
+  field: string,
+  value: unknown
+): { clause: string; bindings: Array<string | number> } {
+  const values = ensureValueArray(value, op, field)
+  const placeholders = values.map(() => '?').join(',')
+  return {
+    clause: `${expr} ${op === 'in' ? 'IN' : 'NOT IN'} (${placeholders})`,
+    bindings: values as Array<string | number>,
+  }
+}
+
+function buildTagOperation(
+  op: PublicFilterOperator,
+  expr: string,
+  field: string,
+  value: unknown
+): { clause: string; bindings: Array<string | number> } {
+  const tags = op === 'has_tag' ? [value] : ensureValueArray(value, op, field)
+  const cleaned = tags.map((item) => asString(item)).filter((item): item is string => item !== null)
+  if (cleaned.length === 0) {
+    throw new TypeError(`Invalid filter: operator '${op}' for field '${field}' requires tag string values`)
+  }
+  if (op === 'has_tag' || op === 'has_any_tag') {
+    const placeholders = cleaned.map(() => '?').join(',')
+    return {
+      clause: `EXISTS (SELECT 1 FROM json_each(${expr}) je WHERE CAST(je.value AS TEXT) IN (${placeholders}))`,
+      bindings: cleaned,
+    }
+  }
+  const allParts = cleaned.map(() => `EXISTS (SELECT 1 FROM json_each(${expr}) je WHERE CAST(je.value AS TEXT) = ?)`)
+  return { clause: allParts.join(' AND '), bindings: cleaned }
+}
+
+function buildConditionClause(
+  condition: PublicFilterCondition,
+  seed: Seed | null
+): { clause: string; bindings: Array<string | number> } | null {
+  const fieldMeta = resolveFieldExpression(seed, condition.field)
+  if (!fieldMeta) return null
+  const { expr, fieldType } = fieldMeta
+  const { op, value, field } = condition
+
+  if (op === 'is_empty')     return { clause: `(${expr} IS NULL OR TRIM(CAST(${expr} AS TEXT)) = '')`, bindings: [] }
+  if (op === 'is_not_empty') return { clause: `(${expr} IS NOT NULL AND TRIM(CAST(${expr} AS TEXT)) <> '')`, bindings: [] }
+  if (op === 'contains' || op === 'not_contains' || op === 'starts_with' || op === 'ends_with') {
+    return buildTextOperation(op, expr, field, value)
+  }
+  if (op === 'in' || op === 'not_in') return buildSetOperation(op, expr, field, value)
+  if (op === 'has_tag' || op === 'has_any_tag' || op === 'has_all_tags') {
+    if (fieldType !== 'json') throw new TypeError(`Invalid filter: operator '${op}' requires a json field`)
+    return buildTagOperation(op, expr, field, value)
+  }
+
+  if (op === 'eq' || op === 'neq') {
+    if (typeof value === 'boolean') {
+      return { clause: `${expr} ${op === 'eq' ? '=' : '!='} ?`, bindings: [value ? 1 : 0] }
+    }
+    if (typeof value === 'number' && !Number.isNaN(value)) {
+      return { clause: `${expr} ${op === 'eq' ? '=' : '!='} ?`, bindings: [value] }
+    }
+    const textValue = asString(value)
+    if (!textValue) throw new TypeError(`Invalid filter: operator '${op}' for field '${field}' requires a scalar value`)
+    return {
+      clause: `LOWER(TRIM(CAST(${expr} AS TEXT))) ${op === 'eq' ? '=' : '!='} LOWER(TRIM(?))`,
+      bindings: [textValue],
+    }
+  }
+
+  const numberValue = typeof value === 'number' && !Number.isNaN(value) ? value : null
+  const textValue = asString(value)
+  const mathOp = op === 'gt' ? '>' : op === 'gte' ? '>=' : op === 'lt' ? '<' : op === 'lte' ? '<=' : null
+  if (!mathOp) throw new TypeError(`Invalid filter: operator '${op}' is not supported`)
+  if ((fieldType === 'number' || field === 'created_at' || field === 'updated_at') && numberValue !== null) {
+    return { clause: `${expr} ${mathOp} ?`, bindings: [numberValue] }
+  }
+  if (textValue) return { clause: `CAST(${expr} AS TEXT) ${mathOp} ?`, bindings: [textValue] }
+  throw new TypeError(`Invalid filter: operator '${op}' for field '${field}' requires a compatible value`)
+}
+
+export function buildPublicFilterWhereClause(
+  seed: Seed | null,
+  parsedFilter: ParsedPublicFilter | null
+): { clause: string; bindings: Array<string | number> } {
+  if (!parsedFilter || parsedFilter.where.length === 0) return { clause: '', bindings: [] }
+  const clauses: string[] = []
+  const bindings: Array<string | number> = []
+  for (const condition of parsedFilter.where) {
+    const built = buildConditionClause(condition, seed)
+    if (!built) continue
+    clauses.push(`(${built.clause})`)
+    bindings.push(...built.bindings)
+  }
+  if (clauses.length === 0) return { clause: '', bindings: [] }
+  return { clause: clauses.join(` ${parsedFilter.logic} `), bindings }
+}
+
+export function parsePublicPagination(input: PublicQueryInput): { page: number; limit: number } {
+  const page = parsePositiveInt(input.page, 1)
+  const limit = Math.min(parsePositiveInt(input.limit, 25), 100)
+  return { page, limit }
+}
+
+export function parseLatestCount(latest: string | undefined): number {
+  if (!latest) return 10
+  const raw = Number.parseInt(latest, 10)
+  const parsed = Number.isNaN(raw) ? 10 : raw
+  if (parsed < 1) return 1
+  if (parsed > 100) return 100
+  return parsed
+}

package/src/public/rate-limit-middleware.ts

@@ -0,0 +1,42 @@
+import type { Context, Next } from 'hono'
+import { publicProblem } from './problem-details'
+
+type PublicBindings = {
+  PUBLIC_READ_RATE_LIMITER?: RateLimit
+  PUBLIC_WRITE_RATE_LIMITER?: RateLimit
+}
+
+function isReadMethod(method: string): boolean {
+  return method === 'GET' || method === 'HEAD' || method === 'OPTIONS'
+}
+
+function getClientIp(headers: Headers): string {
+  return headers.get('cf-connecting-ip') ?? 'unknown'
+}
+
+export function publicRateLimitMiddleware() {
+  return async (c: Context, next: Next): Promise<Response | void> => {
+    const env = c.env as PublicBindings
+    const readMethod = isReadMethod(c.req.method)
+    const limiter = readMethod ? env.PUBLIC_READ_RATE_LIMITER : env.PUBLIC_WRITE_RATE_LIMITER
+    if (!limiter) {
+      await next()
+      return
+    }
+
+    const seed = c.req.param('seed') ?? 'no-seed'
+    const key = `${getClientIp(c.req.raw.headers)}:${seed}:${readMethod ? 'read' : 'write'}`
+    const { success } = await limiter.limit({ key })
+
+    if (!success) {
+      return publicProblem(c, {
+        type: 'rate-limit-exceeded',
+        title: 'Too Many Requests',
+        status: 429,
+        detail: 'Too many requests',
+      })
+    }
+
+    await next()
+  }
+}

package/src/public/response-builder.ts

@@ -0,0 +1,26 @@
+/**
+ * Helper meta per risposta lista Public API.
+ */
+export function buildPublicListMeta(input: {
+  total: number
+  page: number
+  limit: number
+  returned: number
+  seed: string
+}) {
+  return {
+    total: input.total,
+    page: input.page,
+    limit: input.limit,
+    returned: input.returned,
+    seed: input.seed,
+  }
+}
+
+/**
+ * Helper meta per risposta singolo elemento Public API.
+ */
+export function buildPublicSingleMeta(seed: string) {
+  return { seed }
+}
+

package/src/public/sanitize.ts

@@ -0,0 +1,65 @@
+import { validateAndSanitizeSeedPayload } from '@beechcms/core'
+import type { Seed, ValidationDetail } from '@beechcms/core'
+
+type PublicSanitizeSuccess = {
+  ok: true
+  data: Record<string, unknown>
+}
+
+type PublicSanitizeFailure = {
+  ok: false
+  status: 400 | 422
+  code: 'validation_failed' | 'dangerous_content'
+  message: string
+  details?: ValidationDetail[]
+}
+
+export type PublicSanitizeResult = PublicSanitizeSuccess | PublicSanitizeFailure
+
+/**
+ * Adapter Public API: usa la foundation del core e mappa errori nel formato sprint.
+ */
+export function sanitizePublicPayload(
+  seed: Seed,
+  payload: Record<string, unknown>,
+  options: {
+    allowNull?: boolean
+    operation?: 'create' | 'update'
+    requireAtLeastOneValidField?: boolean
+    enforceRequiredFields?: boolean
+  } = {}
+): PublicSanitizeResult {
+  const operation = options.operation ?? 'create'
+  const result = validateAndSanitizeSeedPayload(seed, payload, {
+    allowNull: options.allowNull ?? false,
+    operation,
+    requireAtLeastOneValidField: options.requireAtLeastOneValidField ?? true,
+    enforceRequiredFields: options.enforceRequiredFields ?? true,
+  })
+
+  if (result.dangerousFields.length > 0) {
+    const field = result.dangerousFields[0]
+    return {
+      ok: false,
+      status: 422,
+      code: 'dangerous_content',
+      message: `Content rejected: dangerous markup detected in field '${field}'`,
+    }
+  }
+
+  if (result.details.length > 0) {
+    return {
+      ok: false,
+      status: 400,
+      code: 'validation_failed',
+      message: 'Validation failed',
+      details: result.details,
+    }
+  }
+
+  return {
+    ok: true,
+    data: result.data,
+  }
+}
+

package/src/public/slug-utils.ts

@@ -0,0 +1,14 @@
+import { slugify, generateEntrySlug } from '@beechcms/core'
+
+/**
+ * Converte stringa in slug URL-safe.
+ * Logica spostata in @beechcms/core per consistenza tra Dashboard e API.
+ */
+export { slugify }
+
+/**
+ * Genera slug da title/name o fallback UUID-like.
+ * Logica spostata in @beechcms/core per consistenza tra Dashboard e API.
+ */
+export { generateEntrySlug }
+

package/src/search-utils.ts

@@ -0,0 +1,188 @@
+// apps/api/src/search-utils.ts
+// Pure functions — zero Hono dependencies, importable from Vitest.
+// v0.4.0: FTS is per-seed (fts_{slug}), joined with content_{slug} for metadata.
+
+import type { Seed } from "@beechcms/core"
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+// Row returned by UNION ALL query across fts_{slug} JOIN content_{slug}
+export interface FtsRow {
+  entry_id:    string
+  schema_slug: string
+  slug:        string | null
+  status:      string
+  title:       string | null
+  excerpt:     string
+  rank:        number
+}
+
+export interface SearchResultItem {
+  id:          string
+  schema_slug: string
+  slug:        string | null
+  status:      string
+  title:       string
+  excerpt:     string
+  data:        Record<string, unknown>
+}
+
+export interface SearchResponse {
+  items:      SearchResultItem[]
+  nextCursor: string | null
+  total:      number
+}
+
+export interface SearchQueryParams {
+  q:          string
+  schemaSlug: string | null
+  status:     string | null
+  limit:      number         // already clamped 1–50 by handler
+  cursor:     string | null
+}
+
+// ─── Cursor ──────────────────────────────────────────────────────────────────
+
+export function encodeCursor(rank: number, entryId: string): string {
+  return btoa(`${rank}:${entryId}`)
+}
+
+export function decodeCursor(cursor: string): { rank: number; entryId: string } | null {
+  try {
+    const decoded = atob(cursor)
+    const sep     = decoded.lastIndexOf(":")
+    if (sep === -1) return null
+    return {
+      rank:    parseFloat(decoded.slice(0, sep)),
+      entryId: decoded.slice(sep + 1),
+    }
+  } catch {
+    return null
+  }
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function hasSearchableFts(seed: Seed): boolean {
+  return seed.branches.some(b =>
+    (b.type === 'text' || b.type === 'richtext') && b.policies?.search !== false
+  )
+}
+
+function buildMatchExpr(q: string): string {
+  const MIN_PREFIX = 3
+  const safeQ = q.replace(/["*^()]/g, " ").trim()
+  const terms = safeQ.split(/\s+/).filter(t => t.length >= 2)
+  if (terms.length === 0) throw new Error("EMPTY_QUERY")
+
+  return terms
+    .map(t => {
+      if (/^\d+$/.test(t)) return `"${t}"`
+      if (t.length <= MIN_PREFIX) return `"${t}"*`
+      const prefixes: string[] = []
+      for (let i = MIN_PREFIX; i <= t.length; i++) {
+        prefixes.push(`"${t.slice(0, i)}"*`)
+      }
+      return `(${prefixes.join(" OR ")})`
+    })
+    .join(" ")
+}
+
+// ─── Query builder ───────────────────────────────────────────────────────────
+
+/**
+ * Builds a UNION ALL query across all per-seed fts_{slug} tables (v0.4.0).
+ * Each SELECT joins fts_{slug} with content_{slug} to fetch title, slug, status.
+ * Seeds param: full registry — filtered internally by schemaSlug and FTS availability.
+ */
+export function buildFtsQuery(
+  params: SearchQueryParams,
+  seeds: Seed[],
+): {
+  sql:        string
+  binds:      unknown[]
+  countSql:   string
+  countBinds: unknown[]
+} {
+  const { q, schemaSlug, status, limit, cursor } = params
+
+  const matchExpr = buildMatchExpr(q)  // throws EMPTY_QUERY if needed
+
+  const targetSeeds = seeds.filter(s =>
+    hasSearchableFts(s) && (schemaSlug === null || s.slug === schemaSlug)
+  )
+
+  if (targetSeeds.length === 0) {
+    return {
+      sql:        "SELECT NULL as entry_id, NULL as schema_slug, NULL as slug, NULL as status, NULL as title, '' as excerpt, 0 as rank WHERE 1=0",
+      binds:      [],
+      countSql:   "SELECT 0 as total",
+      countBinds: [],
+    }
+  }
+
+  const decoded = cursor ? decodeCursor(cursor) : null
+
+  const parts:       string[]  = []
+  const binds:       unknown[] = []
+  const countParts:  string[]  = []
+  const countBinds:  unknown[] = []
+
+  for (const seed of targetSeeds) {
+    const fts   = `fts_${seed.slug}`
+    const table = `content_${seed.slug}`
+    const title = seed.displayNameAlias
+
+    // Main query per seed
+    const where: string[]  = [`${fts} MATCH ?`]
+    const lb:    unknown[] = [matchExpr]
+
+    if (status) { where.push("ce.status = ?"); lb.push(status) }
+
+    if (decoded) {
+      where.push(`(bm25(${fts}) > ? OR (bm25(${fts}) = ? AND f.entry_id > ?))`)
+      lb.push(decoded.rank, decoded.rank, decoded.entryId)
+    }
+
+    parts.push(
+      `SELECT f.entry_id, '${seed.slug}' AS schema_slug, ce.slug, ce.status,` +
+      ` ce.${title} AS title,` +
+      ` snippet(${fts}, 1, '<mark>', '</mark>', '…', 16) AS excerpt,` +
+      ` bm25(${fts}) AS rank` +
+      ` FROM ${fts} f JOIN ${table} ce ON ce.id = f.entry_id` +
+      ` WHERE ${where.join(' AND ')}`
+    )
+    binds.push(...lb)
+
+    // Count per seed (no cursor, no limit)
+    const cw: string[]  = [`${fts} MATCH ?`]
+    const cb: unknown[] = [matchExpr]
+    if (status) { cw.push("ce.status = ?"); cb.push(status) }
+
+    countParts.push(
+      `SELECT COUNT(*) as c FROM ${fts} f JOIN ${table} ce ON ce.id = f.entry_id WHERE ${cw.join(' AND ')}`
+    )
+    countBinds.push(...cb)
+  }
+
+  const sql      = `${parts.join(' UNION ALL ')} ORDER BY rank, entry_id LIMIT ?`
+  binds.push(limit + 1)
+
+  const countSql = `SELECT SUM(c) as total FROM (${countParts.join(' UNION ALL ')})`
+
+  return { sql, binds, countSql, countBinds }
+}
+
+// ─── Mapper ──────────────────────────────────────────────────────────────────
+
+export function mapFtsRow(row: FtsRow): SearchResultItem {
+  return {
+    id:          row.entry_id,
+    schema_slug: row.schema_slug,
+    slug:        row.slug,
+    status:      row.status,
+    title:       row.title ?? "",
+    excerpt:     row.excerpt ?? "",
+    data:        {},
+  }
+}

package/src/search.ts

@@ -0,0 +1,72 @@
+// apps/api/src/search.ts
+
+import { Hono }              from "hono"
+import type { Env, Variables } from "./types"
+import { authMiddleware }    from "./middleware"
+import {
+  buildFtsQuery,
+  encodeCursor,
+  mapFtsRow,
+  type FtsRow,
+  type SearchResponse,
+} from "./search-utils"
+
+export const searchRouter = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+searchRouter.use("*", async (c, next) => {
+  return authMiddleware(c.env.JWT_SECRET, {
+    issuer: c.env.JWT_ISSUER,
+    audience: c.env.JWT_AUDIENCE,
+  })(c, next)
+})
+
+// GET /api/search?q=...&schema_slug=...&status=...&limit=20&cursor=...
+searchRouter.get("/", async (c) => {
+  const q          = c.req.query("q")?.trim() ?? ""
+  const schemaSlug = c.req.query("schema_slug") ?? null
+  const status     = c.req.query("status") ?? null
+  const rawLimit   = parseInt(c.req.query("limit") ?? "20", 10)
+  const limit      = Math.min(Math.max(rawLimit, 1), 50)
+  const cursor     = c.req.query("cursor") ?? null
+
+  if (q.length < 2) {
+    return c.json({ error: "Il parametro 'q' deve avere almeno 2 caratteri." }, 400)
+  }
+
+  const seeds = Object.values(c.get('seedRegistry'))
+
+  let queryParts: ReturnType<typeof buildFtsQuery>
+  try {
+    queryParts = buildFtsQuery({ q, schemaSlug, status, limit, cursor }, seeds)
+  } catch (e) {
+    if ((e as Error).message === "EMPTY_QUERY") {
+      return c.json({ items: [], nextCursor: null, total: 0 } satisfies SearchResponse)
+    }
+    throw e
+  }
+
+  const { sql, binds, countSql, countBinds } = queryParts
+
+  const [ftsResult, countResult] = await Promise.all([
+    c.env.DB.prepare(sql).bind(...binds).all<FtsRow>(),
+    c.env.DB.prepare(countSql).bind(...countBinds).first<{ total: number }>(),
+  ])
+
+  const rows  = ftsResult.results ?? []
+  const total = countResult?.total ?? 0
+
+  const hasMore  = rows.length > limit
+  const pageRows = hasMore ? rows.slice(0, limit) : rows
+
+  const nextCursor = hasMore
+    ? encodeCursor(pageRows.at(-1)!.rank, pageRows.at(-1)!.entry_id)
+    : null
+
+  if (pageRows.length === 0) {
+    return c.json({ items: [], nextCursor: null, total } satisfies SearchResponse)
+  }
+
+  const items = pageRows.map(row => mapFtsRow(row))
+
+  return c.json({ items, nextCursor, total } satisfies SearchResponse)
+})