@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.2

package/src/public/entry-projection.ts

@@ -1,46 +1,46 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { resolvePolicies } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
-
-const SYSTEM_FIELDS = ['id', 'slug', 'status', 'created_at', 'updated_at']
-const IDENTITY_FIELDS = ['id', 'slug']
-
-function applyPublicPolicies(data: Record<string, unknown>, seed: Seed): Record<string, unknown> {
-  const result: Record<string, unknown> = {}
-
-  for (const key of SYSTEM_FIELDS) {
-    if (key in data) result[key] = data[key]
-  }
-
-  for (const branch of seed.branches) {
-    const value = data[branch.alias]
-    const { public: isPublic, visibility } = resolvePolicies(branch)
-    if (!isPublic) continue
-    if (visibility === 'hidden') continue
-    result[branch.alias] = visibility === 'masked' && typeof value === 'string' && value.length > 0
-      ? '••••••••'
-      : value
-  }
-  return result
-}
-
-export function toFlatPublicEntry(data: Record<string, unknown>, seed: Seed, fieldsParam?: string): Record<string, unknown> {
-  const projected = applyPublicPolicies(data, seed)
-  const requestedFields = (fieldsParam ?? '').split(',').map(f => f.trim()).filter(Boolean)
-
-  if (requestedFields.length === 0) return projected
-
-  const filtered: Record<string, unknown> = {}
-  for (const field of requestedFields) {
-    if (field in projected) filtered[field] = projected[field]
-  }
-
-  for (const key of IDENTITY_FIELDS) {
-    if (key in projected && !filtered[key]) filtered[key] = projected[key]
-  }
-
-  return filtered
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { resolvePolicies } from '@beechcms/core'
+import type { Seed } from '@beechcms/core'
+
+const SYSTEM_FIELDS = ['id', 'slug', 'status', 'created_at', 'updated_at']
+const IDENTITY_FIELDS = ['id', 'slug']
+
+function applyPublicPolicies(data: Record<string, unknown>, seed: Seed): Record<string, unknown> {
+  const result: Record<string, unknown> = {}
+
+  for (const key of SYSTEM_FIELDS) {
+    if (key in data) result[key] = data[key]
+  }
+
+  for (const branch of seed.branches) {
+    const value = data[branch.alias]
+    const { public: isPublic, visibility } = resolvePolicies(branch)
+    if (!isPublic) continue
+    if (visibility === 'hidden') continue
+    result[branch.alias] = visibility === 'masked' && typeof value === 'string' && value.length > 0
+      ? '••••••••'
+      : value
+  }
+  return result
+}
+
+export function toFlatPublicEntry(data: Record<string, unknown>, seed: Seed, fieldsParam?: string): Record<string, unknown> {
+  const projected = applyPublicPolicies(data, seed)
+  const requestedFields = (fieldsParam ?? '').split(',').map(f => f.trim()).filter(Boolean)
+
+  if (requestedFields.length === 0) return projected
+
+  const filtered: Record<string, unknown> = {}
+  for (const field of requestedFields) {
+    if (field in projected) filtered[field] = projected[field]
+  }
+
+  for (const key of IDENTITY_FIELDS) {
+    if (key in projected && !filtered[key]) filtered[key] = projected[key]
+  }
+
+  return filtered
+}

package/src/public/idempotency.ts

@@ -1,23 +1,23 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { sha256hex } from '@beechcms/core'
-
-export function parseIdempotencyKey(rawValue: string | undefined): string | null {
-  if (!rawValue) return null
-  const key = rawValue.trim()
-  if (!key || key.length > 128) return null
-  return key
-}
-
-type FingerprintInput = {
-  seedSlug: string
-  statusValue: unknown
-  slug: string | null
-  data: Record<string, unknown>
-}
-
-export function buildRequestFingerprint(input: FingerprintInput): Promise<string> {
-  return sha256hex(JSON.stringify({ seedSlug: input.seedSlug, statusValue: input.statusValue, slug: input.slug, data: input.data }))
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { sha256hex } from '@beechcms/core'
+
+export function parseIdempotencyKey(rawValue: string | undefined): string | null {
+  if (!rawValue) return null
+  const key = rawValue.trim()
+  if (!key || key.length > 128) return null
+  return key
+}
+
+type FingerprintInput = {
+  seedSlug: string
+  statusValue: unknown
+  slug: string | null
+  data: Record<string, unknown>
+}
+
+export function buildRequestFingerprint(input: FingerprintInput): Promise<string> {
+  return sha256hex(JSON.stringify({ seedSlug: input.seedSlug, statusValue: input.statusValue, slug: input.slug, data: input.data }))
+}

package/src/public/index.ts

@@ -1,16 +1,16 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-export { apiKeyMiddleware } from './api-key-middleware'
-export { publicRateLimitMiddleware } from './rate-limit-middleware'
-export { publicRoutes } from './public-routes'
-export { PUBLIC_ERRORS } from './public-errors'
-export { sanitizePublicPayload } from './sanitize'
-export { generateEntrySlug, slugify } from './slug-utils'
-export { buildPublicListMeta, buildPublicSingleMeta } from './response-builder'
-export { parseLatestCount, parsePublicPagination } from './query-builder'
-export { publicReadHandler } from './public-read'
-export { publicAddHandler } from './public-add'
-export { publicEditHandler } from './public-edit'
-
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+export { apiKeyMiddleware } from './api-key-middleware'
+export { publicRateLimitMiddleware } from './rate-limit-middleware'
+export { publicRoutes } from './public-routes'
+export { PUBLIC_ERRORS } from './public-errors'
+export { sanitizePublicPayload } from './sanitize'
+export { generateEntrySlug, slugify } from './slug-utils'
+export { buildPublicListMeta, buildPublicSingleMeta } from './response-builder'
+export { parseLatestCount, parsePublicPagination } from './query-builder'
+export { publicReadHandler } from './public-read'
+export { publicAddHandler } from './public-add'
+export { publicEditHandler } from './public-edit'
+

package/src/public/problem-details.ts

@@ -1,124 +1,124 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { Context } from 'hono'
-
-// ──────────────────────────────────────────────────────────────────────────────
-// FK / SQLite error detection
-// ──────────────────────────────────────────────────────────────────────────────
-
-type FkViolationKind = 'relation-in-use' | 'relation-target-not-found' | 'foreign-key-violation'
-
-function isFkError(error: unknown): boolean {
-  if (!(error instanceof Error)) return false
-  // D1 surfaces the error in .message
-  if (/FOREIGN KEY constraint failed/i.test(error.message)) return true
-  // Some runtimes expose cause.code
-  const cause = (error as { cause?: { code?: string } }).cause
-  if (cause?.code === 'SQLITE_CONSTRAINT_FOREIGNKEY') return true
-  return false
-}
-
-/**
- * Classify a SQLite FK error by HTTP method.
- * - DELETE  → the referenced row is still used → relation-in-use
- * - POST/PUT/PATCH → referenced parent does not exist → relation-target-not-found
- * - anything else → generic foreign-key-violation
- */
-function classifyFkError(method: string): FkViolationKind {
-  const m = method.toUpperCase()
-  if (m === 'DELETE') return 'relation-in-use'
-  if (m === 'POST' || m === 'PUT' || m === 'PATCH') return 'relation-target-not-found'
-  return 'foreign-key-violation'
-}
-
-const FK_PROBLEM: Record<FkViolationKind, { title: string; status: 409 | 422; detail: string }> = {
-  'relation-in-use': {
-    title: 'Relation In Use',
-    status: 409,
-    detail: 'The record cannot be deleted because it is referenced by one or more related entries.',
-  },
-  'relation-target-not-found': {
-    title: 'Relation Target Not Found',
-    status: 422,
-    detail: 'The provided relation id does not match any existing record in the referenced collection.',
-  },
-  'foreign-key-violation': {
-    title: 'Foreign Key Violation',
-    status: 409,
-    detail: 'The operation violates a referential integrity constraint.',
-  },
-}
-
-/**
- * Returns a Problem+JSON response when the error is a SQLite FK violation,
- * or null when the error is unrelated (let the caller handle it).
- *
- * @param c       Hono context
- * @param error   The caught error
- * @param method  HTTP method of the current request (e.g. 'DELETE', 'POST')
- */
-export function fkProblemOrNull(c: Context, error: unknown, method: string): Response | null {
-  if (!isFkError(error)) return null
-  const kind = classifyFkError(method)
-  const meta = FK_PROBLEM[kind]
-  return publicProblem(c, {
-    type: `https://beechcms.dev/problems/${kind}`,
-    title: meta.title,
-    status: meta.status,
-    detail: meta.detail,
-  })
-}
-
-export interface PublicProblemDetailItem {
-  field: string
-  expected: string
-  received: string
-  message: string
-}
-
-type PublicProblemInput = {
-  type: string
-  title: string
-  status: 400 | 401 | 403 | 404 | 405 | 409 | 422 | 429 | 500 | 501
-  detail: string
-  errors?: PublicProblemDetailItem[]
-}
-
-/**
- * TODO: UPDATE DOMAIN ONCE REGISTERED
- * Currently uses 'beechcms.dev' as a placeholder. 
- * When a real domain is registered for BeechCMS, update the URL below 
- * to point to the official API error documentation (RFC 9457).
- */
-function normalizeProblemType(type: string): string {
-  if (type.startsWith('http://') || type.startsWith('https://')) {
-    return type
-  }
-  return `https://beechcms.dev/problems/${type}`
-}
-
-export function internalErrorDetail(env: { ENV?: string }, error: unknown): string {
-  if (env.ENV !== 'production' && error instanceof Error) return error.message
-  return 'An unexpected error occurred.'
-}
-
-/**
- * Restituisce errori API in formato Problem Details (RFC 9457).
- */
-export function publicProblem(c: Context, input: PublicProblemInput): Response {
-  const body: Record<string, unknown> = {
-    type: normalizeProblemType(input.type),
-    title: input.title,
-    status: input.status,
-    detail: input.detail,
-    instance: c.req.path,
-  }
-  if (input.errors && input.errors.length > 0) {
-    body.errors = input.errors
-  }
-  return c.json(body, input.status, {
-    'Content-Type': 'application/problem+json',
-  })
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { Context } from 'hono'
+
+// ──────────────────────────────────────────────────────────────────────────────
+// FK / SQLite error detection
+// ──────────────────────────────────────────────────────────────────────────────
+
+type FkViolationKind = 'relation-in-use' | 'relation-target-not-found' | 'foreign-key-violation'
+
+function isFkError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false
+  // D1 surfaces the error in .message
+  if (/FOREIGN KEY constraint failed/i.test(error.message)) return true
+  // Some runtimes expose cause.code
+  const cause = (error as { cause?: { code?: string } }).cause
+  if (cause?.code === 'SQLITE_CONSTRAINT_FOREIGNKEY') return true
+  return false
+}
+
+/**
+ * Classify a SQLite FK error by HTTP method.
+ * - DELETE  → the referenced row is still used → relation-in-use
+ * - POST/PUT/PATCH → referenced parent does not exist → relation-target-not-found
+ * - anything else → generic foreign-key-violation
+ */
+function classifyFkError(method: string): FkViolationKind {
+  const m = method.toUpperCase()
+  if (m === 'DELETE') return 'relation-in-use'
+  if (m === 'POST' || m === 'PUT' || m === 'PATCH') return 'relation-target-not-found'
+  return 'foreign-key-violation'
+}
+
+const FK_PROBLEM: Record<FkViolationKind, { title: string; status: 409 | 422; detail: string }> = {
+  'relation-in-use': {
+    title: 'Relation In Use',
+    status: 409,
+    detail: 'The record cannot be deleted because it is referenced by one or more related entries.',
+  },
+  'relation-target-not-found': {
+    title: 'Relation Target Not Found',
+    status: 422,
+    detail: 'The provided relation id does not match any existing record in the referenced collection.',
+  },
+  'foreign-key-violation': {
+    title: 'Foreign Key Violation',
+    status: 409,
+    detail: 'The operation violates a referential integrity constraint.',
+  },
+}
+
+/**
+ * Returns a Problem+JSON response when the error is a SQLite FK violation,
+ * or null when the error is unrelated (let the caller handle it).
+ *
+ * @param c       Hono context
+ * @param error   The caught error
+ * @param method  HTTP method of the current request (e.g. 'DELETE', 'POST')
+ */
+export function fkProblemOrNull(c: Context, error: unknown, method: string): Response | null {
+  if (!isFkError(error)) return null
+  const kind = classifyFkError(method)
+  const meta = FK_PROBLEM[kind]
+  return publicProblem(c, {
+    type: `https://beechcms.dev/problems/${kind}`,
+    title: meta.title,
+    status: meta.status,
+    detail: meta.detail,
+  })
+}
+
+export interface PublicProblemDetailItem {
+  field: string
+  expected: string
+  received: string
+  message: string
+}
+
+type PublicProblemInput = {
+  type: string
+  title: string
+  status: 400 | 401 | 403 | 404 | 405 | 409 | 422 | 429 | 500 | 501
+  detail: string
+  errors?: PublicProblemDetailItem[]
+}
+
+/**
+ * TODO: UPDATE DOMAIN ONCE REGISTERED
+ * Currently uses 'beechcms.dev' as a placeholder. 
+ * When a real domain is registered for BeechCMS, update the URL below 
+ * to point to the official API error documentation (RFC 9457).
+ */
+function normalizeProblemType(type: string): string {
+  if (type.startsWith('http://') || type.startsWith('https://')) {
+    return type
+  }
+  return `https://beechcms.dev/problems/${type}`
+}
+
+export function internalErrorDetail(env: { ENV?: string }, error: unknown): string {
+  if (env.ENV !== 'production' && error instanceof Error) return error.message
+  return 'An unexpected error occurred.'
+}
+
+/**
+ * Restituisce errori API in formato Problem Details (RFC 9457).
+ */
+export function publicProblem(c: Context, input: PublicProblemInput): Response {
+  const body: Record<string, unknown> = {
+    type: normalizeProblemType(input.type),
+    title: input.title,
+    status: input.status,
+    detail: input.detail,
+    instance: c.req.path,
+  }
+  if (input.errors && input.errors.length > 0) {
+    body.errors = input.errors
+  }
+  return c.json(body, input.status, {
+    'Content-Type': 'application/problem+json',
+  })
+}

package/src/public/public-add.ts

@@ -1,114 +1,114 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { isValidContentStatus, SlugConflictError } from '@beechcms/core'
-import type { Context } from 'hono'
-import { cleanStr } from '../shared/query-utils'
-import { checkPublicOperation } from './access-policy'
-import { publicProblem, internalErrorDetail } from './problem-details'
-import { generateEntrySlug, slugify } from './slug-utils'
-import { sanitizePublicPayload } from './sanitize'
-import { parseIdempotencyKey, buildRequestFingerprint } from './idempotency'
-import { AppEnv } from '../types'
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null
-}
-
-function pickSlug(body: Record<string, unknown>, sanitizedData: Record<string, unknown>): string {
-  const explicit = cleanStr(body.slug)
-  if (explicit) return slugify(explicit)
-  return generateEntrySlug({ title: sanitizedData.title, name: sanitizedData.name })
-}
-
-export async function publicAddHandler(context: Context<AppEnv>) {
-  const seedSlug = context.req.param('seed') ?? ''
-  const seed = context.get('getSeed')(seedSlug)
-  if (!seed) {
-    return publicProblem(context, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
-  }
-
-  const access = checkPublicOperation(seed, 'add')
-  if (!access.ok) {
-    return publicProblem(context, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
-  }
-
-  let body: Record<string, unknown>
-  try {
-    const parsed = await context.req.json<unknown>()
-    body = asRecord(parsed) ?? {}
-  } catch {
-    return publicProblem(context, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
-  }
-
-  const rawData = asRecord(body.data)
-  if (!rawData || Object.keys(rawData).length === 0) {
-    return publicProblem(context, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
-  }
-
-  const statusValue = body.status ?? 'draft'
-  if (!isValidContentStatus(statusValue)) {
-    return publicProblem(context, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
-  }
-
-  const sanitized = sanitizePublicPayload(seed, rawData, { operation: 'create', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true })
-  if (!sanitized.ok) {
-    if (sanitized.status === 422) {
-      return publicProblem(context, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
-    }
-    return publicProblem(context, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
-  }
-
-  const idempotencyKey = parseIdempotencyKey(context.req.header('Idempotency-Key'))
-  const finalSlug = pickSlug(body, sanitized.data) || context.get('idGenerator').uuid().slice(0, 8)
-  const repository = context.get('repository')
-  const idempotencyRepository = context.get('idempotencyRepository')
-
-  try {
-    const now = Math.floor(Date.now() / 1000)
-    const fingerprint = await buildRequestFingerprint({ seedSlug, statusValue, slug: cleanStr(body.slug) ?? null, data: sanitized.data })
-    const idempotencyTtl = Math.max(60, Number.parseInt(context.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
-
-    if (idempotencyKey) {
-      const existing = await idempotencyRepository.lookup(idempotencyKey)
-      if (existing && existing.expiresAt >= now) {
-        if (existing.fingerprint !== fingerprint) {
-          return publicProblem(context, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
-        }
-        let parsedBody: unknown = null
-        try { parsedBody = JSON.parse(existing.responseBody) } catch { parsedBody = { success: true } }
-        return context.json(parsedBody, existing.responseStatus as 201)
-      }
-    }
-
-    const id = context.get('idGenerator').uuid()
-
-    try {
-      await repository.create(seed, id, finalSlug, statusValue as any, sanitized.data)
-    } catch (error) {
-      if (error instanceof SlugConflictError) {
-        return publicProblem(context, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` })
-      }
-      throw error
-    }
-
-    const responseBody = { success: true, id, slug: finalSlug }
-    if (idempotencyKey) {
-      await idempotencyRepository.store({ key: idempotencyKey, fingerprint, responseStatus: 201, responseBody: JSON.stringify(responseBody), expiresAt: now + idempotencyTtl })
-    }
-
-    context.get('notificationService').notify({
-      title: `${seed.label}: New entry`,
-      message: `A new entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") has been added via the public API.`,
-      type: 'success',
-    })
-
-    return context.json(responseBody, 201)
-  } catch (error) {
-    console.error('Public add error:', error)
-    return publicProblem(context, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: internalErrorDetail(context.env, error) })
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { isValidContentStatus, SlugConflictError } from '@beechcms/core'
+import type { Context } from 'hono'
+import { cleanStr } from '../shared/query-utils'
+import { checkPublicOperation } from './access-policy'
+import { publicProblem, internalErrorDetail } from './problem-details'
+import { generateEntrySlug, slugify } from './slug-utils'
+import { sanitizePublicPayload } from './sanitize'
+import { parseIdempotencyKey, buildRequestFingerprint } from './idempotency'
+import { AppEnv } from '../types'
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function pickSlug(body: Record<string, unknown>, sanitizedData: Record<string, unknown>): string {
+  const explicit = cleanStr(body.slug)
+  if (explicit) return slugify(explicit)
+  return generateEntrySlug({ title: sanitizedData.title, name: sanitizedData.name })
+}
+
+export async function publicAddHandler(context: Context<AppEnv>) {
+  const seedSlug = context.req.param('seed') ?? ''
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) {
+    return publicProblem(context, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
+  }
+
+  const access = checkPublicOperation(seed, 'add')
+  if (!access.ok) {
+    return publicProblem(context, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    const parsed = await context.req.json<unknown>()
+    body = asRecord(parsed) ?? {}
+  } catch {
+    return publicProblem(context, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
+  }
+
+  const rawData = asRecord(body.data)
+  if (!rawData || Object.keys(rawData).length === 0) {
+    return publicProblem(context, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
+  }
+
+  const statusValue = body.status ?? 'draft'
+  if (!isValidContentStatus(statusValue)) {
+    return publicProblem(context, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
+  }
+
+  const sanitized = sanitizePublicPayload(seed, rawData, { operation: 'create', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true })
+  if (!sanitized.ok) {
+    if (sanitized.status === 422) {
+      return publicProblem(context, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
+    }
+    return publicProblem(context, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
+  }
+
+  const idempotencyKey = parseIdempotencyKey(context.req.header('Idempotency-Key'))
+  const finalSlug = pickSlug(body, sanitized.data) || context.get('idGenerator').uuid().slice(0, 8)
+  const repository = context.get('repository')
+  const idempotencyRepository = context.get('idempotencyRepository')
+
+  try {
+    const now = Math.floor(Date.now() / 1000)
+    const fingerprint = await buildRequestFingerprint({ seedSlug, statusValue, slug: cleanStr(body.slug) ?? null, data: sanitized.data })
+    const idempotencyTtl = Math.max(60, Number.parseInt(context.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
+
+    if (idempotencyKey) {
+      const existing = await idempotencyRepository.lookup(idempotencyKey)
+      if (existing && existing.expiresAt >= now) {
+        if (existing.fingerprint !== fingerprint) {
+          return publicProblem(context, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
+        }
+        let parsedBody: unknown = null
+        try { parsedBody = JSON.parse(existing.responseBody) } catch { parsedBody = { success: true } }
+        return context.json(parsedBody, existing.responseStatus as 201)
+      }
+    }
+
+    const id = context.get('idGenerator').uuid()
+
+    try {
+      await repository.create(seed, id, finalSlug, statusValue as any, sanitized.data)
+    } catch (error) {
+      if (error instanceof SlugConflictError) {
+        return publicProblem(context, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` })
+      }
+      throw error
+    }
+
+    const responseBody = { success: true, id, slug: finalSlug }
+    if (idempotencyKey) {
+      await idempotencyRepository.store({ key: idempotencyKey, fingerprint, responseStatus: 201, responseBody: JSON.stringify(responseBody), expiresAt: now + idempotencyTtl })
+    }
+
+    context.get('notificationService').notify({
+      title: `${seed.label}: New entry`,
+      message: `A new entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") has been added via the public API.`,
+      type: 'success',
+    })
+
+    return context.json(responseBody, 201)
+  } catch (error) {
+    console.error('Public add error:', error)
+    return publicProblem(context, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: internalErrorDetail(context.env, error) })
+  }
+}