@btst/stack 3.0.0-rc.1 → 3.0.0-rc.3

package/dist/packages/stack/src/plugins/cms/api/operations.mjs

@@ -0,0 +1,1756 @@
+import { defineOperation, OperationHttpError } from '@btst/stack/plugins/api';
+import { z } from 'zod';
+import { formSchemaToZod } from '../../../../../ui/src/lib/schema-converter.mjs';
+import { cmsPermissions } from '../../../../../../plugins/cms/permissions.mjs';
+import { createListContentQuerySchema, DEFAULT_MAX_PAGE_SIZE } from '../schemas.mjs';
+import { slugify } from '../utils.mjs';
+import { serializeContentType, getAllContentItems, getContentItemBySlug, serializeContentItemWithType } from './getters.mjs';
+import { syncRelations, extractRelationFields, isNewRelationValue, isExistingRelationValue } from './relations.mjs';
+
+function operationContentType(contentType) {
+  return { ...contentType };
+}
+function operationContentItem(item) {
+  const {
+    parsedData,
+    contentType,
+    _relations,
+    ...serializedItem
+  } = item;
+  return {
+    ...serializedItem,
+    parsedData,
+    ...contentType ? { contentType: operationContentType(contentType) } : {}
+  };
+}
+function operationContentList(result) {
+  return {
+    items: result.items.map(operationContentItem),
+    total: result.total,
+    ...result.limit !== void 0 ? { limit: result.limit } : {},
+    ...result.offset !== void 0 ? { offset: result.offset } : {}
+  };
+}
+const JSONValueSchema = z.lazy(
+  () => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(JSONValueSchema),
+    z.record(z.string(), JSONValueSchema)
+  ])
+);
+const CMSDataSchema = z.record(
+  z.string(),
+  JSONValueSchema
+);
+const EmptyInputSchema = z.object({});
+const CMSContentTypeParamsSchema = z.object({
+  slug: z.string().min(1)
+});
+const CMSContentItemParamsSchema = z.object({
+  typeSlug: z.string().min(1),
+  id: z.string().min(1)
+});
+const CMSCreateContentItemBodySchema = z.object({
+  slug: z.string().min(1),
+  data: CMSDataSchema
+});
+const CMSUpdateContentItemBodySchema = z.object({
+  slug: z.string().min(1).optional(),
+  data: CMSDataSchema.optional()
+});
+const ListContentTypesInputSchema = EmptyInputSchema;
+const GetContentTypeInputSchema = CMSContentTypeParamsSchema;
+const GetContentItemInputSchema = CMSContentItemParamsSchema;
+const CreateContentItemInputSchema = z.object({
+  typeSlug: z.string().min(1),
+  body: CMSCreateContentItemBodySchema
+});
+const UpdateContentItemInputSchema = z.object({
+  typeSlug: z.string().min(1),
+  id: z.string().min(1),
+  body: CMSUpdateContentItemBodySchema
+});
+const DeleteContentItemInputSchema = CMSContentItemParamsSchema;
+class CMSOperationError extends OperationHttpError {
+  constructor(statusCode, message, code = "CMS_OPERATION_ERROR", issues) {
+    super(statusCode, message, code, issues);
+    this.name = "CMSOperationError";
+  }
+}
+function normalizeOperationError(error, fallback) {
+  if (error instanceof Error) return error;
+  return new Error(typeof error === "string" ? error : fallback, {
+    cause: error
+  });
+}
+async function runBeforeHook(hook, defaultMessage) {
+  if (!hook) return;
+  try {
+    await hook();
+  } catch (error) {
+    throw new CMSOperationError(
+      403,
+      error instanceof Error ? error.message : defaultMessage,
+      "HOOK_DENIED"
+    );
+  }
+}
+function requestFields(context) {
+  return {
+    ...context.request ? { request: context.request, headers: context.request.headers } : {},
+    ...context.identity ? { userId: context.identity.id } : {}
+  };
+}
+function createContext(context) {
+  return Object.freeze({
+    ...context,
+    typeSlug: context.facts.contentType,
+    body: context.input.body,
+    ...requestFields(context)
+  });
+}
+function updateContext(context) {
+  return Object.freeze({
+    ...context,
+    typeSlug: context.facts.contentType,
+    params: Object.freeze({
+      typeSlug: context.facts.contentType,
+      id: context.facts.recordId
+    }),
+    body: context.input.body,
+    ...requestFields(context)
+  });
+}
+function deleteContext(context) {
+  return Object.freeze({
+    ...context,
+    typeSlug: context.facts.contentType,
+    params: Object.freeze({
+      typeSlug: context.facts.contentType,
+      id: context.facts.recordId
+    }),
+    ...requestFields(context)
+  });
+}
+function genericContext(context, typeSlug) {
+  return Object.freeze({
+    ...context,
+    ...typeSlug ? { typeSlug } : {},
+    ...requestFields(context)
+  });
+}
+function operationErrorContext(context, error) {
+  return Object.freeze({ ...context, error });
+}
+function getContentTypeZodSchema(contentType) {
+  return formSchemaToZod(JSON.parse(contentType.jsonSchema));
+}
+async function getContentTypeOrThrow(adapter, ensureSynced, slug, message = "Content type not found") {
+  await ensureSynced();
+  const contentType = await adapter.findOne({
+    model: "contentType",
+    where: [{ field: "slug", value: slug, operator: "eq" }]
+  });
+  if (!contentType) {
+    throw new CMSOperationError(404, message, "CONTENT_TYPE_NOT_FOUND");
+  }
+  return contentType;
+}
+async function getRecordOrThrow(adapter, ensureSynced, typeSlug, id) {
+  await ensureSynced();
+  const item = await adapter.findOne({
+    model: "contentItem",
+    where: [{ field: "id", value: id, operator: "eq" }],
+    join: { contentType: true }
+  });
+  if (!item || item.contentType?.slug !== typeSlug) {
+    throw new CMSOperationError(
+      404,
+      "Content item not found",
+      "RECORD_NOT_FOUND"
+    );
+  }
+  return item;
+}
+function recordFacts(item) {
+  if (!item.contentType) {
+    throw new CMSOperationError(
+      500,
+      "Content item is missing its content type",
+      "CONTENT_TYPE_JOIN_MISSING"
+    );
+  }
+  return {
+    contentType: item.contentType.slug,
+    scope: "record",
+    recordId: item.id,
+    ...item.authorId ? { authorId: item.authorId } : {}
+  };
+}
+function collectionFacts(contentType) {
+  return { contentType, scope: "collection" };
+}
+function assertRecordFacts(item, facts) {
+  if (!facts.recordId || item.id !== facts.recordId || item.contentType?.slug !== facts.contentType || (item.authorId ?? void 0) !== facts.authorId) {
+    throw staleRecordError();
+  }
+}
+const AFFECTED_ROW_KEYS = [
+  "rowCount",
+  "affectedRows",
+  "rowsAffected",
+  "changes",
+  "numUpdatedRows"
+];
+function hasPositiveCount(value) {
+  if (typeof value === "number") return Number.isFinite(value) && value > 0;
+  if (typeof value === "bigint") return value > 0n;
+  return false;
+}
+function didUpdateContentItem(result, expectedId) {
+  if (typeof result === "number" || typeof result === "bigint") {
+    return hasPositiveCount(result);
+  }
+  if (!result || typeof result !== "object") return false;
+  const record = result;
+  if ("count" in record) return hasPositiveCount(record.count);
+  if (Array.isArray(result)) {
+    return result.length > 0 && didUpdateContentItem(result[0], expectedId);
+  }
+  for (const key of AFFECTED_ROW_KEYS) {
+    if (key in record) return hasPositiveCount(record[key]);
+  }
+  if ("meta" in record) {
+    const meta = record.meta;
+    return Boolean(
+      meta && typeof meta === "object" && "changes" in meta && hasPositiveCount(meta.changes)
+    );
+  }
+  return record.id === expectedId;
+}
+function staleRecordError() {
+  return new CMSOperationError(
+    409,
+    "Content item changed while authorization was being evaluated. Retry the operation.",
+    "RECORD_STATE_CHANGED"
+  );
+}
+function assertRecordSnapshot(current, expected) {
+  if (current.id !== expected.id || current.contentTypeId !== expected.contentTypeId || current.contentType?.slug !== expected.contentType?.slug || (current.authorId ?? void 0) !== (expected.authorId ?? void 0) || current.slug !== expected.slug || current.data !== expected.data || current.updatedAt.getTime() !== expected.updatedAt.getTime()) {
+    throw staleRecordError();
+  }
+}
+async function planRelatedItem(adapter, targetContentType, slug, data, authorId) {
+  const validation = getContentTypeZodSchema(targetContentType).safeParse(data);
+  if (!validation.success) {
+    throw new CMSOperationError(
+      400,
+      `Validation failed for new ${targetContentType.slug}`,
+      "RELATED_RECORD_VALIDATION_FAILED",
+      validation.error.issues
+    );
+  }
+  const existing = await adapter.findOne({
+    model: "contentItem",
+    where: [
+      {
+        field: "contentTypeId",
+        value: targetContentType.id,
+        operator: "eq"
+      },
+      { field: "slug", value: slug, operator: "eq" }
+    ]
+  });
+  if (existing) {
+    throw relatedRecordSlugConflictError();
+  }
+  const now = /* @__PURE__ */ new Date();
+  return {
+    id: globalThis.crypto.randomUUID(),
+    contentTypeId: targetContentType.id,
+    slug,
+    data: JSON.stringify(validation.data),
+    ...authorId ? { authorId } : {},
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function relatedRecordSlugConflictError() {
+  return new CMSOperationError(
+    409,
+    "Inline related record could not be created because its slug is unavailable.",
+    "RELATED_RECORD_SLUG_CONFLICT"
+  );
+}
+async function planRelationsInData(adapter, contentType, data, ensureSynced, authorId) {
+  const relationFields = extractRelationFields(contentType);
+  const processedData = { ...data };
+  const relationIds = {};
+  const newItems = [];
+  const plannedSlugs = /* @__PURE__ */ new Set();
+  for (const [fieldName, relationConfig] of Object.entries(relationFields)) {
+    if (!(fieldName in data)) continue;
+    const fieldValue = data[fieldName];
+    if (!fieldValue) {
+      relationIds[fieldName] = [];
+      continue;
+    }
+    const targetContentType = await getContentTypeOrThrow(
+      adapter,
+      ensureSynced,
+      relationConfig.targetType,
+      `Target content type "${relationConfig.targetType}" not found for relation field "${fieldName}"`
+    );
+    const ids = [];
+    if (relationConfig.type === "belongsTo") {
+      const value = fieldValue;
+      if (isNewRelationValue(value)) {
+        const item = await resolvePlannedRelatedItem(
+          adapter,
+          targetContentType,
+          value.data,
+          authorId,
+          plannedSlugs,
+          newItems
+        );
+        ids.push(item.id);
+        processedData[fieldName] = { id: item.id };
+      } else if (isExistingRelationValue(value)) {
+        ids.push(value.id);
+      }
+    } else {
+      const values = Array.isArray(fieldValue) ? fieldValue : [];
+      const processedValues = [];
+      for (const value of values) {
+        if (isNewRelationValue(value)) {
+          const item = await resolvePlannedRelatedItem(
+            adapter,
+            targetContentType,
+            value.data,
+            authorId,
+            plannedSlugs,
+            newItems
+          );
+          ids.push(item.id);
+          processedValues.push({ id: item.id });
+        } else if (isExistingRelationValue(value)) {
+          ids.push(value.id);
+          processedValues.push({ id: value.id });
+        }
+      }
+      processedData[fieldName] = processedValues;
+    }
+    relationIds[fieldName] = ids;
+  }
+  return { processedData, relationIds, newItems };
+}
+async function resolvePlannedRelatedItem(adapter, targetContentType, data, authorId, plannedSlugs, newItems) {
+  const slug = slugify(
+    data.slug || data.name || data.title || `item-${Date.now()}`
+  );
+  const key = `${targetContentType.id}\0${slug}`;
+  if (plannedSlugs.has(key)) throw relatedRecordSlugConflictError();
+  const planned = await planRelatedItem(
+    adapter,
+    targetContentType,
+    slug,
+    data,
+    authorId
+  );
+  plannedSlugs.add(key);
+  newItems.push(planned);
+  return planned;
+}
+async function applyRelationWritePlan(adapter, plan) {
+  for (const item of plan.newItems) {
+    const existing = await adapter.findOne({
+      model: "contentItem",
+      where: [
+        {
+          field: "contentTypeId",
+          value: item.contentTypeId,
+          operator: "eq"
+        },
+        { field: "slug", value: item.slug, operator: "eq" }
+      ]
+    });
+    if (existing) throw staleRecordError();
+    await adapter.create({
+      model: "contentItem",
+      data: item
+    });
+  }
+}
+function relationFilterSnapshot(sourceContentType, fieldName, relation, targetContentType) {
+  return JSON.stringify([
+    sourceContentType.id,
+    sourceContentType.slug,
+    fieldName,
+    relation.type,
+    targetContentType.id,
+    targetContentType.slug
+  ]);
+}
+async function deriveRelationFilterAuthorization(adapter, ensureSynced, sourceContentType, fieldName, targetId) {
+  const relation = extractRelationFields(sourceContentType)[fieldName];
+  if (!relation) {
+    throw new CMSOperationError(
+      404,
+      `Relation field "${fieldName}" was not found on content type "${sourceContentType.slug}".`,
+      "RELATION_FIELD_NOT_FOUND"
+    );
+  }
+  const targetContentType = await getContentTypeOrThrow(
+    adapter,
+    ensureSynced,
+    relation.targetType,
+    `Target content type "${relation.targetType}" not found for relation field "${fieldName}"`
+  );
+  const target = await getRecordOrThrow(
+    adapter,
+    ensureSynced,
+    targetContentType.slug,
+    targetId
+  );
+  const targetFacts = recordFacts(target);
+  return {
+    permission: cmsPermissions.record.read(targetFacts),
+    snapshot: relationFilterSnapshot(
+      sourceContentType,
+      fieldName,
+      relation,
+      targetContentType
+    ),
+    targetFacts
+  };
+}
+function relationTargetSnapshot(facts) {
+  return JSON.stringify([
+    facts.contentType,
+    facts.recordId,
+    facts.authorId ?? null
+  ]);
+}
+async function deriveRelationWriteAuthorization(adapter, contentType, data, ensureSynced, expectedSchemaSnapshot) {
+  const permissions = [];
+  const snapshot = [];
+  const targets = [];
+  const seenCreateTargetTypes = /* @__PURE__ */ new Set();
+  const seenReadTargets = /* @__PURE__ */ new Set();
+  const resolvedRelations = [];
+  for (const [fieldName, relationConfig] of Object.entries(
+    extractRelationFields(contentType)
+  )) {
+    if (!(fieldName in data)) continue;
+    const value = data[fieldName];
+    const values = relationConfig.type === "belongsTo" ? [value] : Array.isArray(value) ? value : [];
+    const targetContentType = await getContentTypeOrThrow(
+      adapter,
+      ensureSynced,
+      relationConfig.targetType,
+      `Target content type "${relationConfig.targetType}" not found for relation field "${fieldName}"`
+    );
+    snapshot.push(
+      JSON.stringify([
+        fieldName,
+        relationConfig.type,
+        targetContentType.id,
+        targetContentType.slug
+      ])
+    );
+    resolvedRelations.push({ values, targetContentType });
+  }
+  snapshot.sort();
+  if (expectedSchemaSnapshot) {
+    assertRelationSchemaSnapshot(expectedSchemaSnapshot, snapshot);
+  }
+  for (const { values, targetContentType } of resolvedRelations) {
+    if (values.some(isNewRelationValue) && !seenCreateTargetTypes.has(targetContentType.slug)) {
+      seenCreateTargetTypes.add(targetContentType.slug);
+      permissions.push(
+        cmsPermissions.record.create({ contentType: targetContentType.slug })
+      );
+    }
+    for (const reference of values) {
+      if (isNewRelationValue(reference) || !isExistingRelationValue(reference)) {
+        continue;
+      }
+      const target = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        targetContentType.slug,
+        reference.id
+      );
+      const facts = recordFacts(target);
+      const targetKey = relationTargetSnapshot(facts);
+      if (seenReadTargets.has(targetKey)) continue;
+      seenReadTargets.add(targetKey);
+      targets.push(facts);
+      permissions.push(cmsPermissions.record.read(facts));
+    }
+  }
+  return {
+    permissions,
+    snapshot,
+    targets: targets.sort(
+      (left, right) => relationTargetSnapshot(left).localeCompare(relationTargetSnapshot(right))
+    )
+  };
+}
+function assertRelationSchemaSnapshot(authorized, current) {
+  if (JSON.stringify(authorized) !== JSON.stringify(current)) {
+    throw relationSchemaChangedError();
+  }
+}
+function assertRelationWriteAuthorization(authorized, current) {
+  assertRelationSchemaSnapshot(authorized.snapshot, current.snapshot);
+  if (JSON.stringify(authorized.targets.map(relationTargetSnapshot)) !== JSON.stringify(current.targets.map(relationTargetSnapshot))) {
+    throw staleRecordError();
+  }
+}
+function relationSchemaChangedError() {
+  return new CMSOperationError(
+    409,
+    "Content type relations changed while authorization was being evaluated. Retry the operation.",
+    "RELATION_SCHEMA_CHANGED"
+  );
+}
+async function getPopulatedRelationSnapshot(adapter, sourceId) {
+  const relations = await adapter.findMany({
+    model: "contentRelation",
+    where: [{ field: "sourceId", value: sourceId, operator: "eq" }]
+  });
+  const targets = [];
+  const seenTargets = /* @__PURE__ */ new Set();
+  for (const relation of relations) {
+    if (seenTargets.has(relation.targetId)) continue;
+    const target = await adapter.findOne({
+      model: "contentItem",
+      where: [
+        { field: "id", value: relation.targetId, operator: "eq" }
+      ],
+      join: { contentType: true }
+    });
+    if (!target) continue;
+    seenTargets.add(target.id);
+    targets.push({
+      item: serializeContentItemWithType(target),
+      facts: recordFacts(target)
+    });
+  }
+  return {
+    relationKeys: relations.map((relation) => `${relation.fieldName}\0${relation.targetId}`).sort(),
+    targets: targets.sort(
+      (left, right) => (left.facts.recordId ?? "").localeCompare(right.facts.recordId ?? "")
+    )
+  };
+}
+function assertPopulatedRelationSnapshot(authorized, current) {
+  const factsKey = (facts) => JSON.stringify([facts.contentType, facts.recordId, facts.authorId ?? null]);
+  if (JSON.stringify(authorized.relationKeys) !== JSON.stringify(current.relationKeys) || JSON.stringify(authorized.targets.map(({ facts }) => factsKey(facts))) !== JSON.stringify(current.targets.map(({ facts }) => factsKey(facts)))) {
+    throw new CMSOperationError(
+      409,
+      "Related content changed while authorization was being evaluated. Retry the operation.",
+      "RECORD_STATE_CHANGED"
+    );
+  }
+}
+function populatedRelationsFromSnapshot(snapshot) {
+  const targetsById = new Map(
+    snapshot.targets.map((target) => [target.facts.recordId, target.item])
+  );
+  const populated = {};
+  for (const relationKey of snapshot.relationKeys) {
+    const [fieldName, targetId] = relationKey.split("\0");
+    if (!fieldName || !targetId) continue;
+    const target = targetsById.get(targetId);
+    if (target) (populated[fieldName] ??= []).push(target);
+  }
+  return populated;
+}
+function inverseSourceKey(source) {
+  return JSON.stringify([
+    source.contentTypeId,
+    source.contentTypeSlug,
+    source.contentTypeName,
+    source.fieldName
+  ]);
+}
+async function deriveInverseSourceAuthorization(adapter, ensureSynced, targetType) {
+  await ensureSynced();
+  const permissions = [];
+  const sources = [];
+  const seenSourceTypes = /* @__PURE__ */ new Set();
+  for (const contentType of await adapter.findMany({
+    model: "contentType"
+  })) {
+    for (const [fieldName, relation] of Object.entries(
+      extractRelationFields(contentType)
+    )) {
+      if (relation.type !== "belongsTo" || relation.targetType !== targetType) {
+        continue;
+      }
+      sources.push({
+        contentTypeId: contentType.id,
+        contentTypeSlug: contentType.slug,
+        contentTypeName: contentType.name,
+        fieldName
+      });
+      if (seenSourceTypes.has(contentType.slug)) continue;
+      seenSourceTypes.add(contentType.slug);
+      permissions.push(
+        cmsPermissions.contentType.read({ contentType: contentType.slug })
+      );
+    }
+  }
+  sources.sort(
+    (left, right) => inverseSourceKey(left).localeCompare(inverseSourceKey(right))
+  );
+  return {
+    permissions,
+    snapshot: sources.map(inverseSourceKey),
+    sources
+  };
+}
+async function listRecordsForRelation(adapter, contentType, fieldName, targetId, limit, offset) {
+  const relations = await adapter.findMany({
+    model: "contentRelation",
+    where: [
+      { field: "targetId", value: targetId, operator: "eq" },
+      { field: "fieldName", value: fieldName, operator: "eq" }
+    ]
+  });
+  const ids = [...new Set(relations.map((relation) => relation.sourceId))];
+  const items = [];
+  for (const id of ids) {
+    const item = await adapter.findOne({
+      model: "contentItem",
+      where: [
+        { field: "id", value: id, operator: "eq" },
+        {
+          field: "contentTypeId",
+          value: contentType.id,
+          operator: "eq"
+        }
+      ],
+      join: { contentType: true }
+    });
+    if (item) items.push(item);
+  }
+  items.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  return {
+    items: items.slice(offset, offset + limit).map(serializeContentItemWithType),
+    total: items.length,
+    limit,
+    offset
+  };
+}
+function createCMSOperations(adapter, options) {
+  const { ensureSynced, getContentTypesWithCounts, hooks } = options;
+  const populatedRelationSnapshots = /* @__PURE__ */ new WeakMap();
+  const relationWriteAuthorizationSnapshots = /* @__PURE__ */ new WeakMap();
+  const relationFilterAuthorizationSnapshots = /* @__PURE__ */ new WeakMap();
+  const inverseSourceAuthorizationSnapshots = /* @__PURE__ */ new WeakMap();
+  const inverseTargetAuthorizationSnapshots = /* @__PURE__ */ new WeakMap();
+  const contentTypeListSnapshots = /* @__PURE__ */ new WeakMap();
+  const assertCurrentRelationWriteAuthorization = async (currentAdapter, authorized, contentTypeSlug, data) => {
+    let current;
+    try {
+      const contentType = await getContentTypeOrThrow(
+        currentAdapter,
+        ensureSynced,
+        contentTypeSlug
+      );
+      current = await deriveRelationWriteAuthorization(
+        currentAdapter,
+        contentType,
+        data,
+        ensureSynced,
+        authorized.snapshot
+      );
+    } catch (error) {
+      if (error instanceof CMSOperationError) {
+        if (error.code === "CONTENT_TYPE_NOT_FOUND") {
+          throw relationSchemaChangedError();
+        }
+        if (error.code === "RECORD_NOT_FOUND") throw staleRecordError();
+      }
+      throw error;
+    }
+    assertRelationWriteAuthorization(authorized, current);
+  };
+  const recheckRelationWriteAuthorization = async (input, contentTypeSlug, data) => {
+    const authorized = relationWriteAuthorizationSnapshots.get(input);
+    relationWriteAuthorizationSnapshots.delete(input);
+    if (!authorized) {
+      throw new CMSOperationError(
+        500,
+        "Relation authorization snapshot is unavailable.",
+        "AUTHORIZATION_SNAPSHOT_MISSING"
+      );
+    }
+    await assertCurrentRelationWriteAuthorization(
+      adapter,
+      authorized,
+      contentTypeSlug,
+      data
+    );
+    return authorized;
+  };
+  const recheckInverseSourceAuthorization = async (input, targetType) => {
+    const authorized = inverseSourceAuthorizationSnapshots.get(input);
+    inverseSourceAuthorizationSnapshots.delete(input);
+    if (!authorized) {
+      throw new CMSOperationError(
+        500,
+        "Inverse relation authorization snapshot is unavailable.",
+        "AUTHORIZATION_SNAPSHOT_MISSING"
+      );
+    }
+    const current = await deriveInverseSourceAuthorization(
+      adapter,
+      ensureSynced,
+      targetType
+    );
+    assertRelationSchemaSnapshot(authorized, current.snapshot);
+    return current.sources;
+  };
+  const recheckRelationFilterAuthorization = async (input, sourceType, fieldName, targetId) => {
+    const authorized = relationFilterAuthorizationSnapshots.get(input);
+    relationFilterAuthorizationSnapshots.delete(input);
+    if (!authorized) {
+      throw new CMSOperationError(
+        500,
+        "Relation-filter authorization snapshot is unavailable.",
+        "AUTHORIZATION_SNAPSHOT_MISSING"
+      );
+    }
+    let sourceContentType;
+    try {
+      sourceContentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        sourceType
+      );
+    } catch (error) {
+      if (error instanceof CMSOperationError && error.code === "CONTENT_TYPE_NOT_FOUND") {
+        throw relationSchemaChangedError();
+      }
+      throw error;
+    }
+    const relation = extractRelationFields(sourceContentType)[fieldName];
+    if (!relation) throw relationSchemaChangedError();
+    let targetContentType;
+    try {
+      targetContentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        relation.targetType
+      );
+    } catch (error) {
+      if (error instanceof CMSOperationError && error.code === "CONTENT_TYPE_NOT_FOUND") {
+        throw relationSchemaChangedError();
+      }
+      throw error;
+    }
+    const currentSnapshot = relationFilterSnapshot(
+      sourceContentType,
+      fieldName,
+      relation,
+      targetContentType
+    );
+    if (authorized.snapshot !== currentSnapshot) {
+      throw relationSchemaChangedError();
+    }
+    let target;
+    try {
+      target = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        targetContentType.slug,
+        targetId
+      );
+    } catch (error) {
+      if (error instanceof CMSOperationError && error.code === "RECORD_NOT_FOUND") {
+        throw staleRecordError();
+      }
+      throw error;
+    }
+    const currentFacts = recordFacts(target);
+    if (authorized.targetFacts.contentType !== currentFacts.contentType || authorized.targetFacts.recordId !== currentFacts.recordId || authorized.targetFacts.authorId !== currentFacts.authorId) {
+      throw staleRecordError();
+    }
+    return sourceContentType;
+  };
+  const recheckInverseTargetAuthorization = async (input, targetType, targetId) => {
+    const authorized = inverseTargetAuthorizationSnapshots.get(input);
+    if (!authorized || authorized.contentType !== targetType || authorized.recordId !== targetId) {
+      throw new CMSOperationError(
+        500,
+        "Inverse-relation target authorization snapshot is unavailable.",
+        "AUTHORIZATION_SNAPSHOT_MISSING"
+      );
+    }
+    const current = await adapter.findOne({
+      model: "contentItem",
+      where: [{ field: "id", value: targetId, operator: "eq" }],
+      join: { contentType: true }
+    });
+    if (!current) throw staleRecordError();
+    assertRecordFacts(current, authorized);
+  };
+  const listQuerySchema = createListContentQuerySchema(options.maxPageSize);
+  const paginationSchema = z.object({
+    limit: z.coerce.number().min(1).max(options.maxPageSize ?? DEFAULT_MAX_PAGE_SIZE).optional().default(20),
+    offset: z.coerce.number().min(0).optional().default(0)
+  });
+  const ListContentItemsInputSchema = z.object({
+    typeSlug: z.string().min(1),
+    query: listQuerySchema
+  });
+  const ListContentByRelationInputSchema = z.object({
+    typeSlug: z.string().min(1),
+    query: z.object({ field: z.string().min(1), targetId: z.string().min(1) }).merge(paginationSchema)
+  });
+  const GetInverseRelationsInputSchema = z.object({
+    slug: z.string().min(1),
+    query: z.object({ itemId: z.string().min(1).optional() })
+  });
+  const ListInverseRelationItemsInputSchema = z.object({
+    slug: z.string().min(1),
+    sourceType: z.string().min(1),
+    query: z.object({
+      itemId: z.string().min(1),
+      fieldName: z.string().min(1)
+    }).merge(paginationSchema)
+  });
+  const notifyError = async (error, operation, context) => {
+    await hooks?.onErrorExecuteContentOperation?.(
+      normalizeOperationError(error, `CMS ${operation} operation failed.`),
+      operation,
+      operationErrorContext(context, error)
+    );
+  };
+  const listContentTypes = defineOperation({
+    input: ListContentTypesInputSchema,
+    permission: cmsPermissions.contentType.read,
+    facts: async () => {
+      await ensureSynced();
+      return {};
+    },
+    additionalPermissions: async ({ input }) => {
+      const contentTypes = await getContentTypesWithCounts();
+      contentTypeListSnapshots.set(input, contentTypes);
+      return contentTypes.map(
+        (contentType) => cmsPermissions.record.read(collectionFacts(contentType.slug))
+      );
+    },
+    execute: ({ input }) => {
+      const contentTypes = contentTypeListSnapshots.get(input);
+      contentTypeListSnapshots.delete(input);
+      if (!contentTypes) {
+        throw new CMSOperationError(
+          500,
+          "Content-type catalog authorization snapshot is unavailable.",
+          "AUTHORIZATION_SNAPSHOT_MISSING"
+        );
+      }
+      return contentTypes.map((contentType) => ({
+        ...operationContentType(contentType),
+        itemCount: contentType.itemCount
+      }));
+    },
+    onError: ({ error, ...context }) => notifyError(error, "list", genericContext(context))
+  });
+  const getContentTypeBySlug = defineOperation({
+    input: GetContentTypeInputSchema,
+    permission: cmsPermissions.contentType.read,
+    facts: async ({ input }) => {
+      const contentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        input.slug
+      );
+      return { contentType: contentType.slug };
+    },
+    execute: async ({ facts }) => operationContentType(
+      serializeContentType(
+        await getContentTypeOrThrow(
+          adapter,
+          ensureSynced,
+          facts.contentType ?? ""
+        )
+      )
+    ),
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "get",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const listContentItems = defineOperation({
+    input: ListContentItemsInputSchema,
+    permission: cmsPermissions.record.read,
+    facts: async ({ input }) => {
+      const contentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        input.typeSlug
+      );
+      if (!input.query.slug) {
+        return collectionFacts(contentType.slug);
+      }
+      const item = await getContentItemBySlug(
+        adapter,
+        contentType.slug,
+        input.query.slug
+      );
+      const facts = {
+        contentType: contentType.slug,
+        scope: "record",
+        ...item ? {
+          recordId: item.id,
+          ...item.authorId ? { authorId: item.authorId } : {}
+        } : {}
+      };
+      return facts;
+    },
+    additionalPermissions: ({ facts }) => [
+      cmsPermissions.contentType.read({ contentType: facts.contentType })
+    ],
+    execute: async ({ input, facts }) => {
+      const result = await getAllContentItems(
+        adapter,
+        facts.contentType,
+        input.query
+      );
+      if (facts.scope === "record") {
+        if (!facts.recordId) {
+          if (result.items.length > 0) throw staleRecordError();
+          if (await getContentItemBySlug(
+            adapter,
+            facts.contentType,
+            input.query.slug ?? ""
+          )) {
+            throw staleRecordError();
+          }
+          return operationContentList(result);
+        }
+        if (result.items.length > 1) throw staleRecordError();
+        if (result.items.length === 0) {
+          const current = await getContentItemBySlug(
+            adapter,
+            facts.contentType,
+            input.query.slug ?? ""
+          );
+          if (!current) throw staleRecordError();
+          assertRecordFacts(current, facts);
+        } else {
+          assertRecordFacts(result.items[0], facts);
+        }
+      }
+      return operationContentList(result);
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "list",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const getContentItem = defineOperation({
+    input: GetContentItemInputSchema,
+    permission: cmsPermissions.record.read,
+    facts: async ({ input }) => recordFacts(
+      await getRecordOrThrow(adapter, ensureSynced, input.typeSlug, input.id)
+    ),
+    additionalPermissions: ({ facts }) => [
+      cmsPermissions.contentType.read({ contentType: facts.contentType })
+    ],
+    execute: async ({ facts }) => {
+      const item = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        facts.contentType,
+        facts.recordId ?? ""
+      );
+      assertRecordFacts(item, facts);
+      return operationContentItem(serializeContentItemWithType(item));
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "get",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const createContentItem = defineOperation({
+    input: CreateContentItemInputSchema,
+    permission: cmsPermissions.record.create,
+    facts: async ({ input }) => ({
+      contentType: (await getContentTypeOrThrow(adapter, ensureSynced, input.typeSlug)).slug
+    }),
+    additionalPermissions: async ({ input, facts }) => {
+      const authorization = await deriveRelationWriteAuthorization(
+        adapter,
+        await getContentTypeOrThrow(adapter, ensureSynced, facts.contentType),
+        input.body.data,
+        ensureSynced
+      );
+      relationWriteAuthorizationSnapshots.set(input, authorization);
+      return [
+        cmsPermissions.contentType.read({ contentType: facts.contentType }),
+        ...authorization.permissions
+      ];
+    },
+    execute: async (context) => {
+      const lifecycleContext = createContext(context);
+      const contentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        context.facts.contentType
+      );
+      const slug = slugify(context.input.body.slug);
+      if (!slug) {
+        throw new CMSOperationError(
+          400,
+          "Invalid slug: must contain at least one alphanumeric character",
+          "INVALID_SLUG"
+        );
+      }
+      const relationAuthorization = await recheckRelationWriteAuthorization(
+        context.input,
+        contentType.slug,
+        context.input.body.data
+      );
+      const relationPlan = await planRelationsInData(
+        adapter,
+        contentType,
+        context.input.body.data,
+        ensureSynced,
+        context.identity?.id
+      );
+      const validation = getContentTypeZodSchema(contentType).safeParse(
+        relationPlan.processedData
+      );
+      if (!validation.success) {
+        throw new CMSOperationError(
+          400,
+          "Validation failed",
+          "RECORD_VALIDATION_FAILED",
+          validation.error.issues
+        );
+      }
+      const existing = await adapter.findOne({
+        model: "contentItem",
+        where: [
+          {
+            field: "contentTypeId",
+            value: contentType.id,
+            operator: "eq"
+          },
+          { field: "slug", value: slug, operator: "eq" }
+        ]
+      });
+      if (existing) {
+        throw new CMSOperationError(
+          409,
+          "Content item with this slug already exists",
+          "DUPLICATE_SLUG"
+        );
+      }
+      const validatedData = validation.data;
+      await runBeforeHook(
+        () => hooks?.onBeforeCreateContent?.(validatedData, lifecycleContext),
+        "Create operation denied"
+      );
+      return adapter.transaction(async (tx) => {
+        await assertCurrentRelationWriteAuthorization(
+          tx,
+          relationAuthorization,
+          contentType.slug,
+          context.input.body.data
+        );
+        const currentDuplicate = await tx.findOne({
+          model: "contentItem",
+          where: [
+            {
+              field: "contentTypeId",
+              value: contentType.id,
+              operator: "eq"
+            },
+            { field: "slug", value: slug, operator: "eq" }
+          ]
+        });
+        if (currentDuplicate) {
+          throw new CMSOperationError(
+            409,
+            "Content item with this slug already exists",
+            "DUPLICATE_SLUG"
+          );
+        }
+        await applyRelationWritePlan(tx, relationPlan);
+        const item = await tx.create({
+          model: "contentItem",
+          data: {
+            contentTypeId: contentType.id,
+            slug,
+            data: JSON.stringify(validatedData),
+            ...context.identity ? { authorId: context.identity.id } : {},
+            createdAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date()
+          }
+        });
+        await syncRelations(tx, item.id, relationPlan.relationIds);
+        const joined = await getRecordOrThrow(
+          tx,
+          ensureSynced,
+          contentType.slug,
+          item.id
+        );
+        return operationContentItem(serializeContentItemWithType(joined));
+      });
+    },
+    after: async (context) => {
+      const base = createContext(context);
+      const afterCreateContent = hooks?.onAfterCreateContent;
+      await afterCreateContent?.(
+        context.result,
+        Object.freeze({ ...base, result: context.result })
+      );
+    },
+    onError: async ({ error, ...context }) => {
+      await notifyError(error, "create", createContext(context));
+    }
+  });
+  const updateContentItem = defineOperation({
+    input: UpdateContentItemInputSchema,
+    permission: cmsPermissions.record.update,
+    facts: async ({ input }) => {
+      const item = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        input.typeSlug,
+        input.id
+      );
+      const facts = recordFacts(item);
+      return {
+        contentType: facts.contentType,
+        recordId: facts.recordId ?? input.id,
+        ...facts.authorId ? { authorId: facts.authorId } : {}
+      };
+    },
+    additionalPermissions: async ({ input, facts }) => {
+      const contentTypePermission = cmsPermissions.contentType.read({
+        contentType: facts.contentType
+      });
+      if (!input.body.data) return [contentTypePermission];
+      const authorization = await deriveRelationWriteAuthorization(
+        adapter,
+        await getContentTypeOrThrow(adapter, ensureSynced, facts.contentType),
+        input.body.data,
+        ensureSynced
+      );
+      relationWriteAuthorizationSnapshots.set(input, authorization);
+      return [contentTypePermission, ...authorization.permissions];
+    },
+    execute: async (context) => {
+      const lifecycleContext = updateContext(context);
+      const contentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        context.facts.contentType
+      );
+      const rawSlug = context.input.body.slug;
+      const slug = rawSlug ? slugify(rawSlug) : void 0;
+      if (rawSlug && !slug) {
+        throw new CMSOperationError(
+          400,
+          "Invalid slug: must contain at least one alphanumeric character",
+          "INVALID_SLUG"
+        );
+      }
+      const bodyData = context.input.body.data;
+      const relationAuthorization = bodyData ? await recheckRelationWriteAuthorization(
+        context.input,
+        contentType.slug,
+        bodyData
+      ) : void 0;
+      const authorizedRecord = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        context.facts.contentType,
+        context.facts.recordId
+      );
+      assertRecordFacts(authorizedRecord, context.facts);
+      if (slug && slug !== authorizedRecord.slug) {
+        const duplicate = await adapter.findOne({
+          model: "contentItem",
+          where: [
+            {
+              field: "contentTypeId",
+              value: contentType.id,
+              operator: "eq"
+            },
+            { field: "slug", value: slug, operator: "eq" }
+          ]
+        });
+        if (duplicate) {
+          throw new CMSOperationError(
+            409,
+            "Content item with this slug already exists",
+            "DUPLICATE_SLUG"
+          );
+        }
+      }
+      const relationPlan = bodyData ? await planRelationsInData(
+        adapter,
+        contentType,
+        bodyData,
+        ensureSynced,
+        context.identity?.id
+      ) : void 0;
+      const currentData = authorizedRecord.data ? JSON.parse(authorizedRecord.data) : {};
+      const validation = getContentTypeZodSchema(contentType).safeParse({
+        ...currentData,
+        ...relationPlan?.processedData ?? {}
+      });
+      if (!validation.success) {
+        throw new CMSOperationError(
+          400,
+          "Validation failed",
+          "RECORD_VALIDATION_FAILED",
+          validation.error.issues
+        );
+      }
+      const mergedData = validation.data;
+      await runBeforeHook(
+        () => hooks?.onBeforeUpdateContent?.(
+          context.facts.recordId,
+          mergedData,
+          lifecycleContext
+        ),
+        "Update operation denied"
+      );
+      return adapter.transaction(async (tx) => {
+        if (bodyData && relationAuthorization) {
+          await assertCurrentRelationWriteAuthorization(
+            tx,
+            relationAuthorization,
+            contentType.slug,
+            bodyData
+          );
+        }
+        const current = await getRecordOrThrow(
+          tx,
+          ensureSynced,
+          context.facts.contentType,
+          context.facts.recordId
+        );
+        assertRecordFacts(current, context.facts);
+        assertRecordSnapshot(current, authorizedRecord);
+        if (slug && slug !== current.slug) {
+          const duplicate = await tx.findOne({
+            model: "contentItem",
+            where: [
+              {
+                field: "contentTypeId",
+                value: contentType.id,
+                operator: "eq"
+              },
+              { field: "slug", value: slug, operator: "eq" }
+            ]
+          });
+          if (duplicate) {
+            throw new CMSOperationError(
+              409,
+              "Content item with this slug already exists",
+              "DUPLICATE_SLUG"
+            );
+          }
+        }
+        if (relationPlan) await applyRelationWritePlan(tx, relationPlan);
+        const update = { updatedAt: /* @__PURE__ */ new Date() };
+        if (slug) update.slug = slug;
+        if (bodyData) update.data = JSON.stringify(mergedData);
+        const matched = await tx.updateMany({
+          model: "contentItem",
+          where: [
+            {
+              field: "id",
+              value: context.facts.recordId,
+              operator: "eq"
+            },
+            {
+              field: "contentTypeId",
+              value: contentType.id,
+              operator: "eq"
+            },
+            {
+              field: "authorId",
+              value: context.facts.authorId ?? null,
+              operator: "eq"
+            },
+            {
+              field: "updatedAt",
+              value: current.updatedAt,
+              operator: "eq"
+            }
+          ],
+          update
+        });
+        if (!didUpdateContentItem(matched, context.facts.recordId)) {
+          throw staleRecordError();
+        }
+        if (relationPlan) {
+          await syncRelations(
+            tx,
+            context.facts.recordId,
+            relationPlan.relationIds
+          );
+        }
+        const updated = await getRecordOrThrow(
+          tx,
+          ensureSynced,
+          context.facts.contentType,
+          context.facts.recordId
+        );
+        return operationContentItem(serializeContentItemWithType(updated));
+      });
+    },
+    after: async (context) => {
+      const base = updateContext(context);
+      const afterUpdateContent = hooks?.onAfterUpdateContent;
+      await afterUpdateContent?.(
+        context.result,
+        Object.freeze({ ...base, result: context.result })
+      );
+    },
+    onError: async ({ error, ...context }) => {
+      await notifyError(error, "update", updateContext(context));
+    }
+  });
+  const deleteContentItem = defineOperation({
+    input: DeleteContentItemInputSchema,
+    permission: cmsPermissions.record.delete,
+    facts: async ({ input }) => {
+      const item = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        input.typeSlug,
+        input.id
+      );
+      const facts = recordFacts(item);
+      return {
+        contentType: facts.contentType,
+        recordId: facts.recordId ?? input.id,
+        ...facts.authorId ? { authorId: facts.authorId } : {}
+      };
+    },
+    before: async (context) => {
+      const current = await getRecordOrThrow(
+        adapter,
+        ensureSynced,
+        context.facts.contentType,
+        context.facts.recordId
+      );
+      assertRecordFacts(current, context.facts);
+      await runBeforeHook(
+        () => hooks?.onBeforeDeleteContent?.(
+          context.facts.recordId,
+          deleteContext(context)
+        ),
+        "Delete operation denied"
+      );
+    },
+    execute: async ({ facts }) => adapter.transaction(async (tx) => {
+      const existing = await getRecordOrThrow(
+        tx,
+        ensureSynced,
+        facts.contentType,
+        facts.recordId
+      );
+      assertRecordFacts(existing, facts);
+      const matched = await tx.updateMany({
+        model: "contentItem",
+        where: [
+          { field: "id", value: facts.recordId, operator: "eq" },
+          {
+            field: "contentTypeId",
+            value: existing.contentTypeId,
+            operator: "eq"
+          },
+          {
+            field: "authorId",
+            value: facts.authorId ?? null,
+            operator: "eq"
+          },
+          {
+            field: "updatedAt",
+            value: existing.updatedAt,
+            operator: "eq"
+          }
+        ],
+        update: { updatedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!didUpdateContentItem(matched, facts.recordId)) {
+        throw staleRecordError();
+      }
+      await tx.delete({
+        model: "contentItem",
+        where: [
+          { field: "id", value: facts.recordId, operator: "eq" },
+          {
+            field: "contentTypeId",
+            value: existing.contentTypeId,
+            operator: "eq"
+          }
+        ]
+      });
+      return { success: true };
+    }),
+    after: async (context) => {
+      const base = deleteContext(context);
+      await hooks?.onAfterDeleteContent?.(
+        context.facts.recordId,
+        Object.freeze({ ...base, result: context.result })
+      );
+    },
+    onError: async ({ error, ...context }) => {
+      await notifyError(error, "delete", deleteContext(context));
+    }
+  });
+  const getContentItemPopulated = defineOperation({
+    input: GetContentItemInputSchema,
+    permission: cmsPermissions.record.read,
+    facts: async ({ input }) => recordFacts(
+      await getRecordOrThrow(adapter, ensureSynced, input.typeSlug, input.id)
+    ),
+    additionalPermissions: async ({ input, facts }) => {
+      const snapshot = await getPopulatedRelationSnapshot(
+        adapter,
+        facts.recordId ?? ""
+      );
+      populatedRelationSnapshots.set(input, snapshot);
+      const contentTypes = /* @__PURE__ */ new Set([
+        facts.contentType,
+        ...snapshot.targets.map(
+          ({ facts: targetFacts }) => targetFacts.contentType
+        )
+      ]);
+      return [
+        ...[...contentTypes].map(
+          (contentType) => cmsPermissions.contentType.read({ contentType })
+        ),
+        ...snapshot.targets.map(
+          ({ facts: targetFacts }) => cmsPermissions.record.read(targetFacts)
+        )
+      ];
+    },
+    execute: async ({ input, facts }) => {
+      try {
+        const item = await getRecordOrThrow(
+          adapter,
+          ensureSynced,
+          facts.contentType,
+          facts.recordId ?? ""
+        );
+        assertRecordFacts(item, facts);
+        const authorizedSnapshot = populatedRelationSnapshots.get(
+          input
+        );
+        if (!authorizedSnapshot) {
+          throw new CMSOperationError(
+            500,
+            "Related-content authorization snapshot is unavailable.",
+            "AUTHORIZATION_SNAPSHOT_MISSING"
+          );
+        }
+        const currentSnapshot = await getPopulatedRelationSnapshot(
+          adapter,
+          facts.recordId ?? ""
+        );
+        assertPopulatedRelationSnapshot(authorizedSnapshot, currentSnapshot);
+        const relations = populatedRelationsFromSnapshot(currentSnapshot);
+        return {
+          ...operationContentItem(serializeContentItemWithType(item)),
+          _relations: Object.fromEntries(
+            Object.entries(relations).map(([field, records]) => [
+              field,
+              records.map(operationContentItem)
+            ])
+          )
+        };
+      } finally {
+        populatedRelationSnapshots.delete(input);
+      }
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "get",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const listContentByRelation = defineOperation({
+    input: ListContentByRelationInputSchema,
+    permission: cmsPermissions.record.read,
+    facts: async ({ input }) => collectionFacts(
+      (await getContentTypeOrThrow(adapter, ensureSynced, input.typeSlug)).slug
+    ),
+    additionalPermissions: async ({ input, facts }) => {
+      const sourceContentType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        facts.contentType
+      );
+      const authorization = await deriveRelationFilterAuthorization(
+        adapter,
+        ensureSynced,
+        sourceContentType,
+        input.query.field,
+        input.query.targetId
+      );
+      relationFilterAuthorizationSnapshots.set(input, authorization);
+      return [
+        cmsPermissions.contentType.read({ contentType: facts.contentType }),
+        authorization.permission
+      ];
+    },
+    execute: async ({ input, facts }) => {
+      const sourceContentType = await recheckRelationFilterAuthorization(
+        input,
+        facts.contentType,
+        input.query.field,
+        input.query.targetId
+      );
+      const result = await listRecordsForRelation(
+        adapter,
+        sourceContentType,
+        input.query.field,
+        input.query.targetId,
+        input.query.limit,
+        input.query.offset
+      );
+      return {
+        ...result,
+        items: result.items.map(operationContentItem)
+      };
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "list",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const getInverseRelations = defineOperation({
+    input: GetInverseRelationsInputSchema,
+    permission: cmsPermissions.contentType.read,
+    facts: async ({ input }) => ({
+      contentType: (await getContentTypeOrThrow(adapter, ensureSynced, input.slug)).slug
+    }),
+    additionalPermissions: async ({ input, facts }) => {
+      const authorization = await deriveInverseSourceAuthorization(
+        adapter,
+        ensureSynced,
+        facts.contentType ?? ""
+      );
+      inverseSourceAuthorizationSnapshots.set(
+        input,
+        authorization.snapshot
+      );
+      const permissions = [...authorization.permissions];
+      if (input.query.itemId) {
+        const targetFacts = recordFacts(
+          await getRecordOrThrow(
+            adapter,
+            ensureSynced,
+            facts.contentType ?? "",
+            input.query.itemId
+          )
+        );
+        inverseTargetAuthorizationSnapshots.set(input, targetFacts);
+        permissions.push(cmsPermissions.record.read(targetFacts));
+        const authorizedSourceTypes = /* @__PURE__ */ new Set();
+        for (const source of authorization.sources) {
+          if (authorizedSourceTypes.has(source.contentTypeSlug)) continue;
+          authorizedSourceTypes.add(source.contentTypeSlug);
+          permissions.push(
+            cmsPermissions.record.read(collectionFacts(source.contentTypeSlug))
+          );
+        }
+      }
+      return permissions;
+    },
+    execute: async ({ input, facts }) => {
+      try {
+        const sources = await recheckInverseSourceAuthorization(
+          input,
+          facts.contentType ?? ""
+        );
+        if (input.query.itemId) {
+          await recheckInverseTargetAuthorization(
+            input,
+            facts.contentType ?? "",
+            input.query.itemId
+          );
+        }
+        const inverseRelations = [];
+        for (const source of sources) {
+          let count = 0;
+          if (input.query.itemId) {
+            const relations = await adapter.findMany({
+              model: "contentRelation",
+              where: [
+                {
+                  field: "targetId",
+                  value: input.query.itemId,
+                  operator: "eq"
+                },
+                {
+                  field: "fieldName",
+                  value: source.fieldName,
+                  operator: "eq"
+                }
+              ]
+            });
+            for (const sourceId of relations.map((value) => value.sourceId)) {
+              const item = await adapter.findOne({
+                model: "contentItem",
+                where: [
+                  {
+                    field: "id",
+                    value: sourceId,
+                    operator: "eq"
+                  },
+                  {
+                    field: "contentTypeId",
+                    value: source.contentTypeId,
+                    operator: "eq"
+                  }
+                ]
+              });
+              if (item) count += 1;
+            }
+          }
+          inverseRelations.push({
+            sourceType: source.contentTypeSlug,
+            sourceTypeName: source.contentTypeName,
+            fieldName: source.fieldName,
+            count
+          });
+        }
+        return {
+          inverseRelations: inverseRelations.map((relation) => ({
+            ...relation
+          }))
+        };
+      } finally {
+        inverseTargetAuthorizationSnapshots.delete(input);
+      }
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "get",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  const listInverseRelationItems = defineOperation({
+    input: ListInverseRelationItemsInputSchema,
+    permission: cmsPermissions.record.read,
+    facts: async ({ input }) => {
+      await getContentTypeOrThrow(adapter, ensureSynced, input.slug);
+      const sourceType = await getContentTypeOrThrow(
+        adapter,
+        ensureSynced,
+        input.sourceType
+      );
+      return collectionFacts(sourceType.slug);
+    },
+    additionalPermissions: async ({ input, facts }) => {
+      const authorization = await deriveInverseSourceAuthorization(
+        adapter,
+        ensureSynced,
+        input.slug
+      );
+      const source = authorization.sources.find(
+        (value) => value.contentTypeSlug === facts.contentType && value.fieldName === input.query.fieldName
+      );
+      if (!source) {
+        throw new CMSOperationError(
+          404,
+          "Inverse relation not found",
+          "INVERSE_RELATION_NOT_FOUND"
+        );
+      }
+      inverseSourceAuthorizationSnapshots.set(
+        input,
+        authorization.snapshot
+      );
+      const targetFacts = recordFacts(
+        await getRecordOrThrow(
+          adapter,
+          ensureSynced,
+          input.slug,
+          input.query.itemId
+        )
+      );
+      inverseTargetAuthorizationSnapshots.set(input, targetFacts);
+      return [
+        cmsPermissions.contentType.read({ contentType: facts.contentType }),
+        cmsPermissions.record.read(targetFacts)
+      ];
+    },
+    execute: async ({ input, facts }) => {
+      try {
+        const sources = await recheckInverseSourceAuthorization(
+          input,
+          input.slug
+        );
+        const source = sources.find(
+          (value) => value.contentTypeSlug === facts.contentType && value.fieldName === input.query.fieldName
+        );
+        if (!source) throw relationSchemaChangedError();
+        await recheckInverseTargetAuthorization(
+          input,
+          input.slug,
+          input.query.itemId
+        );
+        const result = await listRecordsForRelation(
+          adapter,
+          await getContentTypeOrThrow(adapter, ensureSynced, facts.contentType),
+          source.fieldName,
+          input.query.itemId,
+          input.query.limit,
+          input.query.offset
+        );
+        return {
+          ...result,
+          items: result.items.map(operationContentItem)
+        };
+      } finally {
+        inverseTargetAuthorizationSnapshots.delete(input);
+      }
+    },
+    onError: ({ error, ...context }) => notifyError(
+      error,
+      "list",
+      genericContext(context, context.facts.contentType)
+    )
+  });
+  return {
+    listContentTypes,
+    getContentTypeBySlug,
+    listContentItems,
+    getContentItem,
+    createContentItem,
+    updateContentItem,
+    deleteContentItem,
+    getContentItemPopulated,
+    listContentByRelation,
+    getInverseRelations,
+    listInverseRelationItems
+  };
+}
+
+export { CMSContentItemParamsSchema, CMSContentTypeParamsSchema, CMSCreateContentItemBodySchema, CMSOperationError, CMSUpdateContentItemBodySchema, createCMSOperations };