@btst/stack 5.2.0 → 6.0.0-beta.0

package/src/plugins/cms/__tests__/authorization.test.ts

@@ -1,2653 +0,0 @@
-import { createMemoryAdapter } from "@btst/adapter-memory";
-import { defineDb, type DatabaseDefinition } from "@btst/db";
-import { zodToFormSchema } from "@workspace/ui/lib/schema-converter";
-import { describe, expect, it, vi } from "vitest";
-import { z } from "zod";
-import { QueryClient } from "@tanstack/react-query";
-import { createCMSQueryKeys, CMS_QUERY_KEYS } from "../api";
-import { createApiClient } from "../../client";
-import type { CMSApiRouter } from "../api";
-import { createBackendStack } from "../../../api";
-import { defineAuthorization } from "../../../authorization";
-import {
-	createServerAuth,
-	type ServerAuth,
-} from "../../../authorization/server";
-import {
-	cmsBackendPlugin,
-	CMS_LIFECYCLE_HOOK_MIGRATIONS,
-	type CMSBackendHooks,
-} from "../api";
-import { cmsPermissions } from "../permissions";
-import type { ContentItem, ContentRelation, ContentType } from "../types";
-
-const memoryAdapter = (db: DatabaseDefinition) => createMemoryAdapter(db)({});
-
-const articleSchema = z.object({ title: z.string() });
-const categorySchema = z.object({ name: z.string() });
-const resourceSchema = z.object({
-	name: z.string(),
-	categoryIds: z
-		.array(z.object({ id: z.string() }))
-		.default([])
-		.meta({
-			fieldType: "relation",
-			relation: {
-				type: "manyToMany",
-				targetType: "category",
-				displayField: "name",
-				creatable: true,
-			},
-		}),
-});
-const changedResourceRelationSchema = z.object({
-	name: z.string(),
-	categoryIds: z
-		.array(z.object({ id: z.string() }))
-		.default([])
-		.meta({
-			fieldType: "relation",
-			relation: {
-				type: "manyToMany",
-				targetType: "secret",
-				displayField: "title",
-				creatable: true,
-			},
-		}),
-});
-const missingResourceRelationSchema = z.object({
-	name: z.string(),
-	categoryIds: z
-		.array(z.object({ id: z.string() }))
-		.default([])
-		.meta({
-			fieldType: "relation",
-			relation: {
-				type: "manyToMany",
-				targetType: "missing-target",
-				displayField: "name",
-				creatable: true,
-			},
-		}),
-});
-const inverseResourceRelationSchema = z.object({
-	name: z.string(),
-	categoryId: z.object({ id: z.string() }).meta({
-		fieldType: "relation",
-		relation: {
-			type: "belongsTo",
-			targetType: "category",
-			displayField: "name",
-		},
-	}),
-});
-const categoryNoteSchema = z.object({
-	message: z.string(),
-	categoryId: z.object({ id: z.string() }).meta({
-		fieldType: "relation",
-		relation: {
-			type: "belongsTo",
-			targetType: "category",
-			displayField: "name",
-		},
-	}),
-});
-const contentTypes = [
-	{ name: "Article", slug: "article", schema: articleSchema },
-	{ name: "Secret", slug: "secret", schema: articleSchema },
-	{ name: "Category", slug: "category", schema: categorySchema },
-	{ name: "Resource", slug: "resource", schema: resourceSchema },
-	{
-		name: "Category note",
-		slug: "category-note",
-		schema: categoryNoteSchema,
-	},
-];
-
-const authorization = defineAuthorization({
-	identity: z.object({
-		id: z.string(),
-		role: z.enum(["user", "admin"]),
-	}),
-	permissions: [cmsPermissions] as const,
-	rules: ({ cms }) => [
-		cms.contentType.read.allow(),
-		cms.record.read.allow(),
-		cms.record.create.when(({ identity }) => identity !== null),
-		cms.record.update.when(
-			({ identity, facts }) =>
-				identity !== null &&
-				(identity.role === "admin" || identity.id === facts.authorId),
-		),
-		cms.record.delete.when(
-			({ identity, facts }) =>
-				identity !== null &&
-				(identity.role === "admin" || identity.id === facts.authorId),
-		),
-	],
-});
-
-function createAuth(
-	getIdentity: (
-		request: Request,
-	) =>
-		| { id: string; role: "user" | "admin" }
-		| null
-		| Promise<{ id: string; role: "user" | "admin" } | null> = (request) => {
-		const id = request.headers.get("x-user-id");
-		const role = request.headers.get("x-user-role");
-		if (!id || (role !== "user" && role !== "admin")) return null;
-		return { id, role };
-	},
-) {
-	return createServerAuth({
-		authorization,
-		getIdentity: ({ request }) => getIdentity(request),
-	});
-}
-
-function makeBackend(options?: {
-	auth?: ServerAuth<any>;
-	hooks?: CMSBackendHooks;
-}) {
-	return createBackendStack({
-		basePath: "/api",
-		plugins: {
-			cms: cmsBackendPlugin({
-				contentTypes,
-				...(options?.hooks ? { hooks: options.hooks } : {}),
-			}),
-		},
-		adapter: memoryAdapter,
-		...(options?.auth ? { auth: options.auth as never } : {}),
-	});
-}
-
-function allContentTypes(backend: ReturnType<typeof makeBackend>) {
-	return backend.trusted.cms.listContentTypes({});
-}
-
-function allContentItems(
-	backend: ReturnType<typeof makeBackend>,
-	typeSlug: string,
-) {
-	return backend.trusted.cms.listContentItems({ typeSlug, query: {} });
-}
-
-function request(
-	path: string,
-	options?: {
-		method?: string;
-		identity?: { id: string; role: "user" | "admin" };
-		body?: unknown;
-	},
-) {
-	const headers = new Headers();
-	if (options?.identity) {
-		headers.set("x-user-id", options.identity.id);
-		headers.set("x-user-role", options.identity.role);
-	}
-	if (options?.body !== undefined)
-		headers.set("content-type", "application/json");
-	return new Request(`http://localhost/api${path}`, {
-		method: options?.method ?? "GET",
-		headers,
-		...(options?.body !== undefined
-			? { body: JSON.stringify(options.body) }
-			: {}),
-	});
-}
-
-async function seedRecord(
-	backend: ReturnType<typeof makeBackend>,
-	options: { typeSlug?: string; slug: string; authorId?: string },
-) {
-	const typeSlug = options.typeSlug ?? "article";
-	const contentType = (await allContentTypes(backend)).find(
-		(value) => value.slug === typeSlug,
-	);
-	if (!contentType) throw new Error(`Missing test content type ${typeSlug}`);
-	return backend.adapter.create<ContentItem>({
-		model: "contentItem",
-		data: {
-			contentTypeId: contentType.id,
-			slug: options.slug,
-			data: JSON.stringify({ title: options.slug }),
-			...(options.authorId ? { authorId: options.authorId } : {}),
-			createdAt: new Date(),
-			updatedAt: new Date(),
-		},
-	});
-}
-
-describe("CMS authorization inventory", () => {
-	it("selects literal declared content fields without changing stored value semantics", async () => {
-		const backend = createBackendStack({
-			basePath: "/api",
-			plugins: {
-				cms: cmsBackendPlugin({
-					contentTypes: [
-						{
-							name: "Article",
-							slug: "article",
-							schema: z.object({
-								title: z.string(),
-								body: z.string(),
-								optional: z.string().optional(),
-								nil: z.string().nullable(),
-								nested: z.object({ label: z.string() }),
-								entries: z.array(z.string()),
-								'headline,quoted". 标题': z.string(),
-							}),
-						},
-					],
-				}),
-			},
-			adapter: memoryAdapter,
-			auth: createAuth(),
-		});
-		const record = await seedRecord(backend, { slug: "selected-content" });
-		await backend.adapter.update({
-			model: "contentItem",
-			where: [{ field: "id", value: record.id }],
-			update: {
-				data: JSON.stringify({
-					title: "Selected title",
-					body: "Searchable long body",
-					nil: null,
-					nested: { label: "Whole nested value" },
-					entries: ["one", "two"],
-					'headline,quoted". 标题': "Literal property",
-				}),
-			},
-		});
-		const result = await backend.trusted.cms.listContentItems({
-			typeSlug: "article",
-			query: {
-				view: "content",
-				fields: [
-					"title",
-					"optional",
-					"nil",
-					"nested",
-					"entries",
-					'headline,quoted". 标题',
-				],
-			},
-		});
-		expect(result.items[0]).toEqual({
-			id: record.id,
-			slug: record.slug,
-			createdAt: record.createdAt.toISOString(),
-			updatedAt: record.updatedAt.toISOString(),
-			parsedData: {
-				title: "Selected title",
-				nil: null,
-				nested: { label: "Whole nested value" },
-				entries: ["one", "two"],
-				'headline,quoted". 标题': "Literal property",
-			},
-		});
-		expect(result).toMatchObject({ total: 1, limit: 20, offset: 0 });
-		const fields = JSON.stringify(['headline,quoted". 标题', "title", "title"]);
-		for (const path of [
-			`/content/article/${record.id}`,
-			"/content/article?slug=selected-content",
-			"/content/article?search=Searchable",
-		]) {
-			const response = await backend.handler(
-				request(
-					`${path}${path.includes("?") ? "&" : "?"}view=content&fields=${encodeURIComponent(fields)}`,
-				),
-			);
-			expect(response.status).toBe(200);
-			const value = await response.json();
-			expect((value.items ? value.items[0] : value).parsedData).toEqual({
-				title: "Selected title",
-				'headline,quoted". 标题': "Literal property",
-			});
-			if (value.items) expect(value.total).toBe(1);
-		}
-	});
-
-	it("rejects invalid field selections even when an existing collection is empty", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-		for (const fields of [
-			"not-json",
-			"[]",
-			'["unknown"]',
-			'["title.nested"]',
-			"[1]",
-			"{}",
-			"null",
-			'"title"',
-			'["__proto__"]',
-			'["constructor"]',
-		]) {
-			const response = await backend.handler(
-				request(
-					`/content/article?view=content&fields=${encodeURIComponent(fields)}`,
-				),
-			);
-			expect(response.status, fields).toBe(400);
-		}
-		expect(
-			(
-				await backend.handler(
-					request("/content/article?fields=%5B%22title%22%5D"),
-				)
-			).status,
-		).toBe(400);
-		await expect(
-			backend.trusted.cms.listContentItems({
-				typeSlug: "article",
-				query: { fields: ["title"] },
-			}),
-		).rejects.toMatchObject({ statusCode: 400 });
-	});
-
-	it("returns the content envelope only when requested on a collection read", async () => {
-		const backend = makeBackend();
-		const record = await seedRecord(backend, {
-			slug: "content-view",
-			authorId: "author-1",
-		});
-		const full = await backend.trusted.cms.listContentItems({
-			typeSlug: "article",
-			query: {},
-		});
-		const content = await backend.trusted.cms.listContentItems({
-			typeSlug: "article",
-			query: { view: "content" },
-		});
-		expect(full.items[0]).toHaveProperty("data");
-		expect(content).toEqual({
-			items: [
-				{
-					id: record.id,
-					slug: "content-view",
-					parsedData: { title: "content-view" },
-					createdAt: record.createdAt.toISOString(),
-					updatedAt: record.updatedAt.toISOString(),
-				},
-			],
-			total: 1,
-			limit: 20,
-			offset: 0,
-		});
-	});
-
-	it("keeps content views on existing ID and slug HTTP reads with the same access checks", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-		const record = await seedRecord(backend, {
-			slug: "read-content",
-			authorId: "owner",
-		});
-		for (const path of [
-			`/content/article/${record.id}?view=content`,
-			"/content/article?slug=read-content&view=content",
-		]) {
-			const response = await backend.handler(request(path));
-			expect(response.status).toBe(200);
-			const value = await response.json();
-			const item = path.includes("?slug=") ? value.items[0] : value;
-			expect(Object.keys(item).sort()).toEqual([
-				"createdAt",
-				"id",
-				"parsedData",
-				"slug",
-				"updatedAt",
-			]);
-			expect(item.parsedData).toEqual({ title: "read-content" });
-		}
-		expect(
-			(
-				await backend.handler(
-					request(`/content/article/${record.id}?view=invalid`),
-				)
-			).status,
-		).toBe(400);
-		expect(
-			(await backend.handler(request("/content/article?view=invalid"))).status,
-		).toBe(400);
-		expect(
-			(await backend.handler(request("/content/article/missing?view=content")))
-				.status,
-		).toBe(404);
-		expect(
-			(await backend.handler(request("/content/missing?view=content"))).status,
-		).toBe(404);
-		const closed = makeBackend({
-			auth: createServerAuth({
-				authorization: defineAuthorization({
-					identity: z.object({ id: z.string() }),
-					permissions: [cmsPermissions] as const,
-					rules: ({ cms }) => [cms.contentType.read.allow()],
-				}),
-				getIdentity: () => ({ id: "reader" }),
-			}),
-		});
-		const privateRecord = await seedRecord(closed, { slug: "private-content" });
-		expect(
-			(
-				await closed.handler(
-					request(`/content/article/${privateRecord.id}?view=content`),
-				)
-			).status,
-		).toBe(403);
-	});
-
-	it("prefetches content views with matching client keys and serialized infinite pages", async () => {
-		const backend = makeBackend();
-		const record = await seedRecord(backend, { slug: "prefetch-content" });
-		const queryClient = new QueryClient();
-		await backend.raw.cms.prefetchForRoute("contentList", queryClient, {
-			typeSlug: "article",
-			view: "content",
-			fields: ["title", "title"],
-			limit: 5,
-		});
-		await backend.raw.cms.prefetchForRoute("editContent", queryClient, {
-			typeSlug: "article",
-			id: record.id,
-			view: "content",
-			fields: ["title", "title"],
-		});
-		const queries = createCMSQueryKeys(
-			createApiClient<CMSApiRouter>({
-				baseURL: "http://localhost",
-				basePath: "/api",
-			}),
-		);
-		const listKey = queries.cmsContent.list({
-			typeSlug: "article",
-			view: "content",
-			fields: ["title", "title"],
-			limit: 5,
-		}).queryKey;
-		expect(listKey).toEqual(
-			CMS_QUERY_KEYS.contentList({
-				typeSlug: "article",
-				view: "content",
-				fields: ["title", "title"],
-				limit: 5,
-			}),
-		);
-		expect(queryClient.getQueryData(listKey)).toEqual({
-			pages: [
-				{
-					items: [
-						{
-							id: record.id,
-							slug: "prefetch-content",
-							parsedData: { title: "prefetch-content" },
-							createdAt: record.createdAt.toISOString(),
-							updatedAt: record.updatedAt.toISOString(),
-						},
-					],
-					total: 1,
-					limit: 5,
-					offset: 0,
-				},
-			],
-			pageParams: [0],
-		});
-		const detail = queryClient.getQueryData(
-			queries.cmsContent.detail("article", record.id, {
-				view: "content",
-				fields: ["title"],
-			}).queryKey,
-		);
-		expect(detail).toHaveProperty("parsedData.title", "prefetch-content");
-		expect(detail).not.toHaveProperty("data");
-		expect(
-			queryClient.getQueryData(
-				CMS_QUERY_KEYS.contentDetail("article", record.id),
-			),
-		).toBeUndefined();
-	});
-
-	it.each(["", "&fields=%5B%22title%22%5D"])(
-		"still requires content-type metadata access for content-only ID, slug and collection reads (%s)",
-		async (selection) => {
-			const backend = makeBackend({
-				auth: createServerAuth({
-					authorization: defineAuthorization({
-						identity: z.object({ id: z.string() }),
-						permissions: [cmsPermissions] as const,
-						rules: ({ cms }) => [cms.record.read.allow()],
-					}),
-					getIdentity: () => ({ id: "reader" }),
-				}),
-			});
-			const record = await seedRecord(backend, { slug: "metadata-denied" });
-			for (const path of [
-				`/content/article/${record.id}?view=content`,
-				"/content/article?slug=metadata-denied&view=content",
-				"/content/article?view=content",
-			]) {
-				expect(
-					(await backend.handler(request(`${path}${selection}`))).status,
-				).toBe(403);
-			}
-		},
-	);
-
-	it("records every removed lifecycle name and canonical replacement", () => {
-		expect(CMS_LIFECYCLE_HOOK_MIGRATIONS).toEqual({
-			onBeforeCreate: "onBeforeCreateContent",
-			onAfterCreate: "onAfterCreateContent",
-			onBeforeUpdate: "onBeforeUpdateContent",
-			onAfterUpdate: "onAfterUpdateContent",
-			onBeforeDelete: "onBeforeDeleteContent",
-			onAfterDelete: "onAfterDeleteContent",
-			onError: "onErrorExecuteContentOperation",
-		});
-	});
-
-	it("binds every maintained route behavior to the CMS catalog", () => {
-		const plugin = cmsBackendPlugin({ contentTypes });
-		const adapter = memoryAdapter(defineDb({}).use(plugin.dbPlugin));
-		const operations = plugin.operations?.(adapter);
-		expect(Object.keys(operations ?? {}).sort()).toEqual([
-			"createContentItem",
-			"deleteContentItem",
-			"getContentItem",
-			"getContentItemPopulated",
-			"getContentTypeBySlug",
-			"getInverseRelations",
-			"listContentByRelation",
-			"listContentItems",
-			"listContentTypes",
-			"listInverseRelationItems",
-			"updateContentItem",
-		]);
-		expect(
-			Object.fromEntries(
-				Object.entries(operations ?? {}).map(([name, operation]) => [
-					name,
-					operation.permission.id,
-				]),
-			),
-		).toEqual({
-			listContentTypes: "cms:contentType.read",
-			getContentTypeBySlug: "cms:contentType.read",
-			listContentItems: "cms:record.read",
-			getContentItem: "cms:record.read",
-			createContentItem: "cms:record.create",
-			updateContentItem: "cms:record.update",
-			deleteContentItem: "cms:record.delete",
-			getContentItemPopulated: "cms:record.read",
-			listContentByRelation: "cms:record.read",
-			getInverseRelations: "cms:contentType.read",
-			listInverseRelationItems: "cms:record.read",
-		});
-
-		expect(
-			cmsPermissions.record.update({
-				contentType: "article",
-				recordId: "record-1",
-				authorId: "author-1",
-			}),
-		).toMatchObject({ id: "cms:record.update" });
-		expect(() =>
-			cmsPermissions.record.update({
-				contentType: "article",
-				recordId: 1,
-			} as never),
-		).toThrow();
-		if (false) {
-			// @ts-expect-error CMS descriptors reject the RC fact vocabulary.
-			cmsPermissions.record.delete({ typeSlug: "article", id: "record-1" });
-		}
-	});
-
-	it("keeps raw SSG helpers out of request and trusted operation namespaces", async () => {
-		const backend = makeBackend();
-		const operationRequest = request("/content-types");
-		expect(typeof backend.raw.cms.prefetchForRoute).toBe("function");
-		expect(
-			"prefetchForRoute" in backend.forRequest(operationRequest).operations.cms,
-		).toBe(false);
-		expect("prefetchForRoute" in backend.trusted.cms).toBe(false);
-	});
-});
-
-describe("CMS operation-first authorization", () => {
-	it("keeps public reads explicit and preserves HTTP/request/trusted parity", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-		const seeded = await seedRecord(backend, {
-			slug: "public-article",
-			authorId: "author-1",
-		});
-
-		const http = await backend.handler(request("/content/article"));
-		expect(http.status).toBe(200);
-		expect((await http.json()).items).toHaveLength(1);
-		const requestResult = await backend
-			.forRequest(request("/content/article"))
-			.operations.cms.listContentItems({ typeSlug: "article", query: {} });
-		expect(requestResult.items[0]?.id).toBe(seeded.id);
-		const trustedResult = await backend.trusted.cms.listContentItems({
-			typeSlug: "article",
-			query: {},
-		});
-		expect(trustedResult.items[0]?.id).toBe(seeded.id);
-		const httpCatalog = await backend.handler(request("/content-types"));
-		expect(httpCatalog.status).toBe(200);
-		expect(
-			(
-				(await httpCatalog.json()) as Array<{ slug: string; itemCount: number }>
-			).find((contentType) => contentType.slug === "article")?.itemCount,
-		).toBe(1);
-		const requestCatalog = await backend
-			.forRequest(request("/content-types"))
-			.operations.cms.listContentTypes({});
-		expect(
-			requestCatalog.find((contentType) => contentType.slug === "article")
-				?.itemCount,
-		).toBe(1);
-		expect(
-			authorization.can(
-				cmsPermissions.record.read({
-					contentType: "article",
-					scope: "collection",
-				}),
-				null,
-			),
-		).toBe(true);
-	});
-
-	it("authorizes every collection count before returning the content-type catalog", async () => {
-		const checkedCollections: string[] = [];
-		const catalogAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.read.when(({ facts }) => {
-					checkedCollections.push(`${facts.contentType}:${facts.scope}`);
-					return facts.contentType !== "secret";
-				}),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: catalogAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-		});
-		await seedRecord(backend, { slug: "counted-article" });
-		await seedRecord(backend, {
-			typeSlug: "secret",
-			slug: "counted-secret",
-		});
-
-		const http = await backend.handler(request("/content-types"));
-		expect(http.status).toBe(403);
-		expect(await http.text()).not.toContain("itemCount");
-		await expect(
-			backend
-				.forRequest(request("/content-types"))
-				.operations.cms.listContentTypes({}),
-		).rejects.toMatchObject({ statusCode: 403 });
-		expect(new Set(checkedCollections)).toEqual(
-			new Set([
-				"article:collection",
-				"secret:collection",
-				"category:collection",
-				"resource:collection",
-				"category-note:collection",
-			]),
-		);
-
-		const trustedCatalog = await backend.trusted.cms.listContentTypes({});
-		expect(
-			trustedCatalog.find((contentType) => contentType.slug === "article")
-				?.itemCount,
-		).toBe(1);
-		expect(
-			trustedCatalog.find((contentType) => contentType.slug === "secret")
-				?.itemCount,
-		).toBe(1);
-	});
-
-	it("returns 401/403 and derives identity plus ownership on the server", async () => {
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createAuth(),
-			hooks: {
-				onBeforeCreateContent: (_data, context) => {
-					if (false) {
-						// @ts-expect-error Authorized lifecycle input is immutable.
-						context.input.body.slug = "rewritten";
-						// @ts-expect-error Nested CMS input is immutable.
-						context.input.body.data.title = "rewritten";
-					}
-					events.push(`create:${context.identity?.id}`);
-					expect(context.facts).toEqual({ contentType: "article" });
-				},
-				onAfterCreateContent: (item, context) => {
-					if (false) {
-						// @ts-expect-error Authorized lifecycle results are deeply immutable.
-						item.contentType!.slug = "rewritten";
-					}
-					events.push(`created:${item.authorId}`);
-					expect(context.result).toBe(item);
-				},
-				onBeforeUpdateContent: (_id, _data, context) => {
-					events.push(`update:${context.identity?.id}`);
-				},
-				onAfterUpdateContent: (item, context) => {
-					events.push(`updated:${item.authorId}`);
-					expect(context.result).toBe(item);
-				},
-				onBeforeDeleteContent: (_id, context) => {
-					events.push(`delete:${context.identity?.id ?? "trusted"}`);
-				},
-				onAfterDeleteContent: (_id, context) => {
-					events.push(`deleted:${context.result.success}`);
-				},
-			},
-		});
-		const body = { slug: "owned", data: { title: "Owned" } };
-		const anonymousCreate = await backend.handler(
-			request("/content/article", { method: "POST", body }),
-		);
-		expect(anonymousCreate.status).toBe(401);
-		expect(events).toEqual([]);
-
-		const createdResponse = await backend.handler(
-			request("/content/article", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body,
-			}),
-		);
-		expect(createdResponse.status).toBe(200);
-		const created = (await createdResponse.json()) as ContentItem;
-		expect(created.authorId).toBe("author-1");
-		expect(events).toEqual(["create:author-1", "created:author-1"]);
-
-		const denied = await backend.handler(
-			request(`/content/article/${created.id}`, {
-				method: "PUT",
-				identity: { id: "viewer-1", role: "user" },
-				body: { data: { title: "Spoofed" } },
-			}),
-		);
-		expect(denied.status).toBe(403);
-		expect(events).toHaveLength(2);
-
-		const updated = await backend
-			.forRequest(
-				request(`/content/article/${created.id}`, {
-					identity: { id: "author-1", role: "user" },
-				}),
-			)
-			.operations.cms.updateContentItem({
-				typeSlug: "article",
-				id: created.id,
-				body: { data: { title: "Owner update" } },
-			});
-		expect(
-			(updated as unknown as { parsedData: { title: string } }).parsedData
-				.title,
-		).toBe("Owner update");
-		expect(events).toContain("update:author-1");
-
-		await backend.trusted.cms.deleteContentItem({
-			typeSlug: "article",
-			id: created.id,
-		});
-		expect(events).toContain("delete:trusted");
-		expect(events).toContain("deleted:true");
-		expect(
-			await backend.adapter.findOne({
-				model: "contentItem",
-				where: [{ field: "id", value: created.id }],
-			}),
-		).toBeFalsy();
-	});
-
-	it.each(["request", "trusted"] as const)(
-		"invokes every canonical CMS mutation lifecycle through %s execution",
-		async (transport) => {
-			const events: string[] = [];
-			const record = (event: string) => {
-				events.push(event);
-			};
-			const backend = makeBackend({
-				auth: createAuth(),
-				hooks: {
-					onBeforeCreateContent: (_data, context) => {
-						if (context.input.body.slug.startsWith("rejected-")) {
-							events.push("before-error:create");
-							throw new Error("create rejected");
-						}
-						events.push("before:create");
-					},
-					onAfterCreateContent: () => record("after:create"),
-					onBeforeUpdateContent: () => record("before:update"),
-					onAfterUpdateContent: () => record("after:update"),
-					onBeforeDeleteContent: () => record("before:delete"),
-					onAfterDeleteContent: () => record("after:delete"),
-					onErrorExecuteContentOperation: (_error, operation) => {
-						events.push(`error:${operation}`);
-					},
-				},
-			});
-			const api =
-				transport === "request"
-					? backend.forRequest(
-							request("/lifecycle", {
-								identity: { id: "author-1", role: "user" },
-							}),
-						).operations.cms
-					: backend.trusted.cms;
-			const created = await api.createContentItem({
-				typeSlug: "article",
-				body: {
-					slug: `lifecycle-${transport}`,
-					data: { title: "Lifecycle article" },
-				},
-			});
-			await api.updateContentItem({
-				typeSlug: "article",
-				id: created.id,
-				body: { data: { title: "Lifecycle article updated" } },
-			});
-			await api.deleteContentItem({
-				typeSlug: "article",
-				id: created.id,
-			});
-			await expect(
-				api.createContentItem({
-					typeSlug: "article",
-					body: {
-						slug: `rejected-${transport}`,
-						data: { title: "Rejected article" },
-					},
-				}),
-			).rejects.toThrow("create rejected");
-
-			expect(events).toEqual([
-				"before:create",
-				"after:create",
-				"before:update",
-				"after:update",
-				"before:delete",
-				"after:delete",
-				"before-error:create",
-				"error:create",
-			]);
-		},
-	);
-
-	it("authorizes inline related-record creation for the server-derived target type", async () => {
-		const sourceOnlyAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.create.when(
-					({ identity, facts }) =>
-						identity !== null && facts.contentType === "resource",
-				),
-				cms.record.update.when(
-					({ identity, facts }) =>
-						identity !== null && facts.contentType === "resource",
-				),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: sourceOnlyAuthorization,
-				getIdentity: () => ({ id: "author-1", role: "user" as const }),
-			}),
-			hooks: {
-				onBeforeCreateContent: () => {
-					events.push("before");
-				},
-				onBeforeUpdateContent: () => {
-					events.push("before");
-				},
-				onErrorExecuteContentOperation: () => {
-					events.push("error");
-				},
-			},
-		});
-
-		const response = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: {
-					slug: "source",
-					data: {
-						name: "Source",
-						categoryIds: [{ _new: true, data: { name: "Forbidden category" } }],
-					},
-				},
-			}),
-		);
-
-		expect(response.status).toBe(403);
-		expect(events).toEqual([]);
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "existing-source",
-			authorId: "author-1",
-		});
-		const updateResponse = await backend.handler(
-			request(`/content/resource/${source.id}`, {
-				method: "PUT",
-				identity: { id: "author-1", role: "user" },
-				body: {
-					data: {
-						name: "Source",
-						categoryIds: [{ _new: true, data: { name: "Forbidden category" } }],
-					},
-				},
-			}),
-		);
-		expect(updateResponse.status).toBe(403);
-		expect(events).toEqual([]);
-		expect((await allContentItems(backend, "category")).total).toBe(0);
-	});
-
-	it("authorizes authoritative existing relation targets before linking them", async () => {
-		const ownerReadAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.read.when(
-					({ identity, facts }) => identity?.id === facts.authorId,
-				),
-				cms.record.create.when(({ facts }) => facts.contentType === "resource"),
-				cms.record.update.when(({ facts }) => facts.contentType === "resource"),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: ownerReadAuthorization,
-				getIdentity: () => ({ id: "author-1", role: "user" as const }),
-			}),
-			hooks: {
-				onBeforeCreateContent: () => {
-					events.push("before:create");
-				},
-				onBeforeUpdateContent: () => {
-					events.push("before:update");
-				},
-			},
-		});
-		const privateCategory = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "private-category",
-			authorId: "other-owner",
-		});
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "existing-source",
-			authorId: "author-1",
-		});
-		const relationData = {
-			name: "Source",
-			categoryIds: [{ id: privateCategory.id }],
-		};
-
-		const createResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: { slug: "denied-link", data: relationData },
-			}),
-		);
-		expect(createResponse.status).toBe(403);
-		const updateResponse = await backend.handler(
-			request(`/content/resource/${source.id}`, {
-				method: "PUT",
-				identity: { id: "author-1", role: "user" },
-				body: { data: relationData },
-			}),
-		);
-		expect(updateResponse.status).toBe(403);
-		expect(events).toEqual([]);
-		expect((await allContentItems(backend, "resource")).total).toBe(1);
-		expect(
-			await backend.adapter.findOne<ContentRelation>({
-				model: "contentRelation",
-				where: [{ field: "targetId", value: privateCategory.id }],
-			}),
-		).toBeFalsy();
-	});
-
-	it("rejects wrong-type and stale existing relation targets before writing", async () => {
-		const events: string[] = [];
-		let backend: ReturnType<typeof makeBackend>;
-		backend = makeBackend({
-			auth: createAuth(),
-			hooks: {
-				onBeforeCreateContent: async () => {
-					events.push("before");
-					await backend.adapter.update<ContentItem>({
-						model: "contentItem",
-						where: [{ field: "slug", value: "owned-category" }],
-						update: { authorId: "other-owner" },
-					});
-				},
-				onErrorExecuteContentOperation: (_error, operation) => {
-					events.push(`error:${operation}`);
-				},
-			},
-		});
-		const wrongType = await seedRecord(backend, {
-			typeSlug: "secret",
-			slug: "not-a-category",
-			authorId: "author-1",
-		});
-		const wrongTypeResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: {
-					slug: "wrong-type-link",
-					data: {
-						name: "Wrong type",
-						categoryIds: [{ id: wrongType.id }],
-					},
-				},
-			}),
-		);
-		expect(wrongTypeResponse.status).toBe(404);
-		expect(await wrongTypeResponse.json()).toMatchObject({
-			code: "RECORD_NOT_FOUND",
-		});
-		expect(events).toEqual([]);
-
-		const category = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "owned-category",
-			authorId: "author-1",
-		});
-		const staleResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: {
-					slug: "stale-link",
-					data: {
-						name: "Stale target",
-						categoryIds: [{ id: category.id }],
-					},
-				},
-			}),
-		);
-		expect(staleResponse.status).toBe(409);
-		expect(await staleResponse.json()).toMatchObject({
-			code: "RECORD_STATE_CHANGED",
-		});
-		expect(events).toEqual(["before", "error:create"]);
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-		expect(
-			await backend.adapter.findOne<ContentRelation>({
-				model: "contentRelation",
-				where: [{ field: "targetId", value: category.id }],
-			}),
-		).toBeFalsy();
-	});
-	it("does not reuse unreadable records submitted as inline new relations", async () => {
-		const createWithoutReadAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.create.when(
-					({ facts }) =>
-						facts.contentType === "resource" ||
-						facts.contentType === "category",
-				),
-				cms.record.update.when(({ facts }) => facts.contentType === "resource"),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: createWithoutReadAuthorization,
-				getIdentity: () => ({ id: "author-1", role: "user" as const }),
-			}),
-			hooks: {
-				onBeforeCreateContent: () => {
-					events.push("before:create");
-				},
-				onBeforeUpdateContent: () => {
-					events.push("before:update");
-				},
-				onErrorExecuteContentOperation: (_error, operation) => {
-					events.push(`error:${operation}`);
-				},
-			},
-		});
-		const privateCategory = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "private-category",
-			authorId: "other-owner",
-		});
-		const inlineCollision = {
-			name: "Source",
-			categoryIds: [{ _new: true, data: { name: "Private category" } }],
-		};
-
-		const createResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: { slug: "collision-source", data: inlineCollision },
-			}),
-		);
-		expect(createResponse.status).toBe(409);
-		expect(await createResponse.json()).toMatchObject({
-			code: "RELATED_RECORD_SLUG_CONFLICT",
-		});
-		expect(events).toEqual(["error:create"]);
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-		expect((await allContentItems(backend, "category")).total).toBe(1);
-
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "existing-source",
-			authorId: "author-1",
-		});
-		const updateResponse = await backend.handler(
-			request(`/content/resource/${source.id}`, {
-				method: "PUT",
-				identity: { id: "author-1", role: "user" },
-				body: { data: inlineCollision },
-			}),
-		);
-		expect(updateResponse.status).toBe(409);
-		expect(await updateResponse.json()).toMatchObject({
-			code: "RELATED_RECORD_SLUG_CONFLICT",
-		});
-		expect(events).toEqual(["error:create", "error:update"]);
-		const persistedSource = await backend.adapter.findOne<ContentItem>({
-			model: "contentItem",
-			where: [{ field: "id", value: source.id }],
-		});
-		expect(JSON.parse(persistedSource?.data ?? "{}")).toMatchObject({
-			title: "existing-source",
-		});
-		expect(
-			await backend.adapter.findOne<ContentRelation>({
-				model: "contentRelation",
-				where: [
-					{ field: "sourceId", value: source.id },
-					{ field: "targetId", value: privateCategory.id },
-				],
-			}),
-		).toBeFalsy();
-	});
-
-	it("rejects duplicate inline-new slugs instead of merging their data", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-
-		const response = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: {
-					slug: "duplicate-inline-relations",
-					data: {
-						name: "Duplicate inline relations",
-						categoryIds: [
-							{ _new: true, data: { name: "Duplicate category" } },
-							{ _new: true, data: { name: "Duplicate-category" } },
-						],
-					},
-				},
-			}),
-		);
-
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RELATED_RECORD_SLUG_CONFLICT",
-		});
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-		expect((await allContentItems(backend, "category")).total).toBe(0);
-	});
-
-	it("fails closed when a relation schema changes after compound authorization", async () => {
-		const relationAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.create.when(
-					({ facts }) =>
-						facts.contentType === "resource" ||
-						facts.contentType === "category",
-				),
-				cms.record.update.when(({ facts }) => facts.contentType === "resource"),
-			],
-		});
-		let backend: ReturnType<typeof makeBackend>;
-		let changedJsonSchema = JSON.stringify(
-			zodToFormSchema(changedResourceRelationSchema),
-		);
-		const baseAuth = createServerAuth({
-			authorization: relationAuthorization,
-			getIdentity: () => ({ id: "author-1", role: "user" as const }),
-		});
-		const authorize = baseAuth.authorize.bind(baseAuth);
-		const authorizationCalls = new WeakMap<Request, number>();
-		const racingAuth: typeof baseAuth = {
-			...baseAuth,
-			async authorize(request, permissionRequest) {
-				const identity = await authorize(request, permissionRequest);
-				const count = (authorizationCalls.get(request) ?? 0) + 1;
-				authorizationCalls.set(request, count);
-				if (count === 3) {
-					const resourceType = await backend.adapter.findOne<ContentType>({
-						model: "contentType",
-						where: [{ field: "slug", value: "resource" }],
-					});
-					if (!resourceType) throw new Error("Missing resource content type");
-					await backend.adapter.update<ContentType>({
-						model: "contentType",
-						where: [{ field: "id", value: resourceType.id }],
-						update: {
-							jsonSchema: changedJsonSchema,
-							updatedAt: new Date(),
-						},
-					});
-				}
-				return identity;
-			},
-		};
-		backend = makeBackend({ auth: racingAuth });
-		await allContentTypes(backend);
-		const originalResourceType = await backend.adapter.findOne<ContentType>({
-			model: "contentType",
-			where: [{ field: "slug", value: "resource" }],
-		});
-		if (!originalResourceType) throw new Error("Missing resource content type");
-		const resetResourceSchema = () =>
-			backend.adapter.update<ContentType>({
-				model: "contentType",
-				where: [{ field: "id", value: originalResourceType.id }],
-				update: {
-					jsonSchema: originalResourceType.jsonSchema,
-					updatedAt: new Date(),
-				},
-			});
-		const relationInput = {
-			name: "Source",
-			categoryIds: [{ _new: true, data: { title: "Denied secret" } }],
-		};
-
-		const createResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: { slug: "racing-create", data: relationInput },
-			}),
-		);
-		expect(createResponse.status).toBe(409);
-		expect(await createResponse.json()).toMatchObject({
-			code: "RELATION_SCHEMA_CHANGED",
-		});
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-		expect((await allContentItems(backend, "secret")).total).toBe(0);
-
-		await resetResourceSchema();
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "racing-update",
-			authorId: "author-1",
-		});
-		const updateResponse = await backend.handler(
-			request(`/content/resource/${source.id}`, {
-				method: "PUT",
-				identity: { id: "author-1", role: "user" },
-				body: { data: relationInput },
-			}),
-		);
-		expect(updateResponse.status).toBe(409);
-		expect(await updateResponse.json()).toMatchObject({
-			code: "RELATION_SCHEMA_CHANGED",
-		});
-		expect((await allContentItems(backend, "category")).total).toBe(0);
-		expect((await allContentItems(backend, "secret")).total).toBe(0);
-
-		changedJsonSchema = JSON.stringify(
-			zodToFormSchema(missingResourceRelationSchema),
-		);
-		await resetResourceSchema();
-		const missingCreateResponse = await backend.handler(
-			request("/content/resource", {
-				method: "POST",
-				identity: { id: "author-1", role: "user" },
-				body: { slug: "missing-target-create", data: relationInput },
-			}),
-		);
-		expect(missingCreateResponse.status).toBe(409);
-		expect(await missingCreateResponse.json()).toMatchObject({
-			code: "RELATION_SCHEMA_CHANGED",
-		});
-		await resetResourceSchema();
-		const missingUpdateResponse = await backend.handler(
-			request(`/content/resource/${source.id}`, {
-				method: "PUT",
-				identity: { id: "author-1", role: "user" },
-				body: { data: relationInput },
-			}),
-		);
-		expect(missingUpdateResponse.status).toBe(409);
-		expect(await missingUpdateResponse.json()).toMatchObject({
-			code: "RELATION_SCHEMA_CHANGED",
-		});
-		expect((await allContentItems(backend, "resource")).total).toBe(1);
-	});
-
-	it("ignores spoofed browser ownership and content-type facts", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-		const record = await seedRecord(backend, {
-			typeSlug: "secret",
-			slug: "private",
-			authorId: "author-1",
-		});
-		expect(
-			authorization.can(
-				cmsPermissions.record.delete({
-					contentType: "article",
-					recordId: record.id,
-					authorId: "viewer-1",
-				}),
-				{ id: "viewer-1", role: "user" },
-			),
-		).toBe(true);
-
-		const spoofedOwner = await backend.handler(
-			request(`/content/secret/${record.id}`, {
-				method: "DELETE",
-				identity: { id: "viewer-1", role: "user" },
-			}),
-		);
-		expect(spoofedOwner.status).toBe(403);
-		const spoofedType = await backend.handler(
-			request(`/content/article/${record.id}`, {
-				identity: { id: "viewer-1", role: "user" },
-			}),
-		);
-		expect(spoofedType.status).toBe(404);
-	});
-
-	it("requires content-type read authorization before embedding record metadata", async () => {
-		const recordOnlyAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.record.read.when(({ facts }) => facts.contentType === "article"),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: recordOnlyAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-			hooks: {
-				onErrorExecuteContentOperation: () => {
-					events.push("error");
-				},
-			},
-		});
-		const record = await seedRecord(backend, { slug: "metadata-boundary" });
-
-		expect(
-			await backend.handler(request(`/content/article/${record.id}`)),
-		).toMatchObject({ status: 403 });
-		expect(
-			await backend.handler(request("/content/article?limit=1")),
-		).toMatchObject({ status: 403 });
-		expect(events).toEqual([]);
-	});
-
-	it("authorizes relation-filter targets before querying junction rows", async () => {
-		const sourceOnlyAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "resource",
-				),
-				cms.record.read.when(({ facts }) => facts.contentType === "resource"),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: sourceOnlyAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-			hooks: {
-				onErrorExecuteContentOperation: () => {
-					events.push("error");
-				},
-			},
-		});
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "relation-filter-source",
-		});
-		const target = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "private-filter-target",
-		});
-		await backend.adapter.create<ContentRelation>({
-			model: "contentRelation",
-			data: {
-				sourceId: source.id,
-				targetId: target.id,
-				fieldName: "categoryIds",
-				createdAt: new Date(),
-			},
-		});
-		const findMany = backend.adapter.findMany.bind(backend.adapter);
-		let relationReads = 0;
-		vi.spyOn(backend.adapter, "findMany").mockImplementation(async (query) => {
-			if (query.model === "contentRelation") relationReads += 1;
-			return findMany(query);
-		});
-
-		for (const view of [undefined, "content"]) {
-			const response = await backend.handler(
-				request(
-					`/content/resource/by-relation?field=categoryIds&targetId=${target.id}${view ? `&view=${view}&fields=%5B%22name%22%5D` : ""}`,
-				),
-			);
-			expect(response.status).toBe(403);
-		}
-		expect(relationReads).toBe(0);
-		expect(events).toEqual([]);
-	});
-
-	it("pages every unique related record without fetching unrequested content", async () => {
-		const backend = makeBackend({ auth: createAuth() });
-		const target = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "large-category",
-		});
-		const types = await allContentTypes(backend);
-		const noteType = types.find((type) => type.slug === "category-note")!;
-		const articleType = types.find((type) => type.slug === "article")!;
-		const createdAt = new Date("2026-01-01T00:00:00.000Z");
-		for (let index = 0; index < 235; index++) {
-			const isNote = index >= 110;
-			const id = `${isNote ? "note" : "article"}-${String(isNote ? index - 110 : index).padStart(3, "0")}`;
-			await backend.adapter.create<ContentItem>({
-				model: "contentItem",
-				forceAllowId: true,
-				data: {
-					id,
-					contentTypeId: isNote ? noteType.id : articleType.id,
-					slug: id,
-					data: JSON.stringify({ message: id, unrequested: "Long body" }),
-					createdAt,
-					updatedAt: createdAt,
-				} as ContentItem,
-			});
-			await backend.adapter.create<ContentRelation>({
-				model: "contentRelation",
-				data: {
-					sourceId: id,
-					targetId: target.id,
-					fieldName: "categoryId",
-					createdAt,
-				},
-			});
-		}
-		await backend.adapter.create<ContentRelation>({
-			model: "contentRelation",
-			data: {
-				sourceId: "note-124",
-				targetId: target.id,
-				fieldName: "categoryId",
-				createdAt,
-			},
-		});
-		const findMany = backend.adapter.findMany.bind(backend.adapter);
-		const findOne = backend.adapter.findOne.bind(backend.adapter);
-		const fullReads: string[] = [];
-		const individualSourceReads: string[] = [];
-		vi.spyOn(backend.adapter, "findMany").mockImplementation(async (query) => {
-			const rows = await findMany({ ...query, limit: query.limit ?? 100 });
-			if (
-				query.model === "contentItem" &&
-				(!query.select || query.select.includes("data"))
-			) {
-				fullReads.push(...(rows as ContentItem[]).map((item) => item.id));
-			}
-			return rows;
-		});
-		vi.spyOn(backend.adapter, "findOne").mockImplementation(async (query) => {
-			const row = await findOne(query);
-			if (
-				query.model === "contentItem" &&
-				(row as ContentItem | null)?.contentTypeId === noteType.id
-			) {
-				individualSourceReads.push((row as ContentItem).id);
-			}
-			return row;
-		});
-		const expected = Array.from(
-			{ length: 125 },
-			(_, index) => `note-${String(124 - index).padStart(3, "0")}`,
-		);
-		for (const path of [
-			`/content/category-note/by-relation?field=categoryId&targetId=${target.id}`,
-			`/content-types/category/inverse-relations/category-note?fieldName=categoryId&itemId=${target.id}`,
-		]) {
-			expect(
-				(await backend.handler(request(`${path}&view=editor`))).status,
-			).toBe(400);
-			for (const fields of ['["unknown"]', "[]", '["message.nested"]']) {
-				expect(
-					(
-						await backend.handler(
-							request(
-								`${path}&view=content&fields=${encodeURIComponent(fields)}`,
-							),
-						)
-					).status,
-				).toBe(400);
-			}
-			for (const view of [undefined, "content", "projected"]) {
-				const seen: string[] = [];
-				for (let offset = 0; offset < 125; offset += 25) {
-					fullReads.length = 0;
-					const response = await backend.handler(
-						request(
-							`${path}&limit=25&offset=${offset}${view ? `&view=content${view === "projected" ? "&fields=%5B%22message%22%5D" : ""}` : ""}`,
-						),
-					);
-					expect(response.status).toBe(200);
-					const page = await response.json();
-					expect(page).toMatchObject({ total: 125, limit: 25, offset });
-					expect(page.items.map((item: ContentItem) => item.id)).toEqual(
-						expected.slice(offset, offset + 25),
-					);
-					if (view) {
-						expect(page.items[0]).toEqual({
-							id: expected[offset],
-							slug: expected[offset],
-							parsedData: {
-								message: expected[offset],
-								...(view === "content" ? { unrequested: "Long body" } : {}),
-							},
-							createdAt: createdAt.toISOString(),
-							updatedAt: createdAt.toISOString(),
-						});
-					} else {
-						expect(page.items[0]).toMatchObject({
-							data: expect.any(String),
-							parsedData: { message: expected[offset] },
-							contentType: { slug: "category-note" },
-							createdAt: createdAt.toISOString(),
-						});
-					}
-					expect([...fullReads].sort()).toEqual(
-						[...expected.slice(offset, offset + 25)].sort(),
-					);
-					seen.push(...page.items.map((item: ContentItem) => item.id));
-				}
-				expect(seen).toEqual(expected);
-			}
-		}
-		expect(individualSourceReads).toEqual([]);
-	});
-
-	it("fails closed when relation-filter schemas or targets change after authorization", async () => {
-		const relationFilterAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.read.allow(),
-			],
-		});
-		const runRace = async (kind: "schema" | "target", view?: "content") => {
-			const baseAuth = createServerAuth({
-				authorization: relationFilterAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			});
-			const authorize = baseAuth.authorize.bind(baseAuth);
-			let backend: ReturnType<typeof makeBackend>;
-			let targetId = "";
-			const calls = new WeakMap<Request, number>();
-			const racingAuth: typeof baseAuth = {
-				...baseAuth,
-				async authorize(currentRequest, permissionRequest) {
-					const identity = await authorize(currentRequest, permissionRequest);
-					const count = (calls.get(currentRequest) ?? 0) + 1;
-					calls.set(currentRequest, count);
-					if (count === 3) {
-						if (kind === "schema") {
-							const resourceType = await backend.adapter.findOne<ContentType>({
-								model: "contentType",
-								where: [{ field: "slug", value: "resource" }],
-							});
-							if (!resourceType)
-								throw new Error("Missing resource content type");
-							await backend.adapter.update<ContentType>({
-								model: "contentType",
-								where: [{ field: "id", value: resourceType.id }],
-								update: {
-									jsonSchema: JSON.stringify(zodToFormSchema(articleSchema)),
-									updatedAt: new Date(),
-								},
-							});
-						} else {
-							await backend.adapter.delete({
-								model: "contentItem",
-								where: [{ field: "id", value: targetId }],
-							});
-						}
-					}
-					return identity;
-				},
-			};
-			backend = makeBackend({ auth: racingAuth });
-			const source = await seedRecord(backend, {
-				typeSlug: "resource",
-				slug: `${kind}-race-source`,
-			});
-			const target = await seedRecord(backend, {
-				typeSlug: "category",
-				slug: `${kind}-race-target`,
-			});
-			targetId = target.id;
-			await backend.adapter.create<ContentRelation>({
-				model: "contentRelation",
-				data: {
-					sourceId: source.id,
-					targetId: target.id,
-					fieldName: "categoryIds",
-					createdAt: new Date(),
-				},
-			});
-			const response = await backend.handler(
-				request(
-					`/content/resource/by-relation?field=categoryIds&targetId=${target.id}${view ? `&view=${view}` : ""}`,
-				),
-			);
-			expect(response.status).toBe(409);
-			expect(await response.json()).toMatchObject({
-				code:
-					kind === "schema"
-						? "RELATION_SCHEMA_CHANGED"
-						: "RECORD_STATE_CHANGED",
-			});
-		};
-
-		await runRace("schema");
-		await runRace("target");
-		await runRace("schema", "content");
-		await runRace("target", "content");
-	});
-
-	it("authorizes every populated relation target before returning its record", async () => {
-		const sourceOnlyAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) =>
-						facts.contentType === "resource" ||
-						facts.contentType === "category",
-				),
-				cms.record.read.when(({ facts }) => facts.contentType === "resource"),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: sourceOnlyAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-			hooks: {
-				onErrorExecuteContentOperation: () => {
-					events.push("error");
-				},
-			},
-		});
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "source-with-secret-relation",
-		});
-		const target = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "secret-category",
-		});
-		await backend.adapter.create<ContentRelation>({
-			model: "contentRelation",
-			data: {
-				sourceId: source.id,
-				targetId: target.id,
-				fieldName: "categoryIds",
-				createdAt: new Date(),
-			},
-		});
-
-		const response = await backend.handler(
-			request(`/content/resource/${source.id}/populated`, {
-				identity: { id: "reader-1", role: "user" },
-			}),
-		);
-		expect(response.status).toBe(403);
-		expect(events).toEqual([]);
-
-		const trusted = await backend.trusted.cms.getContentItemPopulated({
-			typeSlug: "resource",
-			id: source.id,
-		});
-		expect(trusted._relations.categoryIds?.[0]?.id).toBe(target.id);
-	});
-
-	it("does not return a populated target whose trusted facts change after authorization", async () => {
-		const ownerReadAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.allow(),
-				cms.record.read.when(
-					({ identity, facts }) =>
-						facts.contentType === "resource" || identity?.id === facts.authorId,
-				),
-			],
-		});
-		const events: string[] = [];
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: ownerReadAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-			hooks: {
-				onErrorExecuteContentOperation: (_error, operation) => {
-					events.push(`error:${operation}`);
-				},
-			},
-		});
-		const source = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "source-with-racing-relation",
-		});
-		const target = await seedRecord(backend, {
-			typeSlug: "category",
-			slug: "owned-category",
-			authorId: "reader-1",
-		});
-		await backend.adapter.create<ContentRelation>({
-			model: "contentRelation",
-			data: {
-				sourceId: source.id,
-				targetId: target.id,
-				fieldName: "categoryIds",
-				createdAt: new Date(),
-			},
-		});
-		const findMany = backend.adapter.findMany.bind(backend.adapter);
-		let relationReads = 0;
-		vi.spyOn(backend.adapter, "findMany").mockImplementation(async (query) => {
-			if (query.model === "contentRelation" && ++relationReads === 2) {
-				await backend.adapter.update<ContentItem>({
-					model: "contentItem",
-					where: [{ field: "id", value: target.id }],
-					update: { authorId: "other-owner" },
-				});
-			}
-			return findMany(query);
-		});
-
-		const response = await backend.handler(
-			request(`/content/resource/${source.id}/populated`, {
-				identity: { id: "reader-1", role: "user" },
-			}),
-		);
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RECORD_STATE_CHANGED",
-		});
-		expect(events).toEqual(["error:get"]);
-	});
-
-	it("authorizes referring source types before returning inverse metadata", async () => {
-		const targetOnlyAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "category",
-				),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: targetOnlyAuthorization,
-				getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-			}),
-		});
-
-		const response = await backend.handler(
-			request("/content-types/category/inverse-relations", {
-				identity: { id: "reader-1", role: "user" },
-			}),
-		);
-		expect(response.status).toBe(403);
-	});
-
-	it.each([undefined, "content"] as const)(
-		"authorizes the target record and source collections before inverse counts (%s view)",
-		async (view) => {
-			const inverseCountAuthorization = defineAuthorization({
-				identity: z.object({
-					id: z.string(),
-					mode: z.enum([
-						"target-only",
-						"source-only",
-						"all",
-						"racing",
-						"schema-racing",
-					]),
-				}),
-				permissions: [cmsPermissions] as const,
-				rules: ({ cms }) => [
-					cms.contentType.read.when(
-						({ facts }) =>
-							facts.contentType === "category" ||
-							facts.contentType === "category-note",
-					),
-					cms.record.read.when(({ identity, facts }) => {
-						const targetRecord =
-							facts.contentType === "category" && facts.scope === "record";
-						const sourceCollection =
-							facts.contentType === "category-note" &&
-							facts.scope === "collection";
-						if (identity?.mode === "target-only") return targetRecord;
-						if (identity?.mode === "source-only") return sourceCollection;
-						return (
-							(identity?.mode === "all" ||
-								identity?.mode === "racing" ||
-								identity?.mode === "schema-racing") &&
-							(targetRecord || sourceCollection)
-						);
-					}),
-				],
-			});
-			const modes = [
-				"target-only",
-				"source-only",
-				"all",
-				"racing",
-				"schema-racing",
-			] as const;
-			const baseAuth = createServerAuth({
-				authorization: inverseCountAuthorization,
-				getIdentity: ({ request: currentRequest }) => {
-					const mode = currentRequest.headers.get("x-mode");
-					return modes.includes(mode as (typeof modes)[number])
-						? { id: "reader-1", mode: mode as (typeof modes)[number] }
-						: null;
-				},
-			});
-			let backend: ReturnType<typeof makeBackend>;
-			let targetId = "";
-			const authorizationCalls = new WeakMap<Request, number>();
-			const authorize = baseAuth.authorize.bind(baseAuth);
-			const racingAuth: typeof baseAuth = {
-				...baseAuth,
-				async authorize(currentRequest, permissionRequest) {
-					const identity = await authorize(currentRequest, permissionRequest);
-					const count = (authorizationCalls.get(currentRequest) ?? 0) + 1;
-					authorizationCalls.set(currentRequest, count);
-					if (
-						currentRequest.headers.get("x-mode") === "racing" &&
-						count === 4
-					) {
-						await backend.adapter.update<ContentItem>({
-							model: "contentItem",
-							where: [{ field: "id", value: targetId }],
-							update: { authorId: "other-owner" },
-						});
-					}
-					if (
-						currentRequest.headers.get("x-mode") === "schema-racing" &&
-						count === 2
-					) {
-						const sourceType = await backend.adapter.findOne<ContentType>({
-							model: "contentType",
-							where: [{ field: "slug", value: "category-note" }],
-						});
-						if (!sourceType)
-							throw new Error("Missing category-note content type");
-						await backend.adapter.update<ContentType>({
-							model: "contentType",
-							where: [{ field: "id", value: sourceType.id }],
-							update: {
-								jsonSchema: JSON.stringify(zodToFormSchema(articleSchema)),
-								updatedAt: new Date(),
-							},
-						});
-					}
-					return identity;
-				},
-			};
-			backend = makeBackend({ auth: racingAuth });
-			const target = await seedRecord(backend, {
-				typeSlug: "category",
-				slug: "counted-category",
-				authorId: "reader-1",
-			});
-			targetId = target.id;
-			const source = await seedRecord(backend, {
-				typeSlug: "category-note",
-				slug: "counted-note",
-			});
-			const wrongTypeTarget = await seedRecord(backend, {
-				typeSlug: "article",
-				slug: "wrong-target-type",
-			});
-			await backend.adapter.create<ContentRelation>({
-				model: "contentRelation",
-				data: {
-					sourceId: source.id,
-					targetId: target.id,
-					fieldName: "categoryId",
-					createdAt: new Date(),
-				},
-			});
-			const findMany = backend.adapter.findMany.bind(backend.adapter);
-			let relationReads = 0;
-			vi.spyOn(backend.adapter, "findMany").mockImplementation(
-				async (query) => {
-					if (query.model === "contentRelation") relationReads += 1;
-					return findMany(query);
-				},
-			);
-			const countRequest = (mode: (typeof modes)[number]) =>
-				new Request(
-					`http://localhost/api/content-types/category/inverse-relations?itemId=${target.id}`,
-					{ headers: { "x-mode": mode } },
-				);
-			const listRequest = (
-				mode: (typeof modes)[number],
-				options?: { itemId?: string; fieldName?: string },
-			) =>
-				new Request(
-					`http://localhost/api/content-types/category/inverse-relations/category-note?itemId=${options?.itemId ?? target.id}&fieldName=${options?.fieldName ?? "categoryId"}${view ? `&view=${view}` : ""}`,
-					{ headers: { "x-mode": mode } },
-				);
-
-			const listTargetDenied = await backend.handler(
-				listRequest("source-only"),
-			);
-			expect(listTargetDenied.status).toBe(403);
-			const wrongTargetType = await backend.handler(
-				listRequest("all", { itemId: wrongTypeTarget.id }),
-			);
-			expect(wrongTargetType.status).toBe(404);
-			const invalidField = await backend.handler(
-				listRequest("all", { fieldName: "notACategoryRelation" }),
-			);
-			expect(invalidField.status).toBe(404);
-			expect(await invalidField.json()).toMatchObject({
-				code: "INVERSE_RELATION_NOT_FOUND",
-			});
-			expect(relationReads).toBe(0);
-
-			const allowedList = await backend.handler(listRequest("all"));
-			expect(allowedList.status).toBe(200);
-			expect(await allowedList.json()).toMatchObject({
-				total: 1,
-				items: [{ id: source.id }],
-			});
-			expect(relationReads).toBe(1);
-
-			const sourceDenied = await backend.handler(countRequest("target-only"));
-			expect(sourceDenied.status).toBe(403);
-			const targetDenied = await backend.handler(countRequest("source-only"));
-			expect(targetDenied.status).toBe(403);
-			expect(relationReads).toBe(1);
-
-			const allowed = await backend.handler(countRequest("all"));
-			expect(allowed.status).toBe(200);
-			expect(await allowed.json()).toMatchObject({
-				inverseRelations: [{ sourceType: "category-note", count: 1 }],
-			});
-			expect(relationReads).toBe(2);
-
-			const staleTarget = await backend.handler(countRequest("racing"));
-			expect(staleTarget.status).toBe(409);
-			expect(await staleTarget.json()).toMatchObject({
-				code: "RECORD_STATE_CHANGED",
-			});
-			expect(relationReads).toBe(2);
-
-			const staleSchema = await backend.handler(listRequest("schema-racing"));
-			expect(staleSchema.status).toBe(409);
-			expect(await staleSchema.json()).toMatchObject({
-				code: "RELATION_SCHEMA_CHANGED",
-			});
-			expect(relationReads).toBe(2);
-		},
-	);
-
-	it("fails closed when inverse relation schemas change after authorization", async () => {
-		const inverseAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) =>
-						facts.contentType === "category" ||
-						facts.contentType === "category-note",
-				),
-			],
-		});
-		let backend: ReturnType<typeof makeBackend>;
-		const baseAuth = createServerAuth({
-			authorization: inverseAuthorization,
-			getIdentity: () => ({ id: "reader-1", role: "user" as const }),
-		});
-		const authorize = baseAuth.authorize.bind(baseAuth);
-		let authorizationCalls = 0;
-		const racingAuth: typeof baseAuth = {
-			...baseAuth,
-			async authorize(request, permissionRequest) {
-				const identity = await authorize(request, permissionRequest);
-				if (++authorizationCalls === 2) {
-					const resourceType = await backend.adapter.findOne<ContentType>({
-						model: "contentType",
-						where: [{ field: "slug", value: "resource" }],
-					});
-					if (!resourceType) throw new Error("Missing resource content type");
-					await backend.adapter.update<ContentType>({
-						model: "contentType",
-						where: [{ field: "id", value: resourceType.id }],
-						update: {
-							jsonSchema: JSON.stringify(
-								zodToFormSchema(inverseResourceRelationSchema),
-							),
-							updatedAt: new Date(),
-						},
-					});
-				}
-				return identity;
-			},
-		};
-		backend = makeBackend({ auth: racingAuth });
-		await allContentTypes(backend);
-
-		const response = await backend.handler(
-			request("/content-types/category/inverse-relations", {
-				identity: { id: "reader-1", role: "user" },
-			}),
-		);
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RELATION_SCHEMA_CHANGED",
-		});
-	});
-
-	it("derives detail-by-slug facts for UI Builder and other page renderers", async () => {
-		const ownerReadAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.enum(["user", "admin"]) }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "article",
-				),
-				cms.record.read.when(
-					({ identity, facts }) =>
-						identity?.id === facts.authorId && facts.recordId !== undefined,
-				),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: ownerReadAuthorization,
-				getIdentity: ({ request: currentRequest }) => {
-					const id = currentRequest.headers.get("x-user-id");
-					return id ? { id, role: "user" as const } : null;
-				},
-			}),
-		});
-		const record = await seedRecord(backend, {
-			slug: "rendered-page",
-			authorId: "owner-1",
-		});
-
-		const owner = await backend.handler(
-			request("/content/article?slug=rendered-page&limit=1", {
-				identity: { id: "owner-1", role: "user" },
-			}),
-		);
-		expect(owner.status).toBe(200);
-		expect((await owner.json()).items[0]?.id).toBe(record.id);
-		const viewer = await backend.handler(
-			request("/content/article?slug=rendered-page&limit=1", {
-				identity: { id: "viewer-1", role: "user" },
-			}),
-		);
-		expect(viewer.status).toBe(403);
-	});
-
-	it("keeps anonymous by-slug rendering public without exposing the admin list", async () => {
-		const publicPageAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.enum(["user", "admin"]) }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "article",
-				),
-				cms.record.read.when(
-					({ facts }) =>
-						facts.contentType === "article" && facts.scope === "record",
-				),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: publicPageAuthorization,
-				getIdentity: () => null,
-			}),
-		});
-		const record = await seedRecord(backend, {
-			slug: "public-render",
-			authorId: "owner-1",
-		});
-
-		const publicRender = await backend.handler(
-			request("/content/article?slug=public-render&limit=1"),
-		);
-		expect(publicRender.status).toBe(200);
-		expect((await publicRender.json()).items[0]?.id).toBe(record.id);
-		const missingRender = await backend.handler(
-			request("/content/article?slug=missing-render&limit=1"),
-		);
-		expect(missingRender.status).toBe(200);
-		expect(await missingRender.json()).toMatchObject({ items: [], total: 0 });
-		expect(await backend.handler(request("/content/article"))).toMatchObject({
-			status: 401,
-		});
-	});
-
-	it("preserves empty by-slug results when pagination or search excludes the authorized record", async () => {
-		const publicPageAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "article",
-				),
-				cms.record.read.when(({ facts }) => facts.scope === "record"),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: publicPageAuthorization,
-				getIdentity: () => null,
-			}),
-		});
-		await seedRecord(backend, {
-			slug: "filtered-render",
-			authorId: "owner-1",
-		});
-
-		const paginated = await backend.handler(
-			request("/content/article?slug=filtered-render&limit=1&offset=1"),
-		);
-		expect(paginated.status).toBe(200);
-		expect(await paginated.json()).toMatchObject({
-			items: [],
-			total: 1,
-			limit: 1,
-			offset: 1,
-		});
-
-		const searched = await backend.handler(
-			request(
-				"/content/article?slug=filtered-render&search=does-not-match&limit=1",
-			),
-		);
-		expect(searched.status).toBe(200);
-		expect(await searched.json()).toMatchObject({
-			items: [],
-			total: 0,
-			limit: 1,
-			offset: 0,
-		});
-	});
-
-	it("does not return a by-slug record whose ownership changes after authorization", async () => {
-		const ownerReadAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "article",
-				),
-				cms.record.read.when(
-					({ identity, facts }) => identity?.id === facts.authorId,
-				),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: ownerReadAuthorization,
-				getIdentity: () => ({ id: "owner-1", role: "user" as const }),
-			}),
-		});
-		const record = await seedRecord(backend, {
-			slug: "ownership-race",
-			authorId: "owner-1",
-		});
-		const findMany = backend.adapter.findMany.bind(backend.adapter);
-		vi.spyOn(backend.adapter, "findMany").mockImplementation(async (query) => {
-			if (query.model === "contentItem") {
-				await backend.adapter.update<ContentItem>({
-					model: "contentItem",
-					where: [{ field: "id", value: record.id }],
-					update: { authorId: "other-owner" },
-				});
-			}
-			return findMany(query);
-		});
-
-		const response = await backend.handler(
-			request("/content/article?slug=ownership-race&limit=1"),
-		);
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RECORD_STATE_CHANGED",
-		});
-	});
-
-	it("does not expose a by-slug record created after a public missing-record check", async () => {
-		const publicPageAuthorization = defineAuthorization({
-			identity: z.object({ id: z.string(), role: z.literal("user") }),
-			permissions: [cmsPermissions] as const,
-			rules: ({ cms }) => [
-				cms.contentType.read.when(
-					({ facts }) => facts.contentType === "article",
-				),
-				cms.record.read.when(({ facts }) => facts.scope === "record"),
-			],
-		});
-		const backend = makeBackend({
-			auth: createServerAuth({
-				authorization: publicPageAuthorization,
-				getIdentity: () => null,
-			}),
-		});
-		const contentType = (await allContentTypes(backend)).find(
-			(value) => value.slug === "article",
-		);
-		if (!contentType) throw new Error("Missing article content type");
-		const findMany = backend.adapter.findMany.bind(backend.adapter);
-		let inserted = false;
-		vi.spyOn(backend.adapter, "findMany").mockImplementation(async (query) => {
-			if (query.model === "contentItem" && !inserted) {
-				inserted = true;
-				await backend.adapter.create<ContentItem>({
-					model: "contentItem",
-					data: {
-						contentTypeId: contentType.id,
-						slug: "just-created",
-						data: JSON.stringify({ title: "Just created" }),
-						authorId: "private-owner",
-						createdAt: new Date(),
-						updatedAt: new Date(),
-					},
-				});
-			}
-			return findMany(query);
-		});
-
-		const response = await backend.handler(
-			request("/content/article?slug=just-created&limit=1&offset=1"),
-		);
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RECORD_STATE_CHANGED",
-		});
-	});
-
-	it("keeps identity, missing-rule, policy, fact, and input failures outside hooks", async () => {
-		const events: string[] = [];
-		const hooks: CMSBackendHooks = {
-			onBeforeDeleteContent: () => {
-				events.push("before");
-			},
-			onAfterDeleteContent: () => {
-				events.push("after");
-			},
-			onErrorExecuteContentOperation: () => {
-				events.push("error");
-			},
-		};
-		const identityFailure = makeBackend({
-			auth: createAuth(() => {
-				throw new Error("session unavailable");
-			}),
-			hooks,
-		});
-		const identityRecord = await seedRecord(identityFailure, {
-			slug: "identity-failure",
-			authorId: "author-1",
-		});
-		await expect(
-			identityFailure
-				.forRequest(request("/delete"))
-				.operations.cms.deleteContentItem({
-					typeSlug: "article",
-					id: identityRecord.id,
-				}),
-		).rejects.toThrow("session unavailable");
-
-		for (const [rule, expected] of [
-			[undefined, { statusCode: 403 }],
-			["throw", "policy unavailable"],
-		] as const) {
-			const definition = defineAuthorization({
-				identity: z.object({ id: z.string(), role: z.literal("user") }),
-				permissions: [cmsPermissions] as const,
-				rules: ({ cms }) =>
-					rule === "throw"
-						? [
-								cms.record.delete.when(() => {
-									throw new Error("policy unavailable");
-								}),
-							]
-						: [],
-			});
-			const backend = makeBackend({
-				auth: createServerAuth({
-					authorization: definition,
-					getIdentity: () => ({ id: "author-1", role: "user" as const }),
-				}),
-				hooks,
-			});
-			const record = await seedRecord(backend, {
-				slug: `rule-${rule ?? "missing"}`,
-				authorId: "author-1",
-			});
-			const rejection = expect(
-				backend
-					.forRequest(request("/delete"))
-					.operations.cms.deleteContentItem({
-						typeSlug: "article",
-						id: record.id,
-					}),
-			).rejects;
-			if (typeof expected === "string") await rejection.toThrow(expected);
-			else await rejection.toMatchObject(expected);
-		}
-
-		const factFailure = makeBackend({ hooks });
-		vi.spyOn(factFailure.adapter, "findOne").mockRejectedValueOnce(
-			new Error("facts unavailable"),
-		);
-		await expect(
-			factFailure.trusted.cms.deleteContentItem({
-				typeSlug: "article",
-				id: "missing",
-			}),
-		).rejects.toThrow("facts unavailable");
-		await expect(
-			factFailure.trusted.cms.deleteContentItem({
-				typeSlug: "article",
-				id: 1,
-			} as never),
-		).rejects.toBeInstanceOf(z.ZodError);
-		expect(events).toEqual([]);
-	});
-
-	it("preserves 403 denials from plain before-hook errors", async () => {
-		let backend: ReturnType<typeof makeBackend>;
-		backend = makeBackend({
-			auth: createAuth(),
-			hooks: {
-				onBeforeCreateContent: async (data) => {
-					expect(data).toMatchObject({
-						name: "Denied",
-						categoryIds: [{ id: expect.any(String) }],
-					});
-					expect((await allContentItems(backend, "category")).total).toBe(0);
-					throw new Error("Create denied by hook");
-				},
-				onBeforeUpdateContent: (_id, data) => {
-					expect(data).toMatchObject({ title: "hook-protected" });
-					throw new Error("Update denied by hook");
-				},
-				onBeforeDeleteContent: () => {
-					throw new Error("Delete denied by hook");
-				},
-			},
-		});
-		const record = await seedRecord(backend, {
-			slug: "hook-protected",
-			authorId: "author-1",
-		});
-		const identity = { id: "author-1", role: "user" as const };
-
-		for (const [response, message] of [
-			[
-				await backend.handler(
-					request("/content/resource", {
-						method: "POST",
-						identity,
-						body: {
-							slug: "denied-create",
-							data: {
-								name: "Denied",
-								categoryIds: [
-									{ _new: true, data: { name: "Should not persist" } },
-								],
-							},
-						},
-					}),
-				),
-				"Create denied by hook",
-			],
-			[
-				await backend.handler(
-					request(`/content/article/${record.id}`, {
-						method: "PUT",
-						identity,
-						body: { data: {} },
-					}),
-				),
-				"Update denied by hook",
-			],
-			[
-				await backend.handler(
-					request(`/content/article/${record.id}`, {
-						method: "PUT",
-						identity,
-						body: { slug: "denied-rename" },
-					}),
-				),
-				"Update denied by hook",
-			],
-			[
-				await backend.handler(
-					request(`/content/article/${record.id}`, {
-						method: "DELETE",
-						identity,
-					}),
-				),
-				"Delete denied by hook",
-			],
-		] as const) {
-			expect(response.status).toBe(403);
-			expect(await response.json()).toMatchObject({
-				code: "HOOK_DENIED",
-				message,
-			});
-		}
-
-		expect((await allContentItems(backend, "article")).total).toBe(1);
-		expect((await allContentItems(backend, "category")).total).toBe(0);
-		expect((await allContentItems(backend, "resource")).total).toBe(0);
-		expect(
-			JSON.parse(
-				(
-					await backend.adapter.findOne<ContentItem>({
-						model: "contentItem",
-						where: [{ field: "id", value: record.id }],
-					})
-				)?.data ?? "{}",
-			).title,
-		).toBe("hook-protected");
-	});
-
-	it("detects ownership changes after authorization before an update commits", async () => {
-		const events: string[] = [];
-		let backend: ReturnType<typeof makeBackend>;
-		backend = makeBackend({
-			auth: createAuth(),
-			hooks: {
-				onBeforeUpdateContent: async (id) => {
-					events.push("before");
-					expect((await allContentItems(backend, "category")).total).toBe(0);
-					await backend.adapter.update<ContentItem>({
-						model: "contentItem",
-						where: [{ field: "id", value: id }],
-						update: { authorId: "other-owner" },
-					});
-				},
-				onAfterUpdateContent: () => {
-					events.push("after");
-				},
-				onErrorExecuteContentOperation: (_error, operation, context) => {
-					events.push(`error:${operation}`);
-					expect(context.error).toMatchObject({
-						code: "RECORD_STATE_CHANGED",
-					});
-				},
-			},
-		});
-		const record = await seedRecord(backend, {
-			typeSlug: "resource",
-			slug: "stale-owner",
-			authorId: "author-1",
-		});
-		await expect(
-			backend
-				.forRequest(
-					request(`/content/resource/${record.id}`, {
-						identity: { id: "author-1", role: "user" },
-					}),
-				)
-				.operations.cms.updateContentItem({
-					typeSlug: "resource",
-					id: record.id,
-					body: {
-						data: {
-							name: "Must not commit",
-							categoryIds: [{ _new: true, data: { name: "Must not persist" } }],
-						},
-					},
-				}),
-		).rejects.toMatchObject({ statusCode: 409, code: "RECORD_STATE_CHANGED" });
-		expect(events).toEqual(["before", "error:update"]);
-		const persisted = await backend.adapter.findOne<ContentItem>({
-			model: "contentItem",
-			where: [{ field: "id", value: record.id }],
-		});
-		expect(JSON.parse(persisted?.data ?? "{}").title).toBe("stale-owner");
-		expect((await allContentItems(backend, "category")).total).toBe(0);
-	});
-
-	it("revalidates delete ownership before entering lifecycle hooks", async () => {
-		const events: string[] = [];
-		const baseAuth = createAuth();
-		const authorize = baseAuth.authorize.bind(baseAuth);
-		let backend: ReturnType<typeof makeBackend>;
-		let record: Awaited<ReturnType<typeof seedRecord>>;
-		let ownershipChanged = false;
-		const racingAuth: typeof baseAuth = {
-			...baseAuth,
-			async authorize(request, permissionRequest) {
-				const identity = await authorize(request, permissionRequest);
-				if (!ownershipChanged) {
-					ownershipChanged = true;
-					await backend.adapter.update<ContentItem>({
-						model: "contentItem",
-						where: [{ field: "id", value: record.id }],
-						update: { authorId: "other-owner" },
-					});
-				}
-				return identity;
-			},
-		};
-		backend = makeBackend({
-			auth: racingAuth,
-			hooks: {
-				onBeforeDeleteContent: () => {
-					events.push("before");
-				},
-				onAfterDeleteContent: () => {
-					events.push("after");
-				},
-				onErrorExecuteContentOperation: (_error, operation, context) => {
-					events.push(`error:${operation}`);
-					expect(context.error).toMatchObject({
-						code: "RECORD_STATE_CHANGED",
-					});
-				},
-			},
-		});
-		record = await seedRecord(backend, {
-			slug: "delete-ownership-race",
-			authorId: "author-1",
-		});
-
-		const response = await backend.handler(
-			request(`/content/article/${record.id}`, {
-				method: "DELETE",
-				identity: { id: "author-1", role: "user" },
-			}),
-		);
-
-		expect(response.status).toBe(409);
-		expect(await response.json()).toMatchObject({
-			code: "RECORD_STATE_CHANGED",
-		});
-		expect(events).toEqual(["error:delete"]);
-		expect(
-			await backend.adapter.findOne<ContentItem>({
-				model: "contentItem",
-				where: [{ field: "id", value: record.id }],
-			}),
-		).toMatchObject({ authorId: "other-owner" });
-	});
-
-	it("preserves permissive compatibility when authorization is omitted", async () => {
-		const backend = makeBackend();
-		const response = await backend.handler(
-			request("/content/article", {
-				method: "POST",
-				body: { slug: "legacy", data: { title: "Legacy" } },
-			}),
-		);
-		expect(response.status).toBe(200);
-	});
-});