@dalgoridim/headless-cms 0.1.0 → 0.2.0

package/dist/server/index.cjs

@@ -22,7 +22,8 @@ var server_exports = {};
 __export(server_exports, {
   UnauthorizedError: () => UnauthorizedError,
   createAdminGate: () => createAdminGate,
-  createCmsHandlers: () => createCmsHandlers
+  createCmsHandlers: () => createCmsHandlers,
+  resolveRelations: () => resolveRelations
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -33,13 +34,15 @@ var UnauthorizedError = class extends Error {
     this.name = "UnauthorizedError";
   }
 };
-function createAdminGate(auth) {
+var defaultAuthorize = (identity) => identity.isAdmin === true;
+function createAdminGate(auth, authorize = defaultAuthorize) {
   return async function requireAdmin(req) {
     const identity = await auth.verifyRequest(req);
-    if (!identity || !identity.isAdmin) {
-      throw new UnauthorizedError(
-        identity ? "Forbidden - Not an authorized admin" : "Unauthorized"
-      );
+    if (!identity) {
+      throw new UnauthorizedError("Unauthorized");
+    }
+    if (!await authorize(identity, req)) {
+      throw new UnauthorizedError("Forbidden - Not an authorized admin");
     }
     return identity;
   };
@@ -60,8 +63,8 @@ function errorResponse(error) {
   return json({ error: message }, 403);
 }
 function createCmsHandlers(deps) {
-  const { data, auth, storage } = deps;
-  const requireAdmin = createAdminGate(auth);
+  const { data, auth, storage, authorize } = deps;
+  const requireAdmin = createAdminGate(auth, authorize);
   const GET = async (req, ctx) => {
     try {
       await requireAdmin(req);
@@ -119,10 +122,61 @@ function createCmsHandlers(deps) {
   };
   return { GET, PATCH, PUT, DELETE, sign };
 }
+
+// src/server/relations.ts
+function isRef(v) {
+  return typeof v === "object" && v !== null && typeof v.collection === "string" && typeof v.id === "string";
+}
+async function resolveRelations(adapter, docs, options = {}) {
+  var _a, _b;
+  const list = Array.isArray(docs) ? docs : [docs];
+  const relations = (_a = options.relations) != null ? _a : {};
+  const fields = (_b = options.populate) != null ? _b : Object.keys(relations);
+  if (!fields.length || !list.length) return docs;
+  const cache = /* @__PURE__ */ new Map();
+  const load = (collection, id) => {
+    const key = `${collection}\0${id}`;
+    let pending = cache.get(key);
+    if (!pending) {
+      pending = adapter.fetchById(collection, id);
+      cache.set(key, pending);
+    }
+    return pending;
+  };
+  const toRef = (field, value) => {
+    if (isRef(value)) return value;
+    if (typeof value === "string" && relations[field]) {
+      return { collection: relations[field].collection, id: value };
+    }
+    return null;
+  };
+  const resolveValue = async (field, value) => {
+    const ref = toRef(field, value);
+    if (!ref) return value;
+    const resolved = await load(ref.collection, ref.id);
+    return resolved != null ? resolved : value;
+  };
+  await Promise.all(
+    list.map(async (doc) => {
+      for (const field of fields) {
+        const value = doc[field];
+        if (Array.isArray(value)) {
+          doc[field] = await Promise.all(
+            value.map((v) => resolveValue(field, v))
+          );
+        } else {
+          doc[field] = await resolveValue(field, value);
+        }
+      }
+    })
+  );
+  return docs;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   UnauthorizedError,
   createAdminGate,
-  createCmsHandlers
+  createCmsHandlers,
+  resolveRelations
 });
 //# sourceMappingURL=index.cjs.map

package/dist/server/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/index.ts","../../src/server/createAdminGate.ts","../../src/server/createCmsHandlers.ts"],"sourcesContent":["export {\n  createCmsHandlers,\n  type CmsHandlersDeps,\n} from \"./createCmsHandlers\";\nexport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\n\nexport type {\n  DataAdapter,\n  AuthAdapter,\n  AuthIdentity,\n  StorageAdapter,\n  ClientStorageAdapter,\n  ServerStorageAdapter,\n  Query,\n  Section,\n  NestedSections,\n} from \"../types\";\n","import type { AuthAdapter, AuthIdentity } from \"../types\";\n\n/** Thrown when a request fails the admin gate; carried up to the route handler. */\nexport class UnauthorizedError extends Error {\n  constructor(message = \"Unauthorized\") {\n    super(message);\n    this.name = \"UnauthorizedError\";\n  }\n}\n\n/**\n * Wraps an {@link AuthAdapter} into a reusable server gate. Throws\n * {@link UnauthorizedError} unless the request resolves to an admin identity.\n */\nexport function createAdminGate(auth: AuthAdapter) {\n  return async function requireAdmin(req: Request): Promise<AuthIdentity> {\n    const identity = await auth.verifyRequest(req);\n    if (!identity || !identity.isAdmin) {\n      throw new UnauthorizedError(\n        identity ? \"Forbidden - Not an authorized admin\" : \"Unauthorized\",\n      );\n    }\n    return identity;\n  };\n}\n","import type { DataAdapter, AuthAdapter, ServerStorageAdapter } from \"../types\";\nimport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\n\nexport interface CmsHandlersDeps {\n  data: DataAdapter;\n  auth: AuthAdapter;\n  storage?: ServerStorageAdapter;\n}\n\n/** Next.js App Router passes dynamic params as a promise. */\ntype RouteContext = {\n  params: Promise<{ collection: string; id: string }>;\n};\n\ntype RouteHandler = (req: Request, ctx: RouteContext) => Promise<Response>;\ntype SignHandler = (req: Request) => Promise<Response>;\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\n/**\n * Translate any thrown error into a response. Auth failures return 401 with\n * `{ logout: true }` so a client interceptor can force sign-out.\n */\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof UnauthorizedError && error.message === \"Unauthorized\") {\n    return json({ error: \"Unauthorized\", logout: true }, 401);\n  }\n  const message = error instanceof Error ? error.message : \"Request failed\";\n  return json({ error: message }, 403);\n}\n\n/**\n * Builds the generic admin CRUD handlers, replacing a hand-written\n * `/api/admin/[collection]/[id]/route.ts`. Mount like:\n *\n * ```ts\n * // app/api/admin/[collection]/[id]/route.ts\n * export const { GET, PATCH, PUT, DELETE } = createCmsHandlers({ data, auth });\n * ```\n *\n * If a `storage` adapter with a `sign` method is provided, also mount its sign\n * handler at e.g. `app/api/admin/sign/route.ts`:\n *\n * ```ts\n * export const POST = createCmsHandlers({ data, auth, storage }).sign;\n * ```\n */\nexport function createCmsHandlers(deps: CmsHandlersDeps): {\n  GET: RouteHandler;\n  PATCH: RouteHandler;\n  PUT: RouteHandler;\n  DELETE: RouteHandler;\n  sign: SignHandler;\n} {\n  const { data, auth, storage } = deps;\n  const requireAdmin = createAdminGate(auth);\n\n  const GET: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const doc = await data.fetchById(collection, id);\n      if (!doc) return json({ error: \"Document not found\" }, 404);\n      return json(doc);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PATCH: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.update(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PUT: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.upsert(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const DELETE: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      await data.delete(collection, id);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const sign: SignHandler = async (req) => {\n    try {\n      await requireAdmin(req);\n      if (!storage?.sign) {\n        return json({ error: \"No storage adapter with sign() configured\" }, 404);\n      }\n      const result = await storage.sign(req);\n      return json(result);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  return { GET, PATCH, PUT, DELETE, sign };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,gBAAgB,MAAmB;AACjD,SAAO,eAAe,aAAa,KAAqC;AACtE,UAAM,WAAW,MAAM,KAAK,cAAc,GAAG;AAC7C,QAAI,CAAC,YAAY,CAAC,SAAS,SAAS;AAClC,YAAM,IAAI;AAAA,QACR,WAAW,wCAAwC;AAAA,MACrD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;ACPA,SAAS,KAAK,MAAe,SAAS,KAAe;AACnD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAMA,SAAS,cAAc,OAA0B;AAC/C,MAAI,iBAAiB,qBAAqB,MAAM,YAAY,gBAAgB;AAC1E,WAAO,KAAK,EAAE,OAAO,gBAAgB,QAAQ,KAAK,GAAG,GAAG;AAAA,EAC1D;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AACrC;AAkBO,SAAS,kBAAkB,MAMhC;AACA,QAAM,EAAE,MAAM,MAAM,QAAQ,IAAI;AAChC,QAAM,eAAe,gBAAgB,IAAI;AAEzC,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,MAAM,MAAM,KAAK,UAAU,YAAY,EAAE;AAC/C,UAAI,CAAC,IAAK,QAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AAC1D,aAAO,KAAK,GAAG;AAAA,IACjB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,QAAsB,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,SAAuB,OAAO,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,KAAK,OAAO,YAAY,EAAE;AAChC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,OAAoB,OAAO,QAAQ;AACvC,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,UAAI,EAAC,mCAAS,OAAM;AAClB,eAAO,KAAK,EAAE,OAAO,4CAA4C,GAAG,GAAG;AAAA,MACzE;AACA,YAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;AACrC,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,OAAO,KAAK,QAAQ,KAAK;AACzC;","names":[]}
+{"version":3,"sources":["../../src/server/index.ts","../../src/server/createAdminGate.ts","../../src/server/createCmsHandlers.ts","../../src/server/relations.ts"],"sourcesContent":["export {\n  createCmsHandlers,\n  type CmsHandlersDeps,\n} from \"./createCmsHandlers\";\nexport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\nexport {\n  resolveRelations,\n  type ResolveRelationsOptions,\n} from \"./relations\";\n\nexport type {\n  DataAdapter,\n  AuthAdapter,\n  AuthIdentity,\n  AuthorizeFn,\n  StorageAdapter,\n  ClientStorageAdapter,\n  ServerStorageAdapter,\n  Query,\n  QueryFilter,\n  QueryFilterGroup,\n  QueryCondition,\n  QueryFilterOp,\n  Ref,\n  RelationConfig,\n  Editable,\n  EntityAddress,\n  Section,\n  NestedSections,\n} from \"../types\";\n","import type { AuthAdapter, AuthIdentity, AuthorizeFn } from \"../types\";\n\n/** Thrown when a request fails the admin gate; carried up to the route handler. */\nexport class UnauthorizedError extends Error {\n  constructor(message = \"Unauthorized\") {\n    super(message);\n    this.name = \"UnauthorizedError\";\n  }\n}\n\n/** Default authorization: admin flag must be set. */\nconst defaultAuthorize: AuthorizeFn = (identity) => identity.isAdmin === true;\n\n/**\n * Wraps an {@link AuthAdapter} into a reusable server gate. Throws\n * {@link UnauthorizedError} unless the request resolves to an identity that\n * passes `authorize`. `authorize` defaults to `identity.isAdmin === true`;\n * override it to gate on roles, scopes, tenants, etc.\n */\nexport function createAdminGate(auth: AuthAdapter, authorize: AuthorizeFn = defaultAuthorize) {\n  return async function requireAdmin(req: Request): Promise<AuthIdentity> {\n    const identity = await auth.verifyRequest(req);\n    if (!identity) {\n      throw new UnauthorizedError(\"Unauthorized\");\n    }\n    if (!(await authorize(identity, req))) {\n      throw new UnauthorizedError(\"Forbidden - Not an authorized admin\");\n    }\n    return identity;\n  };\n}\n","import type {\n  DataAdapter,\n  AuthAdapter,\n  AuthorizeFn,\n  ServerStorageAdapter,\n} from \"../types\";\nimport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\n\nexport interface CmsHandlersDeps {\n  data: DataAdapter;\n  auth: AuthAdapter;\n  storage?: ServerStorageAdapter;\n  /** Custom authorization predicate. Defaults to `identity.isAdmin === true`. */\n  authorize?: AuthorizeFn;\n}\n\n/** Next.js App Router passes dynamic params as a promise. */\ntype RouteContext = {\n  params: Promise<{ collection: string; id: string }>;\n};\n\ntype RouteHandler = (req: Request, ctx: RouteContext) => Promise<Response>;\ntype SignHandler = (req: Request) => Promise<Response>;\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\n/**\n * Translate any thrown error into a response. Auth failures return 401 with\n * `{ logout: true }` so a client interceptor can force sign-out.\n */\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof UnauthorizedError && error.message === \"Unauthorized\") {\n    return json({ error: \"Unauthorized\", logout: true }, 401);\n  }\n  const message = error instanceof Error ? error.message : \"Request failed\";\n  return json({ error: message }, 403);\n}\n\n/**\n * Builds the generic admin CRUD handlers, replacing a hand-written\n * `/api/admin/[collection]/[id]/route.ts`. Mount like:\n *\n * ```ts\n * // app/api/admin/[collection]/[id]/route.ts\n * export const { GET, PATCH, PUT, DELETE } = createCmsHandlers({ data, auth });\n * ```\n *\n * If a `storage` adapter with a `sign` method is provided, also mount its sign\n * handler at e.g. `app/api/admin/sign/route.ts`:\n *\n * ```ts\n * export const POST = createCmsHandlers({ data, auth, storage }).sign;\n * ```\n */\nexport function createCmsHandlers(deps: CmsHandlersDeps): {\n  GET: RouteHandler;\n  PATCH: RouteHandler;\n  PUT: RouteHandler;\n  DELETE: RouteHandler;\n  sign: SignHandler;\n} {\n  const { data, auth, storage, authorize } = deps;\n  const requireAdmin = createAdminGate(auth, authorize);\n\n  const GET: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const doc = await data.fetchById(collection, id);\n      if (!doc) return json({ error: \"Document not found\" }, 404);\n      return json(doc);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PATCH: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.update(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PUT: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.upsert(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const DELETE: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      await data.delete(collection, id);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const sign: SignHandler = async (req) => {\n    try {\n      await requireAdmin(req);\n      if (!storage?.sign) {\n        return json({ error: \"No storage adapter with sign() configured\" }, 404);\n      }\n      const result = await storage.sign(req);\n      return json(result);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  return { GET, PATCH, PUT, DELETE, sign };\n}\n","import type { DataAdapter, Ref, RelationConfig } from \"../types\";\n\n/** A field value is a reference when it's a self-describing `{ collection, id }`. */\nfunction isRef(v: unknown): v is Ref {\n  return (\n    typeof v === \"object\" &&\n    v !== null &&\n    typeof (v as Ref).collection === \"string\" &&\n    typeof (v as Ref).id === \"string\"\n  );\n}\n\nexport interface ResolveRelationsOptions {\n  /**\n   * Which fields to resolve. Defaults to every field named in `relations`. Pass\n   * a query's `populate` array here.\n   */\n  populate?: string[];\n  /**\n   * Maps bare-id reference fields → their target collection. Not needed for\n   * self-describing `{ collection, id }` refs.\n   */\n  relations?: RelationConfig;\n}\n\n/**\n * Inline-resolves reference fields on one or more documents, backend-agnostic.\n * A reference may be a self-describing `{ collection, id }`, a bare id string\n * (resolved via `relations`), or an array of either. Resolution is deduplicated\n * and parallelized; unresolved refs are left untouched.\n *\n * Lives in the engine, never in an adapter, so it works the same over Postgres,\n * Firestore, or any custom {@link DataAdapter}.\n *\n * Mutates and returns the passed document(s).\n */\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T,\n  options?: ResolveRelationsOptions,\n): Promise<T>;\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T[],\n  options?: ResolveRelationsOptions,\n): Promise<T[]>;\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T | T[],\n  options: ResolveRelationsOptions = {},\n): Promise<T | T[]> {\n  const list = Array.isArray(docs) ? docs : [docs];\n  const relations = options.relations ?? {};\n  const fields = options.populate ?? Object.keys(relations);\n  if (!fields.length || !list.length) return docs;\n\n  // Dedupe loads across all docs/fields: one fetch per (collection, id).\n  const cache = new Map<string, Promise<unknown>>();\n  const load = (collection: string, id: string): Promise<unknown> => {\n    const key = `${collection}\u0000${id}`;\n    let pending = cache.get(key);\n    if (!pending) {\n      pending = adapter.fetchById(collection, id);\n      cache.set(key, pending);\n    }\n    return pending;\n  };\n\n  const toRef = (field: string, value: unknown): Ref | null => {\n    if (isRef(value)) return value;\n    if (typeof value === \"string\" && relations[field]) {\n      return { collection: relations[field].collection, id: value };\n    }\n    return null;\n  };\n\n  const resolveValue = async (field: string, value: unknown): Promise<unknown> => {\n    const ref = toRef(field, value);\n    if (!ref) return value;\n    const resolved = await load(ref.collection, ref.id);\n    return resolved ?? value;\n  };\n\n  await Promise.all(\n    list.map(async (doc) => {\n      for (const field of fields) {\n        const value = doc[field];\n        if (Array.isArray(value)) {\n          (doc as Record<string, unknown>)[field] = await Promise.all(\n            value.map((v) => resolveValue(field, v)),\n          );\n        } else {\n          (doc as Record<string, unknown>)[field] = await resolveValue(field, value);\n        }\n      }\n    }),\n  );\n\n  return docs;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,mBAAgC,CAAC,aAAa,SAAS,YAAY;AAQlE,SAAS,gBAAgB,MAAmB,YAAyB,kBAAkB;AAC5F,SAAO,eAAe,aAAa,KAAqC;AACtE,UAAM,WAAW,MAAM,KAAK,cAAc,GAAG;AAC7C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,kBAAkB,cAAc;AAAA,IAC5C;AACA,QAAI,CAAE,MAAM,UAAU,UAAU,GAAG,GAAI;AACrC,YAAM,IAAI,kBAAkB,qCAAqC;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACF;;;ACNA,SAAS,KAAK,MAAe,SAAS,KAAe;AACnD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAMA,SAAS,cAAc,OAA0B;AAC/C,MAAI,iBAAiB,qBAAqB,MAAM,YAAY,gBAAgB;AAC1E,WAAO,KAAK,EAAE,OAAO,gBAAgB,QAAQ,KAAK,GAAG,GAAG;AAAA,EAC1D;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AACrC;AAkBO,SAAS,kBAAkB,MAMhC;AACA,QAAM,EAAE,MAAM,MAAM,SAAS,UAAU,IAAI;AAC3C,QAAM,eAAe,gBAAgB,MAAM,SAAS;AAEpD,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,MAAM,MAAM,KAAK,UAAU,YAAY,EAAE;AAC/C,UAAI,CAAC,IAAK,QAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AAC1D,aAAO,KAAK,GAAG;AAAA,IACjB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,QAAsB,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,SAAuB,OAAO,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,KAAK,OAAO,YAAY,EAAE;AAChC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,OAAoB,OAAO,QAAQ;AACvC,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,UAAI,EAAC,mCAAS,OAAM;AAClB,eAAO,KAAK,EAAE,OAAO,4CAA4C,GAAG,GAAG;AAAA,MACzE;AACA,YAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;AACrC,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,OAAO,KAAK,QAAQ,KAAK;AACzC;;;AC/HA,SAAS,MAAM,GAAsB;AACnC,SACE,OAAO,MAAM,YACb,MAAM,QACN,OAAQ,EAAU,eAAe,YACjC,OAAQ,EAAU,OAAO;AAE7B;AAoCA,eAAsB,iBACpB,SACA,MACA,UAAmC,CAAC,GAClB;AAlDpB;AAmDE,QAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI;AAC/C,QAAM,aAAY,aAAQ,cAAR,YAAqB,CAAC;AACxC,QAAM,UAAS,aAAQ,aAAR,YAAoB,OAAO,KAAK,SAAS;AACxD,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,OAAQ,QAAO;AAG3C,QAAM,QAAQ,oBAAI,IAA8B;AAChD,QAAM,OAAO,CAAC,YAAoB,OAAiC;AACjE,UAAM,MAAM,GAAG,UAAU,KAAI,EAAE;AAC/B,QAAI,UAAU,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,SAAS;AACZ,gBAAU,QAAQ,UAAU,YAAY,EAAE;AAC1C,YAAM,IAAI,KAAK,OAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,CAAC,OAAe,UAA+B;AAC3D,QAAI,MAAM,KAAK,EAAG,QAAO;AACzB,QAAI,OAAO,UAAU,YAAY,UAAU,KAAK,GAAG;AACjD,aAAO,EAAE,YAAY,UAAU,KAAK,EAAE,YAAY,IAAI,MAAM;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,OAAO,OAAe,UAAqC;AAC9E,UAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE;AAClD,WAAO,8BAAY;AAAA,EACrB;AAEA,QAAM,QAAQ;AAAA,IACZ,KAAK,IAAI,OAAO,QAAQ;AACtB,iBAAW,SAAS,QAAQ;AAC1B,cAAM,QAAQ,IAAI,KAAK;AACvB,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAC,IAAgC,KAAK,IAAI,MAAM,QAAQ;AAAA,YACtD,MAAM,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AAAA,UACzC;AAAA,QACF,OAAO;AACL,UAAC,IAAgC,KAAK,IAAI,MAAM,aAAa,OAAO,KAAK;AAAA,QAC3E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;","names":[]}

package/dist/server/index.d.cts

@@ -1,10 +1,12 @@
-import { DataAdapter, AuthAdapter, ServerStorageAdapter, AuthIdentity } from '../index.cjs';
-export { ClientStorageAdapter, NestedSections, Query, Section, StorageAdapter } from '../index.cjs';
+import { DataAdapter, AuthAdapter, ServerStorageAdapter, AuthorizeFn, AuthIdentity, RelationConfig } from '../index.cjs';
+export { ClientStorageAdapter, Editable, EntityAddress, NestedSections, Query, QueryCondition, QueryFilter, QueryFilterGroup, QueryFilterOp, Ref, Section, StorageAdapter } from '../index.cjs';
 
 interface CmsHandlersDeps {
     data: DataAdapter;
     auth: AuthAdapter;
     storage?: ServerStorageAdapter;
+    /** Custom authorization predicate. Defaults to `identity.isAdmin === true`. */
+    authorize?: AuthorizeFn;
 }
 /** Next.js App Router passes dynamic params as a promise. */
 type RouteContext = {
@@ -45,8 +47,36 @@ declare class UnauthorizedError extends Error {
 }
 /**
  * Wraps an {@link AuthAdapter} into a reusable server gate. Throws
- * {@link UnauthorizedError} unless the request resolves to an admin identity.
+ * {@link UnauthorizedError} unless the request resolves to an identity that
+ * passes `authorize`. `authorize` defaults to `identity.isAdmin === true`;
+ * override it to gate on roles, scopes, tenants, etc.
  */
-declare function createAdminGate(auth: AuthAdapter): (req: Request) => Promise<AuthIdentity>;
+declare function createAdminGate(auth: AuthAdapter, authorize?: AuthorizeFn): (req: Request) => Promise<AuthIdentity>;
 
-export { AuthAdapter, AuthIdentity, type CmsHandlersDeps, DataAdapter, ServerStorageAdapter, UnauthorizedError, createAdminGate, createCmsHandlers };
+interface ResolveRelationsOptions {
+    /**
+     * Which fields to resolve. Defaults to every field named in `relations`. Pass
+     * a query's `populate` array here.
+     */
+    populate?: string[];
+    /**
+     * Maps bare-id reference fields → their target collection. Not needed for
+     * self-describing `{ collection, id }` refs.
+     */
+    relations?: RelationConfig;
+}
+/**
+ * Inline-resolves reference fields on one or more documents, backend-agnostic.
+ * A reference may be a self-describing `{ collection, id }`, a bare id string
+ * (resolved via `relations`), or an array of either. Resolution is deduplicated
+ * and parallelized; unresolved refs are left untouched.
+ *
+ * Lives in the engine, never in an adapter, so it works the same over Postgres,
+ * Firestore, or any custom {@link DataAdapter}.
+ *
+ * Mutates and returns the passed document(s).
+ */
+declare function resolveRelations<T extends Record<string, any>>(adapter: DataAdapter, docs: T, options?: ResolveRelationsOptions): Promise<T>;
+declare function resolveRelations<T extends Record<string, any>>(adapter: DataAdapter, docs: T[], options?: ResolveRelationsOptions): Promise<T[]>;
+
+export { AuthAdapter, AuthIdentity, AuthorizeFn, type CmsHandlersDeps, DataAdapter, RelationConfig, type ResolveRelationsOptions, ServerStorageAdapter, UnauthorizedError, createAdminGate, createCmsHandlers, resolveRelations };

package/dist/server/index.d.ts

@@ -1,10 +1,12 @@
-import { DataAdapter, AuthAdapter, ServerStorageAdapter, AuthIdentity } from '../index.js';
-export { ClientStorageAdapter, NestedSections, Query, Section, StorageAdapter } from '../index.js';
+import { DataAdapter, AuthAdapter, ServerStorageAdapter, AuthorizeFn, AuthIdentity, RelationConfig } from '../index.js';
+export { ClientStorageAdapter, Editable, EntityAddress, NestedSections, Query, QueryCondition, QueryFilter, QueryFilterGroup, QueryFilterOp, Ref, Section, StorageAdapter } from '../index.js';
 
 interface CmsHandlersDeps {
     data: DataAdapter;
     auth: AuthAdapter;
     storage?: ServerStorageAdapter;
+    /** Custom authorization predicate. Defaults to `identity.isAdmin === true`. */
+    authorize?: AuthorizeFn;
 }
 /** Next.js App Router passes dynamic params as a promise. */
 type RouteContext = {
@@ -45,8 +47,36 @@ declare class UnauthorizedError extends Error {
 }
 /**
  * Wraps an {@link AuthAdapter} into a reusable server gate. Throws
- * {@link UnauthorizedError} unless the request resolves to an admin identity.
+ * {@link UnauthorizedError} unless the request resolves to an identity that
+ * passes `authorize`. `authorize` defaults to `identity.isAdmin === true`;
+ * override it to gate on roles, scopes, tenants, etc.
  */
-declare function createAdminGate(auth: AuthAdapter): (req: Request) => Promise<AuthIdentity>;
+declare function createAdminGate(auth: AuthAdapter, authorize?: AuthorizeFn): (req: Request) => Promise<AuthIdentity>;
 
-export { AuthAdapter, AuthIdentity, type CmsHandlersDeps, DataAdapter, ServerStorageAdapter, UnauthorizedError, createAdminGate, createCmsHandlers };
+interface ResolveRelationsOptions {
+    /**
+     * Which fields to resolve. Defaults to every field named in `relations`. Pass
+     * a query's `populate` array here.
+     */
+    populate?: string[];
+    /**
+     * Maps bare-id reference fields → their target collection. Not needed for
+     * self-describing `{ collection, id }` refs.
+     */
+    relations?: RelationConfig;
+}
+/**
+ * Inline-resolves reference fields on one or more documents, backend-agnostic.
+ * A reference may be a self-describing `{ collection, id }`, a bare id string
+ * (resolved via `relations`), or an array of either. Resolution is deduplicated
+ * and parallelized; unresolved refs are left untouched.
+ *
+ * Lives in the engine, never in an adapter, so it works the same over Postgres,
+ * Firestore, or any custom {@link DataAdapter}.
+ *
+ * Mutates and returns the passed document(s).
+ */
+declare function resolveRelations<T extends Record<string, any>>(adapter: DataAdapter, docs: T, options?: ResolveRelationsOptions): Promise<T>;
+declare function resolveRelations<T extends Record<string, any>>(adapter: DataAdapter, docs: T[], options?: ResolveRelationsOptions): Promise<T[]>;
+
+export { AuthAdapter, AuthIdentity, AuthorizeFn, type CmsHandlersDeps, DataAdapter, RelationConfig, type ResolveRelationsOptions, ServerStorageAdapter, UnauthorizedError, createAdminGate, createCmsHandlers, resolveRelations };

package/dist/server/index.js

@@ -5,13 +5,15 @@ var UnauthorizedError = class extends Error {
     this.name = "UnauthorizedError";
   }
 };
-function createAdminGate(auth) {
+var defaultAuthorize = (identity) => identity.isAdmin === true;
+function createAdminGate(auth, authorize = defaultAuthorize) {
   return async function requireAdmin(req) {
     const identity = await auth.verifyRequest(req);
-    if (!identity || !identity.isAdmin) {
-      throw new UnauthorizedError(
-        identity ? "Forbidden - Not an authorized admin" : "Unauthorized"
-      );
+    if (!identity) {
+      throw new UnauthorizedError("Unauthorized");
+    }
+    if (!await authorize(identity, req)) {
+      throw new UnauthorizedError("Forbidden - Not an authorized admin");
     }
     return identity;
   };
@@ -32,8 +34,8 @@ function errorResponse(error) {
   return json({ error: message }, 403);
 }
 function createCmsHandlers(deps) {
-  const { data, auth, storage } = deps;
-  const requireAdmin = createAdminGate(auth);
+  const { data, auth, storage, authorize } = deps;
+  const requireAdmin = createAdminGate(auth, authorize);
   const GET = async (req, ctx) => {
     try {
       await requireAdmin(req);
@@ -91,9 +93,60 @@ function createCmsHandlers(deps) {
   };
   return { GET, PATCH, PUT, DELETE, sign };
 }
+
+// src/server/relations.ts
+function isRef(v) {
+  return typeof v === "object" && v !== null && typeof v.collection === "string" && typeof v.id === "string";
+}
+async function resolveRelations(adapter, docs, options = {}) {
+  var _a, _b;
+  const list = Array.isArray(docs) ? docs : [docs];
+  const relations = (_a = options.relations) != null ? _a : {};
+  const fields = (_b = options.populate) != null ? _b : Object.keys(relations);
+  if (!fields.length || !list.length) return docs;
+  const cache = /* @__PURE__ */ new Map();
+  const load = (collection, id) => {
+    const key = `${collection}\0${id}`;
+    let pending = cache.get(key);
+    if (!pending) {
+      pending = adapter.fetchById(collection, id);
+      cache.set(key, pending);
+    }
+    return pending;
+  };
+  const toRef = (field, value) => {
+    if (isRef(value)) return value;
+    if (typeof value === "string" && relations[field]) {
+      return { collection: relations[field].collection, id: value };
+    }
+    return null;
+  };
+  const resolveValue = async (field, value) => {
+    const ref = toRef(field, value);
+    if (!ref) return value;
+    const resolved = await load(ref.collection, ref.id);
+    return resolved != null ? resolved : value;
+  };
+  await Promise.all(
+    list.map(async (doc) => {
+      for (const field of fields) {
+        const value = doc[field];
+        if (Array.isArray(value)) {
+          doc[field] = await Promise.all(
+            value.map((v) => resolveValue(field, v))
+          );
+        } else {
+          doc[field] = await resolveValue(field, value);
+        }
+      }
+    })
+  );
+  return docs;
+}
 export {
   UnauthorizedError,
   createAdminGate,
-  createCmsHandlers
+  createCmsHandlers,
+  resolveRelations
 };
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/createAdminGate.ts","../../src/server/createCmsHandlers.ts"],"sourcesContent":["import type { AuthAdapter, AuthIdentity } from \"../types\";\n\n/** Thrown when a request fails the admin gate; carried up to the route handler. */\nexport class UnauthorizedError extends Error {\n  constructor(message = \"Unauthorized\") {\n    super(message);\n    this.name = \"UnauthorizedError\";\n  }\n}\n\n/**\n * Wraps an {@link AuthAdapter} into a reusable server gate. Throws\n * {@link UnauthorizedError} unless the request resolves to an admin identity.\n */\nexport function createAdminGate(auth: AuthAdapter) {\n  return async function requireAdmin(req: Request): Promise<AuthIdentity> {\n    const identity = await auth.verifyRequest(req);\n    if (!identity || !identity.isAdmin) {\n      throw new UnauthorizedError(\n        identity ? \"Forbidden - Not an authorized admin\" : \"Unauthorized\",\n      );\n    }\n    return identity;\n  };\n}\n","import type { DataAdapter, AuthAdapter, ServerStorageAdapter } from \"../types\";\nimport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\n\nexport interface CmsHandlersDeps {\n  data: DataAdapter;\n  auth: AuthAdapter;\n  storage?: ServerStorageAdapter;\n}\n\n/** Next.js App Router passes dynamic params as a promise. */\ntype RouteContext = {\n  params: Promise<{ collection: string; id: string }>;\n};\n\ntype RouteHandler = (req: Request, ctx: RouteContext) => Promise<Response>;\ntype SignHandler = (req: Request) => Promise<Response>;\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\n/**\n * Translate any thrown error into a response. Auth failures return 401 with\n * `{ logout: true }` so a client interceptor can force sign-out.\n */\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof UnauthorizedError && error.message === \"Unauthorized\") {\n    return json({ error: \"Unauthorized\", logout: true }, 401);\n  }\n  const message = error instanceof Error ? error.message : \"Request failed\";\n  return json({ error: message }, 403);\n}\n\n/**\n * Builds the generic admin CRUD handlers, replacing a hand-written\n * `/api/admin/[collection]/[id]/route.ts`. Mount like:\n *\n * ```ts\n * // app/api/admin/[collection]/[id]/route.ts\n * export const { GET, PATCH, PUT, DELETE } = createCmsHandlers({ data, auth });\n * ```\n *\n * If a `storage` adapter with a `sign` method is provided, also mount its sign\n * handler at e.g. `app/api/admin/sign/route.ts`:\n *\n * ```ts\n * export const POST = createCmsHandlers({ data, auth, storage }).sign;\n * ```\n */\nexport function createCmsHandlers(deps: CmsHandlersDeps): {\n  GET: RouteHandler;\n  PATCH: RouteHandler;\n  PUT: RouteHandler;\n  DELETE: RouteHandler;\n  sign: SignHandler;\n} {\n  const { data, auth, storage } = deps;\n  const requireAdmin = createAdminGate(auth);\n\n  const GET: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const doc = await data.fetchById(collection, id);\n      if (!doc) return json({ error: \"Document not found\" }, 404);\n      return json(doc);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PATCH: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.update(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PUT: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.upsert(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const DELETE: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      await data.delete(collection, id);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const sign: SignHandler = async (req) => {\n    try {\n      await requireAdmin(req);\n      if (!storage?.sign) {\n        return json({ error: \"No storage adapter with sign() configured\" }, 404);\n      }\n      const result = await storage.sign(req);\n      return json(result);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  return { GET, PATCH, PUT, DELETE, sign };\n}\n"],"mappings":";AAGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,gBAAgB,MAAmB;AACjD,SAAO,eAAe,aAAa,KAAqC;AACtE,UAAM,WAAW,MAAM,KAAK,cAAc,GAAG;AAC7C,QAAI,CAAC,YAAY,CAAC,SAAS,SAAS;AAClC,YAAM,IAAI;AAAA,QACR,WAAW,wCAAwC;AAAA,MACrD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;ACPA,SAAS,KAAK,MAAe,SAAS,KAAe;AACnD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAMA,SAAS,cAAc,OAA0B;AAC/C,MAAI,iBAAiB,qBAAqB,MAAM,YAAY,gBAAgB;AAC1E,WAAO,KAAK,EAAE,OAAO,gBAAgB,QAAQ,KAAK,GAAG,GAAG;AAAA,EAC1D;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AACrC;AAkBO,SAAS,kBAAkB,MAMhC;AACA,QAAM,EAAE,MAAM,MAAM,QAAQ,IAAI;AAChC,QAAM,eAAe,gBAAgB,IAAI;AAEzC,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,MAAM,MAAM,KAAK,UAAU,YAAY,EAAE;AAC/C,UAAI,CAAC,IAAK,QAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AAC1D,aAAO,KAAK,GAAG;AAAA,IACjB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,QAAsB,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,SAAuB,OAAO,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,KAAK,OAAO,YAAY,EAAE;AAChC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,OAAoB,OAAO,QAAQ;AACvC,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,UAAI,EAAC,mCAAS,OAAM;AAClB,eAAO,KAAK,EAAE,OAAO,4CAA4C,GAAG,GAAG;AAAA,MACzE;AACA,YAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;AACrC,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,OAAO,KAAK,QAAQ,KAAK;AACzC;","names":[]}
+{"version":3,"sources":["../../src/server/createAdminGate.ts","../../src/server/createCmsHandlers.ts","../../src/server/relations.ts"],"sourcesContent":["import type { AuthAdapter, AuthIdentity, AuthorizeFn } from \"../types\";\n\n/** Thrown when a request fails the admin gate; carried up to the route handler. */\nexport class UnauthorizedError extends Error {\n  constructor(message = \"Unauthorized\") {\n    super(message);\n    this.name = \"UnauthorizedError\";\n  }\n}\n\n/** Default authorization: admin flag must be set. */\nconst defaultAuthorize: AuthorizeFn = (identity) => identity.isAdmin === true;\n\n/**\n * Wraps an {@link AuthAdapter} into a reusable server gate. Throws\n * {@link UnauthorizedError} unless the request resolves to an identity that\n * passes `authorize`. `authorize` defaults to `identity.isAdmin === true`;\n * override it to gate on roles, scopes, tenants, etc.\n */\nexport function createAdminGate(auth: AuthAdapter, authorize: AuthorizeFn = defaultAuthorize) {\n  return async function requireAdmin(req: Request): Promise<AuthIdentity> {\n    const identity = await auth.verifyRequest(req);\n    if (!identity) {\n      throw new UnauthorizedError(\"Unauthorized\");\n    }\n    if (!(await authorize(identity, req))) {\n      throw new UnauthorizedError(\"Forbidden - Not an authorized admin\");\n    }\n    return identity;\n  };\n}\n","import type {\n  DataAdapter,\n  AuthAdapter,\n  AuthorizeFn,\n  ServerStorageAdapter,\n} from \"../types\";\nimport { createAdminGate, UnauthorizedError } from \"./createAdminGate\";\n\nexport interface CmsHandlersDeps {\n  data: DataAdapter;\n  auth: AuthAdapter;\n  storage?: ServerStorageAdapter;\n  /** Custom authorization predicate. Defaults to `identity.isAdmin === true`. */\n  authorize?: AuthorizeFn;\n}\n\n/** Next.js App Router passes dynamic params as a promise. */\ntype RouteContext = {\n  params: Promise<{ collection: string; id: string }>;\n};\n\ntype RouteHandler = (req: Request, ctx: RouteContext) => Promise<Response>;\ntype SignHandler = (req: Request) => Promise<Response>;\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\n/**\n * Translate any thrown error into a response. Auth failures return 401 with\n * `{ logout: true }` so a client interceptor can force sign-out.\n */\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof UnauthorizedError && error.message === \"Unauthorized\") {\n    return json({ error: \"Unauthorized\", logout: true }, 401);\n  }\n  const message = error instanceof Error ? error.message : \"Request failed\";\n  return json({ error: message }, 403);\n}\n\n/**\n * Builds the generic admin CRUD handlers, replacing a hand-written\n * `/api/admin/[collection]/[id]/route.ts`. Mount like:\n *\n * ```ts\n * // app/api/admin/[collection]/[id]/route.ts\n * export const { GET, PATCH, PUT, DELETE } = createCmsHandlers({ data, auth });\n * ```\n *\n * If a `storage` adapter with a `sign` method is provided, also mount its sign\n * handler at e.g. `app/api/admin/sign/route.ts`:\n *\n * ```ts\n * export const POST = createCmsHandlers({ data, auth, storage }).sign;\n * ```\n */\nexport function createCmsHandlers(deps: CmsHandlersDeps): {\n  GET: RouteHandler;\n  PATCH: RouteHandler;\n  PUT: RouteHandler;\n  DELETE: RouteHandler;\n  sign: SignHandler;\n} {\n  const { data, auth, storage, authorize } = deps;\n  const requireAdmin = createAdminGate(auth, authorize);\n\n  const GET: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const doc = await data.fetchById(collection, id);\n      if (!doc) return json({ error: \"Document not found\" }, 404);\n      return json(doc);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PATCH: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.update(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const PUT: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      const body = await req.json();\n      await data.upsert(collection, id, body);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const DELETE: RouteHandler = async (req, ctx) => {\n    try {\n      await requireAdmin(req);\n      const { collection, id } = await ctx.params;\n      await data.delete(collection, id);\n      return json({ ok: true });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const sign: SignHandler = async (req) => {\n    try {\n      await requireAdmin(req);\n      if (!storage?.sign) {\n        return json({ error: \"No storage adapter with sign() configured\" }, 404);\n      }\n      const result = await storage.sign(req);\n      return json(result);\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  return { GET, PATCH, PUT, DELETE, sign };\n}\n","import type { DataAdapter, Ref, RelationConfig } from \"../types\";\n\n/** A field value is a reference when it's a self-describing `{ collection, id }`. */\nfunction isRef(v: unknown): v is Ref {\n  return (\n    typeof v === \"object\" &&\n    v !== null &&\n    typeof (v as Ref).collection === \"string\" &&\n    typeof (v as Ref).id === \"string\"\n  );\n}\n\nexport interface ResolveRelationsOptions {\n  /**\n   * Which fields to resolve. Defaults to every field named in `relations`. Pass\n   * a query's `populate` array here.\n   */\n  populate?: string[];\n  /**\n   * Maps bare-id reference fields → their target collection. Not needed for\n   * self-describing `{ collection, id }` refs.\n   */\n  relations?: RelationConfig;\n}\n\n/**\n * Inline-resolves reference fields on one or more documents, backend-agnostic.\n * A reference may be a self-describing `{ collection, id }`, a bare id string\n * (resolved via `relations`), or an array of either. Resolution is deduplicated\n * and parallelized; unresolved refs are left untouched.\n *\n * Lives in the engine, never in an adapter, so it works the same over Postgres,\n * Firestore, or any custom {@link DataAdapter}.\n *\n * Mutates and returns the passed document(s).\n */\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T,\n  options?: ResolveRelationsOptions,\n): Promise<T>;\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T[],\n  options?: ResolveRelationsOptions,\n): Promise<T[]>;\nexport async function resolveRelations<T extends Record<string, any>>(\n  adapter: DataAdapter,\n  docs: T | T[],\n  options: ResolveRelationsOptions = {},\n): Promise<T | T[]> {\n  const list = Array.isArray(docs) ? docs : [docs];\n  const relations = options.relations ?? {};\n  const fields = options.populate ?? Object.keys(relations);\n  if (!fields.length || !list.length) return docs;\n\n  // Dedupe loads across all docs/fields: one fetch per (collection, id).\n  const cache = new Map<string, Promise<unknown>>();\n  const load = (collection: string, id: string): Promise<unknown> => {\n    const key = `${collection}\u0000${id}`;\n    let pending = cache.get(key);\n    if (!pending) {\n      pending = adapter.fetchById(collection, id);\n      cache.set(key, pending);\n    }\n    return pending;\n  };\n\n  const toRef = (field: string, value: unknown): Ref | null => {\n    if (isRef(value)) return value;\n    if (typeof value === \"string\" && relations[field]) {\n      return { collection: relations[field].collection, id: value };\n    }\n    return null;\n  };\n\n  const resolveValue = async (field: string, value: unknown): Promise<unknown> => {\n    const ref = toRef(field, value);\n    if (!ref) return value;\n    const resolved = await load(ref.collection, ref.id);\n    return resolved ?? value;\n  };\n\n  await Promise.all(\n    list.map(async (doc) => {\n      for (const field of fields) {\n        const value = doc[field];\n        if (Array.isArray(value)) {\n          (doc as Record<string, unknown>)[field] = await Promise.all(\n            value.map((v) => resolveValue(field, v)),\n          );\n        } else {\n          (doc as Record<string, unknown>)[field] = await resolveValue(field, value);\n        }\n      }\n    }),\n  );\n\n  return docs;\n}\n"],"mappings":";AAGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,mBAAgC,CAAC,aAAa,SAAS,YAAY;AAQlE,SAAS,gBAAgB,MAAmB,YAAyB,kBAAkB;AAC5F,SAAO,eAAe,aAAa,KAAqC;AACtE,UAAM,WAAW,MAAM,KAAK,cAAc,GAAG;AAC7C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,kBAAkB,cAAc;AAAA,IAC5C;AACA,QAAI,CAAE,MAAM,UAAU,UAAU,GAAG,GAAI;AACrC,YAAM,IAAI,kBAAkB,qCAAqC;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACF;;;ACNA,SAAS,KAAK,MAAe,SAAS,KAAe;AACnD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAMA,SAAS,cAAc,OAA0B;AAC/C,MAAI,iBAAiB,qBAAqB,MAAM,YAAY,gBAAgB;AAC1E,WAAO,KAAK,EAAE,OAAO,gBAAgB,QAAQ,KAAK,GAAG,GAAG;AAAA,EAC1D;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AACrC;AAkBO,SAAS,kBAAkB,MAMhC;AACA,QAAM,EAAE,MAAM,MAAM,SAAS,UAAU,IAAI;AAC3C,QAAM,eAAe,gBAAgB,MAAM,SAAS;AAEpD,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,MAAM,MAAM,KAAK,UAAU,YAAY,EAAE;AAC/C,UAAI,CAAC,IAAK,QAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AAC1D,aAAO,KAAK,GAAG;AAAA,IACjB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,QAAsB,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,MAAoB,OAAO,KAAK,QAAQ;AAC5C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,KAAK,OAAO,YAAY,IAAI,IAAI;AACtC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,SAAuB,OAAO,KAAK,QAAQ;AAC/C,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,YAAM,EAAE,YAAY,GAAG,IAAI,MAAM,IAAI;AACrC,YAAM,KAAK,OAAO,YAAY,EAAE;AAChC,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,OAAoB,OAAO,QAAQ;AACvC,QAAI;AACF,YAAM,aAAa,GAAG;AACtB,UAAI,EAAC,mCAAS,OAAM;AAClB,eAAO,KAAK,EAAE,OAAO,4CAA4C,GAAG,GAAG;AAAA,MACzE;AACA,YAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;AACrC,aAAO,KAAK,MAAM;AAAA,IACpB,SAAS,OAAO;AACd,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,OAAO,KAAK,QAAQ,KAAK;AACzC;;;AC/HA,SAAS,MAAM,GAAsB;AACnC,SACE,OAAO,MAAM,YACb,MAAM,QACN,OAAQ,EAAU,eAAe,YACjC,OAAQ,EAAU,OAAO;AAE7B;AAoCA,eAAsB,iBACpB,SACA,MACA,UAAmC,CAAC,GAClB;AAlDpB;AAmDE,QAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI;AAC/C,QAAM,aAAY,aAAQ,cAAR,YAAqB,CAAC;AACxC,QAAM,UAAS,aAAQ,aAAR,YAAoB,OAAO,KAAK,SAAS;AACxD,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,OAAQ,QAAO;AAG3C,QAAM,QAAQ,oBAAI,IAA8B;AAChD,QAAM,OAAO,CAAC,YAAoB,OAAiC;AACjE,UAAM,MAAM,GAAG,UAAU,KAAI,EAAE;AAC/B,QAAI,UAAU,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,SAAS;AACZ,gBAAU,QAAQ,UAAU,YAAY,EAAE;AAC1C,YAAM,IAAI,KAAK,OAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,CAAC,OAAe,UAA+B;AAC3D,QAAI,MAAM,KAAK,EAAG,QAAO;AACzB,QAAI,OAAO,UAAU,YAAY,UAAU,KAAK,GAAG;AACjD,aAAO,EAAE,YAAY,UAAU,KAAK,EAAE,YAAY,IAAI,MAAM;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,OAAO,OAAe,UAAqC;AAC9E,UAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE;AAClD,WAAO,8BAAY;AAAA,EACrB;AAEA,QAAM,QAAQ;AAAA,IACZ,KAAK,IAAI,OAAO,QAAQ;AACtB,iBAAW,SAAS,QAAQ;AAC1B,cAAM,QAAQ,IAAI,KAAK;AACvB,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAC,IAAgC,KAAK,IAAI,MAAM,QAAQ;AAAA,YACtD,MAAM,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AAAA,UACzC;AAAA,QACF,OAAO;AACL,UAAC,IAAgC,KAAK,IAAI,MAAM,aAAa,OAAO,KAAK;AAAA,QAC3E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalgoridim/headless-cms",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Database-agnostic, inline-edit headless CMS engine for React / Next.js apps",
   "license": "UNLICENSED",
   "author": "dalgoridim",
@@ -95,7 +95,9 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "ARCHITECTURE.md",
+    "REDESIGN.md"
   ],
   "scripts": {
     "build": "tsup",
@@ -137,14 +139,7 @@
       "optional": true
     }
   },
-  "dependencies": {
-    "clsx": "^2.1.1",
-    "lucide-react": "^0.556.0",
-    "react-markdown": "^10.1.0",
-    "remark-gfm": "^4.0.1",
-    "sonner": "^2.0.7",
-    "tailwind-merge": "^3.4.0"
-  },
+  "dependencies": {},
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.700.0",
     "@aws-sdk/s3-request-presigner": "^3.700.0",