@htmless/core 0.1.0

package/dist/api/graphql/resolver.js

@@ -0,0 +1,138 @@
+// ─── Query resolver: maps parsed operations to Prisma queries ───
+import { prisma } from '../../db.js';
+/**
+ * Project an object to only include the requested field names.
+ * Supports nested field selection for sub-objects.
+ */
+function projectFields(obj, fields) {
+    const result = {};
+    for (const field of fields) {
+        if (field.name in obj) {
+            const value = obj[field.name];
+            if (field.subFields && value && typeof value === 'object' && !Array.isArray(value)) {
+                result[field.name] = projectFields(value, field.subFields);
+            }
+            else if (field.subFields && Array.isArray(value)) {
+                result[field.name] = value.map((item) => typeof item === 'object' && item !== null
+                    ? projectFields(item, field.subFields)
+                    : item);
+            }
+            else {
+                result[field.name] = value;
+            }
+        }
+    }
+    return result;
+}
+async function resolveEntries(spaceId, op) {
+    const typeKey = op.args.type;
+    const limit = typeof op.args.limit === 'number' ? op.args.limit : 25;
+    const offset = typeof op.args.offset === 'number' ? op.args.offset : 0;
+    const where = { spaceId };
+    if (typeKey) {
+        where.contentTypeKey = typeKey;
+    }
+    const docs = await prisma.publishedDocument.findMany({
+        where,
+        orderBy: { publishedAt: 'desc' },
+        take: Math.min(limit, 100),
+        skip: offset,
+    });
+    const items = docs.map((doc) => ({
+        id: doc.entryId,
+        type: doc.contentTypeKey,
+        slug: doc.slug,
+        data: doc.data,
+        publishedAt: doc.publishedAt.toISOString(),
+        updatedAt: doc.updatedAt.toISOString(),
+    }));
+    return items.map((item) => projectFields(item, op.fields));
+}
+async function resolveEntry(spaceId, op) {
+    const typeKey = op.args.type;
+    const slug = op.args.slug;
+    const id = op.args.id;
+    const where = { spaceId };
+    if (typeKey)
+        where.contentTypeKey = typeKey;
+    if (slug)
+        where.slug = slug;
+    if (id)
+        where.entryId = id;
+    const doc = await prisma.publishedDocument.findFirst({ where });
+    if (!doc)
+        return null;
+    const item = {
+        id: doc.entryId,
+        type: doc.contentTypeKey,
+        slug: doc.slug,
+        data: doc.data,
+        publishedAt: doc.publishedAt.toISOString(),
+        updatedAt: doc.updatedAt.toISOString(),
+    };
+    return projectFields(item, op.fields);
+}
+async function resolveTypes(spaceId, op) {
+    const types = await prisma.contentType.findMany({
+        where: { spaceId },
+        include: { fields: { orderBy: { sortOrder: 'asc' } } },
+    });
+    const items = types.map((ct) => ({
+        id: ct.id,
+        key: ct.key,
+        name: ct.name,
+        description: ct.description,
+        version: ct.version,
+        fields: ct.fields.map((f) => ({
+            id: f.id,
+            key: f.key,
+            name: f.name,
+            type: f.type,
+            required: f.required,
+            localized: f.localized,
+            validations: f.validations,
+        })),
+    }));
+    return items.map((item) => projectFields(item, op.fields));
+}
+async function resolveAssets(spaceId, op) {
+    const limit = typeof op.args.limit === 'number' ? op.args.limit : 25;
+    const offset = typeof op.args.offset === 'number' ? op.args.offset : 0;
+    const assets = await prisma.asset.findMany({
+        where: { spaceId },
+        orderBy: { createdAt: 'desc' },
+        take: Math.min(limit, 100),
+        skip: offset,
+    });
+    const items = assets.map((a) => ({
+        id: a.id,
+        filename: a.filename,
+        mimeType: a.mimeType,
+        bytes: a.bytes,
+        width: a.width,
+        height: a.height,
+        alt: a.alt,
+        url: `/media/${a.storageKey}`,
+        createdAt: a.createdAt.toISOString(),
+        updatedAt: a.updatedAt.toISOString(),
+    }));
+    return items.map((item) => projectFields(item, op.fields));
+}
+const resolvers = {
+    entries: resolveEntries,
+    entry: resolveEntry,
+    types: resolveTypes,
+    assets: resolveAssets,
+};
+export async function resolveQuery(spaceId, operations) {
+    const data = {};
+    for (const op of operations) {
+        const resolver = resolvers[op.name];
+        if (!resolver) {
+            throw new Error(`Unknown operation: "${op.name}". Available: ${Object.keys(resolvers).join(', ')}`);
+        }
+        data[op.name] = await resolver(spaceId, op);
+    }
+    return data;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/api/graphql/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/api/graphql/resolver.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC;;;GAGG;AACH,SAAS,aAAa,CACpB,GAAM,EACN,MAAqB;IAErB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAgC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACxF,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBACvC,CAAC,CAAC,aAAa,CAAC,IAA+B,EAAE,KAAK,CAAC,SAAU,CAAC;oBAClE,CAAC,CAAC,IAAI,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,EAAmB;IAEnB,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAA0B,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,KAAK,GAA4B,EAAE,OAAO,EAAE,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QACnD,KAAK;QACL,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;QAChC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,GAAG,CAAC,OAAO;QACf,IAAI,EAAE,GAAG,CAAC,cAAc;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE;QAC1C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC,CAAC;IAEJ,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,EAAmB;IAEnB,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAA0B,CAAC;IACnD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAA0B,CAAC;IAChD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAwB,CAAC;IAE5C,MAAM,KAAK,GAA4B,EAAE,OAAO,EAAE,CAAC;IACnD,IAAI,OAAO;QAAE,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC;IAC5C,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE;QAAE,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,GAAG,CAAC,OAAO;QACf,IAAI,EAAE,GAAG,CAAC,cAAc;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE;QAC1C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,EAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,OAAO,EAAE;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;KACvD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,EAAmB;IAEnB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,EAAE,OAAO,EAAE;QAClB,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC,CAAC;IAEJ,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,SAAS,GAGX;IACF,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAA6B;IAE7B,MAAM,IAAI,GAA4B,EAAE,CAAC;IAEzC,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC,IAAI,iBAAiB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/api/preview/content.d.ts

@@ -0,0 +1,4 @@
+import type { Router as IRouter } from 'express';
+declare const router: IRouter;
+export default router;
+//# sourceMappingURL=content.d.ts.map

package/dist/api/preview/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../src/api/preview/content.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,SAAS,CAAC;AAKjD,QAAA,MAAM,MAAM,EAAE,OAAkB,CAAC;AA0OjC,eAAe,MAAM,CAAC"}

package/dist/api/preview/content.js

@@ -0,0 +1,207 @@
+import { Router } from 'express';
+import { prisma } from '../../db.js';
+const router = Router();
+/**
+ * Pick specific fields from a data object.
+ */
+function projectFields(data, fields) {
+    if (!fields || fields.length === 0)
+        return data;
+    const result = {};
+    for (const key of fields) {
+        if (key in data) {
+            result[key] = data[key];
+        }
+    }
+    return result;
+}
+/**
+ * Resolve included references inside entry data.
+ * For preview, resolves to draft versions of referenced entries.
+ */
+async function resolveIncludes(data, include, spaceId) {
+    if (include.length === 0)
+        return data;
+    const resolved = { ...data };
+    for (const key of include) {
+        const refValue = data[key];
+        if (!refValue)
+            continue;
+        const refIds = Array.isArray(refValue) ? refValue : [refValue];
+        const entries = await prisma.entry.findMany({
+            where: {
+                spaceId,
+                id: { in: refIds },
+                state: { isNot: null },
+            },
+            include: {
+                state: {
+                    include: { draftVersion: true },
+                },
+                contentType: { select: { key: true } },
+            },
+        });
+        const mapped = entries.map((entry) => ({
+            id: entry.id,
+            type: entry.contentType.key,
+            slug: entry.slug,
+            data: (entry.state.draftVersion.data ?? {}),
+            status: entry.state.status,
+            createdAt: entry.createdAt.toISOString(),
+            updatedAt: entry.updatedAt.toISOString(),
+        }));
+        if (Array.isArray(refValue)) {
+            resolved[key] = mapped;
+        }
+        else {
+            resolved[key] = mapped[0] ?? null;
+        }
+    }
+    return resolved;
+}
+// ── Preview scope helper ──
+function checkPreviewScope(req, res, entryId) {
+    if (req.auth?.type !== 'preview_token')
+        return true; // JWT/API tokens are unrestricted
+    // If token is scoped to a specific entry, reject access to other entries
+    if (req.auth.previewEntryId && entryId && req.auth.previewEntryId !== entryId) {
+        res.status(403).json({ error: 'preview_scope_denied', message: 'Preview token is scoped to a different entry' });
+        return false;
+    }
+    // If token is scoped to a specific route, check it
+    if (req.auth.previewRoute) {
+        const requestPath = req.originalUrl.split('?')[0];
+        if (!requestPath.includes(req.auth.previewRoute)) {
+            res.status(403).json({ error: 'preview_scope_denied', message: 'Preview token is scoped to a different route' });
+            return false;
+        }
+    }
+    return true;
+}
+// ── GET /content/:typeKey ────────────────────────────────────────────
+router.get('/:typeKey', async (req, res) => {
+    const spaceId = req.headers['x-space-id'];
+    if (!spaceId) {
+        res.status(400).json({ error: 'missing_space', message: 'X-Space-Id header is required' });
+        return;
+    }
+    // If preview token is scoped to a specific entry, listing is not allowed
+    if (req.auth?.type === 'preview_token' && req.auth.previewEntryId) {
+        res.status(403).json({ error: 'preview_scope_denied', message: 'This preview token is scoped to a specific entry — use /content/:typeKey/:id instead' });
+        return;
+    }
+    const typeKey = req.params.typeKey;
+    const slug = req.query.slug;
+    const fieldsParam = req.query.fields;
+    const includeParam = req.query.include;
+    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
+    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 25));
+    const skip = (page - 1) * limit;
+    const fields = fieldsParam ? fieldsParam.split(',').map((f) => f.trim()) : undefined;
+    const include = includeParam ? includeParam.split(',').map((f) => f.trim()) : [];
+    const contentType = await prisma.contentType.findUnique({
+        where: { spaceId_key: { spaceId, key: typeKey } },
+    });
+    if (!contentType) {
+        res.status(404).json({ error: 'not_found', message: `Content type "${typeKey}" not found` });
+        return;
+    }
+    const where = {
+        spaceId,
+        contentTypeId: contentType.id,
+        state: { isNot: null },
+        ...(slug ? { slug } : {}),
+    };
+    const [entries, total] = await Promise.all([
+        prisma.entry.findMany({
+            where,
+            include: {
+                state: {
+                    include: { draftVersion: true },
+                },
+            },
+            skip,
+            take: limit,
+            orderBy: { createdAt: 'desc' },
+        }),
+        prisma.entry.count({ where }),
+    ]);
+    const items = await Promise.all(entries.map(async (entry) => {
+        const rawData = (entry.state.draftVersion.data ?? {});
+        let data = projectFields(rawData, fields);
+        data = await resolveIncludes(data, include, spaceId);
+        return {
+            id: entry.id,
+            type: typeKey,
+            slug: entry.slug,
+            data,
+            status: entry.state.status,
+            createdAt: entry.createdAt.toISOString(),
+            updatedAt: entry.updatedAt.toISOString(),
+        };
+    }));
+    res.json({
+        items,
+        pagination: {
+            page,
+            limit,
+            total,
+            totalPages: Math.ceil(total / limit),
+        },
+    });
+});
+// ── GET /content/:typeKey/:id ────────────────────────────────────────
+router.get('/:typeKey/:id', async (req, res) => {
+    const spaceId = req.headers['x-space-id'];
+    if (!spaceId) {
+        res.status(400).json({ error: 'missing_space', message: 'X-Space-Id header is required' });
+        return;
+    }
+    const typeKey = req.params.typeKey;
+    const id = req.params.id;
+    const fieldsParam = req.query.fields;
+    const includeParam = req.query.include;
+    const fields = fieldsParam ? fieldsParam.split(',').map((f) => f.trim()) : undefined;
+    const include = includeParam ? includeParam.split(',').map((f) => f.trim()) : [];
+    // Enforce preview token scope
+    if (!checkPreviewScope(req, res, id))
+        return;
+    const contentType = await prisma.contentType.findUnique({
+        where: { spaceId_key: { spaceId, key: typeKey } },
+    });
+    if (!contentType) {
+        res.status(404).json({ error: 'not_found', message: `Content type "${typeKey}" not found` });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: {
+            id,
+            spaceId,
+            contentTypeId: contentType.id,
+            state: { isNot: null },
+        },
+        include: {
+            state: {
+                include: { draftVersion: true },
+            },
+        },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const rawData = (entry.state.draftVersion.data ?? {});
+    let data = projectFields(rawData, fields);
+    data = await resolveIncludes(data, include, spaceId);
+    res.json({
+        id: entry.id,
+        type: typeKey,
+        slug: entry.slug,
+        data,
+        status: entry.state.status,
+        createdAt: entry.createdAt.toISOString(),
+        updatedAt: entry.updatedAt.toISOString(),
+    });
+});
+export default router;
+//# sourceMappingURL=content.js.map

package/dist/api/preview/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/api/preview/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,MAAM,MAAM,GAAY,MAAM,EAAE,CAAC;AAEjC;;GAEG;AACH,SAAS,aAAa,CAAC,IAA6B,EAAE,MAAiB;IACrE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,OAAiB,EACjB,OAAe;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAqB,CAAC,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC1C,KAAK,EAAE;gBACL,OAAO;gBACP,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBAClB,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;aACvB;YACD,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;iBAChC;gBACD,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,CAAC,KAAK,CAAC,KAAM,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA4B;YACvE,MAAM,EAAE,KAAK,CAAC,KAAM,CAAC,MAAM;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;SACzC,CAAC,CAAC,CAAC;QAEJ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6BAA6B;AAC7B,SAAS,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,OAAgB;IACtE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACvF,yEAAyE;IACzE,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,mDAAmD;IACnD,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;YACjH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAW,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;QACzJ,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAA0B,CAAC;IAClD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAA6B,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KAClD,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,aAAa,EAAE,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO;QACP,aAAa,EAAE,WAAW,CAAC,EAAE;QAC7B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;IAEF,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpB,KAAK;YACL,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;iBAChC;aACF;YACD,IAAI;YACJ,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC/B,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAM,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAClF,IAAI,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,KAAM,CAAC,MAAM;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;SACzC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC;QACP,KAAK;QACL,UAAU,EAAE;YACV,IAAI;YACJ,KAAK;YACL,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;SACrC;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAW,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAA6B,CAAC;IAE7D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,8BAA8B;IAC9B,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KAClD,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,aAAa,EAAE,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACzC,KAAK,EAAE;YACL,EAAE;YACF,OAAO;YACP,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACvB;QACD,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAChC;SACF;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAM,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAClF,IAAI,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAErD,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,KAAM,CAAC,MAAM;QAC3B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;KACzC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/api/preview/index.d.ts

@@ -0,0 +1,4 @@
+import type { Router as IRouter } from 'express';
+declare const router: IRouter;
+export default router;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/preview/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/preview/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,SAAS,CAAC;AAKjD,QAAA,MAAM,MAAM,EAAE,OAAkB,CAAC;AAQjC,eAAe,MAAM,CAAC"}

package/dist/api/preview/index.js

@@ -0,0 +1,11 @@
+import { Router } from 'express';
+import { authenticate } from '../../auth/middleware.js';
+import contentRoutes from './content.js';
+import liveRouter from './live.js';
+const router = Router();
+// Preview requires a valid token — preview tokens (hlp_) are explicitly allowed
+router.use(authenticate({ required: true, allowPreview: true, allowQueryToken: true }));
+router.use('/content', contentRoutes);
+router.use('/live', liveRouter);
+export default router;
+//# sourceMappingURL=index.js.map

package/dist/api/preview/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/preview/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,aAAa,MAAM,cAAc,CAAC;AACzC,OAAO,UAAU,MAAM,WAAW,CAAC;AAEnC,MAAM,MAAM,GAAY,MAAM,EAAE,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACtC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAEhC,eAAe,MAAM,CAAC"}

package/dist/api/preview/live.d.ts

@@ -0,0 +1,4 @@
+import type { Router as IRouter } from 'express';
+declare const router: IRouter;
+export default router;
+//# sourceMappingURL=live.d.ts.map

package/dist/api/preview/live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/api/preview/live.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,OAAO,EAAqB,MAAM,SAAS,CAAC;AAIpE,QAAA,MAAM,MAAM,EAAE,OAAkB,CAAC;AA2CjC,eAAe,MAAM,CAAC"}

package/dist/api/preview/live.js

@@ -0,0 +1,41 @@
+import { Router } from 'express';
+import { eventBus } from '../../events/emitter.js';
+import { createSSEStream } from '../../events/sse.js';
+const router = Router();
+/**
+ * GET /live?entryId=<id>
+ *
+ * Opens an SSE stream that emits `entry.draftSaved` events for the
+ * specified entry.  Designed for live-preview: the frontend
+ * reconnects via EventSource and refreshes its render whenever the
+ * editor saves a draft.
+ *
+ * Requires a valid preview token (hlp_).
+ */
+router.get('/', (req, res) => {
+    const entryId = req.query['entryId'];
+    if (!entryId) {
+        res.status(400).json({ error: 'validation_error', message: 'entryId query param is required' });
+        return;
+    }
+    // Preview tokens are scoped to a space — use that for filtering
+    const spaceId = req.auth?.spaceId;
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'Could not determine space from preview token' });
+        return;
+    }
+    const sse = createSSEStream(res);
+    const handler = (payload) => {
+        if (payload.spaceId !== spaceId)
+            return;
+        if (payload.data['entryId'] !== entryId && payload.data['id'] !== entryId)
+            return;
+        sse.send('entry.draftSaved', payload);
+    };
+    eventBus.on('entry.draftSaved', handler);
+    res.on('close', () => {
+        eventBus.removeListener('entry.draftSaved', handler);
+    });
+});
+export default router;
+//# sourceMappingURL=live.js.map

package/dist/api/preview/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/api/preview/live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAqB,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,GAAY,MAAM,EAAE,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAuB,CAAC;IAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAChG,OAAO;IACT,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;IAElC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC7G,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAE,EAAE;QACxC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO;QAClF,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,QAAQ,CAAC,EAAE,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAEzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,QAAQ,CAAC,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/audit/logger.d.ts

@@ -0,0 +1,13 @@
+export interface AuditLogParams {
+    spaceId: string;
+    userId?: string;
+    action: string;
+    resource?: string;
+    meta?: object;
+}
+/**
+ * Writes an audit log entry. Fire-and-forget — errors are caught
+ * and logged to stderr so they never break the request path.
+ */
+export declare function logAudit(params: AuditLogParams): void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAcrD"}

package/dist/audit/logger.js

@@ -0,0 +1,21 @@
+import { prisma } from '../db.js';
+/**
+ * Writes an audit log entry. Fire-and-forget — errors are caught
+ * and logged to stderr so they never break the request path.
+ */
+export function logAudit(params) {
+    prisma.auditLog
+        .create({
+        data: {
+            spaceId: params.spaceId,
+            userId: params.userId ?? null,
+            action: params.action,
+            resource: params.resource ?? null,
+            meta: params.meta ?? undefined,
+        },
+    })
+        .catch((err) => {
+        console.error('Failed to write audit log:', err);
+    });
+}
+//# sourceMappingURL=logger.js.map

package/dist/audit/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAUlC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,MAAM,CAAC,QAAQ;SACZ,MAAM,CAAC;QACN,IAAI,EAAE;YACJ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;SAC/B;KACF,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/audit/middleware.d.ts

@@ -0,0 +1,7 @@
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Express middleware that auto-logs audit entries after the response
+ * is sent for CMA write operations (POST, PATCH, DELETE).
+ */
+export declare function auditMiddleware(): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/audit/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/audit/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D;;;GAGG;AACH,wBAAgB,eAAe,KACrB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAqC/D"}

package/dist/audit/middleware.js

@@ -0,0 +1,39 @@
+import { logAudit } from './logger.js';
+/**
+ * Express middleware that auto-logs audit entries after the response
+ * is sent for CMA write operations (POST, PATCH, DELETE).
+ */
+export function auditMiddleware() {
+    return (req, res, next) => {
+        // Only audit write operations
+        const method = req.method.toUpperCase();
+        if (method !== 'POST' && method !== 'PATCH' && method !== 'DELETE') {
+            next();
+            return;
+        }
+        // Hook into response finish event so the audit write happens
+        // after the response is sent — true fire-and-forget.
+        res.on('finish', () => {
+            const spaceId = req.params.spaceId ??
+                req.headers['x-space-id'];
+            if (!spaceId)
+                return;
+            // Normalise path: strip leading slash, collapse param segments
+            const pathSegment = req.route?.path ?? req.path;
+            const action = `${method}.${pathSegment}`;
+            const resource = req.params.id ?? undefined;
+            logAudit({
+                spaceId,
+                userId: req.auth?.userId,
+                action,
+                resource,
+                meta: {
+                    statusCode: res.statusCode,
+                    path: req.originalUrl,
+                },
+            });
+        });
+        next();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/audit/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/audit/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,8BAA8B;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,6DAA6D;QAC7D,qDAAqD;QACrD,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,OAAO,GACV,GAAG,CAAC,MAAiC,CAAC,OAAO;gBAC7C,GAAG,CAAC,OAAO,CAAC,YAAY,CAAwB,CAAC;YAEpD,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,+DAA+D;YAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YAChD,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;YAE1C,MAAM,QAAQ,GAAI,GAAG,CAAC,MAAiC,CAAC,EAAE,IAAI,SAAS,CAAC;YAExE,QAAQ,CAAC;gBACP,OAAO;gBACP,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;gBACxB,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE;oBACJ,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,IAAI,EAAE,GAAG,CAAC,WAAW;iBACtB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/jwt.d.ts

@@ -0,0 +1,9 @@
+export interface JwtPayload {
+    sub: string;
+    email: string;
+    iat?: number;
+    exp?: number;
+}
+export declare function signJwt(payload: Omit<JwtPayload, 'iat' | 'exp'>): Promise<string>;
+export declare function verifyJwt(token: string): Promise<JwtPayload>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvF;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE"}

package/dist/auth/jwt.js

@@ -0,0 +1,15 @@
+import * as jose from 'jose';
+import { config } from '../config.js';
+const secret = new TextEncoder().encode(config.jwtSecret);
+export async function signJwt(payload) {
+    return new jose.SignJWT(payload)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(config.jwtExpiresIn)
+        .sign(secret);
+}
+export async function verifyJwt(token) {
+    const { payload } = await jose.jwtVerify(token, secret);
+    return payload;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAS1D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAwC;IACpE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;SAC7B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC;SACtC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,OAAgC,CAAC;AAC1C,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,24 @@
+import type { Request, Response, NextFunction } from 'express';
+export interface AuthContext {
+    userId: string;
+    email: string;
+    type: 'user' | 'api_token' | 'preview_token';
+    scopes?: string[];
+    spaceId?: string;
+    previewEntryId?: string | null;
+    previewRoute?: string | null;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: AuthContext;
+        }
+    }
+}
+export declare function authenticate(options?: {
+    required?: boolean;
+    allowPreview?: boolean;
+    allowQueryToken?: boolean;
+}): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+export declare function requireScope(...scopes: string[]): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,WAAW,CAAC;SACpB;KACF;CACF;AAMD,wBAAgB,YAAY,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,IAGpG,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CA+E9E;AAED,wBAAgB,YAAY,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,IACtC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAqB/D"}