@htmless/core 0.1.0

package/dist/api/cma/entries.js

@@ -0,0 +1,736 @@
+import { Router } from 'express';
+import { nanoid } from 'nanoid';
+import { prisma } from '../../db.js';
+import { requireScope } from '../../auth/middleware.js';
+import { validateEntryData, validateForPublish } from '../../schema/validator.js';
+import { materializeEntry, dematerializeEntry } from '../../content/materializer.js';
+import { invalidateByType } from '../../content/cache.js';
+import { eventBus } from '../../events/emitter.js';
+import { getCDNProvider } from '../../cache/cdn-purge.js';
+const router = Router();
+// ─── Helpers ───
+function getSpaceId(req) {
+    return req.params.spaceId ?? req.headers['x-space-id'];
+}
+function generateEtag() {
+    return nanoid(16);
+}
+// ─── GET /entries ───
+router.get('/', requireScope('cma:read', 'cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const { contentType, status, limit: limitParam, offset: offsetParam, orderBy, order, } = req.query;
+    const limit = Math.min(parseInt(limitParam ?? '25', 10), 100);
+    const offset = parseInt(offsetParam ?? '0', 10);
+    const where = { spaceId };
+    if (contentType) {
+        const ct = await prisma.contentType.findUnique({
+            where: { spaceId_key: { spaceId, key: contentType } },
+        });
+        if (ct) {
+            where.contentTypeId = ct.id;
+        }
+        else {
+            res.json({ items: [], total: 0, limit, offset });
+            return;
+        }
+    }
+    if (status) {
+        where.state = { status };
+    }
+    const [entries, total] = await Promise.all([
+        prisma.entry.findMany({
+            where,
+            include: {
+                contentType: { select: { key: true, name: true } },
+                state: true,
+                versions: {
+                    orderBy: { createdAt: 'desc' },
+                    take: 1,
+                },
+            },
+            orderBy: { [orderBy ?? 'updatedAt']: order ?? 'desc' },
+            take: limit,
+            skip: offset,
+        }),
+        prisma.entry.count({ where }),
+    ]);
+    const items = entries.map((entry) => ({
+        id: entry.id,
+        slug: entry.slug,
+        contentType: entry.contentType,
+        status: entry.state?.status ?? 'draft',
+        draftVersionId: entry.state?.draftVersionId,
+        publishedVersionId: entry.state?.publishedVersionId,
+        latestVersion: entry.versions[0]
+            ? {
+                id: entry.versions[0].id,
+                kind: entry.versions[0].kind,
+                data: entry.versions[0].data,
+                etag: entry.versions[0].etag,
+                createdAt: entry.versions[0].createdAt,
+            }
+            : null,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+    }));
+    res.json({ items, total, limit, offset });
+});
+// ─── POST /entries ───
+router.post('/', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const { contentTypeKey, slug, data } = req.body;
+    if (!contentTypeKey || !slug) {
+        res.status(400).json({ error: 'validation_error', message: 'contentTypeKey and slug are required' });
+        return;
+    }
+    const contentType = await prisma.contentType.findUnique({
+        where: { spaceId_key: { spaceId, key: contentTypeKey } },
+    });
+    if (!contentType) {
+        res.status(404).json({ error: 'not_found', message: `Content type "${contentTypeKey}" not found` });
+        return;
+    }
+    // Validate entry data against schema
+    if (data && typeof data === 'object') {
+        const validationErrors = await validateEntryData(contentType.id, data);
+        if (validationErrors.length > 0) {
+            res.status(400).json({ error: 'validation_error', message: 'Entry data is invalid', details: validationErrors });
+            return;
+        }
+    }
+    // Check for duplicate slug
+    const existingEntry = await prisma.entry.findUnique({
+        where: { spaceId_contentTypeId_slug: { spaceId, contentTypeId: contentType.id, slug } },
+    });
+    if (existingEntry) {
+        res.status(409).json({ error: 'conflict', message: `Entry with slug "${slug}" already exists for this content type` });
+        return;
+    }
+    const etag = generateEtag();
+    const entry = await prisma.$transaction(async (tx) => {
+        const newEntry = await tx.entry.create({
+            data: {
+                spaceId,
+                contentTypeId: contentType.id,
+                slug,
+            },
+        });
+        const version = await tx.entryVersion.create({
+            data: {
+                entryId: newEntry.id,
+                kind: 'draft',
+                data: data ?? {},
+                etag,
+                createdById: req.auth.userId,
+            },
+        });
+        await tx.entryState.create({
+            data: {
+                entryId: newEntry.id,
+                status: 'draft',
+                draftVersionId: version.id,
+            },
+        });
+        return tx.entry.findUniqueOrThrow({
+            where: { id: newEntry.id },
+            include: {
+                contentType: { select: { key: true, name: true } },
+                state: true,
+                versions: { orderBy: { createdAt: 'desc' }, take: 1 },
+            },
+        });
+    });
+    eventBus.emit('entry.created', { spaceId, userId: req.auth.userId, data: { entryId: entry.id, typeKey: contentTypeKey, slug } });
+    res.status(201).json({
+        id: entry.id,
+        slug: entry.slug,
+        contentType: entry.contentType,
+        status: entry.state?.status ?? 'draft',
+        latestVersion: entry.versions[0]
+            ? {
+                id: entry.versions[0].id,
+                kind: entry.versions[0].kind,
+                data: entry.versions[0].data,
+                etag: entry.versions[0].etag,
+                createdAt: entry.versions[0].createdAt,
+            }
+            : null,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+    });
+    eventBus.emit('entry.created', { spaceId, userId: req.auth.userId, data: { entryId: entry.id, typeKey: contentTypeKey, slug } });
+});
+// ─── GET /entries/:id ───
+router.get('/:id', requireScope('cma:read', 'cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: {
+            contentType: { select: { key: true, name: true } },
+            state: true,
+            versions: { orderBy: { createdAt: 'desc' } },
+        },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const latestVersion = entry.versions[0] ?? null;
+    res.set('ETag', `"${latestVersion?.etag ?? ''}"`);
+    res.json({
+        id: entry.id,
+        slug: entry.slug,
+        contentType: entry.contentType,
+        status: entry.state?.status ?? 'draft',
+        draftVersionId: entry.state?.draftVersionId,
+        publishedVersionId: entry.state?.publishedVersionId,
+        versions: entry.versions.map((v) => ({
+            id: v.id,
+            kind: v.kind,
+            data: v.data,
+            etag: v.etag,
+            createdById: v.createdById,
+            createdAt: v.createdAt,
+        })),
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+    });
+});
+// ─── PATCH /entries/:id ───
+router.patch('/:id', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const { slug } = req.body;
+    const oldSlug = entry.slug;
+    const updated = await prisma.entry.update({
+        where: { id: entry.id },
+        data: {
+            ...(slug !== undefined && { slug }),
+        },
+        include: {
+            contentType: { select: { key: true, name: true } },
+            state: true,
+        },
+    });
+    // Auto-create redirect when slug changes
+    if (slug !== undefined && slug !== oldSlug) {
+        await prisma.redirect.upsert({
+            where: { spaceId_fromSlug: { spaceId: spaceId, fromSlug: oldSlug } },
+            create: {
+                spaceId: spaceId,
+                fromSlug: oldSlug,
+                toSlug: slug,
+                statusCode: 301,
+            },
+            update: {
+                toSlug: slug,
+            },
+        }).catch(() => {
+            // Non-critical — don't fail the entry update if redirect creation fails
+        });
+    }
+    res.json({
+        id: updated.id,
+        slug: updated.slug,
+        contentType: updated.contentType,
+        status: updated.state?.status ?? 'draft',
+        createdAt: updated.createdAt,
+        updatedAt: updated.updatedAt,
+    });
+});
+// ─── DELETE /entries/:id ───
+router.delete('/:id', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    await prisma.entry.delete({ where: { id: entry.id } });
+    eventBus.emit('entry.deleted', { spaceId, userId: req.auth.userId, data: { entryId: entry.id } });
+    res.status(204).end();
+});
+// ─── POST /entries/:id/save-draft ───
+router.post('/:id/save-draft', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: { state: true },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    // Optimistic concurrency: check If-Match header against current draft etag
+    const ifMatch = req.headers['if-match']?.replace(/"/g, '');
+    if (ifMatch && entry.state) {
+        const currentDraft = await prisma.entryVersion.findUnique({
+            where: { id: entry.state.draftVersionId },
+            select: { etag: true },
+        });
+        if (currentDraft && currentDraft.etag !== ifMatch) {
+            res.status(412).json({ error: 'precondition_failed', message: 'ETag mismatch — entry was modified concurrently' });
+            return;
+        }
+    }
+    const { data } = req.body;
+    if (data === undefined) {
+        res.status(400).json({ error: 'validation_error', message: 'data is required' });
+        return;
+    }
+    const etag = generateEtag();
+    const version = await prisma.$transaction(async (tx) => {
+        const newVersion = await tx.entryVersion.create({
+            data: {
+                entryId: entry.id,
+                kind: 'draft',
+                data,
+                etag,
+                createdById: req.auth.userId,
+            },
+        });
+        await tx.entryState.upsert({
+            where: { entryId: entry.id },
+            update: {
+                draftVersionId: newVersion.id,
+                status: entry.state?.publishedVersionId ? 'published' : 'draft',
+            },
+            create: {
+                entryId: entry.id,
+                status: 'draft',
+                draftVersionId: newVersion.id,
+            },
+        });
+        // Touch entry updatedAt
+        await tx.entry.update({ where: { id: entry.id }, data: {} });
+        return newVersion;
+    });
+    res.set('ETag', `"${version.etag}"`);
+    res.json({
+        id: version.id,
+        entryId: entry.id,
+        kind: version.kind,
+        data: version.data,
+        etag: version.etag,
+        createdAt: version.createdAt,
+    });
+    eventBus.emit('entry.draftSaved', { spaceId, userId: req.auth.userId, data: { entryId: entry.id, versionId: version.id } });
+});
+// ─── POST /entries/:id/publish ───
+router.post('/:id/publish', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: { state: true },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    if (!entry.state) {
+        res.status(400).json({ error: 'invalid_state', message: 'Entry has no state — cannot publish' });
+        return;
+    }
+    // Require If-Match for optimistic concurrency
+    const ifMatch = req.headers['if-match']?.replace(/"/g, '');
+    if (!ifMatch) {
+        res.status(428).json({ error: 'precondition_required', message: 'If-Match header is required to publish — fetch the entry first to get the current ETag' });
+        return;
+    }
+    // Get the current draft version's data to snapshot as published
+    const draftVersion = await prisma.entryVersion.findUnique({
+        where: { id: entry.state.draftVersionId },
+    });
+    if (!draftVersion) {
+        res.status(400).json({ error: 'invalid_state', message: 'Draft version not found' });
+        return;
+    }
+    if (draftVersion.etag !== ifMatch) {
+        res.status(412).json({ error: 'precondition_failed', message: 'ETag mismatch — entry was modified concurrently' });
+        return;
+    }
+    // Validate all required fields before publishing
+    const publishErrors = await validateForPublish(entry.contentTypeId, draftVersion.data);
+    if (publishErrors.length > 0) {
+        res.status(400).json({ error: 'publish_validation_error', message: 'Entry cannot be published — required fields missing', details: publishErrors });
+        return;
+    }
+    const etag = generateEtag();
+    const publishedVersion = await prisma.$transaction(async (tx) => {
+        const newVersion = await tx.entryVersion.create({
+            data: {
+                entryId: entry.id,
+                kind: 'published',
+                data: draftVersion.data,
+                etag,
+                createdById: req.auth.userId,
+            },
+        });
+        await tx.entryState.update({
+            where: { entryId: entry.id },
+            data: {
+                status: 'published',
+                publishedVersionId: newVersion.id,
+            },
+        });
+        // Touch entry updatedAt
+        await tx.entry.update({ where: { id: entry.id }, data: {} });
+        return newVersion;
+    });
+    // Materialize the entry into the published_documents read model and
+    // invalidate the CDA cache for this content type (fire-and-forget to
+    // avoid blocking the response).
+    const contentTypeKey = (await prisma.contentType.findUnique({
+        where: { id: entry.contentTypeId },
+        select: { key: true },
+    }))?.key;
+    materializeEntry(entry.id).catch(() => { });
+    if (contentTypeKey) {
+        invalidateByType(spaceId, contentTypeKey).catch(() => { });
+        // Purge CDN edge caches by Surrogate-Key tags
+        getCDNProvider()
+            .purgeByTags([`space:${spaceId}`, `type:${contentTypeKey}`, `entry:${entry.id}`])
+            .catch(() => { });
+    }
+    // Emit before response to ensure event fires
+    eventBus.emit('entry.published', { spaceId, userId: req.auth.userId, data: { entryId: entry.id, publishedVersionId: publishedVersion.id, slug: entry.slug } });
+    res.set('ETag', `"${publishedVersion.etag}"`);
+    res.json({
+        id: publishedVersion.id,
+        entryId: entry.id,
+        kind: publishedVersion.kind,
+        data: publishedVersion.data,
+        etag: publishedVersion.etag,
+        status: 'published',
+        createdAt: publishedVersion.createdAt,
+    });
+});
+// ─── POST /entries/:id/unpublish ───
+router.post('/:id/unpublish', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: { state: true },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    if (!entry.state || entry.state.status !== 'published') {
+        res.status(400).json({ error: 'invalid_state', message: 'Entry is not currently published' });
+        return;
+    }
+    await prisma.$transaction(async (tx) => {
+        await tx.entryState.update({
+            where: { entryId: entry.id },
+            data: {
+                status: 'draft',
+                publishedVersionId: null,
+            },
+        });
+        // Touch entry updatedAt
+        await tx.entry.update({ where: { id: entry.id }, data: {} });
+    });
+    // Remove from published_documents and invalidate cache
+    const contentTypeKey = (await prisma.contentType.findUnique({
+        where: { id: entry.contentTypeId },
+        select: { key: true },
+    }))?.key;
+    dematerializeEntry(entry.id).catch(() => { });
+    if (contentTypeKey) {
+        invalidateByType(spaceId, contentTypeKey).catch(() => { });
+        // Purge CDN edge caches by Surrogate-Key tags
+        getCDNProvider()
+            .purgeByTags([`space:${spaceId}`, `type:${contentTypeKey}`, `entry:${entry.id}`])
+            .catch(() => { });
+    }
+    res.json({
+        id: entry.id,
+        status: 'draft',
+        message: 'Entry unpublished successfully',
+    });
+    eventBus.emit('entry.unpublished', { spaceId, userId: req.auth.userId, data: { entryId: entry.id } });
+});
+// ─── POST /entries/:id/schedule ───
+router.post('/:id/schedule', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: { state: true },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const { publishAt, unpublishAt } = req.body;
+    if (!publishAt && !unpublishAt) {
+        res.status(400).json({ error: 'validation_error', message: 'publishAt or unpublishAt (ISO date) is required' });
+        return;
+    }
+    let scheduledAt = null;
+    let scheduledUnpublishAt = null;
+    if (publishAt) {
+        scheduledAt = new Date(publishAt);
+        if (isNaN(scheduledAt.getTime()) || scheduledAt <= new Date()) {
+            res.status(400).json({ error: 'validation_error', message: 'publishAt must be a valid future date' });
+            return;
+        }
+    }
+    if (unpublishAt) {
+        scheduledUnpublishAt = new Date(unpublishAt);
+        if (isNaN(scheduledUnpublishAt.getTime()) || scheduledUnpublishAt <= new Date()) {
+            res.status(400).json({ error: 'validation_error', message: 'unpublishAt must be a valid future date' });
+            return;
+        }
+    }
+    // If only unpublishAt is provided, the entry must be published
+    if (!publishAt && unpublishAt && entry.state?.status !== 'published') {
+        res.status(400).json({ error: 'invalid_state', message: 'Entry must be published to schedule an unpublish without a publishAt' });
+        return;
+    }
+    const updateData = {};
+    if (scheduledAt) {
+        updateData.status = 'scheduled';
+        updateData.scheduledAt = scheduledAt;
+    }
+    if (scheduledUnpublishAt) {
+        updateData.scheduledUnpublishAt = scheduledUnpublishAt;
+    }
+    await prisma.entryState.upsert({
+        where: { entryId: entry.id },
+        update: updateData,
+        create: {
+            entryId: entry.id,
+            status: scheduledAt ? 'scheduled' : entry.state?.status ?? 'draft',
+            draftVersionId: entry.state.draftVersionId,
+            scheduledAt,
+            scheduledUnpublishAt,
+        },
+    });
+    res.json({
+        id: entry.id,
+        status: scheduledAt ? 'scheduled' : entry.state?.status ?? 'draft',
+        ...(scheduledAt && { scheduledAt: scheduledAt.toISOString() }),
+        ...(scheduledUnpublishAt && { scheduledUnpublishAt: scheduledUnpublishAt.toISOString() }),
+    });
+});
+// ─── POST /entries/:id/revert ───
+router.post('/:id/revert', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: { state: true },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const { versionId } = req.body;
+    if (!versionId) {
+        res.status(400).json({ error: 'validation_error', message: 'versionId is required' });
+        return;
+    }
+    const targetVersion = await prisma.entryVersion.findFirst({
+        where: { id: versionId, entryId: entry.id },
+    });
+    if (!targetVersion) {
+        res.status(404).json({ error: 'not_found', message: 'Version not found for this entry' });
+        return;
+    }
+    // Create a new draft version with the old version's data
+    const etag = generateEtag();
+    const newVersion = await prisma.$transaction(async (tx) => {
+        const reverted = await tx.entryVersion.create({
+            data: {
+                entryId: entry.id,
+                kind: 'draft',
+                data: targetVersion.data,
+                etag,
+                createdById: req.auth.userId,
+            },
+        });
+        await tx.entryState.update({
+            where: { entryId: entry.id },
+            data: { draftVersionId: reverted.id },
+        });
+        await tx.entry.update({ where: { id: entry.id }, data: {} });
+        return reverted;
+    });
+    res.json({
+        id: newVersion.id,
+        entryId: entry.id,
+        kind: 'draft',
+        data: newVersion.data,
+        etag: newVersion.etag,
+        revertedFrom: versionId,
+        createdAt: newVersion.createdAt,
+    });
+});
+// ─── POST /entries/:id/duplicate ───
+router.post('/:id/duplicate', requireScope('cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+        include: {
+            contentType: { select: { key: true, name: true } },
+            versions: { orderBy: { createdAt: 'desc' }, take: 1 },
+        },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const latestVersion = entry.versions[0];
+    if (!latestVersion) {
+        res.status(400).json({ error: 'invalid_state', message: 'Entry has no versions to duplicate' });
+        return;
+    }
+    const copySlug = `${entry.slug}-copy-${Date.now()}`;
+    const etag = generateEtag();
+    const duplicated = await prisma.$transaction(async (tx) => {
+        const newEntry = await tx.entry.create({
+            data: {
+                spaceId,
+                contentTypeId: entry.contentTypeId,
+                slug: copySlug,
+            },
+        });
+        const version = await tx.entryVersion.create({
+            data: {
+                entryId: newEntry.id,
+                kind: 'draft',
+                data: latestVersion.data,
+                etag,
+                createdById: req.auth.userId,
+            },
+        });
+        await tx.entryState.create({
+            data: {
+                entryId: newEntry.id,
+                status: 'draft',
+                draftVersionId: version.id,
+            },
+        });
+        return tx.entry.findUniqueOrThrow({
+            where: { id: newEntry.id },
+            include: {
+                contentType: { select: { key: true, name: true } },
+                state: true,
+                versions: { orderBy: { createdAt: 'desc' }, take: 1 },
+            },
+        });
+    });
+    eventBus.emit('entry.created', { spaceId, userId: req.auth.userId, data: { entryId: duplicated.id, typeKey: duplicated.contentType.key, slug: duplicated.slug } });
+    res.status(201).json({
+        id: duplicated.id,
+        slug: duplicated.slug,
+        contentType: duplicated.contentType,
+        status: duplicated.state?.status ?? 'draft',
+        latestVersion: duplicated.versions[0]
+            ? {
+                id: duplicated.versions[0].id,
+                kind: duplicated.versions[0].kind,
+                data: duplicated.versions[0].data,
+                etag: duplicated.versions[0].etag,
+                createdAt: duplicated.versions[0].createdAt,
+            }
+            : null,
+        duplicatedFrom: entry.id,
+        createdAt: duplicated.createdAt,
+        updatedAt: duplicated.updatedAt,
+    });
+});
+// ─── GET /entries/:id/versions ───
+router.get('/:id/versions', requireScope('cma:read', 'cma:write'), async (req, res) => {
+    const spaceId = getSpaceId(req);
+    if (!spaceId) {
+        res.status(400).json({ error: 'validation_error', message: 'spaceId is required' });
+        return;
+    }
+    const entry = await prisma.entry.findFirst({
+        where: { id: req.params.id, spaceId },
+    });
+    if (!entry) {
+        res.status(404).json({ error: 'not_found', message: 'Entry not found' });
+        return;
+    }
+    const { limit: limitParam, offset: offsetParam } = req.query;
+    const limit = Math.min(parseInt(limitParam ?? '25', 10), 100);
+    const offset = parseInt(offsetParam ?? '0', 10);
+    const [versions, total] = await Promise.all([
+        prisma.entryVersion.findMany({
+            where: { entryId: entry.id },
+            orderBy: { createdAt: 'desc' },
+            take: limit,
+            skip: offset,
+        }),
+        prisma.entryVersion.count({ where: { entryId: entry.id } }),
+    ]);
+    res.json({
+        items: versions.map((v) => ({
+            id: v.id,
+            kind: v.kind,
+            data: v.data,
+            etag: v.etag,
+            createdById: v.createdById,
+            createdAt: v.createdAt,
+        })),
+        total,
+        limit,
+        offset,
+    });
+});
+export default router;
+//# sourceMappingURL=entries.js.map