@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/auth/server/utils/session.ts

@@ -1,88 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
-import { currentSessionEpoch } from './session-epoch'
-
-export function deriveSigningKey(rawSecret: string, passwordHash?: string, epoch = 0): string {
-  // The `epoch` is a server-side revocation counter: bumping it (on logout / force-logout) changes the key
-  // so every previously-issued token fails verification immediately — the stateless model's "hard logout".
-  return createHmac('sha256', rawSecret).update('kestrel-session-v1').update(passwordHash ?? '').update(`e${epoch}`).digest('base64url')
-}
-
-export function signSession(secret: string, expMs: number): string {
-  const payload = Buffer.from(JSON.stringify({ exp: expMs })).toString('base64url')
-  const sig = createHmac('sha256', secret).update(payload).digest('base64url')
-  return `${payload}.${sig}`
-}
-
-export function verifySession(secret: string, value: string | undefined, nowMs: number): { valid: boolean; exp?: number } {
-  if (!value || typeof value !== 'string') return { valid: false }
-  const dot = value.indexOf('.')
-  if (dot <= 0 || dot === value.length - 1) return { valid: false }
-  const payload = value.slice(0, dot)
-  const sig = value.slice(dot + 1)
-  const expected = createHmac('sha256', secret).update(payload).digest('base64url')
-  const sigBuf = Buffer.from(sig)
-  const expBuf = Buffer.from(expected)
-  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return { valid: false }
-  let exp: unknown
-  try {
-    exp = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')).exp
-  } catch {
-    return { valid: false }
-  }
-  if (typeof exp !== 'number' || exp <= nowMs) return { valid: false }
-  return { valid: true, exp }
-}
-
-/**
- * Sliding-expiry decision: refresh the session cookie once its remaining lifetime drops below HALF the
- * idle window. Activity within the window keeps the session alive (each refresh resets exp to now+maxAge);
- * inactivity longer than the window lets it expire → the admin must log in again. The halfway threshold
- * bounds Set-Cookie churn to at most once per half-window instead of on every request.
- */
-export function shouldRefreshSession(exp: number, nowMs: number, maxAgeMs: number): boolean {
-  return exp - nowMs < maxAgeMs / 2
-}
-
-let devSecret: string | undefined
-
-export interface SessionSettings {
-  secret: string
-  maxAge: number
-  secureCookies: boolean
-  cookieName: string
-}
-
-export function sessionSettings({ prerender = import.meta.prerender === true } = {}): SessionSettings {
-  // Treat anything that isn't an EXPLICIT dev signal as production for these safeguards, so a deployment
-  // that simply omits NODE_ENV (a common slip when launching `.output/server/index.mjs`) is hardened —
-  // not silently downgraded to dev, which would tolerate a missing secret + non-Secure cookies. Vitest
-  // sets NODE_ENV=test; KESTREL_DEV=1 is an explicit escape hatch for other dev contexts.
-  const explicitDev = process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test' || process.env.KESTREL_DEV === '1'
-  const isProd = !explicitDev
-  const secureCookies = process.env.KESTREL_SECURE_COOKIES !== 'false'
-  // `nuxt generate` prerenders every page through `/api/route`, which passes the access guard and lands
-  // here with NODE_ENV=production. A prerender request never issues a cookie, so enforcing the flag there
-  // only means a dev `.env` silently drops pages from the static output.
-  if (isProd && !secureCookies && !prerender) {
-    throw new Error('KESTREL_SECURE_COOKIES=false is not allowed in production')
-  }
-  const rawMaxAge = Number(process.env.KESTREL_SESSION_MAX_AGE)
-  const maxAge = Number.isFinite(rawMaxAge) && rawMaxAge > 0 ? rawMaxAge : 604800
-  let secret = process.env.KESTREL_SESSION_SECRET
-  if (!secret) {
-    if (isProd) throw new Error('KESTREL_SESSION_SECRET is required in production')
-    if (!devSecret) {
-      devSecret = randomBytes(32).toString('base64url')
-      console.warn('[kestrel auth] KESTREL_SESSION_SECRET not set — using a random per-process dev secret; sessions reset on restart')
-    }
-    secret = devSecret
-  } else if (isProd && Buffer.byteLength(secret) < 32) {
-    throw new Error('KESTREL_SESSION_SECRET must be at least 32 bytes in production')
-  }
-  return {
-    secret: deriveSigningKey(secret, process.env.KESTREL_ADMIN_PASSWORD_HASH, currentSessionEpoch()),
-    maxAge,
-    secureCookies,
-    cookieName: secureCookies ? '__Host-kestrel_session' : 'kestrel_session',
-  }
-}

package/layers/collections/server/collections/pages.ts

@@ -1,19 +0,0 @@
-import { buildCollection } from '../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../../core/server/utils/defineCollection'
-
-const built = buildCollection(defineCollection({
-  name: 'pages',
-  mode: 'multi',
-  translatable: true,
-  pageLike: true,
-  seo: true,
-  blocks: { enabled: true },
-  status: true,
-  builtin: true,
-  label: { singular: { en: 'Page', de: 'Seite' }, plural: { en: 'Pages', de: 'Seiten' }, new: { en: 'New Page', de: 'Neue Seite' } },
-  icon: 'file-text',
-  fields: { title: { type: 'text', required: true } },
-}))
-
-export const pages = built.table
-export default built

package/layers/collections/server/utils/populate-relations.ts

@@ -1,79 +0,0 @@
-import { fieldIs } from '../../../core/server/utils/defineCollection'
-import type { FieldPopulator } from '../../../core/server/utils/populate'
-import { memoDuringPrerender } from '../../../core/server/utils/prerender-memo'
-import { memoResolver } from '../../../core/server/utils/resolve-scope'
-
-/** Fetches a related record FULLY populated (its own media / links / nested relations resolved), or null
- *  when the id is stale / deleted / draft. Injected so the populator stays pure + unit-testable; the plugin
- *  wires the real `getOne`. `depth` is the ALREADY-decremented depth for the related read (the cycle guard). */
-export type ResolveRecord = (
-  collection: string,
-  id: number,
-  depth: number,
-  locale: string,
-  publicOnly: boolean,
-) => Record<string, unknown> | null
-
-/**
- * Run a related-record fetch, mapping `getOne`'s 404 (a stale / deleted / draft target — the intended
- * "skip this reference" signal) to `null`, but letting ANY OTHER error propagate. Swallowing every error
- * here would drop a relation on a real fault (a DB error, a downstream populator throwing on malformed
- * stored data) while the page still renders + records `success` — violating fail-loud. Pure + testable.
- */
-export function skipMissing(fetch: () => Record<string, unknown>): Record<string, unknown> | null {
-  try {
-    return fetch()
-  } catch (e) {
-    if ((e as { statusCode?: number })?.statusCode === 404) return null
-    throw e
-  }
-}
-
-/**
- * The `relation` field populator: expands a relation id (single, `${name}Id` in columns / bare in props)
- * or id array (many, always bare) into the fully-populated related record(s) under a `$<name>` sibling,
- * leaving the raw id column intact — so write round-trips and the admin relation-picker keep working.
- * Stale / deleted / draft ids are skipped (single → null, many → filtered out) so one bad reference never
- * fails the whole read. The related read passes `ctx.depth - 1`; `populateRow` bails at depth 0, so a
- * relation cycle terminates. Registered per-type via `registerFieldPopulator('relation', …)`; the shared
- * field-tree walker drives it over top-level fields, block props, slots, and repeater entries.
- *
- * Under `ctx.publicOnly` a relation into a collection `isPublicCollection` rejects is left unexpanded
- * (raw id only, NO `$<name>` sibling at all — a relation field targets exactly one collection, so a
- * `many` relation is all-or-nothing): expansion must not reach a record the caller could not have
- * requested directly. The check runs BEFORE `resolve`, so a withheld target never enters the memo.
- */
-export function buildRelationFieldPopulator(
-  resolveRecord: ResolveRecord,
-  isPublicCollection: (collection: string) => boolean,
-): FieldPopulator {
-  // The same target (collection+id+depth+locale+scope) is resolved once — build-wide during a generate run
-  // (memoDuringPrerender), request-/publish-run-wide via the resolve scope (which also budgets the
-  // distinct fan-out of one live request and replays read-tags on hits, so publish deps stay complete).
-  // memoResolver OUTERMOST: the per-scope budget verdict must stay scope-local. If memoDuringPrerender
-  // wrapped memoResolver, a build-wide memoize would cache a budget-skip `null` and poison every later
-  // page of a `nuxt generate`. With this order the build-wide memo only ever caches REAL resolver results.
-  // `publicOnly` is part of the key because the same record populates DIFFERENTLY under it (its own
-  // non-public relations are withheld) — sharing one entry would serve one scope's record to the other.
-  const key = (collection: string, id: number, depth: number, locale: string, publicOnly: boolean) => `rel:${collection}:${id}:${depth}:${locale}:${publicOnly}`
-  const resolve = memoResolver(memoDuringPrerender(resolveRecord, key), key)
-  return (bag, key, field, ctx, keyMode) => {
-    if (!fieldIs(field, 'relation')) return
-    const collection = field.relation.collection
-    const publicOnly = ctx.publicOnly === true
-    if (publicOnly && !isPublicCollection(collection)) return
-    const depth = ctx.depth - 1
-    if (field.relation.many) {
-      const ids = bag[key]
-      if (Array.isArray(ids)) {
-        bag['$' + key] = ids
-          .filter((n): n is number => typeof n === 'number')
-          .map((id) => resolve(collection, id, depth, ctx.locale, publicOnly))
-          .filter((r): r is Record<string, unknown> => r != null)
-      }
-    } else {
-      const id = bag[keyMode === 'columns' ? `${key}Id` : key]
-      if (typeof id === 'number') bag['$' + key] = resolve(collection, id, depth, ctx.locale, publicOnly)
-    }
-  }
-}

package/layers/core/app/utils/bulk-actions.ts

@@ -1,9 +0,0 @@
-// The batch operations the bulk endpoint accepts — the single source of truth shared by the server
-// handler (`bulk.post.ts`) and any client that builds a bulk request. Pure, so the allow-list is
-// unit-testable without a Nitro context.
-export const BULK_ACTIONS = ['delete', 'publish', 'unpublish', 'duplicate'] as const
-export type BulkAction = typeof BULK_ACTIONS[number]
-
-export function isBulkAction(value: unknown): value is BulkAction {
-  return typeof value === 'string' && (BULK_ACTIONS as readonly string[]).includes(value)
-}

package/layers/core/app/utils/filter-ops.ts

@@ -1,98 +0,0 @@
-import type { SerializedField } from '../../server/utils/serialize-collection' // type-only, erased client-side
-
-/**
- * The single shared source of truth for list filtering: which normalized "kind" a field/meta column maps
- * to, and which operators that kind allows. Both the server (validation + predicate building) and the admin
- * UI (operator select + typed value control) import this — so the allowed-operators-per-field-type table is
- * defined exactly once. Kept in `core/app/utils` (the server-and-client shared home) and free of any DB or
- * column-naming detail: each side maps its own column keys.
- */
-
-export type FilterOp = 'eq' | 'ne' | 'lt' | 'lte' | 'gt' | 'gte' | 'contains' | 'notContains'
-
-/**
- * A field's storage/semantics bucket for filtering. `text`/`richtext` do substring LIKE; `stringSet`/`idSet`
- * are JSON-array membership (multi choice / many relation+media); `ref` is a single FK id (eq/ne only);
- * `enum`/`boolean` are equality-only; `number`/`datetime` support the full comparison set.
- */
-export type FilterKind = 'number' | 'text' | 'datetime' | 'boolean' | 'enum' | 'ref' | 'richtext' | 'stringSet' | 'idSet'
-
-const CMP = ['eq', 'ne', 'lt', 'lte', 'gt', 'gte'] as const
-
-export const OPS_BY_KIND: Record<FilterKind, readonly FilterOp[]> = {
-  number: CMP,
-  datetime: CMP,
-  text: ['eq', 'ne', 'contains'],
-  richtext: ['contains'], // `contains` matches the stored HTML SOURCE (searching 'p' can hit a '<p>' tag) —
-  //                          a stripped shadow column / FTS index is a later enhancement (documented caveat).
-  boolean: ['eq', 'ne'],
-  enum: ['eq', 'ne'],
-  ref: ['eq', 'ne'], // a single relation/media FK id — lt/gt on an id is meaningless.
-  stringSet: ['contains', 'notContains'],
-  idSet: ['contains', 'notContains'],
-}
-
-/** The operator a column's filter row defaults to in the admin UI. `datetime` defaults to `gte` ("on or
- *  after") — `eq` on a millisecond timestamp practically never matches, so it made the filter useless. The
- *  admin always emits the operator explicitly, so this does NOT change the wire parser's separate
- *  absent-operator default (a bare `filter[field]` still parses as `eq`, URLs round-trip unchanged). */
-export const DEFAULT_OP: Record<FilterKind, FilterOp> = {
-  number: 'eq', datetime: 'gte', text: 'eq', boolean: 'eq', enum: 'eq', ref: 'eq',
-  richtext: 'contains', stringSet: 'contains', idSet: 'contains',
-}
-
-const ALL_OPS = new Set<string>(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'contains', 'notContains'])
-
-/** Whether a raw wire token is a known operator at all (parse-time guard → a clean 400 for garbage). */
-export const isFilterOp = (s: string): s is FilterOp => ALL_OPS.has(s)
-
-/** Whether `op` is allowed for a column of this kind (list-time guard → a clean 400, never a 500). */
-export const opAllowed = (kind: FilterKind, op: FilterOp): boolean => OPS_BY_KIND[kind].includes(op)
-
-/**
- * The wire key for a filter clause: `filter[field]` or `filter[field][op]`. `[^\]]+` keeps the field/op
- * tokens bracket-free; the optional second group is the operator (absent → `eq`, so a bare
- * `filter[status]=x` stays backward compatible). Defined ONCE here (the shared client+server home) so the
- * admin URL parser (`parseListQuery`) and the server wire parser (`parseFilter`) use exactly one regex.
- */
-export const FILTER_RE = /^filter\[([^\]]+)\](?:\[([^\]]+)\])?$/
-
-/**
- * The FilterKind for a field, or `null` when it is not filterable (link / json / repeater / range-datetime).
- * Unknown consumer types fall back to the conservative `text` (equality + substring on their scalar column).
- */
-export function fieldFilterKind(f: SerializedField): FilterKind | null {
-  switch (f.type) {
-    case 'text':
-    case 'slug':
-      return 'text'
-    case 'richtext':
-      return 'richtext'
-    case 'number':
-      return 'number'
-    case 'boolean':
-      return 'boolean'
-    case 'datetime':
-      return f.options?.range ? null : 'datetime'
-    case 'choice':
-      return f.options?.multiple ? 'stringSet' : 'enum'
-    case 'relation':
-    case 'media':
-      return f.single ? 'ref' : 'idSet'
-    case 'link':
-    case 'json':
-    case 'repeater':
-      return null
-    default:
-      return 'text'
-  }
-}
-
-/** The FilterKind of each filterable meta/system column (keyed by its wire key). */
-export const META_FILTER_KIND: Record<string, FilterKind> = {
-  id: 'number',
-  path: 'text',
-  status: 'enum',
-  createdAt: 'datetime',
-  updatedAt: 'datetime',
-}

package/layers/core/app/utils/list-limits.ts

@@ -1,27 +0,0 @@
-// The single source of truth for collection-list page sizes and, derived from them, the bulk-operation id
-// cap. Lives in `core/app/utils` (the established server+client shared home — same as `filter-ops.ts`) so
-// the admin list UI, the `list()` query engine, and the `bulk` endpoint all agree on ONE set of limits
-// instead of each hardcoding its own.
-
-/** The page sizes offered in the list's per-page selector. */
-export const PER_PAGE_OPTIONS = [25, 50, 100, 250, 500] as const
-
-/** The page size a list falls back to when none (or a garbage value) is supplied. */
-export const DEFAULT_PER_PAGE = 25
-
-/** The largest page a single list request may return — also the ceiling `clampPerPage` clamps to. */
-export const MAX_PER_PAGE = 500
-
-/** Coerce an untrusted page size to a sane integer: a non-finite input (undefined / NaN / Infinity / a
- *  non-numeric string) falls back to `DEFAULT_PER_PAGE`; anything else is floored and clamped to
- *  `[1, MAX_PER_PAGE]`. Guards against `LIMIT NaN` (which SQLite binds as "no limit") — an unauthenticated
- *  cap-bypass / DoS lever. */
-export function clampPerPage(n: unknown): number {
-  const v = Number(n)
-  if (!Number.isFinite(v)) return DEFAULT_PER_PAGE
-  return Math.min(MAX_PER_PAGE, Math.max(1, Math.floor(v)))
-}
-
-/** A bulk op can never carry more ids than one page can show (you select what you can see), so the id cap
- *  is DERIVED from the max page size, not guessed. */
-export const MAX_BULK_IDS = MAX_PER_PAGE

package/layers/core/app/utils/locale-path.ts

@@ -1,12 +0,0 @@
-/**
- * The public route path for a page row: other locales are prefixed with `/<locale>`; the primary locale
- * is unprefixed unless `prefixPrimary` is set (then it is prefixed too, root `/` → `/<primary>`). Single
- * source of truth for the URL scheme shared by the prerender routes, the sitemap, `populate-links`, the
- * `[...slug].vue` resolution, the slug-uniqueness check, and the admin SEO preview. Pure, so it is
- * unit-testable and safe to import from both server and app code.
- */
-export function localePath(path: string, locale: string, primaryLocale: string, prefixPrimary = false): string {
-  const p = path.startsWith('/') ? path : `/${path}`
-  if (locale === primaryLocale && !prefixPrimary) return p
-  return p === '/' ? `/${locale}` : `/${locale}${p}`
-}

package/layers/core/app/utils/slugify.ts

@@ -1,16 +0,0 @@
-/**
- * Turn arbitrary text (a record title) into a url-safe slug: lowercase, fold diacritics to ASCII
- * (`Über` → `uber`, `Café` → `cafe`) via NFKD + combining-mark removal, then collapse every run of
- * non-`[a-z0-9]` into a single hyphen and trim the ends. Letters with no ASCII fold (ß, CJK, …) act as
- * separators — Kestrel does NO language-specific transliteration, so the result is predictable. Returns
- * `''` for blank / symbol-only input (the caller decides: fall back to the manual slug, or reject). Pure.
- */
-export function slugify(input: string): string {
-  if (typeof input !== 'string') return ''
-  return input
-    .normalize('NFKD')
-    .replace(/\p{M}/gu, '') // strip combining diacritical marks left by NFKD (é → e, ü → u)
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-}

package/layers/core/server/api/[collection]/[id]/dead-refs.get.ts

@@ -1,8 +0,0 @@
-// Per-record stale-reference map for the editor: every reference this record holds that now points at a
-// deleted or unpublished target, with its field/block location + reason. Derived on read (auto-clears when
-// the link is fixed or the target restored). Fetched non-blocking alongside the editor load, like the
-// translations map.
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  return recordDeadRefs(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id]/translations.get.ts

@@ -1,4 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  return resolveTranslations(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id].delete.ts

@@ -1,5 +0,0 @@
-export default defineEventHandler((event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  return remove(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id].get.ts

@@ -1,11 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const depth = Number(query.depth ?? 0)
-  const locale = query.locale as string | undefined
-  const publishedOnly = publishedOnlyForScope(event.context.readScope)
-  // See index.get.ts: the public-set restriction follows the ROLE, so the renderer keeps full population;
-  // a missing principal fails closed onto it.
-  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
-  return getOne(useDb(), collection, requireId(event), depth, locale, publishedOnly, publicOnly)
-})

package/layers/core/server/api/[collection]/[id].patch.ts

@@ -1,8 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const id = requireId(event)
-  const body = await readBody(event)
-  // Optimistic concurrency: the editor sends the baseline it loaded; a stale save is refused with 409.
-  return update(useDb(), collection, id, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
-})

package/layers/core/server/api/[collection]/bulk.post.ts

@@ -1,37 +0,0 @@
-import { MAX_BULK_IDS } from '../../../app/utils/list-limits'
-import { BULK_ACTIONS, isBulkAction, type BulkAction } from '../../../app/utils/bulk-actions'
-
-// The ONE command endpoint for collection batch operations — the single wire surface behind both the
-// per-row Quick Actions and the selection Bulk bar (a row action IS a bulk action with one id). POST is
-// classified 'write' on the `{collection}` resource by the access guard (resourceForPath('/api/{c}/bulk')
-// === '{c}'), so CSRF + per-collection policy apply exactly as for a single-record write — no bypass.
-// A literal `bulk.post.ts` segment beats the dynamic `[id]` route (no `[id].post.ts` exists), so no clash.
-//
-//   body:  { action: 'delete' | 'publish' | 'unpublish' | 'duplicate', ids: number[] }
-//   200:   { action, count, ids }        (for 'duplicate', `ids` are the CREATED ids)
-//
-// delete + publish/unpublish are all-or-nothing (an unknown id 404s before any write); duplicate is a
-// sequential row action. All batching lives in crud.ts — this handler is a thin parse-and-dispatch.
-
-function parseBulkBody(body: unknown): { action: BulkAction; ids: number[] } {
-  const action = (body as { action?: unknown })?.action
-  if (!isBulkAction(action)) {
-    throw createError({ statusCode: 400, statusMessage: `Invalid bulk action: ${String(action)} (expected one of ${BULK_ACTIONS.join(', ')})` })
-  }
-  const ids = parseIdList((body as { ids?: unknown })?.ids, MAX_BULK_IDS)
-  return { action, ids }
-}
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const { action, ids } = parseBulkBody(await readBody(event))
-  const db = useDb()
-
-  if (action === 'delete') return { action, ...removeMany(db, collection, ids) }
-  if (action === 'duplicate') {
-    const created = await duplicateMany(db, collection, ids)
-    return { action, count: created.length, ids: created.map((r) => r.id as number) }
-  }
-  return { action, ...setStatusMany(db, collection, ids, action === 'publish' ? 'published' : 'draft') }
-})

package/layers/core/server/api/[collection]/index.get.ts

@@ -1,24 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const db = useDb()
-  const publishedOnly = publishedOnlyForScope(event.context.readScope)
-  // Keyed on the ROLE, not the read scope: the renderer reads published-only too, but it produces the
-  // static site and must still see every relation the output embeds. Only a visitor the guard scopes to
-  // the public collection set is barred from reaching further through a populated relation. Fail-CLOSED
-  // on a missing principal, like `publishedOnlyForScope` above — an absent one is a guard regression.
-  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
-
-  if (collection.def.mode === 'single') {
-    return getSingleton(db, collection, query.locale as string | undefined, publishedOnly, query.depth ? Number(query.depth) : 0, publicOnly)
-  }
-
-  return list(db, collection, {
-    locale: query.locale as string | undefined,
-    sort: query.sort as string | undefined,
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    filter: parseFilter(query as Record<string, unknown>),
-    depth: query.depth ? Number(query.depth) : 0,
-  }, publishedOnly, publicOnly)
-})

package/layers/core/server/api/[collection]/index.post.ts

@@ -1,8 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const body = await readBody(event)
-  const row = create(useDb(), collection, body)
-  setResponseStatus(event, 201)
-  return row
-})

package/layers/core/server/api/[collection]/index.put.test.ts

@@ -1,76 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest'
-import { createError } from 'h3'
-import Database from 'better-sqlite3'
-import { drizzle } from 'drizzle-orm/better-sqlite3'
-import { buildCollection } from '../../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../utils/defineCollection'
-import { putSingleton } from '../../utils/crud'
-import { requireCollection } from '../../utils/http'
-import { clearRegistry, registerCollection } from '../../utils/registry'
-import { clearWriteListeners } from '../../utils/write-events'
-import { registerWriteEffect, clearWriteEffects, runWriteEffects } from '../../utils/write-effects'
-import { desiredSchema } from '../../schema/desired'
-import { diffSchema } from '../../schema/diff'
-import { renderSqlite } from '../../schema/render-sqlite'
-
-const settings = buildCollection(defineCollection({
-  name: 'settings', mode: 'single',
-  fields: { title: { type: 'text', required: true } },
-}))
-
-interface FakeEvent { query: Record<string, unknown>; body: unknown; context: { params: Record<string, string> } }
-
-let db: ReturnType<typeof drizzle>
-
-// Bind the auto-imported helpers to the REAL implementations, so this proves the actual wiring rather
-// than a stub (same rationale as options.get.test.ts).
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  createError,
-  getQuery: (event: FakeEvent) => event.query,
-  readBody: (event: FakeEvent) => Promise.resolve(event.body),
-  useDb: () => db,
-  requireAdmin: () => {},
-  requireCollection,
-  readIfUnmodifiedSince: () => undefined,
-  putSingleton,
-  runWriteEffects,
-})
-
-const handler = (await import('./index.put')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
-const put = (collection: string, body: unknown) => handler({ query: {}, body, context: { params: { collection } } })
-
-beforeEach(() => {
-  const sqlite = new Database(':memory:')
-  for (const stmt of renderSqlite(diffSchema(desiredSchema([settings.table]), {}))) sqlite.exec(stmt)
-  db = drizzle(sqlite)
-  clearRegistry()
-  registerCollection(settings)
-  clearWriteListeners()
-  clearWriteEffects()
-})
-
-describe('PUT /api/[collection] — singleton save', () => {
-  it('writes the row and returns it', async () => {
-    await expect(put('settings', { title: 'Hello' })).resolves.toMatchObject({ title: 'Hello' })
-  })
-
-  it('runs post-write effects with the saved row', async () => {
-    const seen: unknown[] = []
-    registerWriteEffect((e) => { seen.push([e.def.name, e.row.title]) })
-    await put('settings', { title: 'Hello' })
-    expect(seen).toEqual([['settings', 'Hello']])
-  })
-
-  it('fails the save when an effect rejects — a stale side effect must not report success', async () => {
-    registerWriteEffect(() => { throw createError({ statusCode: 500, statusMessage: 'artifact is stale' }) })
-    await expect(put('settings', { title: 'Hello' })).rejects.toMatchObject({ statusCode: 500, statusMessage: 'artifact is stale' })
-  })
-
-  it('does not run effects when validation rejects the body', async () => {
-    let ran = false
-    registerWriteEffect(() => { ran = true })
-    await expect(put('settings', { title: '' })).rejects.toMatchObject({ statusCode: 400 })
-    expect(ran).toBe(false)
-  })
-})

package/layers/core/server/api/[collection]/index.put.ts

@@ -1,24 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const body = await readBody(event)
-  const saved = putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
-  // Awaited, and a rejection is the save's response: a singleton whose write has an external side effect
-  // (the redirects artifact the edge serves) is not really saved until that side effect landed, and the
-  // write-event bus swallows throws by design. See write-effects.ts.
-  try {
-    await runWriteEffects(collection.def, saved)
-  } catch (error) {
-    // The row IS committed and its `updatedAt` bumped, but the client only rebaselines on success — so
-    // hand the new baseline back with the error, or the retry these failures ask for would 409 on a
-    // precondition that is stale by construction.
-    const err = error as { statusCode?: number; statusMessage?: string; data?: Record<string, unknown> }
-    throw createError({
-      statusCode: err.statusCode ?? 500,
-      statusMessage: err.statusMessage ?? 'The record was saved but a follow-up step failed',
-      data: { ...(err.data ?? {}), savedUpdatedAt: new Date(saved.updatedAt as string | number).getTime() },
-    })
-  }
-  return saved
-})

package/layers/core/server/api/[collection]/options.get.test.ts

@@ -1,60 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { createError } from 'h3'
-import Database from 'better-sqlite3'
-import { drizzle } from 'drizzle-orm/better-sqlite3'
-import { buildCollection } from '../../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../utils/defineCollection'
-import { create } from '../../utils/crud'
-import { requireCollection, parseIdList } from '../../utils/http'
-import { clearRegistry, registerCollection } from '../../utils/registry'
-import { pickerOptions } from '../../utils/picker'
-import { desiredSchema } from '../../schema/desired'
-import { diffSchema } from '../../schema/diff'
-import { renderSqlite } from '../../schema/render-sqlite'
-
-const posts = buildCollection(defineCollection({
-  name: 'posts', mode: 'multi', translatable: false,
-  fields: { title: { type: 'text', required: true } },
-}))
-
-interface FakeEvent { query: Record<string, unknown>; context: { params: Record<string, string>; readScope?: string } }
-
-let db: ReturnType<typeof drizzle>
-
-// Same rationale as translations.get.test.ts: bind the handler's auto-imported helpers to the REAL
-// implementations so this proves the actual wiring, not a stub the server does not have.
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  createError,
-  getQuery: (event: FakeEvent) => event.query,
-  useDb: () => db,
-  requireCollection,
-  parseIdList,
-  pickerOptions,
-  publishedOnlyForScope: () => false,
-})
-
-const handler = (await import('./options.get')).default as unknown as (event: FakeEvent) => ReturnType<typeof pickerOptions>
-const get = (collection: string, query: Record<string, unknown>) => handler({ query, context: { params: { collection } } })
-
-beforeEach(() => {
-  const sqlite = new Database(':memory:')
-  for (const stmt of renderSqlite(diffSchema(desiredSchema([posts.table]), {}))) sqlite.exec(stmt)
-  db = drizzle(sqlite)
-  clearRegistry()
-  registerCollection(posts)
-})
-afterEach(() => clearRegistry())
-
-describe('GET /api/{collection}/options?ids=', () => {
-  it('resolves more than 100 ids in one request instead of truncating', () => {
-    const ids = Array.from({ length: 150 }, (_, i) => (create(db, posts, { title: `T${i}` }) as { id: number }).id)
-    const r = get('posts', { ids: ids.join(',') })
-    expect(r.data.length).toBe(150)
-  })
-
-  it('400s (never silently truncates) an ids list over the shared bulk cap', () => {
-    const ids = Array.from({ length: 501 }, (_, i) => i + 1)
-    expect(() => get('posts', { ids: ids.join(',') })).toThrowError(expect.objectContaining({ statusCode: 400 }))
-  })
-})