@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/core/app/utils/filter-ops.ts

@@ -1,98 +0,0 @@
-import type { SerializedField } from '../../server/utils/serialize-collection' // type-only, erased client-side
-
-/**
- * The single shared source of truth for list filtering: which normalized "kind" a field/meta column maps
- * to, and which operators that kind allows. Both the server (validation + predicate building) and the admin
- * UI (operator select + typed value control) import this — so the allowed-operators-per-field-type table is
- * defined exactly once. Kept in `core/app/utils` (the server-and-client shared home) and free of any DB or
- * column-naming detail: each side maps its own column keys.
- */
-
-export type FilterOp = 'eq' | 'ne' | 'lt' | 'lte' | 'gt' | 'gte' | 'contains' | 'notContains'
-
-/**
- * A field's storage/semantics bucket for filtering. `text`/`richtext` do substring LIKE; `stringSet`/`idSet`
- * are JSON-array membership (multi choice / many relation+media); `ref` is a single FK id (eq/ne only);
- * `enum`/`boolean` are equality-only; `number`/`datetime` support the full comparison set.
- */
-export type FilterKind = 'number' | 'text' | 'datetime' | 'boolean' | 'enum' | 'ref' | 'richtext' | 'stringSet' | 'idSet'
-
-const CMP = ['eq', 'ne', 'lt', 'lte', 'gt', 'gte'] as const
-
-export const OPS_BY_KIND: Record<FilterKind, readonly FilterOp[]> = {
-  number: CMP,
-  datetime: CMP,
-  text: ['eq', 'ne', 'contains'],
-  richtext: ['contains'], // `contains` matches the stored HTML SOURCE (searching 'p' can hit a '<p>' tag) —
-  //                          a stripped shadow column / FTS index is a later enhancement (documented caveat).
-  boolean: ['eq', 'ne'],
-  enum: ['eq', 'ne'],
-  ref: ['eq', 'ne'], // a single relation/media FK id — lt/gt on an id is meaningless.
-  stringSet: ['contains', 'notContains'],
-  idSet: ['contains', 'notContains'],
-}
-
-/** The operator a column's filter row defaults to in the admin UI. `datetime` defaults to `gte` ("on or
- *  after") — `eq` on a millisecond timestamp practically never matches, so it made the filter useless. The
- *  admin always emits the operator explicitly, so this does NOT change the wire parser's separate
- *  absent-operator default (a bare `filter[field]` still parses as `eq`, URLs round-trip unchanged). */
-export const DEFAULT_OP: Record<FilterKind, FilterOp> = {
-  number: 'eq', datetime: 'gte', text: 'eq', boolean: 'eq', enum: 'eq', ref: 'eq',
-  richtext: 'contains', stringSet: 'contains', idSet: 'contains',
-}
-
-const ALL_OPS = new Set<string>(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'contains', 'notContains'])
-
-/** Whether a raw wire token is a known operator at all (parse-time guard → a clean 400 for garbage). */
-export const isFilterOp = (s: string): s is FilterOp => ALL_OPS.has(s)
-
-/** Whether `op` is allowed for a column of this kind (list-time guard → a clean 400, never a 500). */
-export const opAllowed = (kind: FilterKind, op: FilterOp): boolean => OPS_BY_KIND[kind].includes(op)
-
-/**
- * The wire key for a filter clause: `filter[field]` or `filter[field][op]`. `[^\]]+` keeps the field/op
- * tokens bracket-free; the optional second group is the operator (absent → `eq`, so a bare
- * `filter[status]=x` stays backward compatible). Defined ONCE here (the shared client+server home) so the
- * admin URL parser (`parseListQuery`) and the server wire parser (`parseFilter`) use exactly one regex.
- */
-export const FILTER_RE = /^filter\[([^\]]+)\](?:\[([^\]]+)\])?$/
-
-/**
- * The FilterKind for a field, or `null` when it is not filterable (link / json / repeater / range-datetime).
- * Unknown consumer types fall back to the conservative `text` (equality + substring on their scalar column).
- */
-export function fieldFilterKind(f: SerializedField): FilterKind | null {
-  switch (f.type) {
-    case 'text':
-    case 'slug':
-      return 'text'
-    case 'richtext':
-      return 'richtext'
-    case 'number':
-      return 'number'
-    case 'boolean':
-      return 'boolean'
-    case 'datetime':
-      return f.options?.range ? null : 'datetime'
-    case 'choice':
-      return f.options?.multiple ? 'stringSet' : 'enum'
-    case 'relation':
-    case 'media':
-      return f.single ? 'ref' : 'idSet'
-    case 'link':
-    case 'json':
-    case 'repeater':
-      return null
-    default:
-      return 'text'
-  }
-}
-
-/** The FilterKind of each filterable meta/system column (keyed by its wire key). */
-export const META_FILTER_KIND: Record<string, FilterKind> = {
-  id: 'number',
-  path: 'text',
-  status: 'enum',
-  createdAt: 'datetime',
-  updatedAt: 'datetime',
-}

package/layers/core/app/utils/list-limits.ts

@@ -1,27 +0,0 @@
-// The single source of truth for collection-list page sizes and, derived from them, the bulk-operation id
-// cap. Lives in `core/app/utils` (the established server+client shared home — same as `filter-ops.ts`) so
-// the admin list UI, the `list()` query engine, and the `bulk` endpoint all agree on ONE set of limits
-// instead of each hardcoding its own.
-
-/** The page sizes offered in the list's per-page selector. */
-export const PER_PAGE_OPTIONS = [25, 50, 100, 250, 500] as const
-
-/** The page size a list falls back to when none (or a garbage value) is supplied. */
-export const DEFAULT_PER_PAGE = 25
-
-/** The largest page a single list request may return — also the ceiling `clampPerPage` clamps to. */
-export const MAX_PER_PAGE = 500
-
-/** Coerce an untrusted page size to a sane integer: a non-finite input (undefined / NaN / Infinity / a
- *  non-numeric string) falls back to `DEFAULT_PER_PAGE`; anything else is floored and clamped to
- *  `[1, MAX_PER_PAGE]`. Guards against `LIMIT NaN` (which SQLite binds as "no limit") — an unauthenticated
- *  cap-bypass / DoS lever. */
-export function clampPerPage(n: unknown): number {
-  const v = Number(n)
-  if (!Number.isFinite(v)) return DEFAULT_PER_PAGE
-  return Math.min(MAX_PER_PAGE, Math.max(1, Math.floor(v)))
-}
-
-/** A bulk op can never carry more ids than one page can show (you select what you can see), so the id cap
- *  is DERIVED from the max page size, not guessed. */
-export const MAX_BULK_IDS = MAX_PER_PAGE

package/layers/core/app/utils/locale-path.ts

@@ -1,12 +0,0 @@
-/**
- * The public route path for a page row: other locales are prefixed with `/<locale>`; the primary locale
- * is unprefixed unless `prefixPrimary` is set (then it is prefixed too, root `/` → `/<primary>`). Single
- * source of truth for the URL scheme shared by the prerender routes, the sitemap, `populate-links`, the
- * `[...slug].vue` resolution, the slug-uniqueness check, and the admin SEO preview. Pure, so it is
- * unit-testable and safe to import from both server and app code.
- */
-export function localePath(path: string, locale: string, primaryLocale: string, prefixPrimary = false): string {
-  const p = path.startsWith('/') ? path : `/${path}`
-  if (locale === primaryLocale && !prefixPrimary) return p
-  return p === '/' ? `/${locale}` : `/${locale}${p}`
-}

package/layers/core/app/utils/slugify.ts

@@ -1,16 +0,0 @@
-/**
- * Turn arbitrary text (a record title) into a url-safe slug: lowercase, fold diacritics to ASCII
- * (`Über` → `uber`, `Café` → `cafe`) via NFKD + combining-mark removal, then collapse every run of
- * non-`[a-z0-9]` into a single hyphen and trim the ends. Letters with no ASCII fold (ß, CJK, …) act as
- * separators — Kestrel does NO language-specific transliteration, so the result is predictable. Returns
- * `''` for blank / symbol-only input (the caller decides: fall back to the manual slug, or reject). Pure.
- */
-export function slugify(input: string): string {
-  if (typeof input !== 'string') return ''
-  return input
-    .normalize('NFKD')
-    .replace(/\p{M}/gu, '') // strip combining diacritical marks left by NFKD (é → e, ü → u)
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-}

package/layers/core/server/api/[collection]/[id]/dead-refs.get.ts

@@ -1,8 +0,0 @@
-// Per-record stale-reference map for the editor: every reference this record holds that now points at a
-// deleted or unpublished target, with its field/block location + reason. Derived on read (auto-clears when
-// the link is fixed or the target restored). Fetched non-blocking alongside the editor load, like the
-// translations map.
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  return recordDeadRefs(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id]/translations.get.ts

@@ -1,4 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  return resolveTranslations(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id].delete.ts

@@ -1,5 +0,0 @@
-export default defineEventHandler((event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  return remove(useDb(), collection, requireId(event))
-})

package/layers/core/server/api/[collection]/[id].get.ts

@@ -1,11 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const depth = Number(query.depth ?? 0)
-  const locale = query.locale as string | undefined
-  const publishedOnly = publishedOnlyForScope(event.context.readScope)
-  // See index.get.ts: the public-set restriction follows the ROLE, so the renderer keeps full population;
-  // a missing principal fails closed onto it.
-  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
-  return getOne(useDb(), collection, requireId(event), depth, locale, publishedOnly, publicOnly)
-})

package/layers/core/server/api/[collection]/[id].patch.ts

@@ -1,8 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const id = requireId(event)
-  const body = await readBody(event)
-  // Optimistic concurrency: the editor sends the baseline it loaded; a stale save is refused with 409.
-  return update(useDb(), collection, id, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
-})

package/layers/core/server/api/[collection]/bulk.post.ts

@@ -1,37 +0,0 @@
-import { MAX_BULK_IDS } from '../../../app/utils/list-limits'
-import { BULK_ACTIONS, isBulkAction, type BulkAction } from '../../../app/utils/bulk-actions'
-
-// The ONE command endpoint for collection batch operations — the single wire surface behind both the
-// per-row Quick Actions and the selection Bulk bar (a row action IS a bulk action with one id). POST is
-// classified 'write' on the `{collection}` resource by the access guard (resourceForPath('/api/{c}/bulk')
-// === '{c}'), so CSRF + per-collection policy apply exactly as for a single-record write — no bypass.
-// A literal `bulk.post.ts` segment beats the dynamic `[id]` route (no `[id].post.ts` exists), so no clash.
-//
-//   body:  { action: 'delete' | 'publish' | 'unpublish' | 'duplicate', ids: number[] }
-//   200:   { action, count, ids }        (for 'duplicate', `ids` are the CREATED ids)
-//
-// delete + publish/unpublish are all-or-nothing (an unknown id 404s before any write); duplicate is a
-// sequential row action. All batching lives in crud.ts — this handler is a thin parse-and-dispatch.
-
-function parseBulkBody(body: unknown): { action: BulkAction; ids: number[] } {
-  const action = (body as { action?: unknown })?.action
-  if (!isBulkAction(action)) {
-    throw createError({ statusCode: 400, statusMessage: `Invalid bulk action: ${String(action)} (expected one of ${BULK_ACTIONS.join(', ')})` })
-  }
-  const ids = parseIdList((body as { ids?: unknown })?.ids, MAX_BULK_IDS)
-  return { action, ids }
-}
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const { action, ids } = parseBulkBody(await readBody(event))
-  const db = useDb()
-
-  if (action === 'delete') return { action, ...removeMany(db, collection, ids) }
-  if (action === 'duplicate') {
-    const created = await duplicateMany(db, collection, ids)
-    return { action, count: created.length, ids: created.map((r) => r.id as number) }
-  }
-  return { action, ...setStatusMany(db, collection, ids, action === 'publish' ? 'published' : 'draft') }
-})

package/layers/core/server/api/[collection]/index.get.ts

@@ -1,24 +0,0 @@
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const db = useDb()
-  const publishedOnly = publishedOnlyForScope(event.context.readScope)
-  // Keyed on the ROLE, not the read scope: the renderer reads published-only too, but it produces the
-  // static site and must still see every relation the output embeds. Only a visitor the guard scopes to
-  // the public collection set is barred from reaching further through a populated relation. Fail-CLOSED
-  // on a missing principal, like `publishedOnlyForScope` above — an absent one is a guard regression.
-  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
-
-  if (collection.def.mode === 'single') {
-    return getSingleton(db, collection, query.locale as string | undefined, publishedOnly, query.depth ? Number(query.depth) : 0, publicOnly)
-  }
-
-  return list(db, collection, {
-    locale: query.locale as string | undefined,
-    sort: query.sort as string | undefined,
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    filter: parseFilter(query as Record<string, unknown>),
-    depth: query.depth ? Number(query.depth) : 0,
-  }, publishedOnly, publicOnly)
-})

package/layers/core/server/api/[collection]/index.post.ts

@@ -1,8 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const body = await readBody(event)
-  const row = create(useDb(), collection, body)
-  setResponseStatus(event, 201)
-  return row
-})

package/layers/core/server/api/[collection]/index.put.test.ts

@@ -1,76 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest'
-import { createError } from 'h3'
-import Database from 'better-sqlite3'
-import { drizzle } from 'drizzle-orm/better-sqlite3'
-import { buildCollection } from '../../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../utils/defineCollection'
-import { putSingleton } from '../../utils/crud'
-import { requireCollection } from '../../utils/http'
-import { clearRegistry, registerCollection } from '../../utils/registry'
-import { clearWriteListeners } from '../../utils/write-events'
-import { registerWriteEffect, clearWriteEffects, runWriteEffects } from '../../utils/write-effects'
-import { desiredSchema } from '../../schema/desired'
-import { diffSchema } from '../../schema/diff'
-import { renderSqlite } from '../../schema/render-sqlite'
-
-const settings = buildCollection(defineCollection({
-  name: 'settings', mode: 'single',
-  fields: { title: { type: 'text', required: true } },
-}))
-
-interface FakeEvent { query: Record<string, unknown>; body: unknown; context: { params: Record<string, string> } }
-
-let db: ReturnType<typeof drizzle>
-
-// Bind the auto-imported helpers to the REAL implementations, so this proves the actual wiring rather
-// than a stub (same rationale as options.get.test.ts).
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  createError,
-  getQuery: (event: FakeEvent) => event.query,
-  readBody: (event: FakeEvent) => Promise.resolve(event.body),
-  useDb: () => db,
-  requireAdmin: () => {},
-  requireCollection,
-  readIfUnmodifiedSince: () => undefined,
-  putSingleton,
-  runWriteEffects,
-})
-
-const handler = (await import('./index.put')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
-const put = (collection: string, body: unknown) => handler({ query: {}, body, context: { params: { collection } } })
-
-beforeEach(() => {
-  const sqlite = new Database(':memory:')
-  for (const stmt of renderSqlite(diffSchema(desiredSchema([settings.table]), {}))) sqlite.exec(stmt)
-  db = drizzle(sqlite)
-  clearRegistry()
-  registerCollection(settings)
-  clearWriteListeners()
-  clearWriteEffects()
-})
-
-describe('PUT /api/[collection] — singleton save', () => {
-  it('writes the row and returns it', async () => {
-    await expect(put('settings', { title: 'Hello' })).resolves.toMatchObject({ title: 'Hello' })
-  })
-
-  it('runs post-write effects with the saved row', async () => {
-    const seen: unknown[] = []
-    registerWriteEffect((e) => { seen.push([e.def.name, e.row.title]) })
-    await put('settings', { title: 'Hello' })
-    expect(seen).toEqual([['settings', 'Hello']])
-  })
-
-  it('fails the save when an effect rejects — a stale side effect must not report success', async () => {
-    registerWriteEffect(() => { throw createError({ statusCode: 500, statusMessage: 'artifact is stale' }) })
-    await expect(put('settings', { title: 'Hello' })).rejects.toMatchObject({ statusCode: 500, statusMessage: 'artifact is stale' })
-  })
-
-  it('does not run effects when validation rejects the body', async () => {
-    let ran = false
-    registerWriteEffect(() => { ran = true })
-    await expect(put('settings', { title: '' })).rejects.toMatchObject({ statusCode: 400 })
-    expect(ran).toBe(false)
-  })
-})

package/layers/core/server/api/[collection]/index.put.ts

@@ -1,24 +0,0 @@
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const body = await readBody(event)
-  const saved = putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
-  // Awaited, and a rejection is the save's response: a singleton whose write has an external side effect
-  // (the redirects artifact the edge serves) is not really saved until that side effect landed, and the
-  // write-event bus swallows throws by design. See write-effects.ts.
-  try {
-    await runWriteEffects(collection.def, saved)
-  } catch (error) {
-    // The row IS committed and its `updatedAt` bumped, but the client only rebaselines on success — so
-    // hand the new baseline back with the error, or the retry these failures ask for would 409 on a
-    // precondition that is stale by construction.
-    const err = error as { statusCode?: number; statusMessage?: string; data?: Record<string, unknown> }
-    throw createError({
-      statusCode: err.statusCode ?? 500,
-      statusMessage: err.statusMessage ?? 'The record was saved but a follow-up step failed',
-      data: { ...(err.data ?? {}), savedUpdatedAt: new Date(saved.updatedAt as string | number).getTime() },
-    })
-  }
-  return saved
-})

package/layers/core/server/api/[collection]/options.get.test.ts

@@ -1,60 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { createError } from 'h3'
-import Database from 'better-sqlite3'
-import { drizzle } from 'drizzle-orm/better-sqlite3'
-import { buildCollection } from '../../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../utils/defineCollection'
-import { create } from '../../utils/crud'
-import { requireCollection, parseIdList } from '../../utils/http'
-import { clearRegistry, registerCollection } from '../../utils/registry'
-import { pickerOptions } from '../../utils/picker'
-import { desiredSchema } from '../../schema/desired'
-import { diffSchema } from '../../schema/diff'
-import { renderSqlite } from '../../schema/render-sqlite'
-
-const posts = buildCollection(defineCollection({
-  name: 'posts', mode: 'multi', translatable: false,
-  fields: { title: { type: 'text', required: true } },
-}))
-
-interface FakeEvent { query: Record<string, unknown>; context: { params: Record<string, string>; readScope?: string } }
-
-let db: ReturnType<typeof drizzle>
-
-// Same rationale as translations.get.test.ts: bind the handler's auto-imported helpers to the REAL
-// implementations so this proves the actual wiring, not a stub the server does not have.
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  createError,
-  getQuery: (event: FakeEvent) => event.query,
-  useDb: () => db,
-  requireCollection,
-  parseIdList,
-  pickerOptions,
-  publishedOnlyForScope: () => false,
-})
-
-const handler = (await import('./options.get')).default as unknown as (event: FakeEvent) => ReturnType<typeof pickerOptions>
-const get = (collection: string, query: Record<string, unknown>) => handler({ query, context: { params: { collection } } })
-
-beforeEach(() => {
-  const sqlite = new Database(':memory:')
-  for (const stmt of renderSqlite(diffSchema(desiredSchema([posts.table]), {}))) sqlite.exec(stmt)
-  db = drizzle(sqlite)
-  clearRegistry()
-  registerCollection(posts)
-})
-afterEach(() => clearRegistry())
-
-describe('GET /api/{collection}/options?ids=', () => {
-  it('resolves more than 100 ids in one request instead of truncating', () => {
-    const ids = Array.from({ length: 150 }, (_, i) => (create(db, posts, { title: `T${i}` }) as { id: number }).id)
-    const r = get('posts', { ids: ids.join(',') })
-    expect(r.data.length).toBe(150)
-  })
-
-  it('400s (never silently truncates) an ids list over the shared bulk cap', () => {
-    const ids = Array.from({ length: 501 }, (_, i) => i + 1)
-    expect(() => get('posts', { ids: ids.join(',') })).toThrowError(expect.objectContaining({ statusCode: 400 }))
-  })
-})

package/layers/core/server/api/[collection]/options.get.ts

@@ -1,18 +0,0 @@
-import { MAX_BULK_IDS } from '../../../app/utils/list-limits'
-
-export default defineEventHandler((event) => {
-  const collection = requireCollection(event)
-  const query = getQuery(event)
-  const db = useDb()
-
-  return pickerOptions(db, collection, {
-    search: query.search ? String(query.search) : undefined,
-    ids: query.ids ? parseIdList(query.ids, MAX_BULK_IDS) : undefined,
-    label: query.label ? String(query.label) : undefined,
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    locale: query.locale ? String(query.locale) : undefined,
-    // Match list()/getOne(): a published-scope read (anonymous / SSG) must not surface draft labels.
-    publishedOnly: publishedOnlyForScope(event.context.readScope),
-  })
-})

package/layers/core/server/api/[collection]/populate-scope.test.ts

@@ -1,119 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { createError } from 'h3'
-import Database from 'better-sqlite3'
-import { drizzle } from 'drizzle-orm/better-sqlite3'
-import { buildCollection } from '../../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../utils/defineCollection'
-import { create, getOne, getSingleton, list, parseFilter, putSingleton } from '../../utils/crud'
-import { requireCollection, requireId } from '../../utils/http'
-import { clearRegistry, registerCollection } from '../../utils/registry'
-import { clearPopulator, registerPopulator, type PopulateCtx } from '../../utils/populate'
-import { desiredSchema } from '../../schema/desired'
-import { diffSchema } from '../../schema/diff'
-import { renderSqlite } from '../../schema/render-sqlite'
-
-const posts = buildCollection(defineCollection({
-  name: 'posts', mode: 'multi', translatable: false,
-  fields: { title: { type: 'text', required: true } },
-}))
-const settings = buildCollection(defineCollection({
-  name: 'settings', mode: 'single', translatable: false,
-  fields: { siteName: { type: 'text' } },
-}))
-
-interface FakeEvent {
-  query: Record<string, unknown>
-  context: { params: Record<string, string>; readScope?: string; principal?: { userId: string | null; role: string } }
-}
-
-let db: ReturnType<typeof drizzle>
-const seen: PopulateCtx[] = []
-
-// The handlers are Nitro routes: their auto-imported helpers are plain globals in a node test. Every read
-// entry point is the REAL one, so this exercises the actual crud → populate threading.
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  createError,
-  getQuery: (event: FakeEvent) => event.query,
-  useDb: () => db,
-  requireCollection,
-  requireId,
-  list,
-  getOne,
-  getSingleton,
-  parseFilter,
-  // Published-only for EVERY role, so a flag that tracked the read scope instead of the role would be
-  // indistinguishable here — the renderer/admin cases below would then fail.
-  publishedOnlyForScope: () => true,
-})
-
-const listHandler = (await import('./index.get')).default as unknown as (event: FakeEvent) => unknown
-const detailHandler = (await import('./[id].get')).default as unknown as (event: FakeEvent) => unknown
-
-let postId: number
-
-beforeEach(() => {
-  clearRegistry()
-  clearPopulator()
-  seen.length = 0
-  const sqlite = new Database(':memory:')
-  for (const stmt of renderSqlite(diffSchema(desiredSchema([posts.table, settings.table]), {}))) sqlite.exec(stmt)
-  db = drizzle(sqlite)
-  registerCollection(posts)
-  registerCollection(settings)
-  postId = (create(db, posts, { title: 'A' }) as Record<string, unknown>).id as number
-  putSingleton(db, settings, undefined, { siteName: 'Kestrel' })
-  registerPopulator((row, ctx) => { seen.push(ctx); return row })
-})
-afterEach(() => {
-  clearRegistry()
-  clearPopulator()
-})
-
-const eventFor = (collection: string, role: string | undefined, params: Record<string, string> = {}): FakeEvent => ({
-  query: { depth: 1 },
-  context: {
-    params: { collection, ...params },
-    readScope: 'published',
-    principal: role ? { userId: null, role } : undefined,
-  },
-})
-
-describe('read routes — public-only populate scope', () => {
-  it('marks an anonymous list read public-only', () => {
-    listHandler(eventFor('posts', 'anonymous'))
-    expect(seen[0]?.publicOnly).toBe(true)
-  })
-
-  it('marks an anonymous detail read public-only', () => {
-    detailHandler(eventFor('posts', 'anonymous', { id: String(postId) }))
-    expect(seen[0]?.publicOnly).toBe(true)
-  })
-
-  it('marks an anonymous singleton read public-only', () => {
-    listHandler(eventFor('settings', 'anonymous'))
-    expect(seen[0]?.publicOnly).toBe(true)
-  })
-
-  // The renderer produces the static site: stripping its relation sidecars would silently empty the
-  // generated HTML, so its read stays unrestricted even though it too is published-only.
-  it('leaves a renderer read unrestricted', () => {
-    listHandler(eventFor('posts', 'renderer'))
-    detailHandler(eventFor('posts', 'renderer', { id: String(postId) }))
-    expect(seen.map((c) => c.publicOnly)).toEqual([false, false])
-  })
-
-  it('leaves an admin read unrestricted', () => {
-    listHandler(eventFor('posts', 'admin'))
-    detailHandler(eventFor('posts', 'admin', { id: String(postId) }))
-    expect(seen.map((c) => c.publicOnly)).toEqual([false, false])
-  })
-
-  // A principal-less request is a guard regression, never a trusted caller — it must fail the same
-  // direction as the `publishedOnly` flag the handler derives beside it.
-  it('treats a missing principal as public-only', () => {
-    listHandler(eventFor('posts', undefined))
-    detailHandler(eventFor('posts', undefined, { id: String(postId) }))
-    expect(seen.map((c) => c.publicOnly)).toEqual([true, true])
-  })
-})