@murumets-ee/content-api 0.1.4 → 0.1.5

package/dist/index.d.mts

@@ -0,0 +1,135 @@
+import { PermissionChecker } from "@murumets-ee/core";
+import { Entity } from "@murumets-ee/entity";
+
+//#region src/types.d.ts
+/** CORS configuration — deny-by-default, explicit origin allowlist. */
+interface CorsConfig {
+  /** Allowed origins. Each matched exactly — no regex, no wildcards. */
+  allowedOrigins: string[];
+  /** Preflight cache max age (seconds). Default: 3600 */
+  maxAge?: number;
+}
+/** Per-entity cache override. */
+interface EntityCacheConfig {
+  /** Cache-Control max-age in seconds. */
+  maxAge?: number;
+  /** stale-while-revalidate window in seconds. */
+  staleWhileRevalidate?: number;
+  /** Whether this entity is cacheable. Default: true. Set false → no-store. */
+  cacheable?: boolean;
+}
+/** Global cache configuration. */
+interface CacheConfig {
+  /** Default max-age for all entities (seconds). Default: 60 */
+  defaultMaxAge?: number;
+  /** Default stale-while-revalidate (seconds). Default: 300 */
+  defaultStaleWhileRevalidate?: number;
+  /** Per-entity overrides, keyed by entity name. */
+  entities?: Record<string, EntityCacheConfig>;
+}
+/** Content API handler configuration. */
+interface ContentApiConfig {
+  /** Entity whitelist — ONLY these entities are queryable. Deny-by-default. */
+  entities: Entity[];
+  /**
+   * Permission checker — REQUIRED. Same pattern as admin API handler.
+   * Called lazily on first request, result cached with 30s TTL.
+   * Checks: `checker(role, entityName, 'view')` → boolean.
+   */
+  loadPermissions: () => Promise<PermissionChecker>;
+  /**
+   * Optional auth. Returns user role, or null for anonymous.
+   * When null or not provided → uses `publicRole`.
+   *
+   * Enables preview mode (e.g. bearer token → editor sees more entities).
+   */
+  authenticate?: (req: Request) => Promise<{
+    role: string;
+  } | null>;
+  /**
+   * Role for unauthenticated requests. Default: `'public'`.
+   * Must have explicit 'view' permission per entity to see anything.
+   */
+  publicRole?: string;
+  /** Default content locale for translation merging. */
+  defaultLocale?: string;
+  /** CORS configuration. Required when serving cross-origin. */
+  cors?: CorsConfig;
+  /** Cache-Control header configuration. */
+  cache?: CacheConfig;
+  /** Max pagination limit. Default: 100. Hard-capped at 100. */
+  maxLimit?: number;
+  /** Error hook for monitoring/logging. Errors are fire-and-forget. */
+  onError?: (err: {
+    status: number;
+    message: string;
+    entity?: string;
+    path: string;
+  }) => void;
+}
+interface ContentListResponse<T = Record<string, unknown>> {
+  data: T[];
+  meta: {
+    total: number;
+    limit: number;
+    offset: number;
+    hasMore: boolean; /** Opaque cursor for fetching the next page via keyset pagination. */
+    nextCursor?: string;
+  };
+}
+interface ContentSingleResponse<T = Record<string, unknown>> {
+  data: T;
+}
+interface ContentCountResponse {
+  data: {
+    count: number;
+  };
+}
+interface ContentErrorResponse {
+  error: {
+    status: number;
+    message: string;
+    code: string;
+  };
+}
+/** Field metadata exposed by /_schema (public-safe subset of FieldConfig). */
+interface SchemaField {
+  type: string;
+  required?: boolean;
+  options?: readonly string[];
+  cardinality?: 'one' | 'many';
+}
+/** Entity metadata exposed by /_schema. */
+interface SchemaEntity {
+  name: string;
+  pluralName: string;
+  fields: Record<string, SchemaField>;
+}
+/** Full /_schema response. */
+interface SchemaResponse {
+  entities: SchemaEntity[];
+}
+/** Next.js catch-all route context shape. */
+interface RouteContext {
+  params: Promise<{
+    path: string[];
+  }>;
+}
+//#endregion
+//#region src/handler.d.ts
+declare function createContentApiHandler(config: ContentApiConfig): {
+  GET: (req: Request, ctx: RouteContext) => Promise<Response>;
+  OPTIONS: (req: Request) => Response;
+};
+//#endregion
+//#region src/schema-endpoint.d.ts
+/** Convert an Entity to public-safe schema metadata. */
+declare function toSchemaEntity(entity: Entity): SchemaEntity;
+/**
+ * Build the full /_schema response.
+ * Only includes entities that pass the permission check.
+ */
+declare function buildSchemaResponse(entities: Entity[], checkPermission: (entityName: string) => boolean): SchemaResponse;
+//#endregion
+export { type CacheConfig, type ContentApiConfig, type ContentCountResponse, type ContentErrorResponse, type ContentListResponse, type ContentSingleResponse, type CorsConfig, type EntityCacheConfig, type RouteContext, type SchemaEntity, type SchemaField, type SchemaResponse, buildSchemaResponse, createContentApiHandler, toSchemaEntity };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCHJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAsWjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBC1dV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import{getApp as e}from"@murumets-ee/core";import{schemaRegistry as t}from"@murumets-ee/db";import{CountCache as n,decodeCursor as r,encodeCursor as i,estimateRowCount as a}from"@murumets-ee/entity";import{QueryClient as o}from"@murumets-ee/entity/query";import{and as s,asc as c,desc as l,eq as u,gte as d,ilike as f,inArray as p,lte as m,or as h}from"drizzle-orm";import{z as g}from"zod";function _(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function v(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function y(e,t){let n=v(e,t);return new Response(null,{status:204,headers:n})}const b=g.object({limit:g.coerce.number().int().min(1).max(100).default(20),offset:g.coerce.number().int().min(0).default(0),sort:g.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:g.string().optional(),search:g.string().max(200).optional(),cursor:g.string().max(500).optional()}),x=g.object({locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:g.string().optional()}),S=g.object({locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional()});function C(e){return e.replace(/[%_\\]/g,`\\$&`)}const w=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function T(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return w.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function E(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>e in t&&!e.startsWith(`_`)&&t[e].type!==`blocks`);return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function D(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function O(e,t,n,r){return D({error:{status:n,message:e,code:t}},n,r)}function k(e){return O(`Not found`,`NOT_FOUND`,404,e)}function A(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function j(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=A(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function M(e,t){return{entities:e.filter(e=>t(e.name)).map(j)}}function N(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function P(e,n){let r=t.get(e.name);if(!r)return;let i=e.allFields;for(let[e,t]of Object.entries(i))if(t.type===`text`&&(t.indexed||t.required)){let t=r[e];if(t)return f(t,`%${C(n)}%`)}}function F(e,n,r){if(!n)return;let i=n.startsWith(`-`),a=i?n.slice(1):n,o=r[a];if(!o||o.type===`blocks`)return;let s=t.get(e);if(!(!s||!s[a]))return i?l(s[a]):c(s[a])}function I(e,n,r){let i=t.get(e);if(!i)return[];let a=[];for(let[e,t]of n.searchParams.entries()){let n=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!n)continue;let o=n[1],s=r[o];if(!s||s.type===`blocks`)continue;let c=i[o];if(!c)continue;if(s.type===`date`){t.startsWith(`gte:`)?a.push(d(c,t.slice(4))):t.startsWith(`lte:`)?a.push(m(c,t.slice(4))):a.push(u(c,t));continue}let l=T(s,t);l!==null&&a.push(u(c,l))}return a}function L(c){let{entities:l,defaultLocale:d,publicRole:f=`public`,cors:m,cache:g,onError:C}=c,w=Math.min(c.maxLimit??100,100),T=N(l),A=new n(5e3),j=null,L=0;async function R(){let e=Date.now();return(!j||e-L>3e4)&&(j=await c.loadPermissions(),L=e),j}async function z(e){if(!c.authenticate)return f;try{return(await c.authenticate(e))?.role??f}catch{return f}}function B(e,t,n){return e(t,n,`view`)}function V(t){let n=e();return new o({entity:t,db:n.db.readOnly,logger:n.logger.child({entity:t.name}),countCache:A})}async function H(e,t,n){let a=new URL(e.url),o=b.safeParse(Object.fromEntries(a.searchParams));if(!o.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:c,offset:l,sort:u,locale:f,fields:p,search:m,cursor:h}=o.data,v=Math.min(c,w),y=t.allFields,x;if(h){let e=r(h);if(!e)return O(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in y)&&e.field!==`id`)return O(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);x=e}let S=[];if(m){let e=P(t,m);e&&S.push(e)}let C=I(t.name,a,y);S.push(...C);let T=F(t.name,u,y),k=E(p,y),A=V(t),j=f??d,M={where:S.length>0?s(...S):void 0,limit:v,offset:l,orderBy:T,select:k,locale:j,defaultLocale:d,cursor:x},[N,L]=await Promise.all([A.findMany(M),A.count({where:S.length>0?s(...S):void 0})]),R;if(N.length>0&&N.length===v){let e=N[N.length-1],t=x?.field??(u?u.startsWith(`-`)?u.slice(1):u:void 0),n=x?.direction??(u?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(R=i(e,t,n))}let z={...n,..._(t.name,g)};return D({data:N,meta:{total:L,limit:v,offset:l,hasMore:l+v<L,nextCursor:R}},200,z)}async function U(t,n,r){let i=new URL(t.url);return S.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?D({data:{count:await a(e().db.readOnly,n.name),estimate:!0}},200,{...r,..._(n.name,g)}):D({data:{count:await V(n).count()}},200,{...r,..._(n.name,g)}):O(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function W(e,t,n,r){let i=new URL(e.url),a=x.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=E(s,c),u=o??d,f=await V(t).findById(n,{select:l,locale:u,defaultLocale:d});return f?D({data:f},200,{...r,..._(t.name,g)}):k(r)}async function G(n,r,i,a){let o=new URL(n.url),c=x.safeParse(Object.fromEntries(o.searchParams));if(!c.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,a);let l=r.allFields;if(!l.slug)return k(a);let{locale:f,fields:m}=c.data,v=E(m,l),y=f??d,b=t.get(r.name);if(!b?.slug)return k(a);let S=V(r),C=l.slug,w=u(b.slug,i);if(C.translatable&&y){let n=`${r.name}_translations`,a=t.get(n);if(a?.slug){let t=await e().db.readOnly.select({entityId:a.entityId}).from(a).where(s(u(a.slug,i),u(a.locale,y)));if(t.length>0){let e=t.map(e=>e.entityId);w=h(p(b.id,e),u(b.slug,i))}}}let T=await S.findMany({where:w,limit:1,select:v,locale:y,defaultLocale:d});return T.length===0?k(a):D({data:T[0]},200,{...a,..._(r.name,g)})}async function K(e,t){let n=v(e,m);try{let r=await t.params.then(e=>e.path);if(!r||r.length===0)return k(n);let i=await z(e),a=await R();if(r[0]===`_schema`)return D(M(l,e=>B(a,i,e)),200,{...n,"Cache-Control":`no-store`});let o=r[0],s=T.get(o)??T.get(o.endsWith(`s`)?o.slice(0,-1):o);return!s||!B(a,i,s.name)?k(n):r.length===1?H(e,s,n):r[1]===`count`?U(e,s,n):r[1]===`slug`&&r[2]?G(e,s,r[2],n):r.length===2?W(e,s,r[1],n):k(n)}catch(t){let r=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),C?.({status:500,message:r,path:new URL(e.url).pathname}),O(`Internal server error`,`INTERNAL_ERROR`,500,n)}}return{GET:(e,t)=>K(e,t),OPTIONS:e=>y(e,m)}}export{M as buildSchemaResponse,L as createContentApiHandler,j as toSchemaEntity};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n  entityName: string,\n  config: CacheConfig | undefined,\n): Record<string, string> {\n  const entityConfig = config?.entities?.[entityName]\n\n  if (entityConfig?.cacheable === false) {\n    return { 'Cache-Control': 'no-store' }\n  }\n\n  const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n  const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n  return {\n    'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n  }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n  req: Request,\n  config: CorsConfig | undefined,\n): Record<string, string> {\n  if (!config) return {}\n\n  const origin = req.headers.get('Origin')\n  if (!origin) return {}\n\n  // Exact match only\n  if (!config.allowedOrigins.includes(origin)) return {}\n\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n    'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n    Vary: 'Origin',\n  }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n  const headers = buildCorsHeaders(req, config)\n  return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n  offset: z.coerce.number().int().min(0).default(0),\n  sort: z\n    .string()\n    .regex(/^-?[a-zA-Z_]+$/)\n    .optional(),\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n  fields: z.string().optional(),\n  search: z.string().max(200).optional(),\n  /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n  cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n  fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n})\n\n/** Escape LIKE wildcards to prevent wildcard injection in search queries. */\nexport function escapeLikePattern(s: string): string {\n  return s.replace(/[%_\\\\]/g, '\\\\$&')\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n  switch (fieldConfig.type) {\n    case 'boolean':\n      if (raw === 'true') return true\n      if (raw === 'false') return false\n      return null\n\n    case 'reference':\n    case 'media':\n      return UUID_RE.test(raw) ? raw : null\n\n    case 'select':\n      return fieldConfig.options.includes(raw) ? raw : null\n\n    case 'date':\n      // Plain date or gte:/lte: prefix handled by caller\n      return raw\n\n    case 'text':\n    case 'number':\n      return raw\n\n    default:\n      return null\n  }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n  fieldsParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n  if (!fieldsParam) return undefined\n\n  const requested = fieldsParam.split(',').map((f) => f.trim())\n  const valid = requested.filter(\n    (name) => name in allFields && !name.startsWith('_') && allFields[name].type !== 'blocks',\n  )\n\n  // Always include id\n  if (valid.length > 0 && !valid.includes('id')) {\n    valid.unshift('id')\n  }\n\n  return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n  data: unknown,\n  status = 200,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      ...extraHeaders,\n    },\n  })\n}\n\nexport function errorResponse(\n  message: string,\n  code: string,\n  status: number,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n  return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n  const field: SchemaField = { type: config.type }\n\n  if (config.required) {\n    field.required = true\n  }\n\n  if (config.type === 'select') {\n    field.options = config.options\n  }\n\n  if (config.type === 'reference') {\n    field.cardinality = config.cardinality\n  }\n\n  return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  const fields: Record<string, SchemaField> = {}\n\n  for (const [name, config] of Object.entries(allFields)) {\n    // Skip internal fields\n    if (name.startsWith('_')) continue\n    fields[name] = toSchemaField(config)\n  }\n\n  return {\n    name: entity.name,\n    pluralName: `${entity.name}s`,\n    fields,\n  }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n  entities: Entity[],\n  checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n  const visible = entities.filter((e) => checkPermission(e.name))\n  return {\n    entities: visible.map(toSchemaEntity),\n  }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n *   entities: [Article, Page],\n *   loadPermissions: async () => {\n *     const roles = await loadRoles(getApp())\n *     return buildPermissionChecker(roles)\n *   },\n *   cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker } from '@murumets-ee/core'\nimport { getApp } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n  countParamsSchema,\n  escapeLikePattern,\n  listParamsSchema,\n  MAX_LIMIT,\n  parseFieldSelection,\n  singleParamsSchema,\n  validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n  const map = new Map<string, Entity>()\n  for (const entity of entities) {\n    map.set(entity.name, entity)\n    map.set(`${entity.name}s`, entity)\n  }\n  return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n  if (!table) return undefined\n\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  for (const [fieldName, config] of Object.entries(allFields)) {\n    if (config.type === 'text' && (config.indexed || config.required)) {\n      const column = table[fieldName]\n      if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n    }\n  }\n  return undefined\n}\n\nfunction buildOrderBy(\n  entityName: string,\n  sortParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n  if (!sortParam) return undefined\n\n  const descending = sortParam.startsWith('-')\n  const fieldName = descending ? sortParam.slice(1) : sortParam\n\n  const fieldConfig = allFields[fieldName]\n  if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table || !table[fieldName]) return undefined\n\n  return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n  entityName: string,\n  url: URL,\n  allFields: Record<string, FieldConfig>,\n): SQL[] {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table) return []\n\n  const conditions: SQL[] = []\n\n  for (const [key, raw] of url.searchParams.entries()) {\n    const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n    if (!match) continue\n\n    const fieldName = match[1]\n    const fieldConfig = allFields[fieldName]\n    if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n    const column = table[fieldName]\n    if (!column) continue\n\n    // Date range filters: gte: / lte: prefix\n    if (fieldConfig.type === 'date') {\n      if (raw.startsWith('gte:')) {\n        conditions.push(gte(column, raw.slice(4)))\n      } else if (raw.startsWith('lte:')) {\n        conditions.push(lte(column, raw.slice(4)))\n      } else {\n        conditions.push(eq(column, raw))\n      }\n      continue\n    }\n\n    const validated = validateFilterValue(fieldConfig, raw)\n    if (validated === null) continue\n    conditions.push(eq(column, validated))\n  }\n\n  return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n  const {\n    entities,\n    defaultLocale,\n    publicRole = 'public',\n    cors: corsConfig,\n    cache: cacheConfig,\n    onError,\n  } = config\n  const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n  const entityMap = buildEntityMap(entities)\n\n  // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n  const countCache = new CountCache(5000)\n\n  // Lazy-loaded permission checker — cached with 30s TTL\n  const PERMISSION_CACHE_TTL_MS = 30_000\n  let permissionChecker: PermissionChecker | null = null\n  let permissionCacheTime = 0\n\n  async function getChecker(): Promise<PermissionChecker> {\n    const now = Date.now()\n    if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n      permissionChecker = await config.loadPermissions()\n      permissionCacheTime = now\n    }\n    return permissionChecker\n  }\n\n  // -- Role resolution -------------------------------------------------------\n\n  async function resolveRole(req: Request): Promise<string> {\n    if (!config.authenticate) return publicRole\n    try {\n      const result = await config.authenticate(req)\n      return result?.role ?? publicRole\n    } catch {\n      return publicRole\n    }\n  }\n\n  // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n  function hasViewPermission(\n    checker: PermissionChecker,\n    role: string,\n    entityName: string,\n  ): boolean {\n    return checker(role, entityName, 'view')\n  }\n\n  // -- Create QueryClient from entity ----------------------------------------\n\n  function createClient(entity: Entity): QueryClient {\n    const app = getApp()\n    return new QueryClient({\n      entity,\n      db: app.db.readOnly,\n      logger: app.logger.child({ entity: entity.name }),\n      countCache,\n    })\n  }\n\n  // -- Endpoint handlers -----------------------------------------------------\n\n  async function handleList(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const {\n      limit: rawLimit,\n      offset,\n      sort,\n      locale,\n      fields,\n      search,\n      cursor: cursorParam,\n    } = params.data\n    const limit = Math.min(rawLimit, maxLimit)\n    const allFields = entity.allFields as Record<string, FieldConfig>\n\n    // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n    let cursor: CursorInput | undefined\n    if (cursorParam) {\n      const decoded = decodeCursor(cursorParam)\n      if (!decoded) {\n        return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      // Whitelist: cursor field must be a real field on the entity\n      if (!(decoded.field in allFields) && decoded.field !== 'id') {\n        return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      cursor = decoded\n    }\n\n    const where: SQL[] = []\n    if (search) {\n      const searchCondition = buildSearchCondition(entity, search)\n      if (searchCondition) where.push(searchCondition)\n    }\n\n    const filterConditions = buildFilterConditions(entity.name, url, allFields)\n    where.push(...filterConditions)\n\n    const orderBy = buildOrderBy(entity.name, sort, allFields)\n    const select = parseFieldSelection(fields, allFields)\n\n    const client = createClient(entity)\n    const resolvedLocale = locale ?? defaultLocale\n    const queryOpts = {\n      where: where.length > 0 ? and(...where) : undefined,\n      limit,\n      offset,\n      orderBy,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n      cursor,\n    }\n\n    const [items, total] = await Promise.all([\n      client.findMany(queryOpts),\n      client.count({ where: where.length > 0 ? and(...where) : undefined }),\n    ])\n\n    // Build nextCursor from last item for keyset pagination\n    let nextCursor: string | undefined\n    if (items.length > 0 && items.length === limit) {\n      const lastItem = items[items.length - 1] as Record<string, unknown>\n      // Derive sort field and direction from cursor or sort param\n      const cursorField =\n        cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n      const cursorDirection: 'asc' | 'desc' =\n        cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n      if (cursorField && lastItem[cursorField] !== undefined) {\n        nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n      }\n    }\n\n    const headers = {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    }\n\n    return jsonResponse(\n      {\n        data: items,\n        meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n      },\n      200,\n      headers,\n    )\n  }\n\n  async function handleCount(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const countMode = url.searchParams.get('countMode')\n\n    // Fast path: use Postgres row estimate for unfiltered counts\n    if (countMode === 'estimate') {\n      const app = getApp()\n      const count = await estimateRowCount(app.db.readOnly, entity.name)\n      return jsonResponse({ data: { count, estimate: true } }, 200, {\n        ...corsHeaders,\n        ...buildCacheHeaders(entity.name, cacheConfig),\n      })\n    }\n\n    const client = createClient(entity)\n    const count = await client.count()\n\n    return jsonResponse({ data: { count } }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleById(\n    req: Request,\n    entity: Entity,\n    id: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const { locale, fields } = params.data\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const client = createClient(entity)\n    const item = await client.findById(id, {\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n    if (!item) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: item }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleBySlug(\n    req: Request,\n    entity: Entity,\n    slug: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // Check entity has a slug field\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n    const { locale, fields } = params.data\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n    const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n    if (!table?.slug) return notFoundResponse(corsHeaders)\n\n    const client = createClient(entity)\n    const slugConfig = allFields.slug as SlugField\n\n    // For translatable slugs, also search the translation table.\n    // A non-default locale's slug may live in {entity}_translations, not the main table.\n    let whereClause: SQL = eq(table.slug, slug)\n\n    if (slugConfig.translatable && resolvedLocale) {\n      const translationTableName = `${entity.name}_translations`\n      // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n      const translationTable = schemaRegistry.get(translationTableName) as\n        | PgTableWithColumns<any>\n        | undefined\n      if (translationTable?.slug) {\n        // Find entity IDs whose translated slug matches (for the requested locale)\n        const app = getApp()\n        const translationMatches = await app.db.readOnly\n          .select({ entityId: translationTable.entityId })\n          .from(translationTable)\n          .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n        if (translationMatches.length > 0) {\n          const translatedIds = translationMatches.map((r) => r.entityId as string)\n          // Match by translated slug OR by main table slug (fallback)\n          whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n        }\n      }\n    }\n\n    const results = await client.findMany({\n      where: whereClause,\n      limit: 1,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n\n    if (results.length === 0) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: results[0] }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  // -- Central dispatch -------------------------------------------------------\n\n  async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n    const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n    try {\n      const segments = await ctx.params.then((p) => p.path)\n      if (!segments || segments.length === 0) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Resolve role + load permissions\n      const role = await resolveRole(req)\n      const checker = await getChecker()\n\n      // /_schema — entity introspection (filtered by role)\n      if (segments[0] === '_schema') {\n        const schema = buildSchemaResponse(entities, (name) =>\n          hasViewPermission(checker, role, name),\n        )\n        return jsonResponse(schema, 200, {\n          ...corsHeaders,\n          'Cache-Control': 'no-store',\n        })\n      }\n\n      // Resolve entity from whitelist\n      const entityName = segments[0]\n      const entity =\n        entityMap.get(entityName) ??\n        entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n      // Entity not in whitelist OR role lacks view permission → 404\n      if (!entity || !hasViewPermission(checker, role, entity.name)) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Route to handler\n      if (segments.length === 1) {\n        return handleList(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'count') {\n        return handleCount(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'slug' && segments[2]) {\n        return handleBySlug(req, entity, segments[2], corsHeaders)\n      }\n      if (segments.length === 2) {\n        return handleById(req, entity, segments[1], corsHeaders)\n      }\n\n      return notFoundResponse(corsHeaders)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Internal server error'\n      console.error('[content-api] handler error:', err)\n      onError?.({\n        status: 500,\n        message,\n        path: new URL(req.url).pathname,\n      })\n      return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n    }\n  }\n\n  return {\n    GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n    OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n  }\n}\n"],"mappings":"sYASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CCnBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACd,CAAC,CAGF,SAAgB,EAAkB,EAAmB,CACnD,OAAO,EAAE,QAAQ,UAAW,OAAO,CAGrC,MAAM,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OACrB,GAAS,KAAQ,GAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAU,GAAM,OAAS,SAClF,CAOD,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GCrGpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAClB,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACD,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAGlC,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GACtB,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,OAC7B,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@murumets-ee/content-api",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
     }
   },
   "files": [
@@ -15,18 +15,18 @@
   "dependencies": {
     "drizzle-orm": "^0.45.1",
     "zod": "^3.24.1",
-    "@murumets-ee/core": "0.1.5",
-    "@murumets-ee/entity": "0.1.4",
-    "@murumets-ee/db": "0.1.4"
+    "@murumets-ee/db": "0.1.5",
+    "@murumets-ee/entity": "0.1.5",
+    "@murumets-ee/core": "0.1.6"
   },
   "devDependencies": {
-    "tsup": "^8.3.5",
+    "tsdown": "^0.21.7",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8"
   },
   "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
+    "build": "tsdown",
+    "dev": "tsdown --watch",
     "test": "vitest"
   }
 }

package/dist/index.d.ts

@@ -1,179 +0,0 @@
-import { PermissionChecker } from '@murumets-ee/core';
-import { Entity } from '@murumets-ee/entity';
-
-/**
- * Content API — Public types
- *
- * All configuration, request, and response types for the read-only content API.
- */
-
-/** CORS configuration — deny-by-default, explicit origin allowlist. */
-interface CorsConfig {
-    /** Allowed origins. Each matched exactly — no regex, no wildcards. */
-    allowedOrigins: string[];
-    /** Preflight cache max age (seconds). Default: 3600 */
-    maxAge?: number;
-}
-/** Per-entity cache override. */
-interface EntityCacheConfig {
-    /** Cache-Control max-age in seconds. */
-    maxAge?: number;
-    /** stale-while-revalidate window in seconds. */
-    staleWhileRevalidate?: number;
-    /** Whether this entity is cacheable. Default: true. Set false → no-store. */
-    cacheable?: boolean;
-}
-/** Global cache configuration. */
-interface CacheConfig {
-    /** Default max-age for all entities (seconds). Default: 60 */
-    defaultMaxAge?: number;
-    /** Default stale-while-revalidate (seconds). Default: 300 */
-    defaultStaleWhileRevalidate?: number;
-    /** Per-entity overrides, keyed by entity name. */
-    entities?: Record<string, EntityCacheConfig>;
-}
-/** Content API handler configuration. */
-interface ContentApiConfig {
-    /** Entity whitelist — ONLY these entities are queryable. Deny-by-default. */
-    entities: Entity[];
-    /**
-     * Permission checker — REQUIRED. Same pattern as admin API handler.
-     * Called lazily on first request, result cached with 30s TTL.
-     * Checks: `checker(role, entityName, 'view')` → boolean.
-     */
-    loadPermissions: () => Promise<PermissionChecker>;
-    /**
-     * Optional auth. Returns user role, or null for anonymous.
-     * When null or not provided → uses `publicRole`.
-     *
-     * Enables preview mode (e.g. bearer token → editor sees more entities).
-     */
-    authenticate?: (req: Request) => Promise<{
-        role: string;
-    } | null>;
-    /**
-     * Role for unauthenticated requests. Default: `'public'`.
-     * Must have explicit 'view' permission per entity to see anything.
-     */
-    publicRole?: string;
-    /** Default content locale for translation merging. */
-    defaultLocale?: string;
-    /** CORS configuration. Required when serving cross-origin. */
-    cors?: CorsConfig;
-    /** Cache-Control header configuration. */
-    cache?: CacheConfig;
-    /** Max pagination limit. Default: 100. Hard-capped at 100. */
-    maxLimit?: number;
-    /** Error hook for monitoring/logging. Errors are fire-and-forget. */
-    onError?: (err: {
-        status: number;
-        message: string;
-        entity?: string;
-        path: string;
-    }) => void;
-}
-interface ContentListResponse<T = Record<string, unknown>> {
-    data: T[];
-    meta: {
-        total: number;
-        limit: number;
-        offset: number;
-        hasMore: boolean;
-        /** Opaque cursor for fetching the next page via keyset pagination. */
-        nextCursor?: string;
-    };
-}
-interface ContentSingleResponse<T = Record<string, unknown>> {
-    data: T;
-}
-interface ContentCountResponse {
-    data: {
-        count: number;
-    };
-}
-interface ContentErrorResponse {
-    error: {
-        status: number;
-        message: string;
-        code: string;
-    };
-}
-/** Field metadata exposed by /_schema (public-safe subset of FieldConfig). */
-interface SchemaField {
-    type: string;
-    required?: boolean;
-    options?: readonly string[];
-    cardinality?: 'one' | 'many';
-}
-/** Entity metadata exposed by /_schema. */
-interface SchemaEntity {
-    name: string;
-    pluralName: string;
-    fields: Record<string, SchemaField>;
-}
-/** Full /_schema response. */
-interface SchemaResponse {
-    entities: SchemaEntity[];
-}
-/** Next.js catch-all route context shape. */
-interface RouteContext {
-    params: Promise<{
-        path: string[];
-    }>;
-}
-
-/**
- * Content API handler factory
- *
- * Creates a read-only catch-all route handler for public content delivery.
- * Mirrors the `createAdminApiHandler` pattern but with:
- * - No mutations (GET + OPTIONS only)
- * - Permission-gated (public role starts with 0 permissions)
- * - Published content only (QueryClient auto-filters)
- * - CORS + Cache-Control headers
- *
- * @example
- * ```typescript
- * // app/api/content/[...path]/route.ts
- * import { createContentApiHandler } from '@murumets-ee/content-api'
- * import { Article, Page } from '@/entities'
- *
- * const handler = createContentApiHandler({
- *   entities: [Article, Page],
- *   loadPermissions: async () => {
- *     const roles = await loadRoles(getApp())
- *     return buildPermissionChecker(roles)
- *   },
- *   cors: { allowedOrigins: ['https://www.example.com'] },
- * })
- *
- * export const { GET, OPTIONS } = handler
- * ```
- */
-
-declare function createContentApiHandler(config: ContentApiConfig): {
-    GET: (req: Request, ctx: RouteContext) => Promise<Response>;
-    OPTIONS: (req: Request) => Response;
-};
-
-/**
- * Schema introspection endpoint — GET /_schema
- *
- * Returns public-safe entity metadata for SDK generation.
- * Only exposes: type, required, options (select), cardinality (reference).
- * Internal fields (_version, _scopeId) excluded.
- * No hooks, behaviors, access rules, or implementation details.
- *
- * Response is filtered by the caller's role permissions — only entities
- * the role can 'view' are included.
- */
-
-/** Convert an Entity to public-safe schema metadata. */
-declare function toSchemaEntity(entity: Entity): SchemaEntity;
-/**
- * Build the full /_schema response.
- * Only includes entities that pass the permission check.
- */
-declare function buildSchemaResponse(entities: Entity[], checkPermission: (entityName: string) => boolean): SchemaResponse;
-
-export { type CacheConfig, type ContentApiConfig, type ContentCountResponse, type ContentErrorResponse, type ContentListResponse, type ContentSingleResponse, type CorsConfig, type EntityCacheConfig, type RouteContext, type SchemaEntity, type SchemaField, type SchemaResponse, buildSchemaResponse, createContentApiHandler, toSchemaEntity };

package/dist/index.js

@@ -1 +0,0 @@
-import {getApp}from'@murumets-ee/core';import {schemaRegistry}from'@murumets-ee/db';import {CountCache,decodeCursor,encodeCursor,estimateRowCount}from'@murumets-ee/entity';import {QueryClient}from'@murumets-ee/entity/query';import {and,eq,or,inArray,ilike,gte,lte,desc,asc}from'drizzle-orm';import {z}from'zod';function v(t,e){let n=e?.entities?.[t];if(n?.cacheable===false)return {"Cache-Control":"no-store"};let o=n?.maxAge??e?.defaultMaxAge??60,c=n?.staleWhileRevalidate??e?.defaultStaleWhileRevalidate??300;return {"Cache-Control":`public, max-age=${o}, stale-while-revalidate=${c}`}}function B(t,e){if(!e)return {};let n=t.headers.get("Origin");return n?e.allowedOrigins.includes(n)?{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":"GET, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Accept, Authorization","Access-Control-Max-Age":String(e.maxAge??3600),Vary:"Origin"}:{}:{}}function ne(t,e){let n=B(t,e);return new Response(null,{status:204,headers:n})}var $=100,re=z.object({limit:z.coerce.number().int().min(1).max($).default(20),offset:z.coerce.number().int().min(0).default(0),sort:z.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:z.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:z.string().optional(),search:z.string().max(200).optional(),cursor:z.string().max(500).optional()}),Z=z.object({locale:z.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:z.string().optional()}),se=z.object({locale:z.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional()});function ie(t){return t.replace(/[%_\\]/g,"\\$&")}var Ce=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function oe(t,e){switch(t.type){case "boolean":return e==="true"?true:e==="false"?false:null;case "reference":case "media":return Ce.test(e)?e:null;case "select":return t.options.includes(e)?e:null;case "date":return e;case "text":case "number":return e;default:return null}}function D(t,e){if(!t)return;let o=t.split(",").map(c=>c.trim()).filter(c=>c in e&&!c.startsWith("_")&&e[c].type!=="blocks");return o.length>0&&!o.includes("id")&&o.unshift("id"),o.length>0?o:void 0}function E(t,e=200,n){return new Response(JSON.stringify(t),{status:e,headers:{"Content-Type":"application/json",...n}})}function S(t,e,n,o){return E({error:{status:n,message:t,code:e}},n,o)}function P(t){return S("Not found","NOT_FOUND",404,t)}function Re(t){let e={type:t.type};return t.required&&(e.required=true),t.type==="select"&&(e.options=t.options),t.type==="reference"&&(e.cardinality=t.cardinality),e}function ae(t){let e=t.allFields,n={};for(let[o,c]of Object.entries(e))o.startsWith("_")||(n[o]=Re(c));return {name:t.name,pluralName:`${t.name}s`,fields:n}}function G(t,e){return {entities:t.filter(o=>e(o.name)).map(ae)}}function Te(t){let e=new Map;for(let n of t)e.set(n.name,n),e.set(`${n.name}s`,n);return e}function ve(t,e){let n=schemaRegistry.get(t.name);if(!n)return;let o=t.allFields;for(let[c,f]of Object.entries(o))if(f.type==="text"&&(f.indexed||f.required)){let u=n[c];if(u)return ilike(u,`%${ie(e)}%`)}}function Me(t,e,n){if(!e)return;let o=e.startsWith("-"),c=o?e.slice(1):e,f=n[c];if(!f||f.type==="blocks")return;let u=schemaRegistry.get(t);if(!(!u||!u[c]))return o?desc(u[c]):asc(u[c])}function Ne(t,e,n){let o=schemaRegistry.get(t);if(!o)return [];let c=[];for(let[f,u]of e.searchParams.entries()){let W=f.match(/^filter\[([a-zA-Z_]+)\]$/);if(!W)continue;let N=W[1],O=n[N];if(!O||O.type==="blocks")continue;let F=o[N];if(!F)continue;if(O.type==="date"){u.startsWith("gte:")?c.push(gte(F,u.slice(4))):u.startsWith("lte:")?c.push(lte(F,u.slice(4))):c.push(eq(F,u));continue}let L=oe(O,u);L!==null&&c.push(eq(F,L));}return c}function _e(t){let{entities:e,defaultLocale:n,publicRole:o="public",cors:c,cache:f,onError:u}=t,W=Math.min(t.maxLimit??$,$),N=Te(e),O=new CountCache(5e3),F=3e4,L=null,K=0;async function ce(){let i=Date.now();return (!L||i-K>F)&&(L=await t.loadPermissions(),K=i),L}async function le(i){if(!t.authenticate)return o;try{return (await t.authenticate(i))?.role??o}catch{return o}}function Y(i,r,a){return i(r,a,"view")}function q(i){let r=getApp();return new QueryClient({entity:i,db:r.db.readOnly,logger:r.logger.child({entity:i.name}),countCache:O})}async function ue(i,r,a){let s=new URL(i.url),p=re.safeParse(Object.fromEntries(s.searchParams));if(!p.success)return S("Invalid query parameters","VALIDATION_ERROR",400,a);let{limit:g,offset:d,sort:l,locale:h,fields:R,search:x,cursor:A}=p.data,y=Math.min(g,W),T=r.allFields,I;if(A){let C=decodeCursor(A);if(!C)return S("Invalid cursor","VALIDATION_ERROR",400,a);if(!(C.field in T)&&C.field!=="id")return S("Invalid cursor field","VALIDATION_ERROR",400,a);I=C;}let b=[];if(x){let C=ve(r,x);C&&b.push(C);}let V=Ne(r.name,s,T);b.push(...V);let w=Me(r.name,l,T),H=D(R,T),_=q(r),z=h??n,Q={where:b.length>0?and(...b):void 0,limit:y,offset:d,orderBy:w,select:H,locale:z,defaultLocale:n,cursor:I},[j,ee]=await Promise.all([_.findMany(Q),_.count({where:b.length>0?and(...b):void 0})]),te;if(j.length>0&&j.length===y){let C=j[j.length-1],U=I?.field??(l?l.startsWith("-")?l.slice(1):l:void 0),he=I?.direction??(l?.startsWith("-")?"desc":"asc");U&&C[U]!==void 0&&(te=encodeCursor(C,U,he));}let ge={...a,...v(r.name,f)};return E({data:j,meta:{total:ee,limit:y,offset:d,hasMore:d+y<ee,nextCursor:te}},200,ge)}async function de(i,r,a){let s=new URL(i.url);if(!se.safeParse(Object.fromEntries(s.searchParams)).success)return S("Invalid query parameters","VALIDATION_ERROR",400,a);if(s.searchParams.get("countMode")==="estimate"){let h=getApp(),R=await estimateRowCount(h.db.readOnly,r.name);return E({data:{count:R,estimate:true}},200,{...a,...v(r.name,f)})}let l=await q(r).count();return E({data:{count:l}},200,{...a,...v(r.name,f)})}async function fe(i,r,a,s){let p=new URL(i.url),g=Z.safeParse(Object.fromEntries(p.searchParams));if(!g.success)return S("Invalid query parameters","VALIDATION_ERROR",400,s);let{locale:d,fields:l}=g.data,h=r.allFields,R=D(l,h),x=d??n,y=await q(r).findById(a,{select:R,locale:x,defaultLocale:n});return y?E({data:y},200,{...s,...v(r.name,f)}):P(s)}async function me(i,r,a,s){let p=new URL(i.url),g=Z.safeParse(Object.fromEntries(p.searchParams));if(!g.success)return S("Invalid query parameters","VALIDATION_ERROR",400,s);let d=r.allFields;if(!d.slug)return P(s);let{locale:l,fields:h}=g.data,R=D(h,d),x=l??n,A=schemaRegistry.get(r.name);if(!A?.slug)return P(s);let y=q(r),T=d.slug,I=eq(A.slug,a);if(T.translatable&&x){let V=`${r.name}_translations`,w=schemaRegistry.get(V);if(w?.slug){let _=await getApp().db.readOnly.select({entityId:w.entityId}).from(w).where(and(eq(w.slug,a),eq(w.locale,x)));if(_.length>0){let z=_.map(Q=>Q.entityId);I=or(inArray(A.id,z),eq(A.slug,a));}}}let b=await y.findMany({where:I,limit:1,select:R,locale:x,defaultLocale:n});return b.length===0?P(s):E({data:b[0]},200,{...s,...v(r.name,f)})}async function pe(i,r){let a=B(i,c);try{let s=await r.params.then(h=>h.path);if(!s||s.length===0)return P(a);let p=await le(i),g=await ce();if(s[0]==="_schema"){let h=G(e,R=>Y(g,p,R));return E(h,200,{...a,"Cache-Control":"no-store"})}let d=s[0],l=N.get(d)??N.get(d.endsWith("s")?d.slice(0,-1):d);return !l||!Y(g,p,l.name)?P(a):s.length===1?ue(i,l,a):s[1]==="count"?de(i,l,a):s[1]==="slug"&&s[2]?me(i,l,s[2],a):s.length===2?fe(i,l,s[1],a):P(a)}catch(s){let p=s instanceof Error?s.message:"Internal server error";return console.error("[content-api] handler error:",s),u?.({status:500,message:p,path:new URL(i.url).pathname}),S("Internal server error","INTERNAL_ERROR",500,a)}}return {GET:(i,r)=>pe(i,r),OPTIONS:i=>ne(i,c)}}export{G as buildSchemaResponse,_e as createContentApiHandler,ae as toSchemaEntity};