@murumets-ee/content-api 0.11.0 → 0.12.0

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { PermissionChecker } from "@murumets-ee/core";
+import { PermissionChecker, RouteContext } from "@murumets-ee/core";
 import { Entity } from "@murumets-ee/entity";
 
 //#region src/types.d.ts
@@ -35,6 +35,9 @@ interface ContentApiConfig {
    * Permission checker — REQUIRED. Same pattern as admin API handler.
    * Called lazily on first request, result cached with 30s TTL.
    * Checks: `checker(role, entityName, 'view')` → boolean.
+   *
+   * To force a reload after a role change, call
+   * `handler.invalidatePermissionCache()` from your role-management code path.
    */
   loadPermissions: () => Promise<PermissionChecker>;
   /**
@@ -42,6 +45,9 @@ interface ContentApiConfig {
    * When null or not provided → uses `publicRole`.
    *
    * Enables preview mode (e.g. bearer token → editor sees more entities).
+   * **Authenticated responses are forced to `Cache-Control: no-store`** so a
+   * shared CDN cannot serve an editor's response to a subsequent anonymous
+   * visitor.
    */
   authenticate?: (req: Request) => Promise<{
     role: string;
@@ -55,7 +61,7 @@ interface ContentApiConfig {
   defaultLocale?: string;
   /** CORS configuration. Required when serving cross-origin. */
   cors?: CorsConfig;
-  /** Cache-Control header configuration. */
+  /** Cache-Control header configuration (only applied to public-role responses). */
   cache?: CacheConfig;
   /** Max pagination limit. Default: 100. Hard-capped at 100. */
   maxLimit?: number;
@@ -67,69 +73,19 @@ interface ContentApiConfig {
     path: string;
   }) => void;
 }
-interface ContentListResponse<T = Record<string, unknown>> {
-  data: T[];
-  meta: {
-    total: number;
-    limit: number;
-    offset: number;
-    hasMore: boolean; /** Opaque cursor for fetching the next page via keyset pagination. */
-    nextCursor?: string;
-  };
-}
-interface ContentSingleResponse<T = Record<string, unknown>> {
-  data: T;
-}
-interface ContentCountResponse {
-  data: {
-    count: number;
-  };
-}
-interface ContentErrorResponse {
-  error: {
-    status: number;
-    message: string;
-    code: string;
-  };
-}
-/** Field metadata exposed by /_schema (public-safe subset of FieldConfig). */
-interface SchemaField {
-  type: string;
-  required?: boolean;
-  options?: readonly string[];
-  cardinality?: 'one' | 'many';
-}
-/** Entity metadata exposed by /_schema. */
-interface SchemaEntity {
-  name: string;
-  pluralName: string;
-  fields: Record<string, SchemaField>;
-}
-/** Full /_schema response. */
-interface SchemaResponse {
-  entities: SchemaEntity[];
-}
-/** Next.js catch-all route context shape. */
-interface RouteContext {
-  params: Promise<{
-    path: string[];
-  }>;
-}
 //#endregion
 //#region src/handler.d.ts
 declare function createContentApiHandler(config: ContentApiConfig): {
   GET: (req: Request, ctx: RouteContext) => Promise<Response>;
   OPTIONS: (req: Request) => Response;
+  /**
+   * Invalidate the cached permission checker. Call this from the
+   * role-management code path (after a role is created/edited/deleted)
+   * so the next request re-runs `loadPermissions()` instead of waiting
+   * up to 30 seconds for the TTL to expire.
+   */
+  invalidatePermissionCache: () => void;
 };
 //#endregion
-//#region src/schema-endpoint.d.ts
-/** Convert an Entity to public-safe schema metadata. */
-declare function toSchemaEntity(entity: Entity): SchemaEntity;
-/**
- * Build the full /_schema response.
- * Only includes entities that pass the permission check.
- */
-declare function buildSchemaResponse(entities: Entity[], checkPermission: (entityName: string) => boolean): SchemaResponse;
-//#endregion
-export { type CacheConfig, type ContentApiConfig, type ContentCountResponse, type ContentErrorResponse, type ContentListResponse, type ContentSingleResponse, type CorsConfig, type EntityCacheConfig, type RouteContext, type SchemaEntity, type SchemaField, type SchemaResponse, buildSchemaResponse, createContentApiHandler, toSchemaEntity };
+export { type ContentApiConfig, createContentApiHandler };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCFJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAmXjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBCxeV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts"],"mappings":";;;;;UAkBiB,UAAA;EAcf;EAZA,cAAA;EAgBA;EAdA,MAAA;AAAA;AAkBF;AAAA,UAViB,iBAAA;;EAEf,MAAA;EAUA;EARA,oBAAA;EAYA;EAVA,SAAA;AAAA;;UAIe,WAAA;EAcA;EAZf,aAAA;;EAEA,2BAAA;EAsB+B;EApB/B,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EAsCP;EApCR,QAAA,EAAU,MAAA;EAoCS;;;;;;;;EA1BnB,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAWE;;;;;;;;;EAAjC,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAqBQ;;;;EAfnD,UAAA;;EAGA,aAAA;;EAGA,IAAA,GAAO,UAAA;ECmG8B;EDhGrC,KAAA,GAAQ,WAAA;ECgGsC;ED7F9C,QAAA;ECif2B;ED9e3B,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;;;iBC0FtD,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAoZjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;ED/gBO"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import{LOCALE_PATTERN as e,escapeLikePattern as t,getApp as n,getContext as r,runWithContextAsync as i}from"@murumets-ee/core";import{schemaRegistry as a}from"@murumets-ee/db";import{CountCache as o,decodeCursor as s,encodeCursor as c,estimateRowCount as l}from"@murumets-ee/entity";import{QueryClient as u}from"@murumets-ee/entity/query";import{and as d,asc as f,desc as p,eq as m,gte as h,ilike as g,inArray as _,lte as v,or as y}from"drizzle-orm";import{z as b}from"zod";function x(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function S(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function C(e,t){let n=S(e,t);return new Response(null,{status:204,headers:n})}const w=b.object({limit:b.coerce.number().int().min(1).max(100).default(20),offset:b.coerce.number().int().min(0).default(0),sort:b.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:b.string().regex(e).optional(),fields:b.string().optional(),search:b.string().max(200).optional(),cursor:b.string().max(500).optional()}),T=b.object({locale:b.string().regex(e).optional(),fields:b.string().optional()}),E=b.object({locale:b.string().regex(e).optional()}),D=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function O(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return D.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function k(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>{let n=t[e];return n!==void 0&&!e.startsWith(`_`)&&n.type!==`blocks`});return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function A(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function j(e,t,n,r){return A({error:{status:n,message:e,code:t}},n,r)}function M(e){return j(`Not found`,`NOT_FOUND`,404,e)}function N(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function P(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=N(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function F(e,t){return{entities:e.filter(e=>t(e.name)).map(P)}}function I(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function L(e,n){let r=a.get(e.name);if(!r)return;let i=e.allFields;for(let[e,a]of Object.entries(i))if(a.type===`text`&&(a.indexed||a.required)){let i=r[e];if(i)return g(i,`%${t(n)}%`)}}function R(e,t,n){if(!t)return;let r=t.startsWith(`-`),i=r?t.slice(1):t,o=n[i];if(!o||o.type===`blocks`)return;let s=a.get(e);if(!(!s||!s[i]))return r?p(s[i]):f(s[i])}function z(e,t,n){let r=a.get(e);if(!r)return[];let i=[];for(let[e,a]of t.searchParams.entries()){let t=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!t)continue;let o=t[1];if(o===void 0)continue;let s=n[o];if(!s||s.type===`blocks`)continue;let c=r[o];if(!c)continue;if(s.type===`date`){a.startsWith(`gte:`)?i.push(h(c,a.slice(4))):a.startsWith(`lte:`)?i.push(v(c,a.slice(4))):i.push(m(c,a));continue}let l=O(s,a);l!==null&&i.push(m(c,l))}return i}function B(e){let{entities:t,defaultLocale:f,publicRole:p=`public`,cors:h,cache:g,onError:v}=e,b=Math.min(e.maxLimit??100,100),D=I(t),O=new o(5e3),N=null,P=0;async function B(){let t=Date.now();return(!N||t-P>3e4)&&(N=await e.loadPermissions(),P=t),N}async function V(t){if(!e.authenticate)return p;try{return(await e.authenticate(t))?.role??p}catch{return p}}function H(e,t,n){return e(t,n,`view`)}function U(e){let t=n();return new u({entity:e,db:t.db.readOnly,logger:t.logger.child({entity:e.name}),countCache:O,contextResolver:()=>{let e=r();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,scope:e.scope}}})}async function W(e,t,n){let r=new URL(e.url),i=w.safeParse(Object.fromEntries(r.searchParams));if(!i.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:a,offset:o,sort:l,locale:u,fields:p,search:m,cursor:h}=i.data,_=Math.min(a,b),v=t.allFields,y;if(h){let e=s(h);if(!e)return j(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in v)&&e.field!==`id`)return j(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);y=e}let S=[];if(m){let e=L(t,m);e&&S.push(e)}let C=z(t.name,r,v);S.push(...C);let T=R(t.name,l,v),E=k(p,v),D=U(t),O=u??f,M={where:S.length>0?d(...S):void 0,limit:_,offset:o,orderBy:T,select:E,locale:O,defaultLocale:f,cursor:y},[N,P]=await Promise.all([D.findMany(M),D.count({where:S.length>0?d(...S):void 0})]),F;if(N.length>0&&N.length===_){let e=N[N.length-1],t=y?.field??(l?l.startsWith(`-`)?l.slice(1):l:void 0),n=y?.direction??(l?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(F=c(e,t,n))}let I={...n,...x(t.name,g)};return A({data:N,meta:{total:P,limit:_,offset:o,hasMore:o+_<P,nextCursor:F}},200,I)}async function G(e,t,r){let i=new URL(e.url);return E.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?A({data:{count:await l(n().db.readOnly,t.name),estimate:!0}},200,{...r,...x(t.name,g)}):A({data:{count:await U(t).count()}},200,{...r,...x(t.name,g)}):j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function K(e,t,n,r){let i=new URL(e.url),a=T.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=k(s,c),u=o??f,d=await U(t).findById(n,{select:l,locale:u,defaultLocale:f});return d?A({data:d},200,{...r,...x(t.name,g)}):M(r)}async function q(e,t,r,i){let o=new URL(e.url),s=T.safeParse(Object.fromEntries(o.searchParams));if(!s.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,i);let c=t.allFields;if(!c.slug)return M(i);let{locale:l,fields:u}=s.data,p=k(u,c),h=l??f,v=a.get(t.name);if(!v?.slug)return M(i);let b=U(t),S=c.slug,C=m(v.slug,r);if(S.translatable&&h){let e=`${t.name}_translations`,i=a.get(e);if(i?.slug){let e=await n().db.readOnly.select({entityId:i.entityId}).from(i).where(d(m(i.slug,r),m(i.locale,h)));if(e.length>0){let t=e.map(e=>e.entityId);C=y(_(v.id,t),m(v.slug,r))}}}let w=await b.findMany({where:C,limit:1,select:p,locale:h,defaultLocale:f});return w.length===0?M(i):A({data:w[0]},200,{...i,...x(t.name,g)})}async function J(e,n){let r=S(e,h);try{let a=await n.params.then(e=>e.path);if(!a||a.length===0)return M(r);let o=await V(e),s=await B();return await i({user:{id:`public`,groups:o?[o]:[]},checker:s},async()=>{if(a[0]===`_schema`)return A(F(t,e=>H(s,o,e)),200,{...r,"Cache-Control":`no-store`});let n=a[0];if(n===void 0)return M(r);let i=D.get(n)??D.get(n.endsWith(`s`)?n.slice(0,-1):n);return!i||!H(s,o,i.name)?M(r):a.length===1?W(e,i,r):a[1]===`count`?G(e,i,r):a[1]===`slug`&&a[2]?q(e,i,a[2],r):a.length===2&&a[1]!==void 0?K(e,i,a[1],r):M(r)})}catch(t){let n=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),v?.({status:500,message:n,path:new URL(e.url).pathname}),j(`Internal server error`,`INTERNAL_ERROR`,500,r)}}return{GET:(e,t)=>J(e,t),OPTIONS:e=>C(e,h)}}export{F as buildSchemaResponse,B as createContentApiHandler,P as toSchemaEntity};
+import{LOCALE_PATTERN as e,escapeLikePattern as t,getApp as n,getContext as r,runWithContextAsync as i}from"@murumets-ee/core";import{schemaRegistry as a}from"@murumets-ee/db";import{CountCache as o,decodeCursor as s,encodeCursor as c}from"@murumets-ee/entity";import{QueryClient as l}from"@murumets-ee/entity/query";import{and as u,asc as d,desc as f,eq as p,getTableColumns as m,gte as h,ilike as g,inArray as _,lte as v,or as y}from"drizzle-orm";import{z as b}from"zod";function x(e,t){let n=t?.entities?.[e];return n?.cacheable===!1?{"Cache-Control":`no-store`}:{"Cache-Control":`public, max-age=${n?.maxAge??t?.defaultMaxAge??60}, stale-while-revalidate=${n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300}`}}function S(e,t,n,r,i){if(n!==r){let e=t.Vary,n=`Cookie, Authorization`;return{...t,"Cache-Control":`no-store`,Vary:e?`${e}, ${n}`:n}}return{...t,...x(e,i)}}function C(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function w(e,t){let n=C(e,t);return new Response(null,{status:204,headers:n})}const T=b.object({limit:b.coerce.number().int().min(1).max(100).default(20),offset:b.coerce.number().int().min(0).default(0),sort:b.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:b.string().regex(e).optional(),fields:b.string().optional(),search:b.string().max(200).optional(),cursor:b.string().max(500).optional()}),E=b.object({locale:b.string().regex(e).optional(),fields:b.string().optional()}),D=b.object({locale:b.string().regex(e).optional()}),O=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,k=/^\d{4}-\d{2}-\d{2}(?:[Tt ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:[Zz]|[+-]\d{2}:?\d{2})?)?$/;function A(e){if(!k.test(e))return!1;let t=Date.parse(e);return Number.isNaN(t)?!1:e.length===10?new Date(t).toISOString().slice(0,10)===e:!0}function j(e){if(e.trim()===``)return!1;let t=Number(e);return Number.isFinite(t)}function M(e){return O.test(e)}function N(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return O.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return A(t.startsWith(`gte:`)||t.startsWith(`lte:`)?t.slice(4):t)?t:null;case`number`:return j(t)?Number(t):null;case`text`:return t.length<=200?t:null;default:return null}}function P(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>{let n=t[e];return n!==void 0&&!e.startsWith(`_`)&&n.type!==`blocks`});return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function F(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function I(e,t,n,r){return F({error:{status:n,message:e,code:t}},n,r)}function L(e){return I(`Not found`,`NOT_FOUND`,404,e)}function R(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function z(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=R(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function B(e,t){return{entities:e.filter(e=>t(e.name)).map(z)}}function V(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function H(e){let t=a.get(e);if(t)return{table:t,cols:m(t)}}function U(e,n){let r=H(e.name);if(!r)return;let{cols:i}=r,a=e.allFields;for(let[e,r]of Object.entries(a))if(r.type===`text`&&(r.indexed||r.required)){let r=i[e];if(r)return g(r,`%${t(n)}%`)}}function W(e,t,n){if(!t)return;let r=t.startsWith(`-`),i=r?t.slice(1):t,a=n[i];if(!a||a.type===`blocks`)return;let o=H(e);if(!o)return;let s=o.cols[i];if(s)return r?f(s):d(s)}function G(e,t,n){let r=H(e);if(!r)return[];let{cols:i}=r,a=[];for(let[e,r]of t.searchParams.entries()){let t=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!t)continue;let o=t[1];if(o===void 0||o.startsWith(`_`)||!Object.hasOwn(n,o))continue;let s=n[o];if(!s||s.type===`blocks`)continue;let c=i[o];if(!c)continue;let l=N(s,r);if(l!==null){if(s.type===`date`&&typeof l==`string`){if(l.startsWith(`gte:`)){a.push(h(c,l.slice(4)));continue}if(l.startsWith(`lte:`)){a.push(v(c,l.slice(4)));continue}}a.push(p(c,l))}}return a}function K(e){let{entities:t,defaultLocale:a,publicRole:d=`public`,cors:f,cache:m,onError:h}=e,g=Math.min(e.maxLimit??100,100),v=V(t),b=new o(5e3),x=null,O=0;async function k(){let t=Date.now();return(!x||t-O>3e4)&&(x=await e.loadPermissions(),O=t),x}function A(){x=null,O=0}async function j(t){if(!e.authenticate)return d;try{return(await e.authenticate(t))?.role??d}catch{return d}}function N(e,t,n){return e(t,n,`view`)}function R(e){let t=n();return new l({entity:e,db:t.db.readOnly,logger:t.logger.child({entity:e.name}),countCache:b,contextResolver:()=>{let e=r();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,...e.scope!==void 0&&{scope:e.scope}}}})}async function z(e,t,n,r){let i=new URL(e.url),o=T.safeParse(Object.fromEntries(i.searchParams));if(!o.success)return I(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{limit:l,offset:f,sort:p,locale:h,fields:_,search:v,cursor:y}=o.data,b=Math.min(l,g),x=t.allFields,C;if(y){let e=s(y);if(!e)return I(`Invalid cursor`,`VALIDATION_ERROR`,400,r);if(!Object.hasOwn(x,e.field)&&e.field!==`id`)return I(`Invalid cursor field`,`VALIDATION_ERROR`,400,r);C=e}let w=[];if(v){let e=U(t,v);e&&w.push(e)}let E=G(t.name,i,x);w.push(...E);let D=W(t.name,p,x),O=P(_,x),k=R(t),A=h??a,j={where:w.length>0?u(...w):void 0,limit:b,offset:f,orderBy:D,select:O,locale:A,defaultLocale:a,cursor:C},[M,N]=await Promise.all([k.findMany(j),k.count({where:w.length>0?u(...w):void 0})]),L;if(M.length>0&&M.length===b){let e=M[M.length-1],t=C?.field??(p?p.startsWith(`-`)?p.slice(1):p:void 0),n=C?.direction??(p?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(L=c(e,t,n))}return F({data:M,meta:{total:N,limit:b,offset:f,hasMore:f+b<N,nextCursor:L}},200,S(t.name,r,n,d,m))}async function K(e,t,n,r){let i=new URL(e.url);return D.safeParse(Object.fromEntries(i.searchParams)).success?F({data:{count:await R(t).count()}},200,S(t.name,r,n,d,m)):I(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function q(e,t,n,r,i){if(!M(n))return L(i);let o=new URL(e.url),s=E.safeParse(Object.fromEntries(o.searchParams));if(!s.success)return I(`Invalid query parameters`,`VALIDATION_ERROR`,400,i);let{locale:c,fields:l}=s.data,u=t.allFields,f=P(l,u),p=c??a,h=await R(t).findById(n,{...f!==void 0&&{select:f},...p!==void 0&&{locale:p},defaultLocale:a});return h?F({data:h},200,S(t.name,i,r,d,m)):L(i)}async function J(e,t,r,i,o){let s=new URL(e.url),c=E.safeParse(Object.fromEntries(s.searchParams));if(!c.success)return I(`Invalid query parameters`,`VALIDATION_ERROR`,400,o);let l=t.allFields;if(!l.slug)return L(o);let{locale:f,fields:h}=c.data,g=P(h,l),v=f??a,b=H(t.name);if(!b)return L(o);let x=b.cols.slug,C=b.cols.id;if(!x||!C)return L(o);let w=R(t),T=l.slug,D=p(x,r);if(T.translatable&&v){let e=H(`${t.name}_translations`);if(e){let t=e.cols.slug,i=e.cols.locale,a=e.cols.entityId;if(t&&i&&a){let o=await n().db.readOnly.select({entityId:a}).from(e.table).where(u(p(t,r),p(i,v)));o.length>0&&(D=y(_(C,o.map(e=>e.entityId)),p(x,r))??p(x,r))}}}let O=await w.findMany({where:D,limit:1,select:g,locale:v,defaultLocale:a});return O.length===0?L(o):F({data:O[0]},200,S(t.name,o,i,d,m))}async function Y(e,r){let a=C(e,f);try{let n=await r.params.then(e=>e.path);if(!n||n.length===0)return L(a);let o=await j(e),s=await k();return await i({user:{id:`public`,groups:o?[o]:[]},checker:s},async()=>{if(n[0]===`_schema`)return F(B(t,e=>N(s,o,e)),200,{...a,"Cache-Control":`no-store`});let r=n[0];if(r===void 0)return L(a);let i=v.get(r)??v.get(r.endsWith(`s`)?r.slice(0,-1):r);return!i||!N(s,o,i.name)?L(a):n.length===1?z(e,i,o,a):n[1]===`count`?K(e,i,o,a):n[1]===`slug`&&n[2]?J(e,i,n[2],o,a):n.length===2&&n[1]!==void 0?q(e,i,n[1],o,a):L(a)})}catch(t){let r=t instanceof Error?t.message:`Internal server error`,i=new URL(e.url).pathname;try{n().logger.error({err:t,path:i},`content-api handler error`)}catch{console.error(`[content-api] handler error:`,t)}return h?.({status:500,message:r,path:i}),I(`Internal server error`,`INTERNAL_ERROR`,500,a)}}return{GET:(e,t)=>Y(e,t),OPTIONS:e=>w(e,f),invalidatePermissionCache:A}}export{K as createContentApiHandler};
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n  entityName: string,\n  config: CacheConfig | undefined,\n): Record<string, string> {\n  const entityConfig = config?.entities?.[entityName]\n\n  if (entityConfig?.cacheable === false) {\n    return { 'Cache-Control': 'no-store' }\n  }\n\n  const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n  const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n  return {\n    'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n  }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n  req: Request,\n  config: CorsConfig | undefined,\n): Record<string, string> {\n  if (!config) return {}\n\n  const origin = req.headers.get('Origin')\n  if (!origin) return {}\n\n  // Exact match only\n  if (!config.allowedOrigins.includes(origin)) return {}\n\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n    'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n    Vary: 'Origin',\n  }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n  const headers = buildCorsHeaders(req, config)\n  return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport { escapeLikePattern, LOCALE_PATTERN } from '@murumets-ee/core'\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n  offset: z.coerce.number().int().min(0).default(0),\n  sort: z\n    .string()\n    .regex(/^-?[a-zA-Z_]+$/)\n    .optional(),\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n  search: z.string().max(200).optional(),\n  /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n  cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n})\n\n// Re-export from core so existing imports from this module continue to work\nexport { escapeLikePattern }\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n  switch (fieldConfig.type) {\n    case 'boolean':\n      if (raw === 'true') return true\n      if (raw === 'false') return false\n      return null\n\n    case 'reference':\n    case 'media':\n      return UUID_RE.test(raw) ? raw : null\n\n    case 'select':\n      return fieldConfig.options.includes(raw) ? raw : null\n\n    case 'date':\n      // Plain date or gte:/lte: prefix handled by caller\n      return raw\n\n    case 'text':\n    case 'number':\n      return raw\n\n    default:\n      return null\n  }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n  fieldsParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n  if (!fieldsParam) return undefined\n\n  const requested = fieldsParam.split(',').map((f) => f.trim())\n  const valid = requested.filter((name) => {\n    const config = allFields[name]\n    return config !== undefined && !name.startsWith('_') && config.type !== 'blocks'\n  })\n\n  // Always include id\n  if (valid.length > 0 && !valid.includes('id')) {\n    valid.unshift('id')\n  }\n\n  return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n  data: unknown,\n  status = 200,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      ...extraHeaders,\n    },\n  })\n}\n\nexport function errorResponse(\n  message: string,\n  code: string,\n  status: number,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n  return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n  const field: SchemaField = { type: config.type }\n\n  if (config.required) {\n    field.required = true\n  }\n\n  if (config.type === 'select') {\n    field.options = config.options\n  }\n\n  if (config.type === 'reference') {\n    field.cardinality = config.cardinality\n  }\n\n  return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  const fields: Record<string, SchemaField> = {}\n\n  for (const [name, config] of Object.entries(allFields)) {\n    // Skip internal fields\n    if (name.startsWith('_')) continue\n    fields[name] = toSchemaField(config)\n  }\n\n  return {\n    name: entity.name,\n    pluralName: `${entity.name}s`,\n    fields,\n  }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n  entities: Entity[],\n  checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n  const visible = entities.filter((e) => checkPermission(e.name))\n  return {\n    entities: visible.map(toSchemaEntity),\n  }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n *   entities: [Article, Page],\n *   loadPermissions: async () => {\n *     const roles = await loadRoles(getApp())\n *     return buildPermissionChecker(roles)\n *   },\n *   cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker, RequestContext } from '@murumets-ee/core'\nimport { getApp, getContext, runWithContextAsync } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n  countParamsSchema,\n  escapeLikePattern,\n  listParamsSchema,\n  MAX_LIMIT,\n  parseFieldSelection,\n  singleParamsSchema,\n  validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n  const map = new Map<string, Entity>()\n  for (const entity of entities) {\n    map.set(entity.name, entity)\n    map.set(`${entity.name}s`, entity)\n  }\n  return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n  if (!table) return undefined\n\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  for (const [fieldName, config] of Object.entries(allFields)) {\n    if (config.type === 'text' && (config.indexed || config.required)) {\n      const column = table[fieldName]\n      if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n    }\n  }\n  return undefined\n}\n\nfunction buildOrderBy(\n  entityName: string,\n  sortParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n  if (!sortParam) return undefined\n\n  const descending = sortParam.startsWith('-')\n  const fieldName = descending ? sortParam.slice(1) : sortParam\n\n  const fieldConfig = allFields[fieldName]\n  if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table || !table[fieldName]) return undefined\n\n  return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n  entityName: string,\n  url: URL,\n  allFields: Record<string, FieldConfig>,\n): SQL[] {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table) return []\n\n  const conditions: SQL[] = []\n\n  for (const [key, raw] of url.searchParams.entries()) {\n    const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n    if (!match) continue\n\n    const fieldName = match[1]\n    if (fieldName === undefined) continue\n    const fieldConfig = allFields[fieldName]\n    if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n    const column = table[fieldName]\n    if (!column) continue\n\n    // Date range filters: gte: / lte: prefix\n    if (fieldConfig.type === 'date') {\n      if (raw.startsWith('gte:')) {\n        conditions.push(gte(column, raw.slice(4)))\n      } else if (raw.startsWith('lte:')) {\n        conditions.push(lte(column, raw.slice(4)))\n      } else {\n        conditions.push(eq(column, raw))\n      }\n      continue\n    }\n\n    const validated = validateFilterValue(fieldConfig, raw)\n    if (validated === null) continue\n    conditions.push(eq(column, validated))\n  }\n\n  return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n  const {\n    entities,\n    defaultLocale,\n    publicRole = 'public',\n    cors: corsConfig,\n    cache: cacheConfig,\n    onError,\n  } = config\n  const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n  const entityMap = buildEntityMap(entities)\n\n  // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n  const countCache = new CountCache(5000)\n\n  // Lazy-loaded permission checker — cached with 30s TTL\n  const PERMISSION_CACHE_TTL_MS = 30_000\n  let permissionChecker: PermissionChecker | null = null\n  let permissionCacheTime = 0\n\n  async function getChecker(): Promise<PermissionChecker> {\n    const now = Date.now()\n    if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n      permissionChecker = await config.loadPermissions()\n      permissionCacheTime = now\n    }\n    return permissionChecker\n  }\n\n  // -- Role resolution -------------------------------------------------------\n\n  async function resolveRole(req: Request): Promise<string> {\n    if (!config.authenticate) return publicRole\n    try {\n      const result = await config.authenticate(req)\n      return result?.role ?? publicRole\n    } catch {\n      return publicRole\n    }\n  }\n\n  // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n  function hasViewPermission(\n    checker: PermissionChecker,\n    role: string,\n    entityName: string,\n  ): boolean {\n    return checker(role, entityName, 'view')\n  }\n\n  // -- Create QueryClient from entity ----------------------------------------\n\n  function createClient(entity: Entity): QueryClient {\n    const app = getApp()\n    return new QueryClient({\n      entity,\n      db: app.db.readOnly,\n      logger: app.logger.child({ entity: entity.name }),\n      countCache,\n      contextResolver: () => {\n        const ctx = getContext()\n        if (!ctx?.user || !ctx?.checker) return undefined\n        return { user: ctx.user, checker: ctx.checker, scope: ctx.scope }\n      },\n    })\n  }\n\n  // -- Endpoint handlers -----------------------------------------------------\n\n  async function handleList(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const {\n      limit: rawLimit,\n      offset,\n      sort,\n      locale,\n      fields,\n      search,\n      cursor: cursorParam,\n    } = params.data\n    const limit = Math.min(rawLimit, maxLimit)\n    const allFields = entity.allFields as Record<string, FieldConfig>\n\n    // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n    let cursor: CursorInput | undefined\n    if (cursorParam) {\n      const decoded = decodeCursor(cursorParam)\n      if (!decoded) {\n        return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      // Whitelist: cursor field must be a real field on the entity\n      if (!(decoded.field in allFields) && decoded.field !== 'id') {\n        return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      cursor = decoded\n    }\n\n    const where: SQL[] = []\n    if (search) {\n      const searchCondition = buildSearchCondition(entity, search)\n      if (searchCondition) where.push(searchCondition)\n    }\n\n    const filterConditions = buildFilterConditions(entity.name, url, allFields)\n    where.push(...filterConditions)\n\n    const orderBy = buildOrderBy(entity.name, sort, allFields)\n    const select = parseFieldSelection(fields, allFields)\n\n    const client = createClient(entity)\n    const resolvedLocale = locale ?? defaultLocale\n    const queryOpts = {\n      where: where.length > 0 ? and(...where) : undefined,\n      limit,\n      offset,\n      orderBy,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n      cursor,\n    }\n\n    const [items, total] = await Promise.all([\n      client.findMany(queryOpts),\n      client.count({ where: where.length > 0 ? and(...where) : undefined }),\n    ])\n\n    // Build nextCursor from last item for keyset pagination\n    let nextCursor: string | undefined\n    if (items.length > 0 && items.length === limit) {\n      const lastItem = items[items.length - 1] as Record<string, unknown>\n      // Derive sort field and direction from cursor or sort param\n      const cursorField =\n        cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n      const cursorDirection: 'asc' | 'desc' =\n        cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n      if (cursorField && lastItem[cursorField] !== undefined) {\n        nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n      }\n    }\n\n    const headers = {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    }\n\n    return jsonResponse(\n      {\n        data: items,\n        meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n      },\n      200,\n      headers,\n    )\n  }\n\n  async function handleCount(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const countMode = url.searchParams.get('countMode')\n\n    // Fast path: use Postgres row estimate for unfiltered counts\n    if (countMode === 'estimate') {\n      const app = getApp()\n      const count = await estimateRowCount(app.db.readOnly, entity.name)\n      return jsonResponse({ data: { count, estimate: true } }, 200, {\n        ...corsHeaders,\n        ...buildCacheHeaders(entity.name, cacheConfig),\n      })\n    }\n\n    const client = createClient(entity)\n    const count = await client.count()\n\n    return jsonResponse({ data: { count } }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleById(\n    req: Request,\n    entity: Entity,\n    id: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const { locale, fields } = params.data\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const client = createClient(entity)\n    const item = await client.findById(id, {\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n    if (!item) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: item }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleBySlug(\n    req: Request,\n    entity: Entity,\n    slug: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // Check entity has a slug field\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n    const { locale, fields } = params.data\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n    const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n    if (!table?.slug) return notFoundResponse(corsHeaders)\n\n    const client = createClient(entity)\n    const slugConfig = allFields.slug as SlugField\n\n    // For translatable slugs, also search the translation table.\n    // A non-default locale's slug may live in {entity}_translations, not the main table.\n    let whereClause: SQL = eq(table.slug, slug)\n\n    if (slugConfig.translatable && resolvedLocale) {\n      const translationTableName = `${entity.name}_translations`\n      // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n      const translationTable = schemaRegistry.get(translationTableName) as\n        | PgTableWithColumns<any>\n        | undefined\n      if (translationTable?.slug) {\n        // Find entity IDs whose translated slug matches (for the requested locale)\n        const app = getApp()\n        const translationMatches = await app.db.readOnly\n          .select({ entityId: translationTable.entityId })\n          .from(translationTable)\n          .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n        if (translationMatches.length > 0) {\n          const translatedIds = translationMatches.map((r) => r.entityId as string)\n          // Match by translated slug OR by main table slug (fallback)\n          whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n        }\n      }\n    }\n\n    const results = await client.findMany({\n      where: whereClause,\n      limit: 1,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n\n    if (results.length === 0) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: results[0] }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  // -- Central dispatch -------------------------------------------------------\n\n  async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n    const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n    try {\n      const segments = await ctx.params.then((p) => p.path)\n      if (!segments || segments.length === 0) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Resolve role + load permissions + establish request context\n      const role = await resolveRole(req)\n      const checker = await getChecker()\n\n      const requestContext: RequestContext = {\n        user: { id: 'public', groups: role ? [role] : [] },\n        checker,\n      }\n\n      return await runWithContextAsync(requestContext, async () => {\n      // /_schema — entity introspection (filtered by role)\n      if (segments[0] === '_schema') {\n        const schema = buildSchemaResponse(entities, (name) =>\n          hasViewPermission(checker, role, name),\n        )\n        return jsonResponse(schema, 200, {\n          ...corsHeaders,\n          'Cache-Control': 'no-store',\n        })\n      }\n\n      // Resolve entity from whitelist\n      const entityName = segments[0]\n      if (entityName === undefined) return notFoundResponse(corsHeaders)\n      const entity =\n        entityMap.get(entityName) ??\n        entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n      // Entity not in whitelist OR role lacks view permission → 404\n      if (!entity || !hasViewPermission(checker, role, entity.name)) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Route to handler\n      if (segments.length === 1) {\n        return handleList(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'count') {\n        return handleCount(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'slug' && segments[2]) {\n        return handleBySlug(req, entity, segments[2], corsHeaders)\n      }\n      if (segments.length === 2 && segments[1] !== undefined) {\n        return handleById(req, entity, segments[1], corsHeaders)\n      }\n\n      return notFoundResponse(corsHeaders)\n      }) // end runWithContextAsync\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Internal server error'\n      console.error('[content-api] handler error:', err)\n      onError?.({\n        status: 500,\n        message,\n        path: new URL(req.url).pathname,\n      })\n      return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n    }\n  }\n\n  return {\n    GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n    OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n  }\n}\n"],"mappings":"0dASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CClBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACpD,CAAC,CAKI,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OAAQ,GAAS,CACvC,IAAM,EAAS,EAAU,GACzB,OAAO,IAAW,IAAA,IAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAO,OAAS,UACxE,CAOF,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GC5FpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GACxB,GAAI,IAAc,IAAA,GAAW,SAC7B,IAAM,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACA,oBAAuB,CACrB,IAAM,EAAM,GAAY,CACpB,MAAC,GAAK,MAAQ,CAAC,GAAK,SACxB,MAAO,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,QAAS,MAAO,EAAI,MAAO,EAEpE,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAOlC,OAAO,MAAM,EAL0B,CACrC,KAAM,CAAE,GAAI,SAAU,OAAQ,EAAO,CAAC,EAAK,CAAG,EAAE,CAAE,CAClD,UACD,CAEgD,SAAY,CAE7D,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GAC5B,GAAI,IAAe,IAAA,GAAW,OAAO,EAAiB,EAAY,CAClE,IAAM,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,GAAK,EAAS,KAAO,IAAA,GACpC,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,EAClC,OACK,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n *\n * Role-aware short-circuit: when the resolved role is NOT the configured\n * `publicRole`, we force `Cache-Control: no-store`. Authenticated/preview\n * responses must never reach a shared CDN cache — the URL is the same for\n * public and editor callers, but the body is role-specific. Without this,\n * a CloudFront/Fastly/Cloudflare edge with the default URL-only cache key\n * would serve an editor's response to subsequent anonymous visitors.\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n  entityName: string,\n  config: CacheConfig | undefined,\n): Record<string, string> {\n  const entityConfig = config?.entities?.[entityName]\n\n  if (entityConfig?.cacheable === false) {\n    return { 'Cache-Control': 'no-store' }\n  }\n\n  const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n  const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n  return {\n    'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n  }\n}\n\n/**\n * Combined response headers: CORS + Cache-Control.\n *\n * When `role !== publicRole`, returns `Cache-Control: no-store` regardless\n * of the per-entity cache config — see file-level comment. We also append\n * `Cookie` and `Authorization` to `Vary` since hosts may resolve role from\n * either; `no-store` already prevents shared-cache reuse, but the Vary\n * header keeps semantics correct for any down-stream policy that respects\n * it without requiring `no-store`.\n */\nexport function buildResponseHeaders(\n  entityName: string,\n  corsHeaders: Record<string, string>,\n  role: string,\n  publicRole: string,\n  cacheConfig: CacheConfig | undefined,\n): Record<string, string> {\n  if (role !== publicRole) {\n    const existingVary = corsHeaders.Vary\n    const authVary = 'Cookie, Authorization'\n    return {\n      ...corsHeaders,\n      'Cache-Control': 'no-store',\n      Vary: existingVary ? `${existingVary}, ${authVary}` : authVary,\n    }\n  }\n  return {\n    ...corsHeaders,\n    ...buildCacheHeaders(entityName, cacheConfig),\n  }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n  req: Request,\n  config: CorsConfig | undefined,\n): Record<string, string> {\n  if (!config) return {}\n\n  const origin = req.headers.get('Origin')\n  if (!origin) return {}\n\n  // Exact match only\n  if (!config.allowedOrigins.includes(origin)) return {}\n\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n    'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n    Vary: 'Origin',\n  }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n  const headers = buildCorsHeaders(req, config)\n  return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport { escapeLikePattern, LOCALE_PATTERN } from '@murumets-ee/core'\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\nconst MAX_FILTER_TEXT_LENGTH = 200\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n  offset: z.coerce.number().int().min(0).default(0),\n  sort: z\n    .string()\n    .regex(/^-?[a-zA-Z_]+$/)\n    .optional(),\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n  search: z.string().max(200).optional(),\n  /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n  cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n})\n\n// Re-export from core so existing imports from this module continue to work\nexport { escapeLikePattern }\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * ISO-8601 calendar date or full timestamp.\n * Accepts: 2024-01-31, 2024-01-31T12:34:56Z, 2024-01-31T12:34:56.789+02:00.\n * Note: shape only — calendar validity (e.g. month 1–12, valid day-of-month)\n * is enforced separately by `isValidIsoDate` so impossible-date values cannot\n * reach Postgres and trigger a 500 cast error.\n */\nconst ISO_DATE_RE =\n  /^\\d{4}-\\d{2}-\\d{2}(?:[Tt ]\\d{2}:\\d{2}(?::\\d{2}(?:\\.\\d+)?)?(?:[Zz]|[+-]\\d{2}:?\\d{2})?)?$/\n\n/**\n * Validate ISO-8601 shape AND calendar validity.\n * `Date.parse('2024-13-01')` returns NaN; `Date.parse('2024-02-30')` rolls over\n * to 2024-03-01 in some hosts but produces a different YYYY-MM-DD prefix from\n * the input — comparing the round-tripped date prefix catches both cases.\n */\nfunction isValidIsoDate(raw: string): boolean {\n  if (!ISO_DATE_RE.test(raw)) return false\n  const ms = Date.parse(raw)\n  if (Number.isNaN(ms)) return false\n  // For bare YYYY-MM-DD, confirm the parsed date round-trips to the same prefix.\n  if (raw.length === 10) {\n    return new Date(ms).toISOString().slice(0, 10) === raw\n  }\n  return true\n}\n\n/** True if `s` parses as a finite number with no trailing junk. */\nfunction isNumericLiteral(s: string): boolean {\n  if (s.trim() === '') return false\n  const n = Number(s)\n  return Number.isFinite(n)\n}\n\n/** True if `id` matches the canonical UUID format used by entity primary keys. */\nexport function isUuid(id: string): boolean {\n  return UUID_RE.test(id)\n}\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value (possibly coerced) or null if invalid.\n *\n * For `date`, accepts a `gte:` / `lte:` prefix; the prefix itself is preserved\n * so the caller can route to the right comparison operator. The bare value\n * (with prefix stripped) must match ISO-8601.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n  switch (fieldConfig.type) {\n    case 'boolean':\n      if (raw === 'true') return true\n      if (raw === 'false') return false\n      return null\n\n    case 'reference':\n    case 'media':\n      return UUID_RE.test(raw) ? raw : null\n\n    case 'select':\n      return fieldConfig.options.includes(raw) ? raw : null\n\n    case 'date': {\n      const bare = raw.startsWith('gte:') || raw.startsWith('lte:') ? raw.slice(4) : raw\n      return isValidIsoDate(bare) ? raw : null\n    }\n\n    case 'number':\n      return isNumericLiteral(raw) ? Number(raw) : null\n\n    case 'text':\n      return raw.length <= MAX_FILTER_TEXT_LENGTH ? raw : null\n\n    default:\n      return null\n  }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n  fieldsParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n  if (!fieldsParam) return undefined\n\n  const requested = fieldsParam.split(',').map((f) => f.trim())\n  const valid = requested.filter((name) => {\n    const config = allFields[name]\n    return config !== undefined && !name.startsWith('_') && config.type !== 'blocks'\n  })\n\n  // Always include id\n  if (valid.length > 0 && !valid.includes('id')) {\n    valid.unshift('id')\n  }\n\n  return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n  data: unknown,\n  status = 200,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      ...extraHeaders,\n    },\n  })\n}\n\nexport function errorResponse(\n  message: string,\n  code: string,\n  status: number,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n  return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n  const field: SchemaField = { type: config.type }\n\n  if (config.required) {\n    field.required = true\n  }\n\n  if (config.type === 'select') {\n    field.options = config.options\n  }\n\n  if (config.type === 'reference') {\n    field.cardinality = config.cardinality\n  }\n\n  return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  const fields: Record<string, SchemaField> = {}\n\n  for (const [name, config] of Object.entries(allFields)) {\n    // Skip internal fields\n    if (name.startsWith('_')) continue\n    fields[name] = toSchemaField(config)\n  }\n\n  return {\n    name: entity.name,\n    pluralName: `${entity.name}s`,\n    fields,\n  }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n  entities: Entity[],\n  checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n  const visible = entities.filter((e) => checkPermission(e.name))\n  return {\n    entities: visible.map(toSchemaEntity),\n  }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n *   entities: [Article, Page],\n *   loadPermissions: async () => {\n *     const roles = await loadRoles(getApp())\n *     return buildPermissionChecker(roles)\n *   },\n *   cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker, RequestContext, RouteContext } from '@murumets-ee/core'\nimport { getApp, getContext, runWithContextAsync } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport {\n  and,\n  asc,\n  desc,\n  eq,\n  getTableColumns,\n  gte,\n  ilike,\n  inArray,\n  lte,\n  or,\n  type SQL,\n} from 'drizzle-orm'\nimport type { PgColumn, PgTable } from 'drizzle-orm/pg-core'\nimport { buildResponseHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n  countParamsSchema,\n  escapeLikePattern,\n  isUuid,\n  listParamsSchema,\n  MAX_LIMIT,\n  parseFieldSelection,\n  singleParamsSchema,\n  validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n  const map = new Map<string, Entity>()\n  for (const entity of entities) {\n    map.set(entity.name, entity)\n    map.set(`${entity.name}s`, entity)\n  }\n  return map\n}\n\n// ---------------------------------------------------------------------------\n// Table-column helpers (typed via drizzle's getTableColumns)\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the registered Drizzle table + its column map for an entity by name.\n * Returns undefined if the entity isn't registered (caller decides whether\n * that's a 404 or a no-op).\n */\nfunction resolveTableCols(\n  name: string,\n): { table: PgTable; cols: Record<string, PgColumn> } | undefined {\n  const table = schemaRegistry.get(name)\n  if (!table) return undefined\n  return { table, cols: getTableColumns(table) as Record<string, PgColumn> }\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n  const resolved = resolveTableCols(entity.name)\n  if (!resolved) return undefined\n  const { cols } = resolved\n\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  for (const [fieldName, config] of Object.entries(allFields)) {\n    if (config.type === 'text' && (config.indexed || config.required)) {\n      const column = cols[fieldName]\n      if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n    }\n  }\n  return undefined\n}\n\nfunction buildOrderBy(\n  entityName: string,\n  sortParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n  if (!sortParam) return undefined\n\n  const descending = sortParam.startsWith('-')\n  const fieldName = descending ? sortParam.slice(1) : sortParam\n\n  const fieldConfig = allFields[fieldName]\n  if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n  const resolved = resolveTableCols(entityName)\n  if (!resolved) return undefined\n  const column = resolved.cols[fieldName]\n  if (!column) return undefined\n\n  return descending ? desc(column) : asc(column)\n}\n\nfunction buildFilterConditions(\n  entityName: string,\n  url: URL,\n  allFields: Record<string, FieldConfig>,\n): SQL[] {\n  const resolved = resolveTableCols(entityName)\n  if (!resolved) return []\n  const { cols } = resolved\n\n  const conditions: SQL[] = []\n\n  for (const [key, raw] of url.searchParams.entries()) {\n    const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n    if (!match) continue\n\n    const fieldName = match[1]\n    if (fieldName === undefined) continue\n    // Reject internal fields (`_scopeId`, `_versionId`, …) — match the\n    // underscore-prefix rule used by `parseFieldSelection`.\n    if (fieldName.startsWith('_')) continue\n    // Reject prototype-chain keys (`constructor`, `toString`, …).\n    if (!Object.hasOwn(allFields, fieldName)) continue\n\n    const fieldConfig = allFields[fieldName]\n    if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n    const column = cols[fieldName]\n    if (!column) continue\n\n    const validated = validateFilterValue(fieldConfig, raw)\n    if (validated === null) continue\n\n    // Date range filters: gte: / lte: prefix is preserved by validateFilterValue.\n    if (fieldConfig.type === 'date' && typeof validated === 'string') {\n      if (validated.startsWith('gte:')) {\n        conditions.push(gte(column, validated.slice(4)))\n        continue\n      }\n      if (validated.startsWith('lte:')) {\n        conditions.push(lte(column, validated.slice(4)))\n        continue\n      }\n    }\n    conditions.push(eq(column, validated))\n  }\n\n  return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n  const {\n    entities,\n    defaultLocale,\n    publicRole = 'public',\n    cors: corsConfig,\n    cache: cacheConfig,\n    onError,\n  } = config\n  const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n  const entityMap = buildEntityMap(entities)\n\n  // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n  const countCache = new CountCache(5000)\n\n  // Lazy-loaded permission checker — cached with 30s TTL.\n  // Hosts that mutate roles at runtime should call invalidatePermissionCache()\n  // immediately after the change so the next request reloads.\n  const PERMISSION_CACHE_TTL_MS = 30_000\n  let permissionChecker: PermissionChecker | null = null\n  let permissionCacheTime = 0\n\n  async function getChecker(): Promise<PermissionChecker> {\n    const now = Date.now()\n    if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n      permissionChecker = await config.loadPermissions()\n      permissionCacheTime = now\n    }\n    return permissionChecker\n  }\n\n  function invalidatePermissionCache(): void {\n    permissionChecker = null\n    permissionCacheTime = 0\n  }\n\n  // -- Role resolution -------------------------------------------------------\n\n  async function resolveRole(req: Request): Promise<string> {\n    if (!config.authenticate) return publicRole\n    try {\n      const result = await config.authenticate(req)\n      return result?.role ?? publicRole\n    } catch {\n      return publicRole\n    }\n  }\n\n  // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n  function hasViewPermission(\n    checker: PermissionChecker,\n    role: string,\n    entityName: string,\n  ): boolean {\n    return checker(role, entityName, 'view')\n  }\n\n  // -- Create QueryClient from entity ----------------------------------------\n\n  function createClient(entity: Entity): QueryClient {\n    const app = getApp()\n    return new QueryClient({\n      entity,\n      db: app.db.readOnly,\n      logger: app.logger.child({ entity: entity.name }),\n      countCache,\n      contextResolver: () => {\n        const ctx = getContext()\n        if (!ctx?.user || !ctx?.checker) return undefined\n        return {\n          user: ctx.user,\n          checker: ctx.checker,\n          ...(ctx.scope !== undefined && { scope: ctx.scope }),\n        }\n      },\n    })\n  }\n\n  // -- Endpoint handlers -----------------------------------------------------\n\n  async function handleList(\n    req: Request,\n    entity: Entity,\n    role: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const {\n      limit: rawLimit,\n      offset,\n      sort,\n      locale,\n      fields,\n      search,\n      cursor: cursorParam,\n    } = params.data\n    const limit = Math.min(rawLimit, maxLimit)\n    const allFields = entity.allFields as Record<string, FieldConfig>\n\n    // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n    let cursor: CursorInput | undefined\n    if (cursorParam) {\n      const decoded = decodeCursor(cursorParam)\n      if (!decoded) {\n        return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      // Whitelist via `Object.hasOwn` so prototype-chain keys (`__proto__`,\n      // `constructor`, …) cannot pass.\n      if (!Object.hasOwn(allFields, decoded.field) && decoded.field !== 'id') {\n        return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      cursor = decoded\n    }\n\n    const where: SQL[] = []\n    if (search) {\n      const searchCondition = buildSearchCondition(entity, search)\n      if (searchCondition) where.push(searchCondition)\n    }\n\n    const filterConditions = buildFilterConditions(entity.name, url, allFields)\n    where.push(...filterConditions)\n\n    const orderBy = buildOrderBy(entity.name, sort, allFields)\n    const select = parseFieldSelection(fields, allFields)\n\n    const client = createClient(entity)\n    const resolvedLocale = locale ?? defaultLocale\n    const queryOpts = {\n      where: where.length > 0 ? and(...where) : undefined,\n      limit,\n      offset,\n      orderBy,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n      cursor,\n    }\n\n    const [items, total] = await Promise.all([\n      client.findMany(queryOpts),\n      client.count({ where: where.length > 0 ? and(...where) : undefined }),\n    ])\n\n    // Build nextCursor from last item for keyset pagination\n    let nextCursor: string | undefined\n    if (items.length > 0 && items.length === limit) {\n      const lastItem = items[items.length - 1] as Record<string, unknown>\n      // Derive sort field and direction from cursor or sort param\n      const cursorField =\n        cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n      const cursorDirection: 'asc' | 'desc' =\n        cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n      if (cursorField && lastItem[cursorField] !== undefined) {\n        nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n      }\n    }\n\n    return jsonResponse(\n      {\n        data: items,\n        meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n      },\n      200,\n      buildResponseHeaders(entity.name, corsHeaders, role, publicRole, cacheConfig),\n    )\n  }\n\n  async function handleCount(\n    req: Request,\n    entity: Entity,\n    role: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // ?countMode=estimate is only safe for entities that don't apply\n    // publish/scope filters at query time — otherwise the pg_class row count\n    // leaks unpublished or out-of-scope rows. For publishable entities we\n    // always run the filtered count instead.\n    //\n    // We fall through to the filtered count even when the public client asked\n    // for an estimate; the response shape stays compatible (`{count}`).\n    const client = createClient(entity)\n    const count = await client.count()\n\n    return jsonResponse(\n      { data: { count } },\n      200,\n      buildResponseHeaders(entity.name, corsHeaders, role, publicRole, cacheConfig),\n    )\n  }\n\n  async function handleById(\n    req: Request,\n    entity: Entity,\n    id: string,\n    role: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    // Entity primary keys are UUID-typed throughout the toolkit. Reject\n    // non-UUID inputs as 404 rather than letting Postgres throw a cast error\n    // that would surface as a 500 (and side-channel \"valid format but missing\"\n    // vs \"bogus format\").\n    if (!isUuid(id)) return notFoundResponse(corsHeaders)\n\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const { locale, fields } = params.data\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const client = createClient(entity)\n    const item = await client.findById(id, {\n      ...(select !== undefined && { select }),\n      ...(resolvedLocale !== undefined && { locale: resolvedLocale }),\n      defaultLocale,\n    })\n    if (!item) return notFoundResponse(corsHeaders)\n\n    return jsonResponse(\n      { data: item },\n      200,\n      buildResponseHeaders(entity.name, corsHeaders, role, publicRole, cacheConfig),\n    )\n  }\n\n  async function handleBySlug(\n    req: Request,\n    entity: Entity,\n    slug: string,\n    role: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // Check entity has a slug field\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n    const { locale, fields } = params.data\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const resolved = resolveTableCols(entity.name)\n    if (!resolved) return notFoundResponse(corsHeaders)\n    const tableSlug = resolved.cols.slug\n    const tableId = resolved.cols.id\n    if (!tableSlug || !tableId) return notFoundResponse(corsHeaders)\n\n    const client = createClient(entity)\n    const slugConfig = allFields.slug as SlugField\n\n    // For translatable slugs, also search the translation table.\n    // A non-default locale's slug may live in {entity}_translations, not the main table.\n    let whereClause: SQL = eq(tableSlug, slug)\n\n    if (slugConfig.translatable && resolvedLocale) {\n      const translationTableName = `${entity.name}_translations`\n      const translationResolved = resolveTableCols(translationTableName)\n      if (translationResolved) {\n        const translationSlug = translationResolved.cols.slug\n        const translationLocale = translationResolved.cols.locale\n        const translationEntityId = translationResolved.cols.entityId\n        if (translationSlug && translationLocale && translationEntityId) {\n          // Find entity IDs whose translated slug matches (for the requested locale).\n          // QueryClient applies publish + scope filters on the follow-up findMany,\n          // so unpublished/out-of-scope translated slugs cannot leak through here.\n          const app = getApp()\n          const translationMatches = await app.db.readOnly\n            .select({ entityId: translationEntityId })\n            .from(translationResolved.table)\n            .where(and(eq(translationSlug, slug), eq(translationLocale, resolvedLocale)))\n\n          if (translationMatches.length > 0) {\n            const translatedIds = translationMatches.map((r) => r.entityId as string)\n            // Match by translated slug OR by main table slug (fallback).\n            // `or(...)` returns SQL when given two non-undefined inputs; the\n            // `?? eq(...)` keeps the type system honest without a non-null\n            // assertion.\n            whereClause =\n              or(inArray(tableId, translatedIds), eq(tableSlug, slug)) ?? eq(tableSlug, slug)\n          }\n        }\n      }\n    }\n\n    const results = await client.findMany({\n      where: whereClause,\n      limit: 1,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n\n    if (results.length === 0) return notFoundResponse(corsHeaders)\n\n    return jsonResponse(\n      { data: results[0] },\n      200,\n      buildResponseHeaders(entity.name, corsHeaders, role, publicRole, cacheConfig),\n    )\n  }\n\n  // -- Central dispatch -------------------------------------------------------\n\n  async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n    const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n    try {\n      const segments = await ctx.params.then((p) => p.path)\n      if (!segments || segments.length === 0) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Resolve role + load permissions + establish request context\n      const role = await resolveRole(req)\n      const checker = await getChecker()\n\n      const requestContext: RequestContext = {\n        user: { id: 'public', groups: role ? [role] : [] },\n        checker,\n      }\n\n      return await runWithContextAsync(requestContext, async () => {\n        // /_schema — entity introspection (filtered by role)\n        if (segments[0] === '_schema') {\n          const schema = buildSchemaResponse(entities, (name) =>\n            hasViewPermission(checker, role, name),\n          )\n          return jsonResponse(schema, 200, {\n            ...corsHeaders,\n            'Cache-Control': 'no-store',\n          })\n        }\n\n        // Resolve entity from whitelist\n        const entityName = segments[0]\n        if (entityName === undefined) return notFoundResponse(corsHeaders)\n        const entity =\n          entityMap.get(entityName) ??\n          entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n        // Entity not in whitelist OR role lacks view permission → 404\n        if (!entity || !hasViewPermission(checker, role, entity.name)) {\n          return notFoundResponse(corsHeaders)\n        }\n\n        // Route to handler\n        if (segments.length === 1) {\n          return handleList(req, entity, role, corsHeaders)\n        }\n        if (segments[1] === 'count') {\n          return handleCount(req, entity, role, corsHeaders)\n        }\n        if (segments[1] === 'slug' && segments[2]) {\n          return handleBySlug(req, entity, segments[2], role, corsHeaders)\n        }\n        if (segments.length === 2 && segments[1] !== undefined) {\n          return handleById(req, entity, segments[1], role, corsHeaders)\n        }\n\n        return notFoundResponse(corsHeaders)\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Internal server error'\n      const path = new URL(req.url).pathname\n      // Route through the toolkit logger so errors land alongside the rest of\n      // the structured stream rather than raw stdout.\n      try {\n        getApp().logger.error({ err, path }, 'content-api handler error')\n      } catch {\n        // App not yet bootstrapped (early failure path) — last-resort log.\n        console.error('[content-api] handler error:', err)\n      }\n      onError?.({\n        status: 500,\n        message,\n        path,\n      })\n      return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n    }\n  }\n\n  return {\n    GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n    OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n    /**\n     * Invalidate the cached permission checker. Call this from the\n     * role-management code path (after a role is created/edited/deleted)\n     * so the next request re-runs `loadPermissions()` instead of waiting\n     * up to 30 seconds for the TTL to expire.\n     */\n    invalidatePermissionCache,\n  }\n}\n"],"mappings":"ydAgBA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GASxC,OAPI,GAAc,YAAc,GACvB,CAAE,gBAAiB,WAAY,CAMjC,CACL,gBAAiB,mBAJJ,GAAc,QAAU,GAAQ,eAAiB,GAInB,2BAHjC,GAAc,sBAAwB,GAAQ,6BAA+B,MAIxF,CAaH,SAAgB,EACd,EACA,EACA,EACA,EACA,EACwB,CACxB,GAAI,IAAS,EAAY,CACvB,IAAM,EAAe,EAAY,KAC3B,EAAW,wBACjB,MAAO,CACL,GAAG,EACH,gBAAiB,WACjB,KAAM,EAAe,GAAG,EAAa,IAAI,IAAa,EACvD,CAEH,MAAO,CACL,GAAG,EACH,GAAG,EAAkB,EAAY,EAAY,CAC9C,CCtDH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CCpBrD,MAGa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACpD,CAAC,CAKI,EAAU,kEASV,EACJ,0FAQF,SAAS,EAAe,EAAsB,CAC5C,GAAI,CAAC,EAAY,KAAK,EAAI,CAAE,MAAO,GACnC,IAAM,EAAK,KAAK,MAAM,EAAI,CAM1B,OALI,OAAO,MAAM,EAAG,CAAS,GAEzB,EAAI,SAAW,GACV,IAAI,KAAK,EAAG,CAAC,aAAa,CAAC,MAAM,EAAG,GAAG,GAAK,EAE9C,GAIT,SAAS,EAAiB,EAAoB,CAC5C,GAAI,EAAE,MAAM,GAAK,GAAI,MAAO,GAC5B,IAAM,EAAI,OAAO,EAAE,CACnB,OAAO,OAAO,SAAS,EAAE,CAI3B,SAAgB,EAAO,EAAqB,CAC1C,OAAO,EAAQ,KAAK,EAAG,CAWzB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EADM,EAAI,WAAW,OAAO,EAAI,EAAI,WAAW,OAAO,CAAG,EAAI,MAAM,EAAE,CAAG,EACpD,CAAG,EAAM,KAGtC,IAAK,SACH,OAAO,EAAiB,EAAI,CAAG,OAAO,EAAI,CAAG,KAE/C,IAAK,OACH,OAAO,EAAI,QAAU,IAAyB,EAAM,KAEtD,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CACrC,CAAC,OAAQ,GAAS,CACvC,IAAM,EAAS,EAAU,GACzB,OAAO,IAAW,IAAA,IAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAO,OAAS,UACxE,CAOF,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GC3IpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAE3C,CAAC,IAAI,EAAe,CACtC,CCMH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAYT,SAAS,EACP,EACgE,CAChE,IAAM,EAAQ,EAAe,IAAI,EAAK,CACjC,KACL,MAAO,CAAE,QAAO,KAAM,EAAgB,EAAM,CAA8B,CAO5E,SAAS,EAAqB,EAAgB,EAAiC,CAC7E,IAAM,EAAW,EAAiB,EAAO,KAAK,CAC9C,GAAI,CAAC,EAAU,OACf,GAAM,CAAE,QAAS,EAEX,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAK,GACpB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAEnD,IAAM,EAAW,EAAiB,EAAW,CAC7C,GAAI,CAAC,EAAU,OACf,IAAM,EAAS,EAAS,KAAK,GACxB,KAEL,OAAO,EAAa,EAAK,EAAO,CAAG,EAAI,EAAO,CAGhD,SAAS,EACP,EACA,EACA,EACO,CACP,IAAM,EAAW,EAAiB,EAAW,CAC7C,GAAI,CAAC,EAAU,MAAO,EAAE,CACxB,GAAM,CAAE,QAAS,EAEX,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAMxB,GALI,IAAc,IAAA,IAGd,EAAU,WAAW,IAAI,EAEzB,CAAC,OAAO,OAAO,EAAW,EAAU,CAAE,SAE1C,IAAM,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAK,GACpB,GAAI,CAAC,EAAQ,SAEb,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,OAAc,KAGlB,IAAI,EAAY,OAAS,QAAU,OAAO,GAAc,SAAU,CAChE,GAAI,EAAU,WAAW,OAAO,CAAE,CAChC,EAAW,KAAK,EAAI,EAAQ,EAAU,MAAM,EAAE,CAAC,CAAC,CAChD,SAEF,GAAI,EAAU,WAAW,OAAO,CAAE,CAChC,EAAW,KAAK,EAAI,EAAQ,EAAU,MAAM,EAAE,CAAC,CAAC,CAChD,UAGJ,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,EAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAMnC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAGT,SAAS,GAAkC,CACzC,EAAoB,KACpB,EAAsB,EAKxB,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OAAO,MADc,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACA,oBAAuB,CACrB,IAAM,EAAM,GAAY,CACpB,MAAC,GAAK,MAAQ,CAAC,GAAK,SACxB,MAAO,CACL,KAAM,EAAI,KACV,QAAS,EAAI,QACb,GAAI,EAAI,QAAU,IAAA,IAAa,CAAE,MAAO,EAAI,MAAO,CACpD,EAEJ,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAI9E,GAAI,CAAC,OAAO,OAAO,EAAW,EAAQ,MAAM,EAAI,EAAQ,QAAU,KAChE,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EAAqB,EAAO,KAAM,EAAa,EAAM,EAAY,EAAY,CAC9E,CAGH,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAgB5B,OAfe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CACpE,CAAC,QAcL,EACL,CAAE,KAAM,CAAE,MAAA,MAJG,EAAa,EACF,CAAC,OAAO,CAGf,CAAE,CACnB,IACA,EAAqB,EAAO,KAAM,EAAa,EAAM,EAAY,EAAY,CAC9E,CAjBQ,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAoB1F,eAAe,EACb,EACA,EACA,EACA,EACA,EACmB,CAKnB,GAAI,CAAC,EAAO,EAAG,CAAE,OAAO,EAAiB,EAAY,CAErD,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EACH,CAAC,SAAS,EAAI,CACrC,GAAI,IAAW,IAAA,IAAa,CAAE,SAAQ,CACtC,GAAI,IAAmB,IAAA,IAAa,CAAE,OAAQ,EAAgB,CAC9D,gBACD,CAAC,CAGF,OAFK,EAEE,EACL,CAAE,KAAM,EAAM,CACd,IACA,EAAqB,EAAO,KAAM,EAAa,EAAM,EAAY,EAAY,CAC9E,CANiB,EAAiB,EAAY,CASjD,eAAe,EACb,EACA,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAE3B,EAAW,EAAiB,EAAO,KAAK,CAC9C,GAAI,CAAC,EAAU,OAAO,EAAiB,EAAY,CACnD,IAAM,EAAY,EAAS,KAAK,KAC1B,EAAU,EAAS,KAAK,GAC9B,GAAI,CAAC,GAAa,CAAC,EAAS,OAAO,EAAiB,EAAY,CAEhE,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAW,EAAK,CAE1C,GAAI,EAAW,cAAgB,EAAgB,CAE7C,IAAM,EAAsB,EAAiB,GADb,EAAO,KAAK,eACsB,CAClE,GAAI,EAAqB,CACvB,IAAM,EAAkB,EAAoB,KAAK,KAC3C,EAAoB,EAAoB,KAAK,OAC7C,EAAsB,EAAoB,KAAK,SACrD,GAAI,GAAmB,GAAqB,EAAqB,CAK/D,IAAM,EAAqB,MADf,GACwB,CAAC,GAAG,SACrC,OAAO,CAAE,SAAU,EAAqB,CAAC,CACzC,KAAK,EAAoB,MAAM,CAC/B,MAAM,EAAI,EAAG,EAAiB,EAAK,CAAE,EAAG,EAAmB,EAAe,CAAC,CAAC,CAE3E,EAAmB,OAAS,IAM9B,EACE,EAAG,EAAQ,EANS,EAAmB,IAAK,GAAM,EAAE,SAMnB,CAAC,CAAE,EAAG,EAAW,EAAK,CAAC,EAAI,EAAG,EAAW,EAAK,IAMzF,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EACL,CAAE,KAAM,EAAQ,GAAI,CACpB,IACA,EAAqB,EAAO,KAAM,EAAa,EAAM,EAAY,EAAY,CAC9E,CAKH,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAOlC,OAAO,MAAM,EAAoB,CAJ/B,KAAM,CAAE,GAAI,SAAU,OAAQ,EAAO,CAAC,EAAK,CAAG,EAAE,CAAE,CAClD,UAG6C,CAAE,SAAY,CAE3D,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CAEd,CAAE,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GAC5B,GAAI,IAAe,IAAA,GAAW,OAAO,EAAiB,EAAY,CAClE,IAAM,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAM,EAAY,CAE/C,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAM,EAAY,CAEhD,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAM,EAAY,CAE9D,EAAS,SAAW,GAAK,EAAS,KAAO,IAAA,GACpC,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAM,EAAY,CAGzD,EAAiB,EAAY,EACpC,OACK,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAC/C,EAAO,IAAI,IAAI,EAAI,IAAI,CAAC,SAG9B,GAAI,CACF,GAAQ,CAAC,OAAO,MAAM,CAAE,MAAK,OAAM,CAAE,4BAA4B,MAC3D,CAEN,QAAQ,MAAM,+BAAgC,EAAI,CAOpD,OALA,IAAU,CACR,OAAQ,IACR,UACA,OACD,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAOjE,4BACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@murumets-ee/content-api",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
@@ -15,17 +15,17 @@
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "zod": "^3.24.1",
-    "@murumets-ee/core": "0.11.0",
-    "@murumets-ee/entity": "0.11.0",
-    "@murumets-ee/db": "0.11.0"
+    "@murumets-ee/core": "0.12.0",
+    "@murumets-ee/entity": "0.12.0",
+    "@murumets-ee/db": "0.12.0"
   },
   "devDependencies": {
-    "tsdown": "^0.21.7",
+    "tsdown": "^0.21.10",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8"
   },
   "typeCoverage": {
-    "atLeast": 98.6
+    "atLeast": 100
   },
   "scripts": {
     "build": "tsdown",